Examkin

Soru

Zorluk: OrtaConfigure Storage Account Network Access

An administrator configures the network firewall of an Azure Storage account named stsecurityprod to restrict access to 'Selected networks'. The administrator adds a virtual network rule to allow access from a subnet named Subnet-App in a virtual network named VNet-Internal.

However, applications running on virtual machines within Subnet-App receive a 'NetworkAccessDenied' error when attempting to read blobs from stsecurityprod.

Which configuration is required to resolve this connectivity issue?

  1. A
    Select the 'Allow trusted Microsoft services to access this storage account' checkbox on stsecurityprod.
  2. Enable the Microsoft.Storage service endpoint on Subnet-App.Cevap
  3. C
    Assign the Storage Blob Data Contributor role to the virtual machines' managed identities.
  4. D
    Link a Private DNS Zone named privatelink.blob.core.windows.net to VNet-Internal.

Cevap

Enable the Microsoft.Storage service endpoint on Subnet-App.
For virtual network firewall rules on an Azure Storage account to function, the source subnet must have the Microsoft.Storage service endpoint enabled. When enabled, traffic from virtual machines in that subnet is routed using private IP addresses over the Azure backbone network. If the service endpoint is not enabled, the traffic uses the virtual machines' public IP addresses (or NAT IPs), which are blocked by the storage account's firewall when configured for 'Selected networks'.

Adım Adım Çözüm

1
Identify the cause of the NetworkAccessDenied error when a virtual network rule is configured but access is still blocked.
Realize that Azure Storage firewall virtual network rules rely on service endpoints to identify traffic originating from the specified subnet.
Without the service endpoint enabled, traffic from virtual machines in the subnet is routed over the public internet using public IP addresses, which are blocked by the storage account's firewall.
2
Select the correct action to route subnet traffic over the Azure backbone network with virtual network identifiers.
Enable the Microsoft.Storage service endpoint on Subnet-App.
This configuration changes the routing of storage traffic from Subnet-App to use private Azure network paths and includes the subnet's resource ID in the request header, allowing the storage account firewall to match it against the virtual network rule.

Anahtar Kavram

Azure Storage Virtual Network Rules and Service Endpoints
Bu soruyu puanla

Konular

Configure Storage Account Network Access

Bu konudan daha fazla soru