An organization deploys an application hosted on Azure Virtual Machines in a subnet named AppSubnet within a virtual network named VNet-Core. The virtual machines must access a storage account named stmigration2026 to store application state. To secure the environment, the network security policy mandates that all public internet access to the storage account must be blocked, and access must be restricted to traffic originating from AppSubnet. The administrative team decides to use Virtual Network service endpoints.
Which two configuration actions must you perform to meet these requirements?
- Enable the Microsoft.Storage service endpoint on the configuration settings of AppSubnet.Cevap
- Configure the firewall settings on stmigration2026 to allow access from selected networks, and add the virtual network VNet-Core and subnet AppSubnet.Cevap
- CAssign the Storage Blob Data Reader role to the virtual machines in AppSubnet to allow them to bypass the storage firewall.
- DEnable the 'Allow trusted Microsoft services to access this storage account' exception to permit access from the virtual machines.
Cevap
Enable the Microsoft.Storage service endpoint on the AppSubnet configuration settings, and configure the firewall settings on stmigration2026 to allow access from VNet-Core and AppSubnet.
To secure network access using service endpoints, two steps are required. First, the virtual network subnet must be configured to route traffic to the storage service over the Azure backbone by enabling the Microsoft.Storage service endpoint. Second, the storage account's network firewall must be configured to restrict access to selected networks and explicitly allow the specific virtual network and subnet.
Adım Adım Çözüm
Anahtar Kavram
Configuring Storage Account Network Access using Virtual Network Service Endpoints