Hotspot Question You have an Azure subscription that contains the virtual machines shown in the following table. Subnet1 and Subnet2 have a network security group (NSG). The NSG has an outbound rule…

Question

Exhibits

Answer Area

• From VM2, you can create a container in storage1.Yes
• From VM1, you can upload data to the blob storage of storage1.Yes
• From VM2, you can upload data to the blob storage of storage1.Yes

Explanation

Azure NSG + Private Endpoint - Explanation

The Core Setup

The Key Concept: Service Tags vs. Private IPs

The NSG rule's Destination: Storage uses an Azure Service Tag - a named group of public IP ranges belonging to Azure Storage. It does not cover private IP addresses.

When a private endpoint is created, Azure DNS resolves the storage account FQDN to the endpoint's private IP (e.g., 10.x.x.x). Traffic to that private IP is not matched by the Storage service tag rule, so the Deny rule is never triggered.

Statement-by-Statement

1. "From VM2, you can create a container in storage1." -> YES

• VM2 is in Subnet2, which has the outbound Deny rule for the Storage service tag.
• However, because Private1 exists, DNS resolves storage1.blob.core.windows.net to a private IP in Subnet1.
• The outbound traffic from VM2 targets a private IP - not in the Storage service tag range - so the Deny rule does not apply.
• The traffic routes within VNet1 to the private endpoint and succeeds.

2. "From VM1, you can upload data to the blob storage of storage1." -> YES

• VM1 is in Subnet1, the same subnet where Private1 lives.
• The private endpoint resolves to a local private IP; traffic never leaves to a public Storage IP.
• The Deny rule for the Storage service tag is irrelevant here - the destination is a private IP.
• Upload succeeds via the private endpoint.

3. "From VM2, you can upload data to the blob storage of storage1." -> YES

• Same reasoning as Statement 1. VM2's outbound NSG checks destination against the Storage service tag (public IPs only).
• The blob upload targets the private endpoint's private IP, which doesn't match the service tag.
• The Deny rule is bypassed; upload succeeds.

Memory Tip

Service Tag = Public IPs only. Private Endpoint = Private IP bypass.

Think of a private endpoint as a secret door inside your VNet. NSG rules guarding the "public highway" (Storage service tag) have no power over traffic using the secret door (private IP). As long as DNS points to the private endpoint, all outbound NSG rules targeting Storage are irrelevant.

Mnemonic: "Private endpoint? Private IP. Private IP? Service tag doesn't see it."

No community discussion yet for this question.