Examkin

Soru

Zorluk: ZorConfigure Storage Account Network Access

You manage an Azure Storage account named sa-prod-data that contains business-critical blob containers. You need to configure network security for sa-prod-data to meet the following requirements:
- Only virtual machines deployed in a subnet named Subnet-App within a virtual network named VNet-Core must be allowed network access to the storage account.
- Azure Backup must be able to back up the blob containers in the storage account.
- All other public internet access to the storage account must be blocked.

Which two configurations must you apply? (Select TWO).

  1. Enable the Microsoft.Storage service endpoint on Subnet-App and add a virtual network rule for Subnet-App in the network settings of sa-prod-data.Cevap
  2. Configure the firewalls and virtual networks settings of sa-prod-data to allow access from selected networks and enable the exception for trusted Microsoft services.Cevap
  3. C
    Assign the Storage Blob Data Contributor role to the Subnet-App Network Security Group (NSG) and allow outbound traffic to sa-prod-data.
  4. D
    Disable the exception to allow trusted Microsoft services and add the public IP addresses of the Azure Backup service endpoints to the firewall rules of sa-prod-data.

Cevap

Enable the Microsoft.Storage service endpoint on the subnet, add a corresponding virtual network rule to the storage account firewall, and configure the storage account to restrict public access to selected networks while allowing the trusted Microsoft services bypass exception.
To secure the storage account, you must restrict public access by setting the firewall to allow access only from selected networks. To permit the virtual machines on the specific subnet, you must enable the Microsoft.Storage service endpoint on that subnet and add a virtual network rule targeting it in the storage account firewall. Additionally, because Azure Backup is an external trusted Microsoft service that operates outside the virtual network, you must check the box to allow trusted Microsoft services to bypass the firewall so that backups can succeed.

Adım Adım Çözüm

1
Enable the Microsoft.Storage service endpoint on Subnet-App within VNet-Core.
This configures the virtual network subnet to route all traffic bound for Azure Storage through the Microsoft backbone network rather than the public internet.
Azure Storage firewall virtual network rules require the source subnet to have the Microsoft.Storage service endpoint enabled.
2
Add a virtual network rule for Subnet-App in the firewalls and virtual networks settings of the storage account sa-prod-data.
The storage account firewall is configured to recognize and allow network traffic originating from Subnet-App.
This establishes the network-level boundary that permits traffic from the authorized subnet.
3
Configure the storage account firewall default action to 'Enabled from selected virtual networks and IP addresses' and enable the exception for trusted Microsoft services.
All public internet access is blocked except for traffic from Subnet-App and connections from Azure Backup.
This blocks unauthorized public access while allowing Azure Backup (a trusted service) to bypass the firewall and perform its backup tasks.

Anahtar Kavram

Configuring Azure Storage firewalls, enabling virtual network service endpoints, and configuring the trusted Microsoft services bypass exception to secure access.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Configure Storage Account Network Access

Bu konudan daha fazla soru