Examkin

Question

Difficulty: MediumCreate and Configure Virtual Machines

You are deploying a new Azure virtual machine named VM1 to a subnet named Subnet1 in a virtual network named VNet1. You plan to use the Custom Script Extension to run a post-deployment configuration script on VM1 during provisioning.

The script is stored in a private container in an Azure storage account named storage1. The firewall of storage1 is configured to restrict access to 'Selected networks'.

You need to ensure that VM1 can download and execute the script during the provisioning phase.

What should you configure?

  1. Configure a virtual network rule on storage1 to allow traffic from Subnet1, and enable the Microsoft.Storage service endpoint on Subnet1.Answer
  2. B
    Enable the 'Allow trusted Microsoft services to access this storage account' setting in the firewall configuration of storage1.
  3. C
    Assign a system-assigned managed identity to VM1, and grant the identity the Storage Blob Data Reader role on storage1.
  4. D
    Configure a private DNS zone for storage1 and link it to VNet1 without creating a private endpoint.

Answer

Configure a virtual network rule on storage1 to allow traffic from Subnet1, and enable the Microsoft.Storage service endpoint on Subnet1.
The correct configuration is to enable the Microsoft.Storage service endpoint on the subnet where the VM resides and add a corresponding virtual network rule on the storage account. Because the Custom Script Extension runs inside the guest operating system of the virtual machine, the download request is initiated directly from the VM's network interface using its subnet configuration. Enabling the service endpoint and allowing the subnet through the storage firewall grants the VM secure access to retrieve the script.

Step-by-Step Solution

1
Identify the source of the network traffic.
The Custom Script Extension executes within the operating system of VM1, which is deployed in Subnet1 of VNet1. The traffic to download the script originates from the VM's network interface in Subnet1.
This determines which source network needs to be permitted through the storage account firewall.
2
Select the appropriate network integration method.
Enable the Microsoft.Storage service endpoint on Subnet1 to optimize and secure the route to Azure Storage.
Service endpoints allow virtual network resources to access Azure services via private IP addresses over the Azure backbone.
3
Configure the storage firewall rule.
Add Subnet1 of VNet1 as an allowed network in the firewall settings of storage1.
This allows the storage account firewall to accept traffic originating from Subnet1, enabling VM1 to download the script during provisioning.

Key Concept

Configuring network access to Azure Storage for Virtual Machine extensions during deployment
Estimated Time:1m 30s
Rate this question

Topics

Create and Configure Virtual Machines

More questions from this topic