You are designing a secure network architecture for an application in Azure. The application consists of Azure Virtual Machines deployed in a subnet named Subnet1 within a virtual network named VNet1. The virtual machines must access an Azure Storage account named storage1 to retrieve configuration files. You need to recommend a solution that ensures all traffic from Subnet1 to storage1 flows over the Microsoft backbone network and that public access to storage1 from the internet is completely blocked. Which two actions should you include in the recommendation?
- Create a Private Endpoint for storage1 in Subnet1.Answer
- Configure the firewall of storage1 to disable public network access.Answer
- CConfigure a Network Security Group (NSG) rule in Subnet1 that allows outbound traffic to the individual public IP addresses of storage1.
- DConfigure a custom Route Table on Subnet1 with a User Defined Route (UDR) that routes all traffic destined for storage1 to the default internet gateway.
Answer
Create a Private Endpoint for storage1 in Subnet1 and configure the firewall of storage1 to disable public network access.
To secure access to the storage account, you must establish private connectivity and disable public access. Creating a Private Endpoint in the virtual network subnet assigns a private IP address to the storage account, routing traffic over the Microsoft backbone. Disabling public network access on the storage account firewall blocks all access from the public internet.
Step-by-Step Solution
Key Concept
Azure Private Link and Storage Account Firewalls
Alternative Method
Instead of Private Endpoints, you could use Service Endpoints combined with Storage Firewall virtual network restrictions, but Private Endpoints are preferred when you must completely block all public access paths.
Estimated Time:45s