Design and Implement Service Endpoints AZ-700 Practice Questions (Page 3)

Questions 11–15

1. 11application · easy

   A company wants to ensure that traffic from a specific subnet to Azure SQL Database does not traverse the public internet. They are considering service endpoints. What is a key benefit of this approach?

   • ATraffic from the subnet to the database uses the Azure backbone network.
   • BThe subnet's NSG rules are automatically applied to the database.
   • CThe database gets a private IP address in the VNet.
   • DThe database becomes accessible only from the VNet, with no public endpoint.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company has a hub-and-spoke topology. The hub VNet contains a firewall appliance. Spoke VNets contain application subnets that need to access Azure Storage. The security team wants to force all storage traffic from the spoke subnets through the firewall for inspection. They also want to restrict which storage accounts can be accessed. What should you do?

   • AEnable a service endpoint for Microsoft.Storage on the spoke subnets and configure the firewall to inspect traffic to the storage service.
   • BUse a private endpoint for each storage account in the hub VNet and route spoke traffic through the hub.
   • CEnable a service endpoint for Microsoft.Storage on the spoke subnets and create a service endpoint policy that allows only the required storage accounts.
   • DDo not enable service endpoints on the spoke subnets. Instead, configure a route table on the spoke subnets with a route to the firewall for storage traffic, and use the firewall to filter access to storage accounts.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company has a storage account that must be accessible from a specific VNet subnet and also from a set of on-premises IP addresses. They enable a service endpoint on the subnet and add a virtual-network rule. They also add firewall rules for the on-premises IPs. Later, they discover that on-premises clients cannot access the storage account. What is the most likely cause?

   • AThe service endpoint on the subnet is interfering with on-premises traffic.
   • BThe on-premises clients are not using the correct DNS name.
   • CThe virtual-network rule is blocking on-premises traffic.
   • DThe storage account's default action is set to Deny, and the on-premises IP rules are not correctly configured.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   You have a VNet with a subnet named Subnet1. You enable a service endpoint for Microsoft.Storage on Subnet1. You need to ensure that only the storage account named 'proddata' can be accessed from Subnet1. What should you do?

   • AAdd a virtual-network rule on 'proddata' that allows Subnet1.
   • BSet the storage account's firewall to allow only Subnet1's IP range.
   • CConfigure a route table on Subnet1 with a route to 'proddata'.
   • DCreate a service endpoint policy on Subnet1 that allows only 'proddata'.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company uses a service endpoint for Azure Storage. They want to allow the subnet to access only two specific storage accounts, not all storage accounts in the subscription. What should they implement?

   • AA conditional access policy in Azure AD that restricts access to the storage accounts.
   • BA route table entry that sends traffic to the two storage accounts through a firewall.
   • CA service endpoint policy on the subnet that lists the allowed storage accounts.
   • DAn NSG rule on the subnet that denies traffic to all storage account IPs except the two allowed.
   Reveal Solution Discussion Select an answer first