AZ-900 Practice Question 56: Private Endpoints
Microsoft Azure Fundamentals (AZ-900) · Test 6 · question 6 of 10
Virtual machines must reach one Azure Storage account so that: the traffic never crosses the public internet, the account is addressed by a private IP inside the virtual network, and only that one storage account, not every account in the Storage service, is reachable from the subnet. What should be configured?
Show answer and explanation
Answer:
Azure Private Link lets you reach Azure PaaS services such as Storage and SQL Database over a private endpoint in your virtual network. Traffic between the virtual network and the service travels the Microsoft backbone, so exposing the service to the public internet is no longer necessary. The third requirement is what makes this the only defensible answer: a private endpoint is mapped to an instance of a PaaS resource instead of the entire service, consumers can only connect to that specific resource, and access to any other resource in the service is blocked, Microsoft's documented protection against data leakage.
Option B is the closest wrong answer. An NSG rule using the Storage service tag controls which destinations the subnet may reach, but the traffic still heads for the service's *public* endpoint, and the tag covers the whole Storage service rather than one account. Option C misapplies peering, which joins two virtual networks you own; a PaaS storage account has no peerable virtual network. Option D builds an encrypted tunnel to an on-premises network or another virtual network; Azure Storage is not a VPN endpoint.
Reference: What is Azure Private Link?