AZ-700 Question 237
Select 2Your organization hosts a back-end service behind a Standard Load Balancer in Azure. You want multiple partners to access this service securely without traversing the public internet. You decide to create a Private Link service. Which two of the following steps must you perform to enable private connectivity for partner subscriptions using Private Link?
- A
Configure a Standard Load Balancer with a front-end IP address in the same Azure region as your service.
- B
Create a Private Link service referencing the Standard Load Balancer front-end IP configuration and enable all network policies on the subnet hosting the service.
- C
Approve each private endpoint connection request after it appears in your subscription or tenant.
- D
Configure an Azure Application Gateway with a wildcard SSL certificate to forward all partner traffic through private endpoints.
Show answer and explanation
Correct answers: A, C
Explanation
To create a Private Link service, you must use a Standard SKU Load Balancer with at least one front-end IP address in the same region, then reference that front-end IP in a Private Link service. The consumer subscription must create a private endpoint pointing to your Private Link service, and you must approve the private endpoint connection. Detailed guidance is available in the official documentation: https://docs.microsoft.com/azure/private-link/create-private-link-service-portal
- A. Correct.
Option 1 is CORRECT. When creating a Private Link service, a Standard SKU Load Balancer deployed in the same region is required, and its front-end IP must be referenced by the Private Link service.
- B. Incorrect.
Option 2 is INCORRECT. You do need to create a Private Link service referencing the Standard Load Balancer, but you do not typically enable all network policies on the subnet. In most cases, certain network policies (like network security group enforcement) must be disabled or configured carefully to allow Private Link traffic.
- C. Correct.
Option 3 is CORRECT. Each private endpoint connection request from a partner or consumer subscription must be approved by the Private Link service owner (in your subscription or tenant) before private connectivity is established.
- D. Incorrect.
Option 4 is INCORRECT. Configuring Azure Application Gateway with a wildcard SSL certificate is unrelated to creating or using a Private Link service for direct private endpoint connections. SSL termination or certificate management may be relevant for HTTP-based services, but this does not address the fundamental requirements of Private Link.