AZ-800 AZ-800 - Microsoft Azure Networking Solutions Azure Bastion and DDoS Protection Questions and Answers 3

Question 1

What is the main difference between a Service Endpoint and Azure Private Link for securing access to Azure PaaS services?

Accepted Answer

Service Endpoints route traffic over the Azure backbone but keep the PaaS public IP; Private Link assigns a private IP in your VNet

Answer

Service Endpoints optimize routing over the Microsoft backbone but the service retains its public endpoint; Private Link maps the service to a private IP inside your VNet.

Question 2

Which subnet-level policy must be enabled to apply NSG rules or UDRs to Private Endpoint network interfaces?

Accepted Answer

Private Endpoint Network Policies

Answer

By default, NSGs and UDRs are bypassed for Private Endpoint NICs; enabling 'Private Endpoint Network Policies' on the subnet allows NSG and UDR enforcement.

Question 3

You enable a Service Endpoint for Microsoft.Storage on a subnet. What is the effect on the Azure Storage firewall?

Accepted Answer

You can configure the Storage account firewall to allow only that subnet, blocking all other access including public internet

Answer

Enabling a Service Endpoint allows the Storage account's firewall to whitelist specific VNet subnets, restricting access to only those subnets and optionally blocking public internet.

Question 4

A Private Endpoint is deployed for an Azure SQL Database. Which DNS change is needed to ensure VNet clients resolve to the private IP?

Accepted Answer

Create an Azure Private DNS Zone for privatelink.database.windows.net and link it to the VNet

Answer

Azure recommends using a Private DNS Zone for the privatelink.database.windows.net zone linked to the VNet so that DNS queries from VNet clients resolve to the private IP.

Question 5

Which feature allows you to use Service Endpoint Policies to restrict a subnet's Service Endpoint access to only specific Azure Storage accounts?

Accepted Answer

Service Endpoint Policies for Azure Storage

Answer

Service Endpoint Policies let you specify exact Azure resource identifiers (e.g., specific storage accounts) so a subnet's Service Endpoint cannot access other tenants' resources.

AZ-800 - Microsoft Azure Networking Solutions Practice Test

AZ-800 - Microsoft Azure Networking Solutions Practice Test

AZ-800 AZ-800 - Microsoft Azure Networking Solutions Azure Bastion and DDoS Protection Questions and Answers 3