AZ-800 Private Link and Endpoints 2 — Questions and Answers
Question 1: A company wants to access Azure SQL Database from an on-premises network over ExpressRoute without traversing the public internet. Which feature enables this?
- Service Endpoint with route filter
- Private Endpoint with private DNS zone (Correct answer)
- VNet peering with gateway transit
- NAT Gateway with public IP
Correct answer: Private Endpoint with private DNS zone
A Private Endpoint assigns a private IP to Azure SQL in your VNet, and combined with a private DNS zone, on-premises traffic via ExpressRoute resolves and routes to the private IP.
Question 2: When you create a Private Endpoint for an Azure Storage account, what DNS record is automatically created in the private DNS zone?
- A CNAME pointing to the storage public FQDN
- An A record mapping the storage FQDN to the private IP (Correct answer)
- An MX record for mail routing
- A PTR record only
Correct answer: An A record mapping the storage FQDN to the private IP
Azure creates an A record in the privatelink DNS zone that maps the storage account FQDN to the private endpoint's private IP address.
Question 3: Which Azure Private Link component allows you to expose your own service hosted behind a Standard Load Balancer to other VNets or tenants?
- Private Endpoint
- Private Link Service (Correct answer)
- Service Endpoint Policy
- Azure Firewall Private IP
Correct answer: Private Link Service
Azure Private Link Service lets you expose your own application behind a Standard Internal Load Balancer so consumers can connect via their own Private Endpoints.
Question 4: A Private Endpoint has been deployed but DNS resolution still returns the public IP of the Azure service. What is the most likely cause?
- The NSG on the subnet is blocking port 443
- The private DNS zone is not linked to the VNet (Correct answer)
- The service endpoint is overriding private endpoint
- The private endpoint NIC has no IP configuration
Correct answer: The private DNS zone is not linked to the VNet
Without a virtual network link on the private DNS zone to the consumer VNet, DNS queries resolve via public DNS and return the public IP instead of the private one.
Question 5: You need to allow a Private Link Service consumer to connect automatically without approval. Which approval method should you configure?
- Role-based access control approval
- Automatic approval using subscription allow-listing (Correct answer)
- Manual approval with email notification
- Active Directory group-based approval
Correct answer: Automatic approval using subscription allow-listing
Private Link Service supports auto-approval by listing specific subscription IDs, so connections from those subscriptions are approved without manual intervention.
Question 6: Which network policy must be DISABLED on a subnet before you can deploy a Private Endpoint into it?
- Service endpoint policies
- Network security group flow logs
- Private endpoint network policies (Correct answer)
- Route table UDR policies
Correct answer: Private endpoint network policies
The 'privateEndpointNetworkPolicies' property on the subnet must be set to Disabled because NSG and UDR enforcement on private endpoint NICs is not supported by default.
Question 7: An organization has a hub-and-spoke topology. Private Endpoints are deployed in the hub VNet. Spoke VNets are peered to the hub. What additional configuration ensures spoke VMs resolve private endpoint FQDNs correctly?
- Add spoke VNet links to the private DNS zone (Correct answer)
- Deploy separate Private Endpoints in each spoke
- Enable BGP route propagation on spoke route tables
- Configure Azure DNS forwarder only in hub VNet
Correct answer: Add spoke VNet links to the private DNS zone
The private DNS zone must have virtual network links added for each spoke VNet so that DNS queries from spoke VMs resolve to the private endpoint IP.
AZ-800 Private Link and Endpoints 2
A company wants to access Azure SQL Database from an on-premises network over ExpressRoute without traversing the public internet.
Which feature enables this?