AZ-700 AZ-700 Private Link and Service Endpoints 1 — Questions and Answers
Question 1: What is the primary purpose of Azure Private Link?
- To connect Azure VNets using peering
- To access Azure PaaS services over a private IP address within your VNet (Correct answer)
- To expose internal services to the public internet
- To configure DNS resolution for Azure services
Correct answer: To access Azure PaaS services over a private IP address within your VNet
Azure Private Link enables you to access Azure PaaS services (like Azure Storage and SQL) through a private endpoint using a private IP in your virtual network.
Question 2: At which level are Azure service endpoints enabled?
- Resource group level
- Subscription level
- Subnet level (Correct answer)
- Virtual network level
Correct answer: Subnet level
Service endpoints are enabled at the subnet level, extending the VNet's identity to Azure services over the Azure backbone network.
Question 3: What type of IP address does a private endpoint use?
- A dynamic public IP assigned by Azure
- A static public IP from Azure's pool
- A private IP address from the VNet address space (Correct answer)
- A link-local address (169.254.x.x)
Correct answer: A private IP address from the VNet address space
A private endpoint is assigned a private IP address from the address space of the virtual network where it is deployed.
Question 4: Which Azure resource is automatically created when you configure a private endpoint?
- A VPN gateway
- A network interface with a private IP (Correct answer)
- A load balancer rule
- A NAT gateway
Correct answer: A network interface with a private IP
Configuring a private endpoint automatically creates a network interface (NIC) with a private IP address in the designated subnet.
Question 5: Why are private DNS zones important when using private endpoints?
- To restrict traffic to specific subnets
- To resolve the service's public FQDN to its private IP address (Correct answer)
- To enable BGP routing for private endpoints
- To assign static IPs to private endpoints
Correct answer: To resolve the service's public FQDN to its private IP address
Private DNS zones are used so that the service's FQDN (e.g., mystorageaccount.blob.core.windows.net) resolves to the private endpoint's private IP instead of the public IP.
Question 6: What are the two connection approval workflow options for a private endpoint?
- Public and Private
- Automatic and Manual (Correct answer)
- Shared and Dedicated
- Push and Pull
Correct answer: Automatic and Manual
Private endpoint connections support Automatic approval (for resources in the same tenant/subscription you control) and Manual approval (requiring explicit acceptance by the resource owner).
AZ-700 AZ-700 Private Link and Service Endpoints 1
What is the primary purpose of Azure Private Link?