Examkin

Soru

Zorluk: OrtaConfigure Storage Account Network Access

You have an Azure subscription containing a virtual network named VNet1. VNet1 has a subnet named Subnet-Internal.

You deploy an Azure Storage account named sa-data-prod. You configure the storage account firewall to restrict access to 'Selected networks' and add Subnet-Internal to the allowed virtual networks.

You configure Azure Backup to back up the files in sa-data-prod. You discover that the backup jobs fail because the backup service cannot access the storage account.

Which configuration change should you make to resolve the backup failure?

  1. Enable the 'Allow trusted Microsoft services to access this storage account' exception in the storage account firewall settings.Cevap
  2. B
    Assign the Storage Account Contributor role to the Azure Backup service instance at the resource group level.
  3. C
    Add a Network Security Group (NSG) rule in Subnet-Internal that allows outbound traffic to the Storage service tag with a priority of 2000, below an existing deny-all rule at priority 1000.
  4. D
    Configure a Microsoft.Storage service endpoint on the subnet used by the Azure Backup service.

Cevap

Enable the 'Allow trusted Microsoft services to access this storage account' exception in the storage account firewall settings.
The correct action is to enable the 'Allow trusted Microsoft services to access this storage account' exception in the storage account firewall settings. This configures the storage account firewall to permit trusted Azure services, such as Azure Backup, to bypass the network restrictions and successfully perform data protection tasks.

Adım Adım Çözüm

1
Identify the root cause of the connection failure between Azure Backup and the storage account.
The storage account is configured to restrict access to 'Selected networks' (Subnet-Internal only), which blocks external network access by default.
By default, when public access is restricted to specific subnets, all other public IP addresses and Microsoft services are blocked unless explicitly allowed.
2
Evaluate the role of Azure Backup in accessing restricted storage accounts.
Azure Backup is classified as a trusted Microsoft service.
Microsoft provides a built-in firewall bypass mechanism for specific trusted services to allow them to perform management and data protection tasks.
3
Apply the firewall bypass configuration in the Azure portal or CLI.
Under the 'Firewalls and virtual networks' configuration of the storage account, enable the checkbox 'Allow trusted Microsoft services to access this storage account'.
This allows Azure Backup to successfully authenticate and transfer backup data despite the restrictive network firewall.

Anahtar Kavram

Azure Storage Firewall Bypass for Trusted Microsoft Services
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Configure Storage Account Network Access

Bu konudan daha fazla soru