AZ-700 Question 238
Select 3You are designing a solution for a company that wants to securely expose an internal application running on multiple virtual machines behind a Standard Load Balancer. They plan to allow external partners to connect privately, without traversing the public internet. You decide to create an Azure Private Link service for this purpose. Which of the following statements are correct when configuring the Private Link service, so that the external partners can connect via their own private endpoints?
- A
The application must be behind a Standard SKU Load Balancer to enable Private Link service.
- B
Both the Private Link service and the consumer� VNet must reside in the same region.
- C
Inbound NAT rules are mandatory in the Load Balancer for Private Link service to function.
- D
The private endpoint for the service can be created in a different subscription from the one hosting the Private Link service, provided appropriate permissions are in place.
- E
You can configure manual approval to control which private endpoints can connect to your Private Link service.
Show answer and explanation
Correct answers: A, D, E
Explanation
When creating an Azure Private Link service for secure external connectivity, it must be behind a Standard SKU Load Balancer (Basic SKU is not supported). You can configure manual or auto approvals to control access to the service. Additionally, a private endpoint can be created in a different subscription or tenant, provided you have the correct permissions. However, inbound NAT rules are not always required, and the service resources do not necessarily have to be in the same region as the consumer VNet. For detailed documentation on Azure Private Link service requirements and configurations, visit https://learn.microsoft.com/azure/private-link/create-private-link-service.
- A. Correct.
Correct. To create an Azure Private Link service, you must place your application behind a Standard SKU Load Balancer. Basic SKU Load Balancers are not supported for Private Link services.
- B. Incorrect.
Incorrect. Although many services require a private endpoint in the same region as the resource, the Private Link service itself does not strictly require that the consumer� VNet be in the exact same region. Cross-region configurations can be possible, especially between different Azure regions for private endpoints. The idea that they must always be in the same region is a misconception.
- C. Incorrect.
Incorrect. Inbound NAT rules are not a mandatory requirement for the Private Link service to function. You typically need a load balancing rule with a frontend IP configured, but NAT rules are optional and depend on your specific networking needs.
- D. Correct.
Correct. A private endpoint can be created in a different subscription or even a different tenant, as long as the necessary permissions are granted. This allows flexibility in multi-subscription environments and complex organizational structures.
- E. Correct.
Correct. Azure Private Link supports both automatic (auto-approve) and manual approval workflows. Manual approval enables you to explicitly permit or deny connections from external private endpoints, which is often used for tighter security and control.