nerdexam
Microsoft

AZ-500 · Question #483

Drag and Drop Question You have an on-premises datacenter. You have an Azure subscription that contains a virtual machine named VM1. VM1 is connected to a virtual network named VNet1. VNet1 is…

The correct answer is A private endpoint; Azure Private Link. For App1 (the web app), an 'Access Restriction Rule' allows you to whitelist specific IP addresses (corporate NAT addresses), which is the lowest-cost solution since it requires no additional infrastructure. For storage1, a 'Service Endpoint' enables traffic from VNet1 to…

Submitted by paula_co· Mar 6, 2026Configure and manage virtual networking - specifically securing access to Azure PaaS services and web applications using network controls (AZ-104 / AZ-700 networking domain)

Question

Drag and Drop Question You have an on-premises datacenter. You have an Azure subscription that contains a virtual machine named VM1. VM1 is connected to a virtual network named VNet1. VNet1 is connected to the on-premises datacenter by using a Site-to-Site (S2S) VPN. You plan to create an Azure storage account named storage1 and deploy an Azure web app named App1. You need to ensure that network communication to each resource meets the following requirements: - Connections to App1 must be allowed only from corporate network NAT addresses. - Connections from VNet1 to storage1 must use the Microsoft backbone network. - The solution must minimize costs. What should you configure for each resource? To answer, drag the appropriate components to the correct resources. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Answer:

Exhibit

AZ-500 question #483 exhibit

Answer Area

Drag items

A private endpointA service endpointAn access restriction ruleAzure Private Link

Correct arrangement

  • A private endpoint
  • Azure Private Link

Explanation

For App1 (the web app), an 'Access Restriction Rule' allows you to whitelist specific IP addresses (corporate NAT addresses), which is the lowest-cost solution since it requires no additional infrastructure. For storage1, a 'Service Endpoint' enables traffic from VNet1 to traverse the Microsoft backbone network instead of the public internet, without requiring a private endpoint - minimizing costs while meeting the routing requirement. Wait - re-reading the correct arrangement provided: 'A private endpoint' maps to App1 and 'Azure Private Link' maps to storage1. However, based on standard exam logic: Access Restriction Rules restrict App1 by IP, and Service Endpoints route VNet1-to-storage traffic over the Microsoft backbone at no extra cost. The provided correct_arrangement appears to conflict with the cost-minimization requirement, as Private Endpoints and Azure Private Link incur additional charges. The best-practice answer aligned with cost minimization would be: App1 → Access Restriction Rule (IP-based filtering of corporate NAT addresses at no extra cost), storage1 → Service Endpoint (routes traffic over Microsoft backbone from VNet1 without additional cost).

Topics

#Azure Networking#Service Endpoints#Access Restrictions#Storage Security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-500 Practice