Home › Azure AZ-500 › cloudcomputing › az500networking › Which Azure networking feature should a security…
Which Azure networking feature should a security engineer use to give a VM-hosted workload a PRIVATE IP-addressable endpoint to a managed PaaS service (e.g. Storage, SQL DB) — without traversing the public internet?
AAzure Bastion
BService Endpoint with public IP
CAzure DNS
DPrivate Endpoint (built on Azure Private Link)
Answer & Solution
Correct answer: D. Private Endpoint (built on Azure Private Link)
Private Endpoint maps a PaaS service into a VNet via a private NIC (per AZ-500 §2 private access). Service Endpoints keep public IP; the others aren't private access.
Related questions
Which Azure Virtual Network feature should a security engineer use to define custom routinWhich Azure tool should a security engineer use to capture and analyse VNet traffic flows Which Microsoft Defender for Cloud feature lets a security engineer OPEN management ports Which Azure service lets a security engineer SSH or RDP into a VM through the Azure portalWhich Azure networking feature should a security engineer use to give an Azure storage accWhich Azure DDoS protection tier should a security engineer recommend for an internet-faciWhich Azure global edge service should a security engineer use to protect a globally-distrWhich Azure service is the canonical L7 application gateway with built-in Web Application