AZ-700 Question 235
Select 2Your company hosts a private endpoint for an Azure Storage account in a subnet within a virtual network. You have set up a site-to-site VPN to connect your on-premises environment to Azure. Users on-premises need to access the private endpoint without exposing traffic to the public internet, and they must use the private IP address when resolving the storage account FQDN. Which two actions should you take to ensure DNS resolution and connectivity?
- A
Enable a service endpoint for the Storage account subnet and configure the on-premises DNS server to forward requests to Azure public DNS
- B
Create a Private DNS zone (e.g., privatelink.blob.core.windows.net) in Azure and add a corresponding A record for your storage account's private endpoint
- C
Link the Private DNS zone to the virtual network hosting the storage account's private endpoint
- D
Configure the storage account firewall to allow only public endpoint traffic and deny any Virtual Network traffic
Show answer and explanation
Correct answers: B, C
Explanation
To ensure on-premises clients resolve and connect to a private endpoint, you must use a Private DNS zone customized for your resource (e.g., privatelink.blob.core.windows.net) and link that zone to the virtual network hosting the endpoint. This setup ensures DNS requests resolve to the private endpoint IP within Azure, instead of the public IP. For more details, see Microsoft Documentation on Creating and configuring private endpoints: https://learn.microsoft.com/azure/private-link/create-private-endpoint.
- A. Incorrect.
Option 1: Incorrect. Service endpoints are not required when using a private endpoint. The private endpoint uses a dedicated IP in the subnet and DNS setup is handled differently (via private DNS zones or custom DNS). Forwarding requests to Azure public DNS would also not direct traffic to the private endpoint.
- B. Correct.
Option 2: Correct. A Private DNS zone (with an A record for the storage account's private endpoint) is necessary so that queries resolve the FQDN to the private IP address. This is essential for promoting private connectivity over the VPN.
- C. Correct.
Option 3: Correct. Linking the Private DNS zone to the virtual network allows VMs and other resources in that VNet to properly resolve the private endpoint. Without this link, name resolution wouldn't direct traffic to the private IP.
- D. Incorrect.
Option 4: Incorrect. Configuring the storage account firewall to only allow public traffic and deny VNet traffic would break private endpoint access entirely. You need the firewall settings to allow the associated virtual network and subnet.