AZ-700 Question 232
Single answerYou have an Azure Function App that needs to securely read files from an Azure Storage account and write data to an Azure SQL Database. You plan to create private endpoints for both services to prevent public internet exposure. After creating private endpoints, which additional step is required so the Function App can correctly resolve the private endpoints?
- A
Deploy an Azure AD Application Proxy to manage name resolution for private endpoints
- B
Configure a private DNS zone for the private endpoints and link it to the Function App� virtual network
- C
Manually add the private IP addresses of the storage account and SQL Database to the Function App� host file
- D
Create a site-to-site VPN tunnel from the Function App� virtual network to the private endpoints
Show answer and explanation
Correct answer: B
Explanation
When planning private endpoints, configuring DNS resolution is crucial. Private endpoints rely on private IP addresses, and using a private DNS zone linked to the same virtual network as the Function App ensures that the Function App resolves the storage account and SQL Database to their private endpoints. This follows Microsoft� best practices for Private Link and Private Endpoints (see Microsoft Learn: 'Use private endpoints for Azure Storage' and 'Use private endpoints for Azure SQL Database').
- A. Incorrect.
Incorrect. Azure AD Application Proxy does not handle DNS name resolution for private endpoints; it is used for publishing on-premises apps to external users, which is not relevant here.
- B. Correct.
Correct. Establishing a private DNS zone and linking it to the virtual network hosting the Function App ensures the Function App can resolve the storage account and SQL Database private endpoints to their internal IP addresses.
- C. Incorrect.
Incorrect. Manually modifying host files is not a recommended or scalable approach in Azure, especially since Function Apps run in a platform-managed environment.
- D. Incorrect.
Incorrect. A site-to-site VPN tunnel is not required for an Azure Function App to access private endpoints within the same or peered virtual network. Private endpoints can be accessed directly through VNet integration and corresponding DNS entries.