AZ-800 Private Link and Endpoints 4

Question 1

You want to use Azure Private DNS Resolver to forward private endpoint DNS queries from on-premises to Azure. What must you deploy?

Accepted Answer

An inbound endpoint in the VNet linked to the private DNS zone

Answer

An outbound endpoint forwarding to on-premises DNS

Answer

A conditional forwarder on Azure DNS only

Answer

A VPN gateway with BGP enabled

Question 2

A Private Link Service requires NAT IP configuration. What is the purpose of the NAT IP in this context?

Accepted Answer

It translates the consumer's source IP to avoid address overlap with the provider VNet

Answer

It provides a public IP for the service to receive inbound internet traffic

Answer

It assigns a static IP to the Private Link Service for DNS resolution

Answer

It routes traffic from the provider to the Standard Load Balancer backend pool

Question 3

Which Azure CLI command correctly creates a Private Endpoint for an Azure SQL server named 'mysqlserver' in resource group 'myRG'?

Accepted Answer

az network private-endpoint create --connection-name myConn --private-connection-resource-id /subscriptions/.../servers/mysqlserver --group-id sqlServer

Answer

az network vnet subnet update --name mySubnet --disable-private-endpoint-network-policies true

Answer

az sql server private-endpoint create --server-name mysqlserver --subnet mySubnet

Answer

az network private-link-service create --name myPLS --lb-frontend-ip-configs myFrontend

Question 4

After creating a Private Endpoint for Azure Service Bus, which private DNS zone name should be used?

Accepted Answer

privatelink.servicebus.windows.net

Answer

privatelink.servicebus.azure.com

Answer

privatelink.azure.servicebus.net

Answer

privatelink.namespace.servicebus.net

Question 5

A multi-tenant SaaS provider wants to expose their service via Private Link without revealing their VNet IP addressing to consumers. Which Private Link feature achieves this?

Accepted Answer

The Private Endpoint NIC uses only the consumer's IP space

Answer

The NAT IP on the Private Link Service hides the provider's internal IPs

Answer

Service Endpoint Policies mask the provider's address space

Answer

Azure Firewall Premium performs IP masking automatically

Question 6

You have an Azure Container Registry with a Private Endpoint. A GitHub Actions runner hosted on Azure VM pulls images but fails with 'unauthorized'. The NSG allows port 443. What is the most likely issue?

Accepted Answer

The private DNS zone for ACR is not linked to the VM's VNet

Answer

The VM's managed identity lacks AcrPull role on the registry

Answer

Container Registry does not support Private Endpoints

Answer

The runner must use a service principal instead of managed identity

Question 7

How many Private Endpoints can a single Azure Private Link Service support by default?

Accepted Answer

Up to 1,000 private endpoints

Answer

Up to 10 private endpoints

Answer

Up to 100 private endpoints

Answer

Unlimited private endpoints