AZ-104 · Question #727
Your on-premises network contains a VPN gateway. You have an Azure subscription that contains the resources shown in the following table. You need to ensure that all the traffic from VM1 to storage1…
The correct answer is B. private endpoints. To ensure traffic from an Azure VM to an Azure Storage account traverses the Microsoft backbone network, private endpoints should be configured.
Question
Options
- Aa network security group (NSG)
- Bprivate endpoints
- CMicrosoft Entra Application Proxy
- DAzure Virtual WAN
How the community answered
(19 responses)- A11% (2)
- B74% (14)
- C5% (1)
- D11% (2)
Why each option
To ensure traffic from an Azure VM to an Azure Storage account traverses the Microsoft backbone network, private endpoints should be configured.
A network security group (NSG) filters network traffic based on rules, but it does not dictate the routing path to Azure platform services over the Microsoft backbone network.
Private endpoints provide a private IP address for an Azure service like Storage Account within a virtual network. This allows traffic from VM1 to Storage1 to flow entirely within the Azure virtual network and the Microsoft backbone, bypassing the public internet and any on-premises connectivity.
Microsoft Entra Application Proxy provides secure remote access to on-premises web applications for users, which is unrelated to connecting an Azure VM to an Azure storage account.
Azure Virtual WAN is a networking service for large-scale branch-to-Azure connectivity and global networks, but it is not the specific mechanism to enable private, backbone-only access for an Azure VM to a PaaS service.
Concept tested: Secure private access to Azure PaaS services using Private Endpoints
Source: https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-overview
Topics
Community Discussion
No community discussion yet for this question.