Exam DP-200 topic 6 question 37 discussion

Actual exam question from Microsoft's DP-200

Question #: 37
Topic #: 6

You need to grant access to a storage account from a virtual network.
Which of the following would you need to enable first for this requirement?

A. Create a virtual private network connection
B. Enable SSL for the virtual network
C. Enable a service endpoint for the storage account
D. Enable CORS configuration for the virtual network

Show Suggested Answer

Suggested Answer: C 🗳️
You have to enable a service endpoint for the storage account.
This is also given in the Microsoft documentation:
Grant access from a virtual network
You can configure storage accounts to allow access only from specific subnets. The allowed subnets may belong to a VNet in the same subscription, or those in a different subscription, including subscriptions belonging to a different Azure Active Directory tenant.
Enable a Service endpoint for Azure Storage within the VNet. The service endpoint routes traffic from the VNet through an optimal path to the Azure Storage service. The identities of the subnet and the virtual network are also transmitted with each request. Administrators can then configure network rules for the storage account that allow requests to be received from specific subnets in a VNet. Clients granted access via these network rules must continue to meet the authorization requirements of the storage account to access the data.
Each storage account supports up to 100 virtual network rules, which may be combined with IP network rules.
Since this is clearly given in the Microsoft documentation, all other options are incorrect.
Reference:
https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security

by [deleted] at April 4, 2025, 9:46 a.m.

Comments

Submit Cancel

Currently there are no comments in this discussion, be the first to comment!