An administrator is configuring network security for an Azure storage account named `mystorage2026`. The storage account must allow traffic from `Subnet-A` of `VNet-A`, but block all other public internet traffic. Additionally, Azure Virtual Machine backup operations must continue to succeed.
Which two settings must be configured on the firewalls and virtual networks blade of the storage account to meet these requirements?
- Set the public network access to 'Enabled from selected virtual networks and IP addresses' and add Subnet-A of VNet-ACevap
- Select 'Allow trusted Microsoft services to access this storage account' as an exceptionCevap
- CSet the public network access to 'Disabled' and delete any firewall exception rules
- DAssign the Storage Blob Data Owner RBAC role directly to Subnet-A
Cevap
Configure the public network access to allow selected virtual networks and add the target subnet, and enable the bypass exception for trusted Microsoft services.
To limit access to a specific subnet while blocking general public traffic, the storage account firewall must be set to 'Enabled from selected virtual networks and IP addresses' and configured with the target subnet. Additionally, to allow Azure Backup to function, the 'Allow trusted Microsoft services to access this storage account' bypass option must be enabled.
Adım Adım Çözüm
Anahtar Kavram
Azure Storage firewalls allow restricting public access to specific subnets while permitting trusted Microsoft services to bypass these restrictions.