AZ-104 Practice Question 18: Private Endpoint from on Premises
Microsoft Azure Administrator Associate (AZ-104) · Test 2 · question 8 of 10
An on-premises data centre reaches Azure over ExpressRoute private peering. A colleague enabled the Microsoft.Storage service endpoint on the snet-app subnet and then set the storage account firewall on stfinance to allow only that subnet.
Azure VMs in snet-app can now reach the account. On-premises servers cannot: they still resolve stfinance.blob.core.windows.net to a public IP address and their requests are refused. Company policy forbids sending this traffic over the internet.
What should you do?
Show answer and explanation
Answer:
A private endpoint "is a network interface that uses a private IP address from your virtual network"; by creating one "you're bringing the service into your virtual network." Microsoft lists on-premises environments connected "using VPN or ExpressRoute" among the clients a private endpoint serves, which is exactly the missing capability here. Because the connection is made to a private IP, the DNS piece matters just as much: the FQDN "must resolve to the private IP address of the private endpoint," which is what the privatelink.blob.core.windows.net private DNS zone, linked to the virtual network and reachable from on-premises resolution, provides.
Option A satisfies the firewall but violates the policy. Traffic arriving from a NAT address is traffic that crossed the public internet to a public storage endpoint; nothing about it is private.
Option B misunderstands service endpoints. They extend a subnet's private identity to the service over the Azure backbone for resources in that subnet, and on-premises hosts are not in any subnet. Enabling one on the gateway subnet does not make ExpressRoute clients eligible.
Option C targets the wrong exception. The trusted-services setting is for first-party Azure services such as Azure Backup or Azure Monitor acting on your behalf; it grants nothing to on-premises servers.
Reference: What is a private endpoint?