Examkin

Soru

Zorluk: OrtaManage Data Movement using AzCopy and Storage Explorer

Your company has a strict security policy requiring Microsoft Entra ID authorization for all data plane operations on Azure Storage accounts. The use of Storage Account Access Keys and Shared Access Signatures (SAS) is disabled.

An administrator needs to upload files from an on-premises workstation to a blob container named `archive` in a storage account named `stdatafiles2026`. The storage account's network routing is configured to restrict access to selected networks.

Which of the following configurations are required to ensure the administrator can upload the files using AzCopy? (Select three.)

  1. Run the `azcopy login` command on the workstation prior to executing the transfer.Cevap
  2. Configure the firewall of `stdatafiles2026` to allow traffic from the public IP address of the on-premises workstation.Cevap
  3. Assign the Storage Blob Data Contributor role to the administrator's Microsoft Entra ID account.Cevap
  4. D
    Assign the Contributor role to the administrator's Microsoft Entra ID account at the resource group level.
  5. E
    Enable the 'Allow Azure services on the trusted services list to access this storage account' firewall exception.
  6. F
    Generate an ad-hoc Shared Access Signature (SAS) token with a validity window of 30 days to authenticate the destination.

Cevap

To successfully upload files using AzCopy under these network and security constraints, the administrator must log in using Entra ID credentials via the command-line interface, assign the Storage Blob Data Contributor role to the user account to grant write access to the blob container, and add the workstation's public IP address to the storage account firewall rules to permit network access.
To copy data to a storage account with restricted network access under a policy that requires Entra ID auth, you must authenticate the command line session by running the command to log in, ensure your user identity has a data plane role such as the Storage Blob Data Contributor role, and add the workstation's public IP address to the storage account's firewall configuration.

Adım Adım Çözüm

1
Authenticate the local session using Entra ID.
The local session is authenticated using the administrator's corporate credentials.
Since SAS and Access Keys are disabled by policy, token-based authentication using the 'azcopy login' command is mandatory.
2
Ensure correct data plane permissions.
The administrator's account is assigned the Storage Blob Data Contributor role.
Standard control-plane RBAC roles like Contributor or Owner do not grant access to read or write data inside containers. A data plane role is required.
3
Establish network connectivity through the firewall.
The on-premises workstation's public IP address is added to the allowed firewall rules on the storage account.
Because network access is restricted to selected networks, the client's IP must be explicitly whitelisted; internal trusted service exceptions do not apply to external clients.

Anahtar Kavram

Authorizing and securing data movement using AzCopy with Microsoft Entra ID authentication and firewall constraints.
Bu soruyu puanla

Konular

Manage Data Movement using AzCopy and Storage Explorer

Bu konudan daha fazla soru