AZ-104 Question 231
Single answerYou have successfully created a Private Endpoint for an Azure Storage account in a virtual network (VNet). The VNet is connected to your on-premises environment via VPN. However, on-premises clients cannot upload files to the storage account via the private endpoint. What is the most critical step you need to perform to ensure on-premises traffic can resolve and use the private endpoint to reach Azure Storage?
- A
Add a firewall rule in the Azure Storage account to allow the on-premises public IP address
- B
Enable the 'Service Endpoints' feature on the storage account subnet
- C
Add a corresponding DNS record in your on-premises DNS or forwarder to map the storage account name to the private endpoint IP
- D
Deploy an additional private endpoint for each service within Azure Storage (Blob, File, Queue, Table)
Show answer and explanation
Correct answer: C
Explanation
Private endpoints provide a private IP address within your VNet for Azure services, thereby preventing traffic from leaving the corporate network over the public internet. To complete this setup, you must configure DNS so that the service name resolves to the private IP address associated with the endpoint, enabling secure and successful on-premises connectivity to Azure PaaS resources.
- A. Incorrect.
Azure Storage account firewalls are relevant for restricting or allowing public IP addresses, but do not resolve the on-premises traffic routing issue for a private endpoint scenario.
- B. Incorrect.
Service Endpoints are a separate feature that allow traffic from a virtual network to remain on the Azure backbone for publicly exposed services. However, they are not required when using a Private Endpoint, which provides a dedicated private IP for the service.
- C. Correct.
When using a Private Endpoint, you must ensure DNS resolution directs traffic to the private IP address of the service. Without the proper DNS entry, on-premises clients will attempt to connect to the public endpoint instead, resulting in failed connections.
- D. Incorrect.
You typically do not need an additional private endpoint for each internal service (Blob, File, etc.) if the existing endpoint covers them. Instead, correct DNS resolution is key for on-premises connectivity.