Examkin

Soru

Zorluk: KolayManage Data Movement using AzCopy and Storage Explorer

You are using the AzCopy command-line tool to upload log files from an on-premises client computer to an Azure Blob storage container. The storage account has its firewall configured to allow access only from selected networks. When you execute the AzCopy upload command, the transfer fails, and you receive an HTTP 403 Forbidden error. Which action should you perform to resolve the upload failure?

  1. Add the public IP address of the on-premises client computer to the firewall configuration of the storage account.Cevap
  2. B
    Enable the 'Allow trusted Microsoft services to access this storage account' bypass setting on the storage account.
  3. C
    Assign the Storage Blob Data Contributor role to the identity used by AzCopy.
  4. D
    Generate a new Shared Access Signature (SAS) token that has a longer expiration window.

Cevap

Add the public IP address of the on-premises client computer to the firewall configuration of the storage account.
The correct action is to add the public IP address of the client computer to the storage account firewall. This is because the HTTP 403 Forbidden error under a restricted network configuration indicates that the client machine is blocked from accessing the storage endpoint at the network layer.

Adım Adım Çözüm

1
Identify the cause of the failure based on the HTTP 403 Forbidden error.
The error indicates that the network request is being rejected by a security boundary, specifically the storage account firewall.
Understanding the error code helps isolate whether the issue is related to credentials or network-level access control.
2
Analyze the storage account firewall settings.
The firewall is configured to block all traffic except from selected networks, which excludes the on-premises client by default.
You must identify where the request is originating from to authorize it within the firewall rules.
3
Modify the firewall rule to allow the client's public IP address.
The network block is removed, allowing AzCopy to successfully establish a connection and upload the files.
Adding the specific client IP address permits traffic while maintaining a secure default-deny posture for all other untrusted networks.

Anahtar Kavram

Configuring network access and firewalls for Azure Storage accounts during data movement operations.
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

Manage Data Movement using AzCopy and Storage Explorer

Bu konudan daha fazla soru