AZ-500 Question 82
Single answerYou have deployed a custom web service behind an internal load balancer in a dedicated subnet of your virtual network. You want to make this service accessible to third-party clients so they can securely consume it from their own virtual networks over a Private Endpoint. According to Azure best practices for Private Link services, which of the following actions is required to make this service accessible over a private link?
- A
Assign a public IP configuration to your load balancer and create a Private Endpoint using that public IP
- B
Create a Private Link service that references the internal load balancer's front-end IP configuration
- C
Deploy a Network Security Group (NSG) on the subnet to allow inbound connections from the public internet
- D
Set up a user-defined route to forward all outbound traffic to the load balancer's IP address
Show answer and explanation
Correct answer: B
Explanation
When exposing a custom service via Azure Private Link, you must create a Private Link service that references an internal load balancer's front-end IP configuration. This Private Link service can then be used by consumers from other virtual networks to establish Private Endpoints, ensuring traffic remains on the Azure backbone and never traverses the public internet. Refer to Azure documentation on 'Create a private link service using Azure CLI' (https://learn.microsoft.com/azure/private-link/create-private-link-service-portal) for step-by-step guidance.
- A. Incorrect.
Incorrect. Assigning a public IP to the load balancer and creating a Private Endpoint using a public IP does not align with the concept of Private Link, which requires referencing an internal load balancer front-end IP for private connectivity.
- B. Correct.
Correct. Private Link services must reference the front-end IP of an internal load balancer. This ensures that the traffic remains on the Azure backbone, allowing private access to your web service from other virtual networks via approved Private Endpoints.
- C. Incorrect.
Incorrect. While NSGs can help secure traffic, simply deploying an NSG for inbound connections from the public internet does not enable private connectivity. Private Link depends on an internal load balancer and a Private Link service to provide secure, private access.
- D. Incorrect.
Incorrect. User-defined routes (UDRs) can direct traffic, but they do not enable consumer virtual networks to connect privately to your service. Only a Private Link service and its associated Private Endpoints achieve that private connectivity.