Examkin

Question

Difficulty: MediumConfigure Storage Account Network Access

An administrator needs to configure secure private access to an Azure Storage account named corpstore2026 from a virtual network named VNet1. The solution must ensure that resources in VNet1 can resolve the storage account's fully qualified domain name (FQDN) to its private IP address. All public internet access to the storage account must be blocked. In which order should the administrator perform the configuration steps?

  1. 1Create a Private DNS zone named privatelink.blob.core.windows.net.
  2. 2Link the Private DNS zone to the virtual network VNet1.
  3. 3Create a private endpoint for the storage account corpstore2026 in Subnet1 of VNet1.
  4. 4Identify the private IP address assigned to the private endpoint.
  5. 5Create a DNS A record in the Private DNS zone that maps the storage account FQDN to the private IP address.

Answer

To configure secure private access and DNS resolution for the storage account, the administrator must first create the Private DNS zone, link it to the virtual network, deploy the private endpoint to allocate a private IP address, retrieve that private IP address, and finally create the DNS A record mapping the FQDN to the private IP address.
The correct sequence ensures that the DNS infrastructure is prepared and linked to the virtual network first. Once the private endpoint is created, its allocated private IP address can be retrieved and registered as an A record in the Private DNS zone. This ensures seamless transition and correct name resolution from resources within VNet1.

Step-by-Step Solution

1
Create the Private DNS zone named privatelink.blob.core.windows.net.
The Private DNS zone is created in the Azure subscription, preparing the namespace for private resolution.
You must establish the private zone before you can link it to virtual networks or add records to it.
2
Link the Private DNS zone to VNet1.
A virtual network link is established between the Private DNS zone and VNet1.
This step enables name resolution within the virtual network so that resources in VNet1 query the private zone.
3
Create the private endpoint for corpstore2026 in Subnet1 of VNet1.
A private endpoint is provisioned, and a private IP address is allocated from Subnet1's range.
Creating the private endpoint establishes the physical private network interface and generates the private IP address needed for the DNS record.
4
Retrieve the allocated private IP address from the private endpoint's network interface.
The specific private IP address is identified.
The exact private IP address must be known to create the correct A record in the next step.
5
Create a DNS A record in the Private DNS zone mapping corpstore2026.blob.core.windows.net to the private IP address.
The DNS record is added to the private zone.
This updates the DNS resolution path so that requests from VNet1 directed to the storage account resolve to the private endpoint instead of the public endpoint.

Key Concept

Configuring private access to Azure Storage requires deploying a private endpoint and setting up private DNS resolution so that clients resolve the storage account's FQDN to its private endpoint IP address.
Estimated Time:2m 0s
Rate this question

Topics

Configure Storage Account Network Access

More questions from this topic