Examkin

Soru

Zorluk: ZorManage Data Movement using AzCopy and Storage Explorer

You need to use AzCopy to upload a folder from an on-premises client computer to a blob container named `data` in an Azure Storage account named `store1`.

The storage account is configured to restrict network access to selected networks.

You plan to authenticate AzCopy using a Microsoft Entra ID service principal named `AzCopySP`.

Which five actions should you perform in sequence? To answer, arrange the actions in the correct order.

  1. 1Configure the storage account firewall of `store1` to allow access from the public IP address of the client computer.
  2. 2Assign the Storage Blob Data Contributor role to the `AzCopySP` service principal at the scope of the `store1` storage account.
  3. 3On the client computer, set the `AZCOPY_SPA_CLIENT_SECRET` environment variable to the client secret value of the service principal.
  4. 4On the client computer, run `azcopy login --service-principal --application-id <AppID> --tenant-id <TenantID>`.
  5. 5On the client computer, run `azcopy copy` specifying the local folder path and the blob container destination URL.

Cevap

To successfully perform the migration, you must first configure the storage account firewall to allow the public IP of the client computer, assign the Storage Blob Data Contributor role to the service principal, configure the `AZCOPY_SPA_CLIENT_SECRET` environment variable on the client, run `azcopy login` with the service principal's credentials, and finally run the `azcopy copy` command.
The correct sequence starts with setting up the infrastructure dependencies: first configuring the storage account firewall to permit traffic from the client's public IP address, and assigning the Storage Blob Data Contributor role to the service principal to authorize data plane actions. Next, on the client side, the environment variable `AZCOPY_SPA_CLIENT_SECRET` must be set because AzCopy does not accept the client secret as a direct parameter. Once the environment variable is configured, running `azcopy login` with the service principal parameters completes the authentication. Finally, executing `azcopy copy` transfers the files securely.

Adım Adım Çözüm

1
Configure the firewall of the storage account `store1` to allow traffic from the public IP address of the client computer.
Network connectivity is established between the on-premises client computer and the storage account endpoints.
By default, a firewalled storage account blocks all traffic unless the client IP is explicitly allowed or configured as an exception.
2
Assign the Storage Blob Data Contributor role to the service principal `AzCopySP` at the storage account level.
The service principal is authorized to perform data write operations to the blob service.
Microsoft Entra ID authentication requires specific data plane roles like Storage Blob Data Contributor to write data; control plane roles like Owner or Contributor are insufficient.
3
Set the environment variable `AZCOPY_SPA_CLIENT_SECRET` to the service principal's client secret on the client computer.
The client secret is stored securely in the shell's environment.
For security reasons, AzCopy does not accept the client secret as a direct command-line parameter. It must be set as an environment variable prior to authentication.
4
Run the `azcopy login` command with the `--service-principal`, `--application-id`, and `--tenant-id` flags on the client computer.
AzCopy authenticates against Microsoft Entra ID using the service principal identity.
Running this command initiates the non-interactive login session needed for scripts or automated transfers.
5
Run the `azcopy copy` command with the source local directory and the destination container URL.
The directory and its files are copied successfully to the Azure Blob storage container.
Once network access, authorization, and authentication are in place, the copy command can interact with the storage account and write data.

Anahtar Kavram

Configuring non-interactive authentication and network access for secure AzCopy data transfers using Microsoft Entra ID service principals.
Bu soruyu puanla

Konular

Manage Data Movement using AzCopy and Storage Explorer

Bu konudan daha fazla soru