AZ-700 Private Link and Service Endpoints Flashcards

What is the key difference between service endpoints and private endpoints?

Answer: Service endpoints extend the VNet identity to the service but traffic may still use service's public IP; private endpoints assign a private IP directly in the VNet

Service endpoints optimize routing to Azure services over the backbone but the service's public IP is still the destination; private endpoints assign a true private IP inside the VNet.

How many private endpoints can reference the same Private Link resource?

Answer: Multiple private endpoints can connect to the same resource

Multiple private endpoints in different VNets or subscriptions can all connect to the same Private Link resource simultaneously.

Which Azure CLI command enables network policies on a subnet to support NSGs on private endpoints?

Answer: az network vnet subnet update --private-endpoint-network-policies Enabled

The command `az network vnet subnet update --private-endpoint-network-policies Enabled` turns on NSG and UDR enforcement for private endpoint NICs in that subnet.

For which scenario would you choose a private endpoint over a service endpoint?

Answer: When you need a private IP in your VNet and want to block all public access to the PaaS resource

Private endpoints are preferred when you need a fully private IP in your VNet and want to disable public network access entirely on the PaaS resource.

What is the purpose of a private DNS zone group on a private endpoint?

Answer: To automatically create and manage DNS records in a linked private DNS zone

A private DNS zone group links a private endpoint to a private DNS zone and automatically creates/updates the DNS A record when the endpoint is created or deleted.

Which of the following services natively supports Azure Private Link?

Answer: Azure SQL Database

Azure SQL Database natively supports Private Link, allowing you to create a private endpoint so your VNet can connect to SQL over a private IP.