AZ-500 Question 80
Select 2You have an Azure SQL Database (named SalesDB) that should only be accessed from an internal web application running on Azure App Service. You configure Private Endpoint connectivity for SalesDB. Which two additional steps are required to ensure the web application uses the private IP instead of the public endpoint?
- A
Configure the App Service to use VNet Integration for the same subnet that hosts the private endpoint.
- B
Enable 'Allow Azure services and resources to access this server' in the SalesDB firewall settings.
- C
Create a private DNS zone for the Azure SQL Database FQDN and link it to the virtual network.
- D
Enable a public endpoint in SalesDB and allow the App Service subnet address range in the firewall.
- E
Assign a service endpoint for Microsoft.Sql on the target subnet used by the private endpoint.
Show answer and explanation
Correct answers: A, C
Explanation
To fully implement Azure Private Endpoints for Azure SQL Database, you must ensure the consuming service (App Service) can resolve and route traffic to the private IP instead of the public endpoint. This commonly involves integrating the App Service into the virtual network (via App Service VNet Integration) and configuring private DNS for name resolution. For detailed guidance, refer to Microsoft’s documentation on 'Azure SQL Database private endpoints' and 'Integrate your app with an Azure virtual network'.
- A. Correct.
Option 1 is correct. To leverage private endpoints, the web application must be able to route traffic internally. Integrating the App Service into the same virtual network that contains the private endpoint ensures the traffic goes through the private IP.
- B. Incorrect.
Option 2 is incorrect. Enabling 'Allow Azure services and resources to access this server' bypasses the private network restriction and is unnecessary for private endpoint access. This can potentially open the database to other Azure services by default.
- C. Correct.
Option 3 is correct. When using private endpoints, private DNS must resolve the service’s hostname to the private IP address. Creating a private DNS zone and linking it to the same virtual network ensures name resolution to the private endpoint.
- D. Incorrect.
Option 4 is incorrect. Enabling a public endpoint and opening firewall rules for the subnet defeats the point of using Private Link for secure internal connectivity. This would again expose the database through a public endpoint.
- E. Incorrect.
Option 5 is incorrect. Service endpoints are a different feature. For purely private connectivity, you use private endpoints and private DNS. Service endpoints do not replace private endpoints nor do they handle private IP routing.