Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Azure Private Endpoint for Secure VNet Access
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An enterprise hosts an internal database in Azure that contains sensitive financial data. Applications running on Azure Virtual Machines inside a Virtual Network (VNet) need to query this database securely.
Corporate security policies require that:
- The database is not accessible via a public IP address.
- All network traffic between the virtual machines and the database remains entirely within the private Azure network.
- The database is assigned a private IP address from the virtual network subnet.
Which feature should the enterprise implement to satisfy these requirements?
Explanations
Azure ExpressRoute
Azure ExpressRoute
What Azure ExpressRoute is
Azure ExpressRoute is a dedicated hybrid networking service that creates private, high-speed physical connections between an organization's on-premises data centers and the Microsoft cloud ecosystem. It bypasses public internet service providers entirely by routing traffic through a certified connectivity partner.
Why it doesn't meet the requirement
- Designed for hybrid connectivity, not PaaS isolation: ExpressRoute establishes connectivity between on-premises sites and Azure VNets; it is not a mechanism for assigning private IP addresses to Azure PaaS resources.
- Unnecessary for intra-cloud communication: The application VMs and database are both hosted within Azure, meaning no on-premises-to-cloud connection is required.
- Does not replace private endpoints: Even when using ExpressRoute, connecting on-premises clients privately to PaaS databases still requires configuring a private endpoint inside the target VNet.
Key characteristics and limitations
- Provides Layer 3 dedicated connectivity with higher reliability, faster speeds, and lower latencies than standard internet connections.
- Requires specialized hardware, partner provisioning, and dedicated physical circuit infrastructure.
- Does not natively create private network interfaces inside an Azure VNet for individual Azure services.
This answer would be correct if
The scenario required connecting a corporate on-premises headquarters or data center to Azure VNets over a dedicated, private physical line without traversing the public internet.
Additional context
ExpressRoute and private endpoints work together in enterprise architectures: ExpressRoute connects the corporate office to the VNet, while private endpoints allow those offices to access Azure PaaS services privately.
Public endpoint with IP firewall rules
Public endpoint with IP firewall rules
What a public endpoint with IP firewall rules is
A public endpoint exposes an Azure service using a publicly routable IP address or domain name over the internet. Adding IP firewall rules restricts inbound connections so that only requests originating from designated public IP ranges or approved Azure services are accepted, while blocking all other external traffic.
Why it doesn't meet the requirement
- Requires a public IP: The database would still maintain a publicly reachable endpoint on the internet, directly violating corporate security requirements.
- No private VNet IP assignment: Firewall rules filter incoming public connections; they do not assign a private IP address from a VNet subnet to the database.
- Public internet routing path: VM traffic destined for a public endpoint reaches the service across public gateway endpoints rather than staying strictly within the private VNet boundaries.
Key characteristics and limitations
- Exposes services to public DNS resolution and internet-facing network interfaces.
- Filters connection attempts based on client source IP addresses rather than internal VNet routing.
- Does not provide private network isolation or protect against certain data exfiltration vectors.
This answer would be correct if
This approach would be appropriate if external partners or remote client applications without VPN connectivity needed controlled access to the database from specific, static public IP addresses.
Additional context
While IP firewall rules provide a basic layer of access control, they do not transform an internet-facing endpoint into a private, VNet-integrated resource.
Network Security Group (NSG)
Network Security Group (NSG)
What a Network Security Group (NSG) is
A Network Security Group (NSG) acts as a virtual firewall for filtering network traffic to and from Azure resources within an Azure Virtual Network. It contains a list of security rules that allow or deny inbound and outbound network traffic based on source/destination IP address, port, and protocol.
Why it doesn't meet the requirement
- Filters traffic rather than creating endpoints: An NSG evaluates packet headers against security rules; it cannot create network interfaces or assign private IP addresses to Azure PaaS services.
- Cannot convert public endpoints to private: Applying NSG rules to VM subnets controls outbound traffic flow but does not give a multi-tenant Azure database a private IP inside the VNet.
- Does not natively connect services: NSGs enforce network access policies across existing endpoints rather than establishing private link connections.
Key characteristics and limitations
- Operates at Layers 3 and 4 of the OSI model using 5-tuple matching (source IP, source port, destination IP, destination port, protocol).
- Attaches to subnets or individual virtual machine network interfaces (NICs).
- Uses prioritized rules (100 to 4096) with default rules permitting intra-VNet traffic and outbound internet access.
This answer would be correct if
The goal was to control or restrict inbound and outbound traffic between existing virtual machine subnets within a virtual network.
Additional context
NSGs are commonly applied alongside private endpoints to add granular traffic filtering to the subnet where the private endpoint interface resides.
Private endpoint
Private endpoint
What an Azure Private Endpoint is
An Azure Private Endpoint is a network interface that connects a virtual machine or other resource privately and securely to a service powered by Azure Private Link. The private endpoint uses a private IP address from your Azure Virtual Network (VNet) address space, effectively bringing the targeted Azure PaaS service directly into your private network.
How it meets the requirements
- Eliminates public internet exposure: By using a private endpoint, the database does not need to expose a public endpoint or route traffic over the public internet.
- Keeps traffic on the Microsoft backbone: Traffic between the virtual machines in the VNet and the database travels exclusively over the secure Microsoft global network backbone.
- Assigns a private VNet IP: The private endpoint assigns a specific private IP address from the VNet's subnet directly to the service resource.
Key advantages and capabilities
- Granular resource access: Secures connectivity to a specific resource instance rather than the entire multi-tenant service.
- Built-in data exfiltration protection: Restricts network access strictly to the mapped resource, preventing unauthorized data transfers to unintended external destinations.
- Integration with private DNS: Seamlessly resolves Azure service Fully Qualified Domain Names (FQDNs) to private IP addresses using Azure Private DNS zones.
- Cross-premises connectivity: Enables secure connectivity from on-premises networks across VPN Gateways or Azure ExpressRoute without public routing.
Why this is optimal
A private endpoint is the ideal architectural choice when organizations must comply with strict isolation standards, eliminating public endpoints and keeping all database transactions confined within private IP boundaries.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Private Endpoint DNS Resolution
Define public and private endpoints
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Private Endpoint
Define public and private endpoints
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Advisor Operational Excellence Category
Describe the purpose of Azure Advisor
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure File Sync
Identify options for moving files, including AzCopy, Azure Storage Explorer, and Azure File Sync
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Entra B2B Collaboration
Describe external identities in Azure
AdvancedAZ-104 Microsoft Azure Administrator Exam
Availability Zones High Availability
Deploy virtual machines to availability zones and availability sets
Last updated Validated