AZ-700 Private Endpoints and Private Link 2 — Questions and Answers
Question 1: What DNS change is required to ensure Azure resources resolve a Private Endpoint's private IP instead of the service's public IP?
- Update the service's A record in Azure DNS public zone
- Create a Private DNS Zone for the service and link it to the VNet (Correct answer)
- Add a static host file entry on each VM
- Configure a custom DNS server with a stub zone
Correct answer: Create a Private DNS Zone for the service and link it to the VNet
Creating a Private DNS Zone (e.g., privatelink.blob.core.windows.net) and linking it to the VNet overrides public DNS resolution with the private endpoint's IP.
Question 2: How does a Private Endpoint affect network security for an Azure PaaS service?
- It removes the need for NSGs on the VNet
- It allows the service to be accessed from the private IP and can be used alongside firewall rules to disable public access (Correct answer)
- It automatically enables Advanced Threat Protection
- It replaces role-based access control
Correct answer: It allows the service to be accessed from the private IP and can be used alongside firewall rules to disable public access
Private Endpoints provide a private IP path and can be combined with disabling public network access on the service to ensure all traffic is private.
Question 3: Which feature allows you to use a single Private Endpoint to access multiple services behind the same Private Link Service?
- This is not supported — one endpoint per service
- Sub-resources (group IDs) allow targeting specific service sub-components (Correct answer)
- Private Link multiplexing
- Shared Private Link pools
Correct answer: Sub-resources (group IDs) allow targeting specific service sub-components
Some services expose multiple sub-resources (group IDs); you create separate Private Endpoints for each sub-resource (e.g., blob vs. file for Storage Account).
Question 4: What happens to a Private Endpoint if the linked Azure resource (e.g., storage account) is deleted?
- The Private Endpoint is automatically deleted as well
- The Private Endpoint remains and shows a 'disconnected' state (Correct answer)
- The Private Endpoint is reassigned to the next available resource
- Azure prevents deletion of the resource while a Private Endpoint exists
Correct answer: The Private Endpoint remains and shows a 'disconnected' state
When the underlying resource is deleted, the associated Private Endpoint enters a 'disconnected' state and must be manually deleted.
Question 5: Which Azure tool can you use to audit all Private Endpoint connections and their approval status across your subscription?
- Azure Monitor Logs
- Azure Policy compliance dashboard
- The Private Link Center in the Azure portal (Correct answer)
- Azure Security Center
Correct answer: The Private Link Center in the Azure portal
The Azure Private Link Center provides a centralized view of all Private Endpoints and Private Link Services, including connection approval status.
Question 6: Can a Private Endpoint be accessed from an on-premises network connected via ExpressRoute or VPN?
- No — Private Endpoints are restricted to Azure VNets only
- Yes — on-premises clients can reach Private Endpoints via ExpressRoute or VPN with proper DNS forwarding (Correct answer)
- Yes — but only with ExpressRoute Premium
- Only if the on-premises network uses Azure AD-joined devices
Correct answer: Yes — on-premises clients can reach Private Endpoints via ExpressRoute or VPN with proper DNS forwarding
On-premises clients can access Private Endpoints over ExpressRoute or VPN; DNS must be configured to resolve the privatelink FQDN to the private IP.
AZ-700 Private Endpoints and Private Link 2
What DNS change is required to ensure Azure resources resolve a Private Endpoint's private IP instead of the service's public IP?