AZ-800 Private Link and Endpoints 4 — Questions and Answers
Question 1: You want to use Azure Private DNS Resolver to forward private endpoint DNS queries from on-premises to Azure. What must you deploy?
- An inbound endpoint in the VNet linked to the private DNS zone (Correct answer)
- An outbound endpoint forwarding to on-premises DNS
- A conditional forwarder on Azure DNS only
- A VPN gateway with BGP enabled
Correct answer: An inbound endpoint in the VNet linked to the private DNS zone
The Azure DNS Private Resolver inbound endpoint provides an IP in your VNet that on-premises DNS servers can forward queries to, which then resolve via Azure private DNS zones.
Question 2: A Private Link Service requires NAT IP configuration. What is the purpose of the NAT IP in this context?
- It translates the consumer's source IP to avoid address overlap with the provider VNet (Correct answer)
- It provides a public IP for the service to receive inbound internet traffic
- It assigns a static IP to the Private Link Service for DNS resolution
- It routes traffic from the provider to the Standard Load Balancer backend pool
Correct answer: It translates the consumer's source IP to avoid address overlap with the provider VNet
The NAT IP performs SNAT on consumer traffic so the provider network sees a private IP from its own address space, avoiding IP conflicts between consumer and provider VNets.
Question 3: Which Azure CLI command correctly creates a Private Endpoint for an Azure SQL server named 'mysqlserver' in resource group 'myRG'?
- az network private-endpoint create --connection-name myConn --private-connection-resource-id /subscriptions/.../servers/mysqlserver --group-id sqlServer (Correct answer)
- az network vnet subnet update --name mySubnet --disable-private-endpoint-network-policies true
- az sql server private-endpoint create --server-name mysqlserver --subnet mySubnet
- az network private-link-service create --name myPLS --lb-frontend-ip-configs myFrontend
Correct answer: az network private-endpoint create --connection-name myConn --private-connection-resource-id /subscriptions/.../servers/mysqlserver --group-id sqlServer
The 'az network private-endpoint create' command with --private-connection-resource-id and --group-id is the correct syntax to create a Private Endpoint for an Azure SQL server.
Question 4: After creating a Private Endpoint for Azure Service Bus, which private DNS zone name should be used?
- privatelink.servicebus.windows.net (Correct answer)
- privatelink.servicebus.azure.com
- privatelink.azure.servicebus.net
- privatelink.namespace.servicebus.net
Correct answer: privatelink.servicebus.windows.net
Azure Service Bus uses the private DNS zone 'privatelink.servicebus.windows.net' for Private Endpoint DNS resolution.
Question 5: A multi-tenant SaaS provider wants to expose their service via Private Link without revealing their VNet IP addressing to consumers. Which Private Link feature achieves this?
- The NAT IP on the Private Link Service hides the provider's internal IPs
- The Private Endpoint NIC uses only the consumer's IP space (Correct answer)
- Service Endpoint Policies mask the provider's address space
- Azure Firewall Premium performs IP masking automatically
Correct answer: The Private Endpoint NIC uses only the consumer's IP space
Since the Private Endpoint NIC receives an IP from the consumer's own VNet address space, consumers never see or route to the provider's internal IP addresses.
Question 6: You have an Azure Container Registry with a Private Endpoint. A GitHub Actions runner hosted on Azure VM pulls images but fails with 'unauthorized'. The NSG allows port 443. What is the most likely issue?
- The VM's managed identity lacks AcrPull role on the registry
- The private DNS zone for ACR is not linked to the VM's VNet (Correct answer)
- Container Registry does not support Private Endpoints
- The runner must use a service principal instead of managed identity
Correct answer: The private DNS zone for ACR is not linked to the VM's VNet
Even though the VM can reach port 443, if the private DNS zone privatelink.azurecr.io is not linked to the VM's VNet, DNS resolves to the public IP and the private endpoint is bypassed, causing auth to fail at the firewall.
Question 7: How many Private Endpoints can a single Azure Private Link Service support by default?
- Up to 10 private endpoints
- Up to 100 private endpoints
- Up to 1,000 private endpoints (Correct answer)
- Unlimited private endpoints
Correct answer: Up to 1,000 private endpoints
By default, a single Azure Private Link Service supports up to 1,000 private endpoint connections, though this limit can be increased via a support request.
AZ-800 Private Link and Endpoints 4
You want to use Azure Private DNS Resolver to forward private endpoint DNS queries from on-premises to Azure.
What must you deploy?