Implement and Manage Storage Flashcards
Configure access to storage, configure and manage storage accounts, azure files/blobs
Why should you name a storage account well and uniquely?
The storage account name is included in the URL for any storage, and must be globally unique because of this.
What are the three(fourish) storage redundancy options?
GRS = geo-redundant storage -> Puts data in another region
LRS = Locally redundant storage -> 3 copies in the same region
ZRS = Zone redundant -> distributed into different datacenters in the same region
RA-GRS = GRS + another endpoint to read data from
What are the four storage tiers?
Hot tier - Acessed or modified frequently. highest storage costs, but the lowest access costs.
Cool tier - Infrequently accessed or modified. Should be stored for a minimum of 30 days. Lower storage costs and higher access costs compared to the hot tier.
Cold tier - Rarely accessed or modified, but still requires fast retrieval. Should be stored for a minimum of 90 days. The cold tier has lower storage costs and higher access costs compared to the cool tier.
Archive tier - Rarely accessed, and that has flexible latency requirements, on the order of hours. Stored for a minimum of 180 days.
By default, what networks are storage accounts accessible from?
All networks!
What are is the routing preference setting in Storage accounts?
MS network Routing = Take path which stays in MS network for as long as possible
In data protection, what does recovery mean?
Protecting from accidental or erroneous deletions, e.g. enabling soft delete.
What is soft delete? and what does it apply to?
Blob soft delete protects an individual blob, snapshot, or version from accidental deletes or overwrites by maintaining the deleted data in the system for a specified period of time. During the retention period, you can restore a soft-deleted object to its state at the time it was deleted. After the retention period has expired, the object is permanently deleted.
In data protection, what does tracking mean?
Versions to track versions of blobs. See changes via a change feed.
Does tracking cost money?
Yes, it accumulates costs via storage as you have multiple versions of the data
In data protection, what concepts are there for access control?
Version level immutability = = ensures a file cannot be modified/deleted for things like log files / security related logs, etc.
Is data in storage accounts encrypted?
Yes, all harddrives storing data are encrypted by default.
You or Microsoft can manage encryption keys.
What are the four core kinds of storage in Azure?
Blob storage = Containers -> Just a box you can put files into.
File Shares = traditional File storage option (eg U/H Drive) -> Capacity of 5TB default limit
Queues = Like a messaging service -> One PC can put a message in the queue, another can read it
Tables=Semi-structured data, the structure is not rigid, but it is structured.
What are storage account access keys?
When you create a storage account, Azure generates two 512-bit storage account access keys for that account. These keys can be used to authorize access to data in your storage account via Shared Key authorization.
What are Shared Access Signature (SAS) tokens? How can they become invalidated?
They are tokens which can be used to fine grained access to individual folders/files.
They can be set to expire.
These tokens are signed by the Storage access keys, and become invalid if those are invalidated.
What should you use instead of access keys and SAS tokens?
Turn off the “allow storage account key access” setting, revoking permissions of the
access keys.
Turn on the “Default to Microsoft Entra authorization in the Azure portal” setting.
Then in the storage account in the “access control (IAM)” you can assign roles to people for access to the
storage account.
Assign people/groups access to the blob with particular conditions like can give read access so long a the container doesn’t have “private” in the name.
