AZ-500 Question 79
Select 2You have an Azure Storage account that must only be accessible from resources within a specific Azure Virtual Network. You have created a Private Endpoint in a dedicated subnet within that VNet. Which of the following additional steps must you take to ensure all traffic to the Storage account is routed through the Private Endpoint and that no public access is allowed?
- A
Create or update private DNS zone records for the Storage account, mapping its host name to the Private Endpoint IP address
- B
Disable public network access on the Storage account
- C
Enable Service Endpoints on the subnet that hosts the Private Endpoint
- D
Grant the Storage account's Managed Identity the Contributor role on the hosting subnet
- E
Associate a custom route table with the subnet to redirect traffic to the Private Endpoint
Show answer and explanation
Correct answers: A, B
Explanation
To achieve a fully private connection to your Azure Storage account, you must ensure that name resolution and traffic flow both use the Private Endpoint. First, you create or update a private DNS zone record (or use an auto-generated record) that points the Storage account name to the private IP of the Private Endpoint. Second, to eliminate public access, you disable the Storage account’s public network access. These actions guarantee that only traffic originating from the specified Azure Virtual Network reaches the Storage account. For more details, consult the official Azure documentation on Private Endpoints and private DNS integration (https://learn.microsoft.com/azure/private-link/private-endpoint-overview).
- A. Correct.
Option 1 is correct. Ensuring that the DNS resolution for the Storage account points to the Private Endpoint IP address is critical. By creating the appropriate record in a private DNS zone (and linking that zone to the VNet), you ensure that any resource in the VNet that tries to resolve the Storage account's host name will receive the private IP address, thus routing traffic privately.
- B. Correct.
Option 2 is correct. Disabling public network access on the Storage account prevents all connections over the public endpoint. With this setting enabled, traffic can only flow through the Private Endpoint, closing off any public entry points.
- C. Incorrect.
Option 3 is incorrect. Service Endpoints are different from Private Endpoints. Enabling Service Endpoints does not affect Private Endpoint traffic; instead, Service Endpoints allow traffic to remain on Azure's backbone when connecting to supported services. However, when a Private Endpoint is used, traffic is routed over a private IP, making Service Endpoints unnecessary for restricting public access.
- D. Incorrect.
Option 4 is incorrect. Granting a role to the Storage account's Managed Identity on the subnet does not address network-level access. Role assignments govern resource permissions (e.g., reading blob data), not the network routing path. Restricting network access requires Private Endpoints, DNS configurations, and disabling public endpoints.
- E. Incorrect.
Option 5 is incorrect. When you set up a Private Endpoint, the routing to that endpoint is handled automatically at the platform level. You typically do not need to create or associate a custom route table for private endpoint traffic. User-defined routes are more relevant for scenarios like forced tunneling or traffic inspection, not basic private endpoint routing.