An administrator needs to configure secure private access to the blob service of an Azure Storage account named `ststorage1` from a virtual network named `VNet1`. The storage account must not be accessible over the public internet.
Which five actions should the administrator perform in sequence? To answer, arrange the actions in the correct order.
- 1Create a Private DNS zone named `privatelink.blob.core.windows.net`.
- 2Link the Private DNS zone to the virtual network `VNet1`.
- 3Create a private endpoint in `VNet1` targeting the blob sub-resource of `ststorage1`.
- 4Integrate the private endpoint with the Private DNS zone `privatelink.blob.core.windows.net`.
- 5Configure the firewalls and virtual networks settings of `ststorage1` to disable public network access.
Answer
The correct sequence of actions is: 1. Create a Private DNS zone named `privatelink.blob.core.windows.net`. 2. Link the Private DNS zone to the virtual network `VNet1`. 3. Create a private endpoint in `VNet1` targeting the blob sub-resource of `ststorage1`. 4. Integrate the private endpoint with the Private DNS zone `privatelink.blob.core.windows.net`. 5. Configure the firewalls and virtual networks settings of `ststorage1` to disable public network access.
To secure private access to an Azure Storage account using a Private Endpoint, you first create the Private DNS zone `privatelink.blob.core.windows.net`. Next, you link this Private DNS zone to the virtual network so clients in the network can resolve names using it. You then create the private endpoint itself in the virtual network. Once created, you integrate it with the Private DNS zone to register the DNS A records. Finally, you disable public network access on the storage account to enforce that all connections must go through the private endpoint.
Step-by-Step Solution
Key Concept
Azure Private Endpoint and Private DNS integration for Azure Storage