Examkin

Question

Difficulty: HardConfigure Azure App Services

An administrator is configuring an Azure App Service web app named app-corp to access private blobs in an Azure Storage account named storagecorp. The firewall settings of storagecorp are configured to 'Enabled from selected virtual networks and IP addresses'. The administrator enables a system-assigned managed identity for app-corp and assigns the 'Storage Blob Data Reader' role to the identity for the storage account. However, outbound connections from app-corp to storagecorp fail with a network access error. Which configuration should the administrator implement to allow app-corp to successfully access the blobs in storagecorp?

  1. Configure Regional VNet Integration for app-corp to connect to a subnet in a virtual network, and add that subnet to the allowed networks list of storagecorp.Answer
  2. B
    Enable the 'Allow trusted Microsoft services to access this storage account' exception on storagecorp.
  3. C
    Create a Private DNS Zone named privatelink.blob.core.windows.net and link it to the App Service plan without configuring virtual network integration.
  4. D
    Assign the Reader role to the web app's system-assigned managed identity at the subscription level.

Answer

Configure Regional VNet Integration for app-corp to connect to a subnet in a virtual network, and add that subnet to the allowed networks list of storagecorp.
The correct configuration is to enable Regional VNet Integration on the App Service web app and then allow that integrated subnet on the storage account's firewall. Regional VNet Integration routes the outbound traffic from the App Service web app into the virtual network, allowing it to conform to network rules and be permitted by the storage account's firewalls.

Step-by-Step Solution

1
Enable Regional VNet Integration on the App Service web app app-corp.
The web app's outbound traffic is routed into a delegated subnet within a virtual network.
This allows the outbound traffic to originate from a private IP within the virtual network rather than the public outbound IP addresses of the App Service multitenant infrastructure.
2
Configure the storage account firewall settings on storagecorp.
The delegated subnet from the virtual network is added to the allowed networks list.
This tells the storage account firewall to permit traffic originating from that specific subnet, establishing a secure network path.
3
Verify role assignment and test connectivity.
The web app app-corp successfully reads blobs from storagecorp using its managed identity.
With both the network path allowed via VNet integration and data plane authorization granted via the Storage Blob Data Reader role, the secure access is fully enabled.

Key Concept

Azure App Service Regional VNet Integration and Storage Firewall configuration
Rate this question

Topics

Configure Azure App Services

More questions from this topic