AZ-700 Question 248
Select 2You manage an Azure virtual network (VNet) that includes a Production subnet. You need to ensure that traffic to your Azure Storage account remains on Microsoft� backbone network and is allowed only from your VNet. After deciding to use a service endpoint, which of the following actions must you take? (Select two.)
- A
Enable the service endpoint for the Azure Storage service on the Production subnet.
- B
Configure a user-defined route (UDR) to route traffic from the Production subnet to the internet.
- C
Add the Production subnet to the firewall settings of the Azure Storage account, allowing service endpoint traffic.
- D
Create a private endpoint in the Production subnet to handle network traffic to the Storage account.
Show answer and explanation
Correct answers: A, C
Explanation
Service endpoints allow traffic from a designated subnet to a specific Azure service to remain on the Microsoft backbone network. After enabling the service endpoint on the subnet, you must also update the service (in this case, Azure Storage) to accept traffic from that subnet. A user-defined route directing traffic to the internet or creating a private endpoint are different approaches and are not required when simply using service endpoints. For more details, see the Microsoft documentation on configuring service endpoints: https://learn.microsoft.com/azure/virtual-network/virtual-network-service-endpoints-overview.
- A. Correct.
Option 1: CORRECT. You must explicitly enable the service endpoint for Azure Storage on the specific subnet where you want the traffic restricted to Microsoft� backbone.
- B. Incorrect.
Option 2: INCORRECT. A user-defined route to redirect traffic to the public internet is the opposite of what is required; service endpoints keep traffic within Microsoft's backbone.
- C. Correct.
Option 3: CORRECT. Adding the subnet to the Storage account� firewall allows the service endpoint to authenticate traffic from the Production subnet, blocking traffic from external networks.
- D. Incorrect.
Option 4: INCORRECT. A private endpoint is a different method that assigns a private IP to the service. You don�t need a private endpoint if you are configuring service endpoints.