AZ-700 Private Endpoints and Private Link 1 — Questions and Answers
Question 1: What is an Azure Private Endpoint?
- A public IP address assigned to an Azure PaaS service
- A network interface with a private IP that connects to an Azure service via Private Link (Correct answer)
- A VNet peering connection to a PaaS service
- A DNS alias for an Azure service
Correct answer: A network interface with a private IP that connects to an Azure service via Private Link
A Private Endpoint is a NIC with a private IP from your VNet subnet, connected to an Azure service through the Private Link service.
Question 2: Which Azure service lets you expose your own application (running behind an Azure Standard Load Balancer) to other VNets using Private Link?
- Azure Private Endpoint
- Azure Private Link Service (Correct answer)
- Azure Service Endpoint
- Azure VNet Integration
Correct answer: Azure Private Link Service
Azure Private Link Service allows you to publish your own application behind a Standard Load Balancer so consumers can connect via private endpoints in their VNets.
Question 3: When a Private Endpoint is created, what network policy must be disabled on the subnet to allow the private IP assignment?
- Network Security Group policies
- Private endpoint network policies (PrivateEndpointNetworkPolicies) (Correct answer)
- Route table policies
- Service endpoint policies
Correct answer: Private endpoint network policies (PrivateEndpointNetworkPolicies)
The subnet property 'PrivateEndpointNetworkPolicies' must be set to Disabled to allow private endpoints to be deployed in that subnet.
Question 4: What connection approval model allows a Private Link consumer to connect without requiring explicit approval from the provider?
- Manual approval
- Auto-approval (Correct answer)
- Role-based approval
- Cross-tenant approval
Correct answer: Auto-approval
Auto-approval is configured by the Private Link Service provider to automatically approve connection requests from specific subscriptions.
Question 5: Which statement is TRUE about network traffic flowing through a Private Endpoint?
- Traffic traverses the public internet with encryption
- Traffic stays entirely within the Microsoft backbone and never crosses the public internet (Correct answer)
- Traffic is routed through Azure Firewall by default
- Traffic uses BGP routing over ExpressRoute
Correct answer: Traffic stays entirely within the Microsoft backbone and never crosses the public internet
Private Endpoint traffic remains on the Microsoft global network, never crossing the public internet, providing a private and secure path to Azure services.
Question 6: Which Azure PaaS services natively support Private Endpoints? (Select the most comprehensive answer)
- Only Azure Storage and Azure SQL Database
- Only Azure Key Vault and Azure Cosmos DB
- A wide range including Storage, SQL, Key Vault, App Service, ACR, Event Hubs, and more (Correct answer)
- Only first-party Microsoft services in the East US region
Correct answer: A wide range including Storage, SQL, Key Vault, App Service, ACR, Event Hubs, and more
Azure Private Endpoints are supported by a broad and growing list of Azure services including Storage, SQL, Key Vault, App Service, ACR, Event Hubs, Service Bus, and many others.
AZ-700 Private Endpoints and Private Link 1
What is an Azure Private Endpoint?