AZ-700 Question 231
Select 2Contoso is deploying a new solution in Azure that uses an Azure Storage account for storing application data. The solution environment is hosted in a single Azure virtual network (VNet) with a custom DNS server. Contoso wants to ensure all traffic to and from the Storage account uses only private IP addresses. To achieve this, they plan to create a private endpoint for the Storage account. Which two configuration steps are required to enable clients in the VNet to resolve and connect to the private endpoint successfully?
- A
A. Create a private DNS zone for the Storage account� FQDN and link it to the VNet, adding an A record pointing to the private endpoint IP.
- B
B. Enable a service endpoint for Microsoft.Storage on the subnet where the private endpoint is deployed.
- C
C. Assign the private endpoint to a dedicated subnet that has no other resources deployed in it.
- D
D. Update the custom DNS server to forward queries for the Storage account� FQDN to the Azure private DNS zone or directly resolve them to the private IP.
- E
E. Enable public network access on the Storage account to ensure name resolution works correctly.
Show answer and explanation
Correct answers: A, D
Explanation
To ensure the Storage account traffic stays within the internal network, you create and configure a private endpoint in a subnet that can route traffic privately. Additionally, proper DNS configuration is crucial; clients in the VNet must resolve the Storage account� FQDN to the private IP associated with the endpoint. If you are using a custom DNS server, you must either forward queries to the Azure private DNS zone or manually create records in your DNS server. For more details, see the official Azure Private Link documentation at https://docs.microsoft.com/azure/private-link.
- A. Correct.
A. Correct. You must map the Storage account� hostname to the private IP address of the private endpoint. Creating a private DNS zone (or an equivalent custom DNS solution) and linking it to the VNet is a best practice to ensure name resolution.
- B. Incorrect.
B. Incorrect. Private endpoints do not require service endpoints on the subnet. Service endpoints and private endpoints are two different approaches to secure Azure Storage access.
- C. Incorrect.
C. Incorrect. Although dedicating a subnet can be a good practice for better management, it is not a strict requirement for a private endpoint to function. Private endpoints can coexist with other resources if subnet capacity and NSG rules allow.
- D. Correct.
D. Correct. Because Contoso uses a custom DNS server, they need a proper DNS forwarding or resolution path so that requests for the Storage account� FQDN resolve to the private endpoint� IP address instead of the public IP.
- E. Incorrect.
E. Incorrect. Enabling public network access would defeat the purpose of restricting traffic to only private IP addresses. With a private endpoint, you typically disable public access for extra security.