AZ-800 Private Link and Endpoints 5

Question 1

A company uses Azure Policy to audit resources. Which built-in policy definition helps ensure that Azure PaaS services use Private Endpoints instead of public access?

Accepted Answer

Audit Public Network Access on Azure PaaS services

Answer

Deny Network Security Group associations

Answer

Require Service Endpoints on all subnets

Answer

Enforce Azure Firewall on all VNets

Question 2

When configuring a Private Endpoint, the 'group ID' (also called subresource) determines what?

Accepted Answer

The specific sub-service of the target Azure resource that the endpoint connects to

Answer

The resource group where the endpoint is deployed

Answer

The number of IP addresses allocated to the endpoint NIC

Answer

The Azure AD group that has access to the endpoint

Question 3

A spoke VNet uses a custom DNS server (Azure VM). The custom DNS server is in the hub VNet. Private Endpoints are in the hub. Spoke VMs cannot resolve private endpoint FQDNs. What is the recommended fix?

Accepted Answer

Configure the custom DNS server to forward private endpoint queries to Azure's 168.63.129.16

Answer

Move private endpoints to each spoke VNet

Answer

Add a conditional forwarder on spoke VMs pointing to the hub DNS server

Answer

Enable DNS proxy on Azure Firewall in the spoke VNet

Question 4

You need to monitor all connection attempts to a Private Endpoint. Which Azure service provides this visibility?

Accepted Answer

Azure Monitor with NSG flow logs on the private endpoint subnet

Answer

Azure Advisor recommendations

Answer

Azure Cost Management usage logs

Answer

Azure Service Health alerts

Question 5

An Azure Event Hub namespace has both a Private Endpoint and public network access enabled. A client outside Azure attempts to connect. What happens?

Accepted Answer

The connection uses the public endpoint since public access is still enabled

Answer

The connection is automatically routed through the Private Endpoint

Answer

The connection is blocked regardless of public access setting

Answer

The connection fails because dual-access mode is unsupported

Question 6

Which pricing component is associated with Azure Private Link when using Private Endpoints to connect to Azure PaaS services?

Accepted Answer

You pay per Private Endpoint hour plus per GB of data processed

Answer

Private Endpoints to Azure PaaS services are completely free

Answer

You pay only for the VNet peering bandwidth consumed

Answer

You pay a flat monthly fee per Azure service connected

Question 7

A Private Endpoint connection is in 'Pending' state. What does this indicate?

Accepted Answer

The service provider has not yet approved the connection request

Answer

The Private Endpoint NIC is not yet assigned an IP address

Answer

The private DNS zone record has not propagated yet

Answer

The subnet lacks sufficient available IP addresses