Examkin

Question

Difficulty: Very hardConfigure Azure Files and Azure File Sync

A company plans to use Azure File Sync to synchronize files between an on-premises server named Server1 and an Azure file share named share1. The company has an established ExpressRoute connection between the on-premises network and Azure. To comply with security policies, all synchronization traffic must be routed over the private connection. An administrator performs the following configurations:
1. Deploys a Storage Sync Service named Sync1.
2. Creates a sync group named SyncGroup1 in Sync1, and configures share1 as the cloud endpoint.
3. Restricts network access to the storage account hosting share1 by setting public network access to disabled.
4. Creates a private endpoint for Sync1 in the Azure virtual network and configures DNS resolution for the Storage Sync Service.
5. Installs the Azure File Sync agent on Server1 and registers Server1 with Sync1.
6. Adds Server1 as a server endpoint in SyncGroup1.

After these configurations are applied, the synchronization health status for Server1 shows an error, and files fail to sync. Which action must the administrator perform to resolve this issue?

  1. Create a private endpoint for the storage account hosting share1 using the file sub-resource, and configure DNS resolution for the storage account's private IP address.Answer
  2. B
    Enable the 'Allow Azure services on the trusted services list to access this storage account' setting on the storage account firewall.
  3. C
    Assign the Storage File Data SMB Share Reader RBAC role to the Server1 computer object in Microsoft Entra ID.
  4. D
    Enable Cloud Tiering on the Server1 endpoint and configure a date policy to sync only files accessed within the last 14 days.

Answer

Create a private endpoint for the storage account hosting share1 using the file sub-resource, and configure DNS resolution for the storage account's private IP address.
The correct answer is correct because Azure File Sync requires connectivity to both the Storage Sync Service and the storage account hosting the target file share. When public access to the storage account is disabled, the local sync agent on Server1 cannot transfer data. Since the sync agent runs on-premises, its traffic is not covered by internal Azure bypasses. Therefore, a private endpoint for the 'file' sub-resource must be configured in the virtual network, allowing the agent to resolve the storage account's FQDN to a private IP and route the sync traffic over the ExpressRoute link.

Step-by-Step Solution

1
Identify the communication pathways required by the Azure File Sync agent.
The agent on Server1 must communicate with the Storage Sync Service (management plane) and the Storage Account (data plane).
Without connectivity to both endpoints, metadata and file data cannot be synchronized.
2
Evaluate the network connectivity settings of the storage account.
Public network access is disabled on the storage account, meaning the agent cannot connect to the default public endpoint over the Internet.
This restriction blocks all inbound traffic to the file share from the on-premises server.
3
Examine if the 'trusted services list' setting can bypass this block for the on-premises agent.
The traffic originates from the on-premises server (Server1), which does not qualify as an internal Azure trusted service.
The firewall bypass rule only applies to direct requests from internal Azure services, not to on-premises agents.
4
Determine the necessary network configuration for private routing.
Create a private endpoint for the storage account using the 'file' sub-resource on the virtual network and configure appropriate DNS resolution.
This establishes a private IP address for the storage account on the virtual network, which is reachable from Server1 over the ExpressRoute connection.

Key Concept

Azure File Sync Private Endpoint Configuration
Rate this question

Topics

Configure Azure Files and Azure File Sync

More questions from this topic