AZ-800 Private Link and Endpoints 3

Question 1

A customer reports that after enabling a Private Endpoint for Azure Key Vault, their Azure Function (in a different VNet) cannot reach Key Vault.
VNet peering exists between the two VNets.
What should you check first?

Accepted Answer

Whether the private DNS zone is linked to the Function's VNet

Answer

Whether the Function App has a managed identity

Answer

Whether Key Vault firewall allows Azure services

Answer

Whether the peering has UseRemoteGateways enabled

Question 2

Which sub-resource target should you specify when creating a Private Endpoint for an Azure Storage account to allow only Blob access?

Accepted Answer

blob

Answer

storage

Answer

file

Answer

table

Question 3

You have a Private Link Service. A consumer VNet is in a different Azure region. Can they connect via Private Endpoint?

Accepted Answer

Yes, Private Link works across regions

Answer

No, Private Link is region-restricted

Answer

Only if both VNets use the same address space

Answer

Only within the same Azure geography

Question 4

A security team wants to prevent any Private Endpoint from being created that points to storage accounts outside an approved list. Which Azure feature enforces this?

Accepted Answer

Service Endpoint Policies

Answer

Azure Firewall DNAT rules

Answer

NSG application security groups

Answer

Private DNS zone conditional forwarders

Question 5

When inspecting a Private Endpoint NIC in the Azure portal, you notice it has no associated NSG. Why?

Accepted Answer

Private endpoint network policies must be enabled first to attach NSGs

Answer

NSGs must be created separately and cannot attach to endpoint NICs

Answer

NSGs are automatically removed when a private endpoint is created

Answer

Private endpoints always inherit the subnet-level NSG only

Question 6

An Azure Cosmos DB account has a Private Endpoint. A developer queries it from a VM in the same VNet and receives a connection timeout. NSG rules allow port 443 outbound. What should you verify next?

Accepted Answer

Whether the VM subnet has a UDR routing traffic away from the private endpoint IP

Answer

Whether the Cosmos DB account has public network access disabled but the private endpoint is in a different subnet

Answer

Whether the Cosmos DB account tier supports Private Link

Answer

Whether the developer is using the correct SDK version

Question 7

Which Azure Private Link resource type is used by the service CONSUMER rather than the service PROVIDER?

Accepted Answer

Private Endpoint

Answer

Private Link Service

Answer

Standard Internal Load Balancer

Answer

Azure Private DNS Resolver