AZ-800 Private Link and Endpoints 5

Question 1

A company uses Azure Policy to audit resources. Which built-in policy definition helps ensure that Azure PaaS services use Private Endpoints instead of public access?

Accepted Answer

Audit Public Network Access on Azure PaaS services

Answer

Azure Policy includes built-in definitions that audit or deny public network access on PaaS services, encouraging or enforcing the use of Private Endpoints.

Question 2

When configuring a Private Endpoint, the 'group ID' (also called subresource) determines what?

Accepted Answer

The specific sub-service of the target Azure resource that the endpoint connects to

Answer

The group ID specifies which sub-service of the target Azure resource the Private Endpoint connects to, such as 'blob', 'sql', or 'vault' for storage, SQL, and Key Vault respectively.

Question 3

A spoke VNet uses a custom DNS server (Azure VM). The custom DNS server is in the hub VNet. Private Endpoints are in the hub. Spoke VMs cannot resolve private endpoint FQDNs. What is the recommended fix?

Accepted Answer

Configure the custom DNS server to forward private endpoint queries to Azure's 168.63.129.16

Answer

The custom DNS server should forward queries for the privatelink zones to Azure's platform DNS (168.63.129.16) so it can resolve private endpoint IPs using the linked private DNS zones.

Question 4

You need to monitor all connection attempts to a Private Endpoint. Which Azure service provides this visibility?

Accepted Answer

Azure Monitor with NSG flow logs on the private endpoint subnet

Answer

Enabling NSG flow logs on the subnet containing the Private Endpoint and sending them to Azure Monitor or Log Analytics provides visibility into connection attempts and traffic patterns.

Question 5

An Azure Event Hub namespace has both a Private Endpoint and public network access enabled. A client outside Azure attempts to connect. What happens?

Accepted Answer

The connection uses the public endpoint since public access is still enabled

Answer

When public network access is enabled alongside a Private Endpoint, external clients can still connect via the public endpoint; Private Endpoint and public access are not mutually exclusive unless public access is explicitly disabled.

AZ-800 - Microsoft Azure Networking Solutions Practice Test

AZ-800 - Microsoft Azure Networking Solutions Practice Test

AZ-800 Private Link and Endpoints 5