Examkin

Soru

Zorluk: ZorConfigure Storage Account Network Access

An administrator is configuring network access for an Azure Storage account named `corpstorage99` to meet the following requirements:
- Allow access from a subnet named `Subnet1` in a virtual network named `VNet1`.
- Block all other traffic from the public internet.
- Allow Azure Backup to back up the storage account.

To support this, `Subnet1` has the `Microsoft.Storage` service endpoint enabled.

Which configuration should the administrator apply to the firewalls and virtual networks settings of `corpstorage99`?

  1. Set public network access to 'Enabled from selected virtual networks and IP addresses', add VNet1 and Subnet1 to the virtual networks list, and select the exception to allow trusted Microsoft services.Cevap
  2. B
    Set public network access to 'Enabled from selected virtual networks and IP addresses', add VNet1 and Subnet1 to the virtual networks list, and clear all exceptions while assigning the Backup Contributor role to the Backup Vault's managed identity.
  3. C
    Set public network access to 'Disabled', add VNet1 and Subnet1 to the virtual networks list, and select the exception to allow trusted Microsoft services.
  4. D
    Set public network access to 'Enabled from selected virtual networks and IP addresses', add VNet1 and Subnet1 to the virtual networks list, and assign the Storage Blob Data Contributor role to the Backup Vault's managed identity without enabling firewall exceptions.

Cevap

Set public network access to 'Enabled from selected virtual networks and IP addresses', add VNet1 and Subnet1 to the virtual networks list, and select the exception to allow trusted Microsoft services.
The correct configuration is to set the public network access to 'Enabled from selected virtual networks and IP addresses', configure the allowed subnet, and check the option to allow trusted Microsoft services. This setup enforces the firewall to block general internet traffic, permits traffic from the authorized Subnet1 using the service endpoint, and allows Azure Backup (a trusted service) to bypass the firewall to perform backups.

Adım Adım Çözüm

1
Select the correct public network access mode on the storage account.
Setting the public network access to 'Enabled from selected virtual networks and IP addresses' activates the Azure Storage firewall, which is required to restrict access to specific subnets while still maintaining the public endpoint active for authorized traffic and exceptions.
This allows granular firewall rules to be defined instead of completely disabling public access or allowing all traffic.
2
Bind the virtual network and subnet to the storage firewall.
Adding VNet1 and Subnet1 to the allowed virtual networks list allows traffic originating from Subnet1 (leveraging the Microsoft.Storage service endpoint) to reach the storage account.
This satisfies the requirement to allow access from Subnet1 while blocking other public internet traffic.
3
Configure the trusted Microsoft services bypass exception.
Enabling the 'Allow Azure services on the trusted services list to access this storage account' setting permits services like Azure Backup to bypass the network rules.
This ensures the backup service can connect to and back up the storage account resources without being blocked by the IP/VNet restrictions.

Anahtar Kavram

Azure Storage Account Network Firewalls and Trusted Microsoft Services Bypass
Bu soruyu puanla

Konular

Configure Storage Account Network Access

Bu konudan daha fazla soru