AZ-500 Question 84
Single answerContoso runs a proprietary data processing solution in Azure that must be privately accessed by multiple external partners. The solution's virtual machines run behind an Azure Standard Load Balancer in a dedicated virtual network. You want to implement a Private Link service that provides secure, private connectivity for partner subscriptions without exposing any public endpoints or requiring a site-to-site VPN. Which action should you take to enable private connections for these external partners?
- A
Create a standard public IP address on the virtual machines behind the load balancer and configure inbound NAT rules for partner networks.
- B
Set up an Azure Private Link service on the Standard Load Balancer, configure a NAT IP configuration, and provide an alias so partners can create private endpoints in their subscriptions.
- C
Deploy an Application Gateway with WAF enabled in front of the Standard Load Balancer to route private traffic from partner networks.
- D
Enable IP forwarding on the virtual machines and let partners route traffic directly to the solution using their IP addresses.
Show answer and explanation
Correct answer: B
Explanation
When planning and implementing Private Link services, you must create an Azure Private Link service on a resource such as a Standard Load Balancer. The Private Link service is then shared with external consumers via an alias. Each partner can create a private endpoint mapping to that alias in their own virtual network, providing secure, private connectivity over the Azure backbone. For more details, refer to Microsoft documentation on Azure Private Link and private endpoints.
- A. Incorrect.
Option 1 is incorrect. Exposing a standard public IP and NAT rules wouldn't provide the private connectivity required; it would open a public endpoint.
- B. Correct.
Option 2 is correct. Creating an Azure Private Link service on the Standard Load Balancer allows you to securely provide access by sharing an alias, which partner networks can use to create private endpoints and connect privately.
- C. Incorrect.
Option 3 is incorrect. An Application Gateway with WAF can protect web applications, but it does not establish a direct private link from partner subscriptions. Private Link services specifically enable private endpoints in other virtual networks.
- D. Incorrect.
Option 4 is incorrect. Simply enabling IP forwarding and routing traffic directly from partner IP addresses does not establish private connectivity or manage approvals. Private Link ensures isolated, approved connections over the Azure backbone.