Examkin

Soru

Zorluk: Çok zorConfigure Storage Account Network Access

An administrator configures the network firewall for an Azure Storage account named storagedata1 that contains a blob container named container1 and an Azure file share named share1.

The firewall settings for storagedata1 are configured as follows:
- Public network access: Enabled from selected virtual networks and IP addresses
- Virtual networks: None
- Firewall (IP ranges): None
- Exceptions: "Allow Azure services on the trusted services list to access this storage account" is enabled

The administrator needs to support the following administrative tasks:
- Task 1: Backup share1 using Azure Backup.
- Task 2: Allow a developer named User1 to upload blobs to container1 using the Azure CLI from an on-premises computer with the public IP address 203.0.113.5. User1 is assigned the Owner role at the subscription level.
- Task 3: Allow an Azure Data Factory instance named ADF1 to copy data from container1. ADF1 has been assigned the Storage Blob Data Contributor role on storagedata1.

Which of the tasks will succeed under the current configuration without any further modifications?

  1. Task 1 onlyCevap
  2. B
    Task 1 and Task 3 only
  3. C
    Task 1 and Task 2 only
  4. D
    Task 1, Task 2, and Task 3

Cevap

Task 1 only
The task to backup the file share using Azure Backup succeeds because Azure Backup is a trusted Microsoft service that natively utilizes the firewall bypass exception for Azure Files backup. The other tasks fail because the network firewall blocks the user's public IP address (and Owner does not grant data-plane access), and Azure Data Factory requires a resource instance rule to bypass the firewall.

Adım Adım Çözüm

1
Evaluate Task 1 (Azure Backup of Azure Files share1).
Task 1 succeeds.
Azure Backup is a trusted Microsoft service that can bypass the storage firewall to backup Azure File shares when the 'Allow trusted Microsoft services...' exception is enabled.
2
Evaluate Task 2 (User1 uploading blobs from public IP 203.0.113.5).
Task 2 fails.
The storage firewall is set to selected networks and does not have User1's public IP address listed in the firewall rules. Additionally, the Owner role is a control-plane role and does not grant data-plane access to blobs via Entra ID authentication.
3
Evaluate Task 3 (Azure Data Factory ADF1 copying data from container1).
Task 3 fails.
For Azure Data Factory to bypass the storage firewall over public endpoints, a resource instance rule matching the specific ADF instance must be configured. Enabling the general trusted Microsoft services exception alone is insufficient.

Anahtar Kavram

Azure Storage Account network security exceptions and resource instance rules.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Configure Storage Account Network Access

Bu konudan daha fazla soru