Which Azure feature is commonly used to manage access permissions for a Private Endpoint?

Azure Role-Based Access Control (RBAC)

A company wants to ensure that traffic from a VNet to an Azure Storage account does not traverse the internet. They also want to keep using the storage account's public hostname (e.g., mystorage.blob.core.windows.net). What should they implement?

Create a service endpoint for the storage account and use the public hostname.

Use Azure Firewall to route traffic to the storage account's public IP.

Create a network security group (NSG) rule to block internet access to the storage account.

Create a private endpoint for the storage account and configure a private DNS zone for 'privatelink.blob.core.windows.net' linked to the VNet.

A company creates a private endpoint for a storage account. They want to access the storage account from a VM in a different VNet that is peered. The VM cannot resolve the storage account name. What is the most likely cause?

The private DNS zone is not linked to the peered VNet

The storage account's public access is disabled

The private endpoint is in a different region

The VM's NSG blocks DNS traffic

An on-premises client needs to connect to an Azure service via a private endpoint. The client uses a custom DNS server. What must be configured for name resolution?

A private DNS zone linked to the on-premises network

A public DNS record with the private IP

Conditional forwarding to Azure DNS

A VPN gateway with DNS settings

A company wants to expose a service via Private Link. They have a VM with a public IP and an NSG that allows traffic from the internet. They want to keep the service private. What should they do?

Use Azure Firewall to block internet traffic

Remove the public IP and place the VM behind an internal load balancer

Create a private endpoint on the VM's NIC

Keep the public IP and add an NSG rule to block internet traffic

Microsoft Certified:Azure Network Engineer Associate

Domain 4Objective 1

Design and Implement Azure Private Link Service and Azure Private Endpoints AZ-700 Practice Questions (Page 3)

Part of the Design and implement private access to Azure services domain, which accounts for 10–15% of the AZ-700 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~4–10 in this domain), expect 2–5 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

8concepts

10–15%of the exam

Questions 11–15

11foundation · easy
Which Azure feature is commonly used to manage access permissions for a Private Endpoint?
Select an answer first
12application · medium
A company wants to ensure that traffic from a VNet to an Azure Storage account does not traverse the internet. They also want to keep using the storage account's public hostname (e.g., mystorage.blob.core.windows.net). What should they implement?
Select an answer first
13expert · hard
A company creates a private endpoint for a storage account. They want to access the storage account from a VM in a different VNet that is peered. The VM cannot resolve the storage account name. What is the most likely cause?
Select an answer first
14application · medium
An on-premises client needs to connect to an Azure service via a private endpoint. The client uses a custom DNS server. What must be configured for name resolution?
Select an answer first
15expert · hard
A company wants to expose a service via Private Link. They have a VM with a public IP and an NSG that allows traffic from the internet. They want to keep the service private. What should they do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-700

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-700” is a trademark of its owner, used for identification only.