AZ-800 Private Link and Endpoints 3 — Questions and Answers
Question 1: A customer reports that after enabling a Private Endpoint for Azure Key Vault, their Azure Function (in a different VNet) cannot reach Key Vault. VNet peering exists between the two VNets. What should you check first?
- Whether the Function App has a managed identity
- Whether the private DNS zone is linked to the Function's VNet (Correct answer)
- Whether Key Vault firewall allows Azure services
- Whether the peering has UseRemoteGateways enabled
Correct answer: Whether the private DNS zone is linked to the Function's VNet
Even with peering, the Function's VNet must be linked to the privatelink.vaultcore.azure.net DNS zone so DNS resolves the private IP of the Key Vault endpoint.
Question 2: Which sub-resource target should you specify when creating a Private Endpoint for an Azure Storage account to allow only Blob access?
- storage
- blob (Correct answer)
- file
- table
Correct answer: blob
Each storage service (blob, file, queue, table, dfs, web) is a separate sub-resource; specifying 'blob' scopes the Private Endpoint to Blob storage only.
Question 3: You have a Private Link Service. A consumer VNet is in a different Azure region. Can they connect via Private Endpoint?
- No, Private Link is region-restricted
- Yes, Private Link works across regions (Correct answer)
- Only if both VNets use the same address space
- Only within the same Azure geography
Correct answer: Yes, Private Link works across regions
Azure Private Link supports cross-region connections, allowing a Private Endpoint in one region to connect to a Private Link Service in a different region.
Question 4: A security team wants to prevent any Private Endpoint from being created that points to storage accounts outside an approved list. Which Azure feature enforces this?
- Service Endpoint Policies (Correct answer)
- Azure Firewall DNAT rules
- NSG application security groups
- Private DNS zone conditional forwarders
Correct answer: Service Endpoint Policies
Service Endpoint Policies allow you to restrict VNet service endpoint traffic to specific Azure Storage accounts, preventing connections to unauthorized accounts.
Question 5: When inspecting a Private Endpoint NIC in the Azure portal, you notice it has no associated NSG. Why?
- NSGs must be created separately and cannot attach to endpoint NICs
- Private endpoint network policies must be enabled first to attach NSGs (Correct answer)
- NSGs are automatically removed when a private endpoint is created
- Private endpoints always inherit the subnet-level NSG only
Correct answer: Private endpoint network policies must be enabled first to attach NSGs
To apply NSGs or UDRs to private endpoint NICs, the subnet's privateEndpointNetworkPolicies property must be set to Enabled, which is non-default.
Question 6: An Azure Cosmos DB account has a Private Endpoint. A developer queries it from a VM in the same VNet and receives a connection timeout. NSG rules allow port 443 outbound. What should you verify next?
- Whether the Cosmos DB account has public network access disabled but the private endpoint is in a different subnet
- Whether the VM subnet has a UDR routing traffic away from the private endpoint IP (Correct answer)
- Whether the Cosmos DB account tier supports Private Link
- Whether the developer is using the correct SDK version
Correct answer: Whether the VM subnet has a UDR routing traffic away from the private endpoint IP
A UDR on the VM's subnet that routes the private endpoint IP to a next hop other than 'None' or the local VNet can cause traffic to miss the private endpoint.
Question 7: Which Azure Private Link resource type is used by the service CONSUMER rather than the service PROVIDER?
- Private Link Service
- Private Endpoint (Correct answer)
- Standard Internal Load Balancer
- Azure Private DNS Resolver
Correct answer: Private Endpoint
The Private Endpoint is deployed in the consumer's VNet to create a private connection to a provider's service; the Private Link Service is the provider-side component.
AZ-800 Private Link and Endpoints 3
A customer reports that after enabling a Private Endpoint for Azure Key Vault, their Azure Function (in a different VNet) cannot reach Key Vault.
VNet peering exists between the two VNets.
What should you check first?