Configure access to storage
Objective configure.access-to-storage sits in Implement and manage storage, which carries 19% of the Azure Administrator exam. The questions below are original, written from the official objective title above, and each explanation cites the Microsoft Azure page it rests on.
Objective title verbatim from the official objectives. Microsoft Azure exam page ↗
A worked example
Shown solved, with the whole explanation open: this is what every question here carries.
A firm needs private access to one specific Azure Storage account from both their virtual network and their on-premises network, without exposing the account over a public endpoint. Which option satisfies both requirements together?
The concept
Two different problems hide behind the phrase private access to storage. Extending a virtual network's identity to a service still routes over that service's public endpoint and only serves callers inside the network. Reaching one named resource privately, including from on-premises, needs a different mechanism.
Why this answer
Because the requirement includes on-premises access to one specific instance without a public endpoint, Private Link is the option built for that combination, unlike service endpoints which only cover the virtual network side.
- AService endpoints extend the vnet's identity to the service but still route over the service's public endpoint and do not cover on-premises access, so this fails the private on-premises requirement.
- Correct: Private Link privately reaches a specific service instance from both the virtual network and on-premises networks.
- CPeering only connects two virtual networks to each other, it does not provide private access to a storage service instance or to on-premises networks.
- DA network virtual appliance performs functions like firewalling or WAN optimization, it does not provide private connectivity to a storage service instance.
- EPoint-to-site VPN connects individual computers to a virtual network, it does not by itself provide private access to a specific storage service instance.
Now you: objective configure.access-to-storage questions
No account needed. The explanation opens when you answer.
Sample question 1 of 3
An administrator wants VMs in a virtual network to reach a storage account using the VNet's private address space and identity, without exposing the storage account to the general internet. Which option should be configured?
Sample question 2 of 3
A company connects its on-premises datacenter to Azure over ExpressRoute. It must let both on-premises servers and VNet resources privately reach one specific storage account instance, not just any account of that resource type. Which option meets this?
Sample question 3 of 3
Which type of shared access signature does Microsoft recommend, and what secures it?
Full Azure Administrator question bank coming
We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.
Read the sources
These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.