AZ-700 Question 233
Single answerYou manage a company� Azure Storage account named contosostorage that hosts highly sensitive data. You have configured a private endpoint for contosostorage in a dedicated subnet within a virtual network to ensure traffic remains on the corporate network. The company connects on-premises resources to Azure using an ExpressRoute private peering circuit. After creating the private endpoint, on-premises clients cannot resolve contosostorage.blob.core.windows.net to the private IP address. Which configuration is required to ensure on-premises clients can send all blob data traffic to the private endpoint?
- A
Create a private DNS zone named privatelink.blob.core.windows.net, link it to the virtual network, and configure the on-premises DNS server to forward lookups to Azure for this zone.
- B
Enable the public endpoint on the storage account and add on-premises IP ranges to the storage account firewall.
- C
Delete the existing private endpoint and deploy a new one to the default subnet with no custom DNS servers set in the virtual network.
- D
Set the PublicNetworkAccess property of the storage account to Disabled to force all traffic through the private endpoint.
Show answer and explanation
Correct answer: A
Explanation
When creating a private endpoint for services like Azure Storage, you not only need to place the endpoint in a suitable subnet, but also configure DNS so that the service� fully qualified domain name resolves to the private IP address. This typically involves creating and linking an Azure private DNS zone (for example, privatelink.blob.core.windows.net) to the virtual network containing the private endpoint. You must also configure on-premises DNS servers to forward queries for that zone to Azure (either to Azure DNS or an internal DNS server in Azure), ensuring correct name resolution. For more details, see the official Microsoft documentation on configuring private endpoints and Azure private DNS zones.
- A. Correct.
Correct. To ensure on-premises clients correctly resolve the storage account to its private IP, you need a matching private DNS zone and a forwarding solution. Linking the zone privatelink.blob.core.windows.net to the virtual network hosting the private endpoint ensures internal name resolution in Azure. On-premises DNS servers must be configured to forward requests to this zone, allowing name resolution to the private IP.
- B. Incorrect.
Incorrect. Enabling the public endpoint and adding on-premises ranges to the firewall will allow connectivity over the internet or via the storage firewall, but it defeats the purpose of a private endpoint. Traffic would not necessarily remain on the private network.
- C. Incorrect.
Incorrect. Redeploying the private endpoint to the default subnet and removing custom DNS servers does not solve the DNS resolution issue for on-premises clients. DNS resolution must direct contosostorage.blob.core.windows.net to the private IP address in Azure.
- D. Incorrect.
Incorrect. While disabling public network access helps enforce private traffic, it does not address the DNS issue preventing on-premises resources from resolving the storage account to its private IP. DNS configuration is still required.