A company wants to reduce the risk of data exfiltration from their Azure VMs to storage accounts. They plan to use service endpoints. Which additional configuration is required to ensure that only approved storage accounts can be accessed from the VNet?

Add a network security group rule that denies outbound traffic to the storage service tag.

Set the storage accounts' firewalls to allow only the VNet's address space.

Create a service endpoint policy on the subnet and associate it with the subnet.

Configure a route table with a route to the storage service through a firewall.

A company has a storage account that is accessed by VMs in a subnet that has a service endpoint enabled. They also have on-premises clients that access the storage account through the public endpoint. The storage account's default action is set to Deny. They add a virtual-network rule for the subnet and firewall rules for the on-premises IPs. They later find that on-premises clients are still unable to access the storage account. What is the most likely cause?

The service endpoint on the subnet is blocking on-premises traffic.

The on-premises IP rules are not correctly configured or are missing.

The virtual-network rule is blocking on-premises traffic.

The on-premises clients are not using the correct DNS name.

In which scenario is a service endpoint the appropriate solution?

You need to connect to an Azure SQL database from an on-premises network using a private IP address

You need to restrict access to an Azure Storage account so that it can only be reached from a specific virtual network subnet

You need to assign a private IP address to an Azure App Service from your virtual network

You need to connect to an Azure service from a peered virtual network in another region

Your team has enabled a service endpoint for Azure Key Vault on a subnet. Users report they can still access the Key Vault from the internet. What is the most likely reason?

The Key Vault firewall is still set to allow all networks.

The service endpoint was configured on the wrong subnet.

The subnet's NSG is blocking the service endpoint traffic.

The service endpoint is not supported for Key Vault.

Microsoft Certified:Azure Network Engineer Associate

Domain 4Objective 2

Design and Implement Service Endpoints AZ-700 Practice Questions (Page 1)

Part of the Design and implement private access to Azure services domain, which accounts for 10–15% of the AZ-700 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~4–10 in this domain), expect 2–5 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

5concepts

10–15%of the exam

Questions 1–5

1application · medium
A company wants to reduce the risk of data exfiltration from their Azure VMs to storage accounts. They plan to use service endpoints. Which additional configuration is required to ensure that only approved storage accounts can be accessed from the VNet?
Select an answer first
2expert · hard
A company has a storage account that is accessed by VMs in a subnet that has a service endpoint enabled. They also have on-premises clients that access the storage account through the public endpoint. The storage account's default action is set to Deny. They add a virtual-network rule for the subnet and firewall rules for the on-premises IPs. They later find that on-premises clients are still unable to access the storage account. What is the most likely cause?
Select an answer first
3application · easy
You need to enable a service endpoint for Azure Key Vault on a subnet. What is the correct service name to use?
Select an answer first
4foundation · easy
In which scenario is a service endpoint the appropriate solution?
Select an answer first
5application · medium
Your team has enabled a service endpoint for Azure Key Vault on a subnet. Users report they can still access the Key Vault from the internet. What is the most likely reason?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to AZ-700

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “AZ-700” is a trademark of its owner, used for identification only.

Design and Implement Service Endpoints AZ-700 Practice Questions (Page 1)

Questions 1–5

A company wants to reduce the risk of data exfiltration from their Azure VMs to storage accounts. They plan to use service endpoints. Which additional configuration is required to ensure that only approved storage accounts can be accessed from the VNet?

You need to enable a service endpoint for Azure Key Vault on a subnet. What is the correct service name to use?

In which scenario is a service endpoint the appropriate solution?

Your team has enabled a service endpoint for Azure Key Vault on a subnet. Users report they can still access the Key Vault from the internet. What is the most likely reason?

Keep studying — Design and implement private access to Azure services