You manage an Azure Storage account named `sa-finance-prod` that stores sensitive financial documents. You are configuring network security for `sa-finance-prod` to meet the following requirements:
- Only virtual machines in a subnet named `Subnet-Web` within a virtual network named `VNet-Prod` must be allowed to access the storage account over the Azure network backbone.
- System administrators working from an on-premises office must be able to access the storage account. The office uses the public IP address range .
- Azure Backup must be able to back up the files in `sa-finance-prod` successfully.
- All other public internet access to the storage account must be blocked.
Which of the following configurations should you implement?
- Configure the public network access of `sa-finance-prod` to Enabled from selected virtual networks and IP addresses. Add a virtual network rule for `Subnet-Web` with the `Microsoft.Storage` service endpoint, add an IP firewall rule for , and enable the option to allow trusted Microsoft services to access the storage account.Answer
- BConfigure the public network access of `sa-finance-prod` to Enabled from selected virtual networks and IP addresses. Add a virtual network rule for `Subnet-Web` with the `Microsoft.Storage` service endpoint, add an IP firewall rule for , and assign the Contributor role to the Azure Backup service principal at the resource group level.
- CConfigure the public network access of `sa-finance-prod` to Disabled. Create a private endpoint for `sa-finance-prod` in `Subnet-Web`, add an IP firewall rule for , and enable the option to allow trusted Microsoft services to access the storage account.
- DConfigure the public network access of `sa-finance-prod` to Enabled from selected virtual networks and IP addresses. Add a virtual network rule for `Subnet-Web` with the `Microsoft.Storage` service endpoint, add an IP firewall rule for , and disable the trusted services exception while generating a Shared Access Signature (SAS) token for Azure Backup.
Answer
Configure the public network access of the storage account to 'Enabled from selected virtual networks and IP addresses', add a virtual network rule for the subnet with the service endpoint, add the IP firewall rule for the on-premises range, and allow trusted Microsoft services.
The correct configuration enables public network access from selected networks, which is required to evaluate IP firewall rules and virtual network rules. It adds the administrator IP range to the firewall rules, associates the virtual network subnet (which requires the storage service endpoint), and enables the trusted Microsoft services bypass to allow Azure Backup to function.
Step-by-Step Solution
Key Concept
Azure Storage Firewalls and Virtual Networks network routing, including Service Endpoints, IP rules, and Trusted Microsoft Services bypass.