Design and implement private access to Azure services

Contoso hosts an internal line-of-business application on an Azure App Service (App Service plan, not a Function App). Security requires that the app be reachable only from within the corporate virtual network and never over the public internet. You decide to create a private endpoint for the App Service. When creating the private endpoint in the Azure portal, which target sub-resource must you select so that inbound traffic to the web app is routed privately?

Contoso hosts a multi-tenant SaaS application behind a Private Link service in their Azure subscription. A customer, Fabrikam, creates a private endpoint in their own subscription (a different Entra ID tenant) that targets Contoso's Private Link service using the service's alias. After Fabrikam deploys the private endpoint, its connection status shows 'Pending' and traffic does not flow. What must be done to establish connectivity?

Your company runs an Azure Cosmos DB account configured with the Core (SQL) API. Security requires all traffic to the account to flow over a private endpoint from a spoke virtual network, with no public network access. During deployment you notice that when creating the private endpoint for the Cosmos DB account, the portal prompts you to choose a target sub-resource (group ID). Which value must you select so that applications can query the SQL API collections through the private endpoint?

Your company plans to deploy 40 private endpoints across several virtual networks to reach Azure Storage and Azure SQL Database privately. The finance team asks you to describe how the private endpoints themselves will be billed so they can forecast costs. Which statement accurately describes the Azure Private Link billing model for these private endpoints?

Your company has three spoke virtual networks (VNet-A, VNet-B, VNet-C) peered to a hub VNet. You deploy a private endpoint for an Azure Storage account (blob sub-resource) in VNet-A. Workloads in all three spoke VNets must resolve the storage account's FQDN to the private endpoint's private IP address. You want to minimize administrative overhead and avoid duplicating DNS records. What should you do?

Your company creates a private endpoint for an Azure Storage account (blob service) inside a VNet. You configure a Private DNS zone named privatelink.blob.core.windows.net and link it to the VNet. Applications running on VMs in the VNet must automatically resolve the storage account FQDN to the private endpoint's private IP address without any manual DNS record maintenance, even if the private endpoint IP changes later. What should you do when creating the private endpoint to meet this requirement?

Your company deploys a private endpoint for an Azure Key Vault so that a set of VMs in a hub virtual network can retrieve secrets over a private IP. You create the private endpoint and select the 'vault' target sub-resource. To ensure the VMs resolve the Key Vault FQDN to the private endpoint's private IP address automatically, you must link the correct Azure Private DNS zone to the virtual network. Which Private DNS zone name must you use?

Contoso hosts a SQL Managed Instance analytics platform and exposes it through an Azure Private Link service. A partner company, Fabrikam, wants to create a private endpoint that connects to Contoso's service using the shared alias. Contoso's security team requires that they explicitly review and authorize each incoming connection before any traffic is allowed. When Fabrikam creates the private endpoint, which connection state will the endpoint initially be in, and what must Contoso do to enable connectivity?

Your team deploys a private endpoint for an Azure SQL Database into a subnet named 'data-pe-subnet'. Security requires that an NSG applied to the subnet actually filters inbound traffic destined to the private endpoint, and the network team also wants a user-defined route with a next hop of an Azure Firewall to force traffic through inspection. Currently, neither the NSG rules nor the UDR appear to affect the private endpoint. What must you configure on the subnet to make both the NSG and the UDR take effect for the private endpoint?

Contoso hosts an internal application that must reach an Azure Storage account exclusively over a private connection. They have created a private endpoint for the storage account (blob subresource) in a hub VNet. On-premises servers connect to Azure through an ExpressRoute private peering circuit. From on-premises, application servers currently fail to connect to the storage account, and nslookup for the storage FQDN still returns a public IP address. What must Contoso do so that on-premises servers resolve the storage FQDN to the private endpoint's private IP?

Contoso deploys an Azure SQL Database and creates a private endpoint for it in a hub virtual network. On-premises servers connect to Azure over an ExpressRoute private peering. When on-premises applications resolve the database FQDN (contoso-db.database.windows.net), they still receive the public IP address instead of the private endpoint's private IP. A Private DNS zone named privatelink.database.windows.net exists and is linked to the hub VNet with A records for the private endpoint. What must you configure so that on-premises clients resolve the FQDN to the private endpoint's private IP?

Your company deploys a private endpoint for an Azure SQL Database into a subnet named snet-data in a hub-spoke topology. A security team requires that only VMs in the app-tier subnet be allowed to reach the private endpoint, and all other subnets must be denied. The private endpoint subnet already has network policies enabled. What must you do to enforce this traffic filtering using network security groups?

Your company runs an Azure SQL logical server named sql-fin01 that hosts a production database. Security requires all connectivity from an Azure VNet to traverse a private endpoint, and the application connects using the standard SQL connection string. When you create the private endpoint for sql-fin01, which target sub-resource must you select so the private endpoint is provisioned correctly for direct database access?

Your company hosts a general-purpose v2 storage account named 'salesdata'. You create a private endpoint for the blob sub-resource in a spoke VNet, approve the connection, and configure the private DNS zone integration correctly. Application VMs in the spoke VNet can resolve the storage account FQDN to the private IP address, but they still receive '403 Authorization Failure' errors when accessing blobs. The storage account's networking firewall is set to 'Enabled from selected virtual networks and IP addresses' with no networks or IPs added. What should you do to allow access while keeping the account private?

Your company runs an application in an Azure VNet that must access a general-purpose v2 storage account privately over the Microsoft backbone. The application uses only blob storage. You are creating a private endpoint for the storage account and want to minimize the number of private IP addresses consumed while ensuring only blob access is provisioned. When creating the private endpoint, what must you configure to achieve this?

Your company runs a set of VMs in a spoke virtual network that must access an Azure SQL Database. Security requires that traffic to the database stay on the Microsoft backbone and that the database be reachable using a private IP address from the VNet address space, so that on-premises clients connected over ExpressRoute private peering can also reach it through the same private IP. Which connectivity option meets all of these requirements?

Your company hosts a multi-tenant SaaS application behind a Standard internal load balancer and exposes it through an Azure Private Link service. Several customers in other Azure AD tenants will connect to this service using private endpoints. You want private endpoint connection requests from three specific, trusted customer subscriptions to be established immediately without any manual action from your operations team, while all other subscriptions must still require manual approval. What should you configure on the Private Link service?

Your company hosts a multi-tenant SaaS application behind a Standard internal load balancer in an Azure subscription. You have created a Private Link service so that customers in other Azure tenants can reach the application over a private endpoint. A new customer asks how they should initiate the connection from their own virtual network. What must you provide to the customer so they can create a private endpoint that targets your Private Link service?

Your company hosts a multi-tenant SaaS application on Azure. You need to expose the application privately to customers in other Azure tenants so they can connect using private endpoints in their own VNets, without traversing the public internet. You plan to create an Azure Private Link service. Which infrastructure component must front your application before you can create the Private Link service?

Your company operates a SaaS platform behind an Azure Standard internal Load Balancer. You publish it through a Private Link service so that customer tenants can connect via private endpoints. As the number of customer connections grows, some new private endpoint connections begin to fail while existing ones remain healthy. You confirm the Private Link service is configured with a single subnet for NAT IP allocation. What is the most likely cause and the correct remediation?