Examkin

Question

Difficulty: MediumConfigure Azure Files and Azure File Sync

An organization is deploying Azure File Sync to synchronize files from an on-premises Windows Server named NY-FS01 to an Azure file share. The destination file share is hosted in a storage account named stsyncdata which has its firewall configured to restrict network access to 'Selected networks'. The organization's security policy prohibits exposing storage traffic to the public internet. Which of the following actions should you perform to enable successful file synchronization while adhering to the security policy?

  1. Configure a private endpoint for the file sub-resource of the storage account stsyncdata and ensure the on-premises server can resolve the private IP address.Answer
  2. B
    Enable the 'Allow trusted Microsoft services to access this storage account' bypass option on the storage account stsyncdata.
  3. C
    Generate a Shared Access Signature (SAS) token on the storage account stsyncdata with a 365-day expiration and configure the Azure File Sync agent to authenticate using this token.
  4. D
    Assign the 'Storage File Data SMB Share Contributor' role in Microsoft Entra ID to the on-premises server's computer identity.

Answer

Configure a private endpoint for the file sub-resource of the storage account stsyncdata and ensure the on-premises server can resolve the private IP address.
Configuring a private endpoint for the file sub-resource of the storage account allows the on-premises sync agent to transfer files over a private IP address using VPN or ExpressRoute. This satisfies the 'Selected networks' firewall constraint without exposing the storage account's endpoints to the public internet.

Step-by-Step Solution

1
Determine the network path requirements for the Azure File Sync agent.
Identify that the agent must communicate with the Storage Sync Service and the Storage Account directly to upload/download data.
Although the Storage Sync Service orchestrates the sync topology, data plane traffic goes directly to the Azure File share endpoint in the storage account.
2
Evaluate the network security constraints of the storage account.
Recognize that because the storage account firewall is set to 'Selected networks', public internet connections from the on-premises server will be blocked.
An on-premises server is treated as an untrusted public source by default under 'Selected networks' rules.
3
Identify the private networking solution that meets the security policy.
Implement a private endpoint for the file sub-resource of the storage account, allowing traffic to transit privately via VPN or ExpressRoute.
A private endpoint maps a private IP address from a virtual network to the storage account, keeping the sync traffic within the private network boundary.

Key Concept

Secure network connectivity for Azure File Sync and Azure Files using private endpoints
Estimated Time:1m 30s
Rate this question

Topics

Configure Azure Files and Azure File Sync

More questions from this topic