Examkin

Question

Difficulty: HardBlob, File, and Disk Storage Solutions

An organization is designing a shared storage architecture for a hybrid application. The application components are deployed in an Azure Kubernetes Service (AKS) cluster and on-premises virtual machines. The solution must meet the following requirements:
- Provide a shared file system that can be mounted concurrently by multiple AKS pods (ReadWriteMany) and the on-premises virtual machines using the SMB protocol.
- Ensure that the storage can survive a physical zone outage in the primary Azure region without data loss or service disruption.
- Provide access to on-premises users using their existing on-premises Active Directory Domain Services (AD DS) credentials.
- Secure the storage access; if Shared Access Signatures (SAS) are used for any ad-hoc diagnostic transfers, they must support easy revocation.

Which two actions should you include in the storage design?

  1. Create an Azure Files Premium file share configured with Zone-Redundant Storage (ZRS).Answer
  2. Enable on-premises Active Directory Domain Services (AD DS) authentication for the Azure storage account.Answer
  3. C
    Create an Azure Files Standard file share configured with Locally Redundant Storage (LRS).
  4. D
    Configure Read-Access Geo-Redundant Storage (RA-GRS) and use it as an active-active write target across two regions.
  5. E
    Generate ad-hoc Shared Access Signatures (SAS) with a five-year validity window directly in the URI.

Answer

To meet the requirements, the design must include creating an Azure Files Premium file share configured with Zone-Redundant Storage (ZRS) and enabling on-premises Active Directory Domain Services (AD DS) authentication for the Azure storage account.
The correct architecture consists of creating an Azure Files Premium file share configured with Zone-Redundant Storage (ZRS) and enabling on-premises Active Directory Domain Services (AD DS) authentication. ZRS ensures high availability across zones. Premium files deliver the required sub-second failover and high performance for containerized workloads. On-premises AD DS integration allows seamless mounting of SMB shares using existing corporate credentials.

Step-by-Step Solution

1
Select the appropriate storage service and protocol.
Azure Files Premium SMB share is chosen to support ReadWriteMany mounts from AKS and SMB access from on-premises virtual machines.
Azure Files provides managed SMB shares that can be mounted concurrently by AKS pods and on-premises virtual machines.
2
Choose the replication strategy to handle zonal outages.
Zone-Redundant Storage (ZRS) is selected.
ZRS replicates data synchronously across three availability zones in the primary region, surviving a zone outage without service disruption.
3
Configure the authentication mechanism for hybrid access.
On-premises Active Directory Domain Services (AD DS) authentication is enabled on the storage account.
This allows clients to authenticate to the Azure file shares using their existing on-premises domain credentials over VPN or ExpressRoute.
4
Ensure secure and revocable SAS generation.
Stored access policies should be used instead of long-lived, direct-URI SAS tokens.
Ad-hoc SAS tokens with long lifetimes created without a stored access policy cannot be easily revoked without rotating the storage keys, which causes service disruption.

Key Concept

Designing secure, zone-resilient hybrid file storage using Azure Files Premium with ZRS and on-premises AD DS integration.
Rate this question

Topics

Blob, File, and Disk Storage Solutions

More questions from this topic