AZ-800 Private Link and Endpoints 5 — Questions and Answers
Question 1: A company uses Azure Policy to audit resources. Which built-in policy definition helps ensure that Azure PaaS services use Private Endpoints instead of public access?
- Audit Public Network Access on Azure PaaS services (Correct answer)
- Deny Network Security Group associations
- Require Service Endpoints on all subnets
- Enforce Azure Firewall on all VNets
Correct answer: Audit Public Network Access on Azure PaaS services
Azure Policy includes built-in definitions that audit or deny public network access on PaaS services, encouraging or enforcing the use of Private Endpoints.
Question 2: When configuring a Private Endpoint, the 'group ID' (also called subresource) determines what?
- The resource group where the endpoint is deployed
- The specific sub-service of the target Azure resource that the endpoint connects to (Correct answer)
- The number of IP addresses allocated to the endpoint NIC
- The Azure AD group that has access to the endpoint
Correct answer: The specific sub-service of the target Azure resource that the endpoint connects to
The group ID specifies which sub-service of the target Azure resource the Private Endpoint connects to, such as 'blob', 'sql', or 'vault' for storage, SQL, and Key Vault respectively.
Question 3: A spoke VNet uses a custom DNS server (Azure VM). The custom DNS server is in the hub VNet. Private Endpoints are in the hub. Spoke VMs cannot resolve private endpoint FQDNs. What is the recommended fix?
- Move private endpoints to each spoke VNet
- Configure the custom DNS server to forward private endpoint queries to Azure's 168.63.129.16 (Correct answer)
- Add a conditional forwarder on spoke VMs pointing to the hub DNS server
- Enable DNS proxy on Azure Firewall in the spoke VNet
Correct answer: Configure the custom DNS server to forward private endpoint queries to Azure's 168.63.129.16
The custom DNS server should forward queries for the privatelink zones to Azure's platform DNS (168.63.129.16) so it can resolve private endpoint IPs using the linked private DNS zones.
Question 4: You need to monitor all connection attempts to a Private Endpoint. Which Azure service provides this visibility?
- Azure Monitor with NSG flow logs on the private endpoint subnet (Correct answer)
- Azure Advisor recommendations
- Azure Cost Management usage logs
- Azure Service Health alerts
Correct answer: Azure Monitor with NSG flow logs on the private endpoint subnet
Enabling NSG flow logs on the subnet containing the Private Endpoint and sending them to Azure Monitor or Log Analytics provides visibility into connection attempts and traffic patterns.
Question 5: An Azure Event Hub namespace has both a Private Endpoint and public network access enabled. A client outside Azure attempts to connect. What happens?
- The connection is automatically routed through the Private Endpoint
- The connection uses the public endpoint since public access is still enabled (Correct answer)
- The connection is blocked regardless of public access setting
- The connection fails because dual-access mode is unsupported
Correct answer: The connection uses the public endpoint since public access is still enabled
When public network access is enabled alongside a Private Endpoint, external clients can still connect via the public endpoint; Private Endpoint and public access are not mutually exclusive unless public access is explicitly disabled.
Question 6: Which pricing component is associated with Azure Private Link when using Private Endpoints to connect to Azure PaaS services?
- You pay per Private Endpoint hour plus per GB of data processed (Correct answer)
- Private Endpoints to Azure PaaS services are completely free
- You pay only for the VNet peering bandwidth consumed
- You pay a flat monthly fee per Azure service connected
Correct answer: You pay per Private Endpoint hour plus per GB of data processed
Azure Private Endpoint billing includes an hourly charge per endpoint and a data processing charge per GB of inbound and outbound traffic through the endpoint.
Question 7: A Private Endpoint connection is in 'Pending' state. What does this indicate?
- The Private Endpoint NIC is not yet assigned an IP address
- The service provider has not yet approved the connection request (Correct answer)
- The private DNS zone record has not propagated yet
- The subnet lacks sufficient available IP addresses
Correct answer: The service provider has not yet approved the connection request
A 'Pending' connection state means the Private Link Service or PaaS resource owner has not yet approved the incoming private endpoint connection request.
AZ-800 Private Link and Endpoints 5
A company uses Azure Policy to audit resources.
Which built-in policy definition helps ensure that Azure PaaS services use Private Endpoints instead of public access?