Examkin

Question

Difficulty: EasyConfigure Storage Account Network Access

You have an Azure Storage account named prodstorage. You configure the firewall on prodstorage to restrict network access to selected virtual networks only. After applying this configuration, a scheduled Azure Backup job fails to back up the blob containers in prodstorage due to network access restrictions. Which configuration change should you make to allow Azure Backup to access the storage account?

  1. A
    Create a Network Security Group (NSG) rule that allows inbound traffic from the AzureBackup service tag to the subnet containing the storage account.
  2. Select the 'Allow trusted Microsoft services to access this storage account' exception in the firewall settings.Answer
  3. C
    Assign the Storage Blob Data Reader role to the Azure Backup service principal.
  4. D
    Create a Private DNS Zone link between the storage account's private endpoint and the Azure Backup virtual network.

Answer

Select the 'Allow trusted Microsoft services to access this storage account' exception in the firewall settings.
Selecting the 'Allow trusted Microsoft services to access this storage account' exception allows services such as Azure Backup to access the storage account even if the firewall is set to deny public network access. This is a built-in exception designed to facilitate operational tasks by trusted Azure services.

Step-by-Step Solution

1
Analyze the access error.
The backup job fails because the storage account firewall blocks traffic originating outside the allowed virtual networks.
Azure Backup runs as a multi-tenant Microsoft service and its traffic does not originate from the configured virtual networks.
2
Modify the storage account network security configurations.
Navigate to the networking blade of the storage account and configure firewall exceptions.
Exceptions allow specific trusted traffic types to bypass the default deny rule.
3
Enable the trusted Microsoft services exception.
Checking 'Allow trusted Microsoft services to access this storage account' permits Azure Backup to connect securely.
This is the standard mechanism to grant secure administrative bypass to native Azure services.

Key Concept

Azure Storage Firewall Exceptions
Estimated Time:1m 0s
Rate this question

Topics

Configure Storage Account Network Access

More questions from this topic