AZ-500 Question 81
Select 2You have an Azure SQL Database that stores sensitive financial data. To ensure all traffic from your Azure Web App to this database stays on the internal network, you create a Private Endpoint for the SQL Database in a dedicated subnet of a virtual network. However, the Web App still fails to connect to the database using the private IP address. Which two actions should you take to enable the Web App to properly route to the database via the Private Endpoint?
- A
Create a private DNS zone named 'privatelink.database.windows.net' and link it to the virtual network hosting the Private Endpoint.
- B
Enable Virtual Network integration for the Azure Web App and configure it to use the private DNS zone for name resolution.
- C
Disable SSL/TLS encryption to allow the Web App to connect using the private IP address.
- D
Assign the Web App the 'Private Endpoint Contributor' role at the subscription scope.
Show answer and explanation
Correct answers: A, B
Explanation
When planning and implementing Private Endpoints for Azure SQL Database, you must configure both network integration (for the Web App to communicate over the virtual network) and custom/private DNS resolution (to ensure the database’s host name resolves to the private IP). According to Microsoft’s documentation, creating and linking a private DNS zone (e.g., privatelink.database.windows.net) to the virtual network that hosts the endpoint is crucial for name resolution. Additionally, enabling VNet integration for the Azure Web App allows it to communicate with services in that virtual network. Refer to https://learn.microsoft.com/azure/private-link/private-endpoint-overview for detailed guidelines.
- A. Correct.
Option 1 is correct. For the Web App to resolve the database's host name to the private IP, you must use a private DNS zone such as 'privatelink.database.windows.net' and link it to the VNet where the Private Endpoint resides.
- B. Correct.
Option 2 is correct. The Web App needs to integrate with the same virtual network and use its DNS settings so that lookup requests for the SQL Database go to the private IP rather than the public endpoint.
- C. Incorrect.
Option 3 is incorrect. Disabling SSL/TLS does not affect private IP routing or DNS resolution, and is a security risk. It does not help in ensuring traffic stays within the private network.
- D. Incorrect.
Option 4 is incorrect. Granting the 'Private Endpoint Contributor' role at the subscription level is not necessary for the Web App to connect via the private link. The Web App only needs network integration and correct DNS resolution.