AZ-700 Question 229
Select 2You have deployed a custom service behind a Standard Load Balancer in Azure and want to securely share this service with external consumers in different subscriptions and virtual networks without exposing a public endpoint. Which two actions must you take to implement an Azure Private Link Service so these external consumers can connect privately to your service?
- A
Create a Private Link Service that references the front-end IP configuration of your Standard Load Balancer
- B
Configure a separate Application Gateway in your VNet to handle the Private Link traffic
- C
Approve any connection requests made by external consumers after they create a private endpoint pointing to your Private Link Service
- D
Deploy a private endpoint in your own VNet for each external consumer to connect to your service
Show answer and explanation
Correct answers: A, C
Explanation
Azure Private Link Service allows you to securely expose a service running behind a Standard Load Balancer to external consumers in different Azure subscriptions or tenants. The main steps include creating the Private Link Service in your VNet mapped to the load balancer� front-end IP configuration, and then approving incoming private endpoint connection requests from consumers. Refer to Microsoft� documentation on Azure Private Link Service (https://learn.microsoft.com/azure/private-link/private-link-service-overview) for detailed guidance on configuration, approval workflows, and best practices.
- A. Correct.
Correct. To expose your service through Azure Private Link, you must first create a Private Link Service. This service references the front-end configuration of your Standard Load Balancer, enabling private connectivity from external consumers via private endpoints.
- B. Incorrect.
Incorrect. An Application Gateway is not required for creating and sharing an Azure Private Link Service. You can continue using the Standard Load Balancer to enable private connectivity.
- C. Correct.
Correct. Once external consumers create their private endpoints to your Private Link Service, you (as the owner of the Private Link Service) must approve those connection requests. This ensures that only approved private endpoints can route traffic to your service.
- D. Incorrect.
Incorrect. You do not need to deploy private endpoints inside your own VNet for each consumer. The consumer is responsible for creating private endpoints in their own VNet, which then connect to your Private Link Service.