AZ-800 - Microsoft Azure Networking Solutions Private Link and Endpoints Questions and Answers — Questions and Answers
Question 1: An organization wants to provide secure access to an Azure SQL Database from a virtual machine (VM) located in an Azure Virtual Network (VNet). The security policy mandates that the database must not be accessible over the public internet and all traffic must remain on the Microsoft backbone network. Which Azure networking component should be implemented?
- A VNet service endpoint for Azure SQL.
- An Azure Private Endpoint for the SQL Database. (Correct answer)
- A Network Security Group (NSG) rule to deny internet access.
- An Azure Application Gateway with a Web Application Firewall (WAF).
Correct answer: An Azure Private Endpoint for the SQL Database.
An Azure Private Endpoint is a network interface that connects you privately and securely to a service powered by Azure Private Link, like Azure SQL Database. It uses a private IP address from your VNet, effectively bringing the service into your VNet and ensuring traffic never traverses the public internet.
Question 2: A software company has developed a multi-tenant application running on virtual machines behind a Standard Load Balancer. They need to provide dedicated, private access to this application for a partner company that operates in a separate Azure tenant. Which Azure service is designed to expose this application privately to the partner without using VNet peering or VPNs?
- Azure ExpressRoute
- Azure Firewall
- Azure Private Link Service (Correct answer)
- Azure Virtual WAN
Correct answer: Azure Private Link Service
Azure Private Link Service is the correct solution. It allows you to expose a service running behind a Standard Load Balancer to consumers in other VNets, subscriptions, or even different Azure AD tenants. The consumer can then create a private endpoint in their VNet to connect to the service securely over the Microsoft backbone.
Question 3: When you configure a private endpoint for an Azure Storage Account, what is the primary role of an Azure Private DNS Zone?
- To block public DNS queries for the storage account's public endpoint.
- To host the public DNS records for all Azure services.
- To enable on-premises clients to connect without a VPN or ExpressRoute.
- To override public DNS resolution and resolve the storage account's FQDN to its private IP address within the VNet. (Correct answer)
Correct answer: To override public DNS resolution and resolve the storage account's FQDN to its private IP address within the VNet.
For a private endpoint to work seamlessly, clients in the VNet must resolve the service's public FQDN (e.g., `mystorage.blob.core.windows.net`) to the private IP address of the private endpoint. An Azure Private DNS Zone (e.g., `privatelink.blob.core.windows.net`) linked to the VNet is used to host the 'A' record that maps the FQDN to the private IP, overriding the public DNS CNAME record.
Question 4: An administrator needs to provide access to an Azure Storage account from an on-premises network connected via ExpressRoute. They are evaluating both Service Endpoints and Private Endpoints. Which of the following is a key advantage of using a Private Endpoint in this scenario?
- A Private Endpoint does not require a private DNS zone for name resolution.
- A Private Endpoint is less expensive to implement than a Service Endpoint.
- A Private Endpoint enables access from on-premises networks, whereas a Service Endpoint does not. (Correct answer)
- A Private Endpoint uses the public IP address of the storage account for enhanced compatibility.
Correct answer: A Private Endpoint enables access from on-premises networks, whereas a Service Endpoint does not.
A primary advantage of Private Endpoints is their ability to be accessed from on-premises networks through ExpressRoute or VPN tunnels, as well as from peered VNets. Service Endpoints only secure traffic from within a specific Azure VNet and do not provide a path for on-premises access.
Question 5: When an Azure Private Endpoint is created within a consumer's virtual network, which specific resource is provisioned in that VNet to facilitate the private connection?
- A virtual network gateway
- A network interface (NIC) (Correct answer)
- A public IP address
- A load balancer rule
Correct answer: A network interface (NIC)
A private endpoint is fundamentally a network interface (NIC) that is created within a subnet of the consumer's virtual network. This NIC is assigned a private IP address from that subnet's address space and acts as the entry point for traffic destined for the privately-linked Azure service.
Question 6: Which of the following statements accurately distinguishes an Azure Private Endpoint from an Azure Service Endpoint?
- Service Endpoints bring the PaaS service into the VNet with a private IP, while Private Endpoints secure the route to the service's public IP.
- Private Endpoints support Network Security Groups (NSGs), while Service Endpoints do not.
- Private Endpoints bring the PaaS service into the VNet with a private IP, while Service Endpoints provide a secure, direct route to the service's public IP over the Azure backbone. (Correct answer)
- Service Endpoints are used to connect to IaaS services, while Private Endpoints are used exclusively for PaaS services.
Correct answer: Private Endpoints bring the PaaS service into the VNet with a private IP, while Service Endpoints provide a secure, direct route to the service's public IP over the Azure backbone.
The core difference is that a Private Endpoint provisions a network interface in your VNet with a private IP address, making the PaaS service appear as a native VNet resource. A Service Endpoint, however, extends the VNet's identity to the service, allowing you to secure the service's public endpoint to your VNet, but communication is still directed at the public IP address of the service.
AZ-800 - Microsoft Azure Networking Solutions Private Link and Endpoints Questions and Answers
An organization wants to provide secure access to an Azure SQL Database from a virtual machine (VM) located in an Azure Virtual Network (VNet).
The security policy mandates that the database must not be accessible over the public internet and all traffic must remain on the Microsoft backbone network.
Which Azure networking component should be implemented?