Examkin

Soru

Zorluk: KolayManage Data Movement using AzCopy and Storage Explorer

You need to use the AzCopy command-line utility to upload data from an on-premises client computer to a blob container in an Azure Storage account. The storage account has public network access enabled from selected networks.

Which of the following configurations will allow you to successfully authenticate and execute the upload? (Select two.)

  1. Authenticate by running the azcopy login command with a Microsoft Entra ID account that has the Storage Blob Data Contributor role assigned.Cevap
  2. Append a Shared Access Signature (SAS) token that has write permissions directly to the destination container URL.Cevap
  3. C
    Authenticate by running the azcopy login command with a Microsoft Entra ID account that only has the Contributor role assigned at the storage account level.
  4. D
    Configure the storage account firewall to block all public network traffic, and check the 'Allow trusted Microsoft services to access this storage account' setting to allow AzCopy traffic from your client computer.

Cevap

To successfully execute the upload, you must either authenticate via Microsoft Entra ID using a login session with the Storage Blob Data Contributor role, or append a valid Shared Access Signature (SAS) token with write permissions to the destination container URL.
To upload data using AzCopy, you need data-plane permissions. This can be achieved by authenticating with Microsoft Entra ID via the azcopy login command, provided the account has the Storage Blob Data Contributor role assigned. Alternatively, you can authorize the request by appending a valid Shared Access Signature (SAS) token with write permissions directly to the destination container URL.

Adım Adım Çözüm

1
Identify the tool's access requirements.
Determine that AzCopy requires authentication and data-plane authorization to upload blobs to a storage account.
AzCopy requires explicit data-plane permissions to perform write operations in a storage container.
2
Evaluate Microsoft Entra ID configuration.
Find that control-plane roles like Contributor do not grant container data access, whereas data-plane roles like Storage Blob Data Contributor do.
Running azcopy login requires a data-plane role to authorize write operations on blobs.
3
Evaluate Shared Access Signature (SAS) configuration.
Identify that appending a write-enabled SAS token directly to the destination container URL is a supported authentication method for AzCopy.
SAS tokens provide delegated access with specific permissions and scopes directly within the resource URI.
4
Evaluate network security.
Identify that AzCopy executes from client environments and cannot bypass firewalls using the 'Allow trusted Microsoft services' setting.
AzCopy is a client utility, not an internal trusted Azure service, meaning its traffic originates from the client's public IP.

Anahtar Kavram

Data plane authorization and firewall traversal for AzCopy
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

Manage Data Movement using AzCopy and Storage Explorer

Bu konudan daha fazla soru