AZ-104 Question 230
Single answerYou have configured a private endpoint for an Azure Storage account to restrict access to your internal network. However, your application running in the same virtual network is still trying to connect to the public endpoint rather than the private one. Which configuration change is required to ensure your application routes to the private endpoint by default?
- A
Create or link the private endpoint to an Azure Private DNS zone and configure your virtual network to use it
- B
Configure a Network Security Group (NSG) rule on the subnet to block outbound traffic to the public endpoint
- C
Disable the public network access setting on the Azure Storage account
- D
Manually add a static route in the route table to redirect traffic to the private endpoint
Show answer and explanation
Correct answer: A
Explanation
For a private endpoint to work seamlessly, Azure DNS resolution must direct the resource’s fully qualified domain name to the private IP in the virtual network. Linking the private endpoint with an Azure Private DNS zone and configuring the VNet to use it ensures that the domain name of the storage account resolves to the private IP instead of the public endpoint.
- A. Correct.
Using Private DNS ensures the storage account’s fully qualified domain name resolves to the private IP, directing traffic internally by default.
- B. Incorrect.
NSG rules alone cannot change DNS resolution; they can only allow or block traffic.
- C. Incorrect.
Disabling public access would help restrict access, but it doesn’t fix DNS resolution for the private endpoint by itself.
- D. Incorrect.
Route tables manage IP-level routing, not domain-level name resolution, so a static route alone will not redirect the hostname to the private endpoint.