AZ-700 Question 236
Single answerYour company deploys a private endpoint for an Azure Storage account to ensure all traffic remains within the virtual network. You also run a web application hosted in the same VNet, configured to connect to the storage account� FQDN. However, the web application fails to resolve the storage account� private IP. Which configuration change is required so the web application can resolve and connect to the storage account privately?
- A
Enable service endpoints on the subnet hosting the web application for the Storage service.
- B
Enable public network access on the Azure Storage account for outbound traffic.
- C
Add a user-defined route to direct traffic from the web application's subnet to the private endpoint's IP address.
- D
Configure an Azure Private DNS zone with the storage account� FQDN record and link it to the virtual network hosting the private endpoint.
Show answer and explanation
Correct answer: D
Explanation
A private endpoint uses a private IP address within your VNet, so name resolution must be handled by Azure Private DNS or a custom DNS solution. Simply creating a private endpoint does not automatically configure DNS resolution. According to Microsoft� documentation (https://learn.microsoft.com/azure/private-link/private-endpoint-dns), you should set up a private DNS zone for the appropriate Azure service domain and link it to your VNet for seamless resolution of private endpoints.
- A. Incorrect.
Incorrect: Service endpoints differ from private endpoints. Enabling service endpoints doesn't resolve private DNS names; it simply provides a direct path to Azure services over an optimized route. This does not fix name resolution for private endpoints.
- B. Incorrect.
Incorrect: Enabling public network access goes against the goal of restricting traffic to private connections. Also, this does not resolve the DNS issue within your VNet.
- C. Incorrect.
Incorrect: Creating a custom route might send traffic to the correct IP, but it does not solve the DNS name resolution problem. You still need DNS to resolve the FQDN to the private endpoint� IP address.
- D. Correct.
Correct: By creating an Azure Private DNS zone for the storage account� domain (e.g., blob.core.windows.net) and adding an A record pointing to the private endpoint� IP, you enable name resolution within the VNet. Linking this DNS zone to the VNet ensures the web app can resolve the storage account� FQDN privately.