Examkin

Question

Difficulty: MediumConfigure Storage Account Network Access

An administrator is configuring network access for an Azure Storage account named safinanceprod.

The storage account's firewall is configured to restrict access to selected virtual networks. The administrator adds a virtual network named vnetprod and its subnet named subnetapps to the allowed networks list of the storage account.

However, virtual machines in subnetapps are still blocked when attempting to access the storage account.

Which configuration change must be applied to subnetapps to allow the virtual machines to access the storage account?

  1. Enable the Microsoft.Storage service endpoint on the subnet.Answer
  2. B
    Assign the Storage Blob Data Reader RBAC role to the virtual machines' managed identities.
  3. C
    Enable the 'Allow trusted Microsoft services to access this storage account' setting on the storage account.
  4. D
    Add a high-priority outbound Network Security Group rule allowing traffic to the Storage service tag.

Answer

Enable the Microsoft.Storage service endpoint on the subnet.
The correct action is to enable the Microsoft.Storage service endpoint on the subnet. When a storage account firewall is configured to restrict access to selected virtual networks, it will only accept traffic from subnets that have been explicitly added to its configuration. However, for the storage account to recognize that the traffic is coming from the allowed subnet, the subnet itself must have the service endpoint enabled. This endpoint ensures that traffic is routed over the Azure backbone network and carries the virtual network identity.

Step-by-Step Solution

1
Analyze the network configuration of the storage account.
The storage account firewall is configured to restrict access to selected virtual networks, and the target subnet is added to the allowed list.
This establishes that the storage account is ready to receive traffic from the subnet, provided the traffic carries the virtual network identity.
2
Identify why the virtual machines' traffic is being blocked.
By default, traffic from subnets to public endpoints of Azure services uses public IP routing, meaning the storage account sees the public IP instead of the virtual network identity.
Understanding the routing behavior explains why simply adding the subnet to the storage firewall is not enough.
3
Select the configuration that exposes the subnet's identity to the storage account.
Enabling the Microsoft.Storage service endpoint on the subnet routes traffic through the Azure backbone and adds the subnet's network identity to the request headers.
This satisfies the firewall rule on the storage account, allowing traffic to flow securely.

Key Concept

Azure Virtual Network service endpoints extend your virtual network private address space and the identity of your VNet to Azure service endpoints over a direct connection.
Estimated Time:1m 30s
Rate this question

Topics

Configure Storage Account Network Access

More questions from this topic