AZ-800 AZ-800 - Microsoft Azure Networking Solutions Azure Bastion and DDoS Protection Questions and Answers 3

Question 1

What is the main difference between a Service Endpoint and Azure Private Link for securing access to Azure PaaS services?

Accepted Answer

Service Endpoints route traffic over the Azure backbone but keep the PaaS public IP; Private Link assigns a private IP in your VNet

Answer

Service Endpoints assign a private IP; Private Link uses the public IP

Answer

Service Endpoints only work with Storage; Private Link works with all PaaS services

Answer

Service Endpoints are deprecated in favor of VNet injection

Question 2

Which subnet-level policy must be enabled to apply NSG rules or UDRs to Private Endpoint network interfaces?

Accepted Answer

Private Endpoint Network Policies

Answer

Service Endpoint Policies

Answer

Network Intent Policies

Answer

Subnet Delegation Policies

Question 3

You enable a Service Endpoint for Microsoft.Storage on a subnet. What is the effect on the Azure Storage firewall?

Accepted Answer

You can configure the Storage account firewall to allow only that subnet, blocking all other access including public internet

Answer

The storage account becomes fully private with no public endpoint

Answer

The subnet can access Storage only over port 445

Answer

Service Endpoints have no effect on Storage account firewall rules

Question 4

A Private Endpoint is deployed for an Azure SQL Database. Which DNS change is needed to ensure VNet clients resolve to the private IP?

Accepted Answer

Create an Azure Private DNS Zone for privatelink.database.windows.net and link it to the VNet

Answer

Modify the public DNS record for the SQL server to point to the private IP

Answer

Configure a custom DNS server to return the private IP only for on-premises clients

Answer

No DNS change is needed; Azure automatically redirects all queries

Question 5

Which feature allows you to use Service Endpoint Policies to restrict a subnet's Service Endpoint access to only specific Azure Storage accounts?

Accepted Answer

Service Endpoint Policies for Azure Storage

Answer

NSG service tags with storage account resource IDs

Answer

Azure Firewall FQDN filtering

Answer

Private Link approval policies

Question 6

When a Private Endpoint connection request is made to a privately linked PaaS service in another Azure subscription, what approval step is required?

Accepted Answer

The resource owner in the target subscription must manually approve the Private Endpoint connection

Answer

Approval is automatic if both subscriptions are in the same Azure AD tenant

Answer

A support ticket must be filed with Microsoft to enable cross-subscription Private Link

Answer

No approval is needed; the connection activates immediately