AZ-800 Private Link and Endpoints 2

Question 1

A company wants to access Azure SQL Database from an on-premises network over ExpressRoute without traversing the public internet. Which feature enables this?

Accepted Answer

Private Endpoint with private DNS zone

Answer

Service Endpoint with route filter

Answer

VNet peering with gateway transit

Answer

NAT Gateway with public IP

Question 2

When you create a Private Endpoint for an Azure Storage account, what DNS record is automatically created in the private DNS zone?

Accepted Answer

An A record mapping the storage FQDN to the private IP

Answer

A CNAME pointing to the storage public FQDN

Answer

An MX record for mail routing

Answer

A PTR record only

Question 3

Which Azure Private Link component allows you to expose your own service hosted behind a Standard Load Balancer to other VNets or tenants?

Accepted Answer

Private Link Service

Answer

Private Endpoint

Answer

Service Endpoint Policy

Answer

Azure Firewall Private IP

Question 4

A Private Endpoint has been deployed but DNS resolution still returns the public IP of the Azure service. What is the most likely cause?

Accepted Answer

The private DNS zone is not linked to the VNet

Answer

The NSG on the subnet is blocking port 443

Answer

The service endpoint is overriding private endpoint

Answer

The private endpoint NIC has no IP configuration

Question 5

You need to allow a Private Link Service consumer to connect automatically without approval. Which approval method should you configure?

Accepted Answer

Automatic approval using subscription allow-listing

Answer

Role-based access control approval

Answer

Manual approval with email notification

Answer

Active Directory group-based approval

Question 6

Which network policy must be DISABLED on a subnet before you can deploy a Private Endpoint into it?

Accepted Answer

Private endpoint network policies

Answer

Service endpoint policies

Answer

Network security group flow logs

Answer

Route table UDR policies

Question 7

An organization has a hub-and-spoke topology. Private Endpoints are deployed in the hub VNet. Spoke VNets are peered to the hub. What additional configuration ensures spoke VMs resolve private endpoint FQDNs correctly?

Accepted Answer

Add spoke VNet links to the private DNS zone

Answer

Deploy separate Private Endpoints in each spoke

Answer

Enable BGP route propagation on spoke route tables

Answer

Configure Azure DNS forwarder only in hub VNet