Unit 2 capstone — A media archive on a budget
AZ-104 › Unit 2 › Capstone
Unit 2 capstone — A media archive on a budget
Fabrikam Media consolidates its footage
- AZ104-U2
- 3
- 17
- 5
- 25 minutes
The brief
Fabrikam Media holds 400 TB of finished footage and a working set of about 8 TB. A post-production partner needs to pull files from one container for the length of a project, and Fabrikam has been burned before by access that outlived the contract. The archive must survive the loss of a datacenter, but the finance director has refused to pay for a second region. Editors delete the wrong file about once a month. Footage older than ninety days is almost never opened again, and when it is, waiting is acceptable. The application that indexes the archive runs on virtual machines in one subnet, and the storage account currently accepts connections from anywhere.
What they need
- The partner can read one container for the project, and access can be cut off early if the contract ends.
- The archive survives the loss of a datacenter, without paying for a second region.
- A file deleted by an editor can be recovered for at least 30 days.
- Footage older than ninety days moves automatically to the cheapest storage available.
- Only the application's subnet may reach the storage account.
Commit before you read on
Write down your answer to each of the 5 numbered requirements above — the mechanism, and the scope you would apply it at. Then open the working below and compare. Reading the reasoning beside the question is the one way to feel like you knew it without having known it.
▶Show the working
1. Partner reads one container, revocable early
A service SAS issued against a stored access policy on that container.
The scope is one container, so a service SAS fits. But a signature normally stands until it expires, and there is no list of issued signatures to revoke from. A stored access policy is what lets you change the start time, expiry time, or permissions for a SAS, or revoke it after it has been issued. Regenerating the account key would also work and is the wrong answer — it invalidates every signature signed with that key, not just this partner's.
2. Survive a datacenter, not pay for a second region
ZRS.
LRS replicates within a single physical datacenter, so it fails the requirement. GRS and GZRS both copy to a secondary region, which the finance director has ruled out. ZRS copies synchronously across three or more availability zones in the primary region at at least twelve nines of durability — exactly the gap between the two.
3. Recover a deleted file for 30 days
Blob soft delete, retention set to 30 days or more.
Blob soft delete protects an individual blob, snapshot or version from deletion or overwrite, with a retention period between 1 and 365 days. Note what it is not: container soft delete restores a deleted container, not one blob from a live one. And redundancy is not an answer here at all — every redundancy option copies the deletion faithfully.
4. Old footage to the cheapest storage
A lifecycle management rule moving blobs to archive after 90 days — with the consequences stated.
Archive is the cheapest tier and the requirement allows waiting, so it fits. Three consequences have to be accepted with it: data in the archive tier should be stored for a minimum of 180 days or an early deletion charge applies; a blob in archive cannot be read or modified until it is rehydrated, which can take up to 15 hours; and ⚠ you cannot rehydrate using a lifecycle policy — the policy can put footage into archive but cannot bring it back out. Also: a rule change takes up to 24 hours to take effect.
5. Only the application's subnet
Storage firewall rules restricted to that subnet, reached by a service endpoint or private endpoint.
Start from the default: storage accounts allow connections from any network until you change it, and once you select networks, subnets receive a 403 until a rule allows them. Then the trap — if Fabrikam uses a service endpoint, source addresses switch from public to private, and existing service firewall rules written against public IPs stop working. If anything else reaches this account by public IP allowance, that breaks the moment the endpoint is enabled.
The reasoning this unit rewards
Check yourself
Where these figures come from
Every figure above was read from the raw documentation below on the day this sheet was written. The sha1 is git hash-object over the bytes as fetched, so a doc that changes underneath this sheet can be detected rather than assumed.
| Document | sha1 |
|---|---|
| Create a stored access policy | b3ae20db97dd |
| Azure Storage redundancy | c09bcf4095c8 |
| Soft delete for blobs | c0acd68a6998 |
| Access tiers for blob data | 78c82ab0e7da |
| Optimize costs by automatically managing the data lifecycle | a6e60139abfb |
| Configure Azure Storage firewalls and virtual networks | a1bf219c7533 |
| Virtual network service endpoints | 62733fb4a7e8 |