Private Endpoint Private IP for SQL and Storage

Private IP Access to PaaS with Private Endpoint

An enterprise organization manages backend database workloads on Azure PaaS services, including Azure SQL Database and Azure Storage. According to corporate compliance and security requirements, virtual machines inside an Azure Virtual Network (VNet) must connect to these services privately without exposing network traffic to the public internet.

Which networking feature should the organization deploy to assign a private IP address within their virtual network to these services?

Public IP address

Azure Traffic Manager

Virtual network peering

Private endpoint

Explanations

Public IP address

What a Public IP Address Is

A public IP address is a globally routable IPv4 or IPv6 address assigned to an Azure resource that allows inbound communication from the internet and outbound connectivity to the internet.

Why It Doesn't Meet the Requirement

Exposes traffic to the public internet: Assigning or using public IP addresses directly violates the corporate requirement that traffic must remain off the public internet.
Lacks internal subnet integration: Public IP addresses do not map PaaS services directly into a private subnet range within an Azure Virtual Network.
Increased attack surface: Exposing services publicly requires additional firewall and security rules to protect against unauthorized access attempts.

Key Characteristics and Limitations

Internet routable: Designed specifically for external, internet-facing communication.
Public DNS resolution: Associated with public domain names resolved via public DNS servers.
Requires perimeter defenses: Necessitates network security groups, firewalls, and DDoS protection for hardened security.

This Answer Would Be Correct If

This option would be correct if the enterprise needed to host a public web application or API that must be directly accessible by general users across the public internet.

View source documentation

Azure Traffic Manager

What Azure Traffic Manager Is

Azure Traffic Manager is a DNS-based traffic load balancer that distributes network traffic across endpoints located in different Azure regions or external locations.

Why It Doesn't Meet the Requirement

DNS-level routing only: Traffic Manager operates at the DNS level and directs client traffic to optimal public endpoints rather than providing a private network interface inside a virtual network.
Does not establish private IPs: It cannot assign a private IP address from a virtual network subnet to a backend Azure PaaS resource.
Targets public endpoints: Traffic Manager is intended to route public incoming user traffic to geographically dispersed endpoints.

Key Characteristics and Limitations

Global load distribution: Routes user requests using routing methods like priority, performance, geographic, or weighted distribution.
Non-proxy architecture: Does not see or encapsulate the actual data traffic passing between the client and the application.
Public service focus: Primarily handles public endpoints accessible over the internet.

This Answer Would Be Correct If

This answer would be correct if the organization wanted to distribute incoming public internet traffic across redundant web application servers deployed in multiple global Azure regions to maximize availability.

View source documentation

Virtual network peering

What Virtual Network Peering Is

Virtual network peering is a networking mechanism that connects two or more Azure Virtual Networks (VNets) together, allowing resources in both networks to communicate with each other using private IP addresses.

Why It Doesn't Meet the Requirement

Connects VNets, not PaaS services: Virtual network peering connects two VNets together (such as a hub and spoke architecture), but multi-tenant Azure PaaS resources (like Azure SQL Database or Azure Storage) do not reside natively inside a customer VNet by default.
Requires private endpoints: To bring PaaS services into a peered network topology privately, you must still deploy private endpoints within a subnet.

Key Characteristics and Limitations

High-speed connectivity: Traffic between peered VNets flows entirely across the private Microsoft backbone network with low latency.
Non-transitive by default: Peering does not automatically route traffic through intermediate networks without additional routing configuration.
VNet-to-VNet scope: Only connects virtual networks and does not individually project managed platform services.

This Answer Would Be Correct If

This option would be correct if the scenario asked how to connect two separate Azure Virtual Networks (such as a hub VNet and a spoke VNet) so that virtual machines in both networks could communicate privately.

View source documentation