Question

Difficulty: HardConfigure Storage Account Network Access

You manage an Azure Storage account named `sa-finance-prod` that stores sensitive financial documents. You are configuring network security for `sa-finance-prod` to meet the following requirements:

- Only virtual machines in a subnet named `Subnet-Web` within a virtual network named `VNet-Prod` must be allowed to access the storage account over the Azure network backbone.
- System administrators working from an on-premises office must be able to access the storage account. The office uses the public IP address range 203.0.113.0/24203.0.113.0/24.
- Azure Backup must be able to back up the files in `sa-finance-prod` successfully.
- All other public internet access to the storage account must be blocked.

Which of the following configurations should you implement?

  1. Configure the public network access of `sa-finance-prod` to Enabled from selected virtual networks and IP addresses. Add a virtual network rule for `Subnet-Web` with the `Microsoft.Storage` service endpoint, add an IP firewall rule for 203.0.113.0/24203.0.113.0/24, and enable the option to allow trusted Microsoft services to access the storage account.Answer
  2. B
    Configure the public network access of `sa-finance-prod` to Enabled from selected virtual networks and IP addresses. Add a virtual network rule for `Subnet-Web` with the `Microsoft.Storage` service endpoint, add an IP firewall rule for 203.0.113.0/24203.0.113.0/24, and assign the Contributor role to the Azure Backup service principal at the resource group level.
  3. C
    Configure the public network access of `sa-finance-prod` to Disabled. Create a private endpoint for `sa-finance-prod` in `Subnet-Web`, add an IP firewall rule for 203.0.113.0/24203.0.113.0/24, and enable the option to allow trusted Microsoft services to access the storage account.
  4. D
    Configure the public network access of `sa-finance-prod` to Enabled from selected virtual networks and IP addresses. Add a virtual network rule for `Subnet-Web` with the `Microsoft.Storage` service endpoint, add an IP firewall rule for 203.0.113.0/24203.0.113.0/24, and disable the trusted services exception while generating a Shared Access Signature (SAS) token for Azure Backup.

Answer

Configure the public network access of the storage account to 'Enabled from selected virtual networks and IP addresses', add a virtual network rule for the subnet with the service endpoint, add the IP firewall rule for the on-premises range, and allow trusted Microsoft services.
The correct configuration enables public network access from selected networks, which is required to evaluate IP firewall rules and virtual network rules. It adds the administrator IP range to the firewall rules, associates the virtual network subnet (which requires the storage service endpoint), and enables the trusted Microsoft services bypass to allow Azure Backup to function.

Step-by-Step Solution

1
Select the correct public network access state.
Choose 'Enabled from selected virtual networks and IP addresses' rather than 'Disabled'.
Disabling public network access ignores all public IP firewall rules, which would block the on-premises administrators using the public IP range.
2
Enable the service endpoint on the subnet.
Enable the `Microsoft.Storage` service endpoint on `Subnet-Web`.
This allows traffic from the subnet to be routed securely over the Azure backbone network to the storage account.
3
Add virtual network and IP rules to the storage account firewall.
Add `Subnet-Web` to the allowed virtual networks list and 203.0.113.0/24203.0.113.0/24 to the firewall IP rules.
This restricts general public access while permitting traffic from the specific subnet and the administrator office.
4
Allow trusted Microsoft services to bypass the firewall.
Check the box to 'Allow Azure services on the trusted services list to access this storage account'.
Azure Backup is a trusted Microsoft service and requires this exception to access the storage account when firewall rules are active.

Key Concept

Azure Storage Firewalls and Virtual Networks network routing, including Service Endpoints, IP rules, and Trusted Microsoft Services bypass.
Rate this question