AZ-700 AZ-700 Private Link and Service Endpoints 2 — Questions and Answers
Question 1: What do service endpoint policies allow you to do?
- Block all outbound traffic from a subnet
- Restrict VNet service endpoint access to specific Azure Storage accounts (Correct answer)
- Enable private DNS resolution for service endpoints
- Apply NSG rules to service endpoint traffic
Correct answer: Restrict VNet service endpoint access to specific Azure Storage accounts
Service endpoint policies let you filter outbound VNet traffic to Azure Storage, allowing access only to specific storage accounts rather than all accounts.
Question 2: By default, what is the state of network policies for private endpoints on a subnet?
- Enabled
- Disabled (Correct answer)
- Inherited from VNet
- Configured by Azure Policy
Correct answer: Disabled
Network policies (such as NSG and UDR support) for private endpoints are disabled by default on subnets and must be explicitly enabled.
Question 3: Which type of load balancer is required to create an Azure Private Link service exposing your own application?
- Basic Internal Load Balancer
- Basic Public Load Balancer
- Standard Internal Load Balancer (Correct answer)
- Application Gateway
Correct answer: Standard Internal Load Balancer
Azure Private Link service requires a Standard tier internal load balancer as the frontend to expose your service privately to consumers.
Question 4: Can private endpoints be used to access services across different Azure Active Directory tenants?
- No, private endpoints only work within a single AAD tenant
- Yes, but only with automatic approval
- Yes, with manual approval by the resource owner (Correct answer)
- Yes, but only within the same subscription
Correct answer: Yes, with manual approval by the resource owner
Cross-tenant private endpoint connections are supported but require manual approval from the resource owner in the other tenant.
Question 5: What does Azure Private Link Center provide?
- A billing dashboard for Private Link data transfer costs
- Centralized monitoring and management for private endpoints and Private Link services (Correct answer)
- A DNS configuration wizard for private endpoints
- BGP route tables for Private Link traffic
Correct answer: Centralized monitoring and management for private endpoints and Private Link services
Azure Private Link Center is a portal hub that gives you a unified view for monitoring, managing, and auditing all private endpoints and Private Link services in your subscription.
Question 6: Which statement about application security groups (ASGs) and private endpoints is correct?
- ASGs cannot be used with private endpoints
- ASGs can be applied to private endpoint NICs to simplify NSG rules (Correct answer)
- ASGs replace private DNS zones for private endpoints
- ASGs are required for all private endpoint deployments
Correct answer: ASGs can be applied to private endpoint NICs to simplify NSG rules
Once network policies are enabled on a subnet, ASGs can be associated with private endpoint NICs, allowing you to reference them in NSG rules instead of individual IPs.
AZ-700 AZ-700 Private Link and Service Endpoints 2
What do service endpoint policies allow you to do?