Examkin

Soru

Zorluk: ZorManage Data Movement using AzCopy and Storage Explorer

Your company has an Azure Storage account named `sa-prod-backup` that stores database backups in a blob container named `db-dumps`. To comply with security policies, the storage account has Shared Key authorization disabled (`AllowSharedKeyAccess` set to `false`).

An administrator needs to use AzCopy on a local machine to upload files to the `db-dumps` container. The administrator generates an Account Shared Access Signature (SAS) token using the Azure portal and signs it with the storage account access key. When running the `azcopy copy` command with the generated SAS token, the operation fails with an HTTP 403 (Authentication Failed) error.

You need to resolve the error and ensure that the administrator can successfully upload the files using AzCopy while adhering to the security policy of the storage account.

Which of the following actions should you perform?

  1. Assign the Storage Blob Data Contributor role to the administrator and have them authenticate using the `azcopy login` command before running the transfer.Cevap
  2. B
    Assign the Contributor role to the administrator at the storage account level and have them authenticate using the `azcopy login` command before running the transfer.
  3. C
    Regenerate the storage account access keys in the Azure portal and generate a new Account SAS token with a longer expiration window.
  4. D
    Configure the storage account firewall settings to enable the 'Allow trusted Microsoft services to access this storage account' bypass option.

Cevap

Assign the Storage Blob Data Contributor role to the administrator and have them authenticate using the `azcopy login` command before running the transfer.
When an Azure Storage account has Shared Key authorization disabled (`AllowSharedKeyAccess` set to `false`), all requests using account access keys or SAS tokens signed with account keys are blocked. To perform data operations with AzCopy, the administrator must authenticate using Microsoft Entra ID by running the `azcopy login` command. The administrator must also be assigned a data-plane role, such as Storage Blob Data Contributor, to have permissions to upload blobs to the container.

Adım Adım Çözüm

1
Analyze the cause of the HTTP 403 error during the AzCopy operation.
The storage account has `AllowSharedKeyAccess` set to `false`. This blocks any requests authorized using storage account keys, including Account and Service SAS tokens signed with those keys.
Understanding the restriction helps identify that traditional SAS tokens cannot be used.
2
Determine the supported authentication methods under the security policy.
With Shared Key access disabled, authentication must be performed using Microsoft Entra ID (directly or via a User Delegation SAS).
Microsoft Entra ID authentication does not rely on storage account keys.
3
Select the correct RBAC role and command to enable the transfer.
The administrator must be assigned the Storage Blob Data Contributor role for data-plane access, and then run `azcopy login` to authenticate with Microsoft Entra ID before executing the copy command.
This configuration satisfies the security policy and provides the necessary data-plane permissions.

Anahtar Kavram

Disabling Shared Key authorization on an Azure Storage account blocks key-based Shared Access Signatures (SAS). To copy data using tools like AzCopy when Shared Key access is disabled, you must use Microsoft Entra ID authentication combined with appropriate data-plane RBAC roles like Storage Blob Data Contributor.
Bu soruyu puanla

Konular

Manage Data Movement using AzCopy and Storage Explorer

Bu konudan daha fazla soru