Examkin

Question

Difficulty: MediumCreate and Configure Virtual Machines

You are deploying an Azure virtual machine named VM1 in the East US region. You plan to configure VM1 using the Custom Script Extension. The script is stored in a private container in an Azure storage account named `storage1`. The firewall for `storage1` is configured to restrict access to selected networks only. You need to ensure that the VM Agent on VM1 can download and execute the script. Which configuration should you implement?

  1. A
    Enable the 'Allow trusted Microsoft services to access this storage account' exception on `storage1`, and configure the Custom Script Extension to download the script.
  2. B
    Assign the Reader role to VM1's system-assigned managed identity on `storage1`, and configure the Custom Script Extension to use the managed identity.
  3. Configure a service endpoint for `Microsoft.Storage` on the subnet of VM1, and add a virtual network rule to the firewall settings of `storage1` to allow traffic from that subnet.Answer
  4. D
    Deploy VM1 in an Availability Set to protect the deployment from datacenter-wide failures, and configure the storage firewall to allow access from the Availability Set.

Answer

Configure a service endpoint for `Microsoft.Storage` on the subnet of VM1, and add a virtual network rule to the firewall settings of `storage1` to allow traffic from that subnet.
Configuring a service endpoint for `Microsoft.Storage` on the virtual machine's subnet allows the virtual machine to securely connect to Azure storage. Adding a virtual network rule to the storage account's firewall to permit traffic from that subnet allows the VM Agent to download the script directly over the Azure backbone network, successfully bypassing the restricted firewall.

Step-by-Step Solution

1
Identify the source of network requests generated by the Custom Script Extension.
The requests originate from the virtual machine's network interface (NIC) inside its designated subnet.
VM extensions execute directly inside the VM's operating system environment.
2
Evaluate the storage firewall settings regarding virtual machine access.
Direct network access from the VM is blocked by default when the storage account restricts access to selected networks, and the VM traffic does not bypass the firewall via the 'trusted Microsoft services' exemption.
The 'trusted Microsoft services' bypass applies to backend service-to-service communications from Azure resource providers, not VM-initiated outbound traffic.
3
Configure secure private routing between the virtual machine and the storage account.
Enabling a service endpoint for `Microsoft.Storage` on the subnet and adding a virtual network rule to the storage account firewall permits traffic from the VM's subnet.
This establishes a direct, secure connection over the Azure backbone network and satisfies the storage firewall's subnet validation.

Key Concept

Virtual Machine extension configuration and secure storage integration
Rate this question

Topics

Create and Configure Virtual Machines

More questions from this topic