Examkin

Soru

Zorluk: ZorConfigure Azure App Services

You have an Azure App Service web app named WebApp1 that runs on the Premium V2 App Service plan. You need to configure custom backups for WebApp1. The backups must be stored in an Azure Storage account named storage1. The storage account has its firewall enabled, restricting all public access. Which five actions should you perform in sequence to configure the backups? To answer, arrange the actions in the correct order.

  1. 1Configure Regional Virtual Network Integration for WebApp1 to a subnet.
  2. 2Configure the firewall of storage1 to allow access from the subnet integrated with WebApp1.
  3. 3Enable a system-assigned managed identity for WebApp1.
  4. 4Assign the Storage Blob Data Contributor role to WebApp1's managed identity on storage1.
  5. 5Configure the backup settings for WebApp1 by selecting storage1 and setting the authentication method to Managed Identity.

Cevap

Configure Regional Virtual Network Integration for WebApp1 to a subnet, configure the firewall of storage1 to allow access from that subnet, enable a system-assigned managed identity for WebApp1, assign the Storage Blob Data Contributor role to WebApp1's managed identity on storage1, and configure the backup settings for WebApp1 by selecting storage1 and setting the authentication method to Managed Identity.
To secure backups of an Azure App Service to a firewall-restricted storage account, you must route the backup traffic over a virtual network and authenticate using a managed identity. First, you configure Regional Virtual Network Integration to place the App Service outbound traffic in a subnet. Second, you update the storage account firewall to permit traffic from that subnet. Third, you enable a system-assigned managed identity on the App Service. Fourth, you assign the Storage Blob Data Contributor role to this identity on the storage account. Finally, you configure the backup settings using the managed identity.

Adım Adım Çözüm

1
Configure Regional Virtual Network Integration for WebApp1 to a subnet.
Outbound traffic from WebApp1 is routed through the specified subnet.
This is necessary to establish a network path to a storage account that has its firewall enabled, as public access is blocked.
2
Configure the firewall of storage1 to allow access from the subnet integrated with WebApp1.
The storage account accepts connections originating from the integrated subnet.
Since the storage account restricts access to trusted networks, the subnet associated with the web app's VNet integration must be added to the allowed networks list.
3
Enable a system-assigned managed identity for WebApp1.
An identity for WebApp1 is registered in Microsoft Entra ID.
Backing up over a firewall-secured storage account requires using a managed identity for authentication, as SAS tokens are not supported under this configuration.
4
Assign the Storage Blob Data Contributor role to WebApp1's managed identity on storage1.
WebApp1 is authorized to write blobs to storage1.
The managed identity requires permissions to write the backup files to the storage container, which is provided by the Storage Blob Data Contributor role.
5
Configure the backup settings for WebApp1 by selecting storage1 and setting the authentication method to Managed Identity.
Automated backups are configured and running successfully using the secured path.
Specifying the storage account and selecting the managed identity finishes the configuration and starts backing up the web app.

Anahtar Kavram

Configuring secure backups for Azure App Services using VNet integration and managed identities.
Bu soruyu puanla

Konular

Configure Azure App Services

Bu konudan daha fazla soru