AZ-500 Question 85
Single answerYou are responsible for an internal data-processing solution that consists of an Azure App Service front end and an Azure Function for back-end processing. Both must communicate over a private network without exposing endpoints to the public internet. You also want to simplify DNS configuration. Which approach best meets these requirements?
- A
Enable service endpoints on the subnets where both the App Service and the Function reside, then whitelist the App Service outbound IP addresses in the Function.
- B
Configure IP restriction rules in the App Service and the Function to block all external IP addresses except those used by each other's service plans.
- C
Create a Private Endpoint for the Azure Function and configure Regional Virtual Network Integration for the App Service to use the same VNet, ensuring DNS is updated for private name resolution.
- D
Deploy both the App Service and the Function into the same App Service Plan with the same runtime stack to share a default private network.
Show answer and explanation
Correct answer: C
Explanation
The best practice for limiting public exposure when integrating Azure App Service and Azure Functions is to combine Private Endpoints with Regional Virtual Network Integration. This setup provides each service with secure, private IP addresses and ensures traffic flows entirely within the VNet. For more details, see the Microsoft documentation on 'Integrate your app with an Azure virtual network' and 'Create and use private endpoints for Azure Web Apps and Azure Functions.'
- A. Incorrect.
Option 1: Incorrect. Service endpoints allow resources to connect securely to Azure services but do not provide full private IP addresses. Relying on whitelisting outbound IPs can be complex and does not fully remove internet exposure.
- B. Incorrect.
Option 2: Incorrect. IP restrictions alone limit inbound traffic but do not establish a fully private endpoint. External traffic is still routed over public endpoints, even though connections might be filtered.
- C. Correct.
Option 3: Correct. By creating a Private Endpoint for the Function, you provide the Function with a private IP address on the VNet. Configuring Regional VNet Integration for the App Service ensures it can access the Function privately. Updating DNS (e.g., Azure DNS private zones) ensures name resolution points to the private endpoint.
- D. Incorrect.
Option 4: Incorrect. Placing both services in the same App Service Plan does not inherently create a private network integration. They can still have publicly accessible endpoints unless further steps (like private endpoints) are taken.