Exam AZ-500 topic 3 question 53 discussion

Hi Elazari, Thanks for testing the scenario at lab. Need clarification in your 3rd point, ("you have also to enable a service end point to the storage."), Looks you have enabled Service endpoint Vnet3/subnet3 to storage, However this is not the given requirement. Should we consider the answer as 'NO' for 3rd question (VM3 can connect to Storage1?)

Weird that Azure would go against its own documentation: "IP network rules can't be used in the following cases: To restrict access to clients in same Azure region as the storage account. IP network rules have no effect on requests originating from the same Azure region as the storage account. Use Virtual network rules to allow same-region requests. To restrict access to clients in a paired region which are in a VNet that has a service endpoint. To restrict access to Azure services deployed in the same region as the storage account. Services deployed in the same region as the storage account use private Azure IP addresses for communication. Thus, you can't restrict access to specific Azure services based on their public outbound IP address range." https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal

Guys don't fall for this answer. I'm pretty sure that this guy set the lab with incorrect setting. It looks like he configured the Service EP with Storage not with keyvault. It have to be N,Y,N. Without Service EP set to Storage, you can't connect to the storage

VM3 can connect to the storage - at the moment you register the subnet to the storage selected network, ---Correct . service EP configured for key vault at VNET3 .so its not affect storage access.

Agree with you. Answers are correct

Isn't a new Service endpoint created automatically once you whitelist a subnet on the Storage account firewall?

Yes, but not on the same Azure region. The answer is: NO,NO,NO

To access from a VNET to a storage account without using the public IP space, you need both: a rule and a service endpoint Point 1: There is a SERVICE endpoint configured for VNET1. However, the rule does not allow the internal nor the Public IP Point 2: No endpoint so public IP is used which is allowed by the rule Point 3: Rule allows the VNET3 but there is no Service Endpoint. The public IP is not allowed https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal Section: Grant access from a virtual network

Correcting answer its NO YES NO, if I delete the service end point after adding the VNET the access will go away

I meant n, y, y

N-N-Y. Managed to test it in LAB. The change concerns the Box 3: answer is Yes. When you select VNET3\Subnet3, "(Service endpoint required)" will be added after the name of the selected Subnet, and show a disclaimer about the time required to enable the service endpoint.. So the service Endpoint is automatically created when you select subnet which needs it.

("Services deployed in the same region as the storage account use private Azure IP addresses for communication. So, you can't restrict access to specific Azure services based on their public outbound IP address range.")

For the box 3 I am unsure as https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal#grant-access-from-an-internet-ip-range says: "IP network rules have no effect on requests that originate from the same Azure region as the storage account. Use Virtual network rules to allow same-region requests." So maybe that will works...

Service endpoints are used to create a shorter route to direct traffic through Microsoft network not through the internet. You still need to whitelist the IP address of the source machine to access the storage account so the real reason 1 & 3 are No is because of the non IP whitelisting in the storage account firewall.