AZ-305 Practice Question 29: Hybrid PaaS Private Access
Microsoft Azure Solutions Architect Expert (AZ-305) · Test 3 · question 9 of 10
An energy company connects its datacenter to Azure over an ExpressRoute circuit with private peering. Application servers that remain on-premises must read from an Azure Storage account and query an Azure SQL database. The security standard states that:
- traffic to these services must never traverse the public internet, - the storage account and the logical SQL server must have public network access disabled, - on-premises clients must keep using the services' normal fully qualified domain names, which must resolve to private addresses.
Which design meets the requirements?
Show answer and explanation
Answer:
A private endpoint is a network interface with a private IP address from your virtual network that brings the service into that network, and Microsoft lists on-premises environments connected by VPN or ExpressRoute among the places that can reach it. Because the service is now addressable privately, the public endpoint can be switched off entirely. The remaining problem is name resolution: the service FQDN must resolve to the private IP for on-premises clients too, which is what linking the private DNS zones and conditionally forwarding those namespaces to a resolver inbound endpoint achieves. Microsoft's documentation stresses that the DNS settings must resolve to the private endpoint's private IP address for the connection to work.
Option A misunderstands the scope of service endpoints. A service endpoint extends a *virtual network subnet's* identity to the PaaS service; it grants no access to on-premises clients, whose traffic arrives with source addresses that are not part of that subnet. The connection still targets the service's public endpoint, which the standard requires to be disabled.
Option B violates the first requirement in its own text. IP firewall rules plus TLS make an internet path narrower and encrypted, but it is still the public internet, and the public endpoints must remain enabled for it to work at all.
Option D is the strongest distractor: Microsoft peering does carry the traffic over the ExpressRoute circuit rather than the internet. But it reaches the services' *public* endpoints, so those endpoints cannot be disabled, and the FQDNs keep resolving to public addresses. It satisfies the first requirement and breaks the other two.
Reference: What is a private endpoint?