Examkin

Question

Difficulty: MediumConfigure Storage Account Network Access

You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains a subnet named Subnet1. You deploy an Azure Storage account named storageapp2026 and configure a private endpoint for the storage account in Subnet1. You create a private DNS zone named privatelink.blob.core.windows.net and add the host record for storageapp2026. You discover that virtual machines in Subnet1 continue to resolve the fully qualified domain name (FQDN) of storageapp2026 to its public IP address instead of the private endpoint IP address. What should you do to ensure that the virtual machines resolve the FQDN to the private IP address?

  1. Link the privatelink.blob.core.windows.net private DNS zone to VNet1.Answer
  2. B
    Enable the Microsoft.Storage service endpoint on Subnet1.
  3. C
    Assign the Storage Blob Data Contributor role to the virtual machines.
  4. D
    Change the public network access setting of the storage account to Disabled.

Answer

Link the privatelink.blob.core.windows.net private DNS zone to VNet1.
Linking the private DNS zone `privatelink.blob.core.windows.net` to `VNet1` is required because the Azure-provided DNS server (168.63.129.16) in the virtual network can only resolve records from the private DNS zone once the zone is linked to that virtual network. Without this link, name resolution queries from the virtual machines will fall back to public DNS servers and resolve to the public IP address of the storage account.

Step-by-Step Solution

1
Understand how Azure Private Endpoints use DNS resolution.
Clients need to resolve the storage account's FQDN to the private IP of the private endpoint instead of the public IP.
By default, the FQDN resolves to the public endpoint IP via public DNS.
2
Identify the configuration required for virtual machines in VNet1 to use the private DNS zone.
The private DNS zone privatelink.blob.core.windows.net must be linked to VNet1.
Without a virtual network link, the Azure-provided DNS service in VNet1 will not query the private DNS zone for name resolution.
3
Evaluate the proposed solutions.
Linking the private DNS zone to VNet1 is the correct step.
It allows VMs in VNet1 to resolve the storage FQDN to the private IP address.

Key Concept

Azure Private Endpoints require the associated Private DNS Zone to be linked to the virtual network for proper name resolution.
Rate this question

Topics

Configure Storage Account Network Access

More questions from this topic