nerdexam
Microsoft

AZ-500 · Question #521

You have an Azure subscription that contains an Azure Data Lake Storage account named sa1. You plan to deploy an app named App1 that will access sa1 and perform operations, including Read, List…

The correct answer is B. 2. To securely connect an app to an Azure Data Lake Storage Gen2 account using a private endpoint for both data and hierarchical namespace operations, two private endpoints are required.

Submitted by yousef_jo· Mar 6, 2026Secure compute, storage, and databases

Question

You have an Azure subscription that contains an Azure Data Lake Storage account named sa1. You plan to deploy an app named App1 that will access sa1 and perform operations, including Read, List, Create Directory, and Delete Directory. You need to ensure that App1 can connect securely to sa1 by using a private endpoint. What is the minimum number of private endpoints required for sa1?

Options

  • A1
  • B2
  • C3
  • D4
  • E5

How the community answered

(47 responses)
  • A
    4% (2)
  • B
    89% (42)
  • D
    2% (1)
  • E
    4% (2)

Why each option

To securely connect an app to an Azure Data Lake Storage Gen2 account using a private endpoint for both data and hierarchical namespace operations, two private endpoints are required.

A1

A single private endpoint would only cover either blob data operations (Read, List) or hierarchical namespace operations (Create Directory, Delete Directory) privately, but not both simultaneously.

B2Correct

Azure Data Lake Storage Gen2 accounts expose two distinct sub-resources for private endpoints: 'blob' for general data operations like Read and List, and 'dfs' for hierarchical namespace operations like Create Directory and Delete Directory. To ensure all specified operations are routed securely through private endpoints, one endpoint is needed for the 'blob' sub-resource and another for the 'dfs' sub-resource.

C3

There are no additional distinct private endpoint sub-resources required beyond 'blob' and 'dfs' for the operations specified on an Azure Data Lake Storage Gen2 account.

D4

There are no additional distinct private endpoint sub-resources required beyond 'blob' and 'dfs' for the operations specified on an Azure Data Lake Storage Gen2 account.

E5

There are no additional distinct private endpoint sub-resources required beyond 'blob' and 'dfs' for the operations specified on an Azure Data Lake Storage Gen2 account.

Concept tested: Data Lake Storage Gen2 private endpoint sub-resources

Source: https://learn.microsoft.com/azure/data-lake-storage/data-lake-storage-network-security#private-endpoints

Community Discussion

No community discussion yet for this question.

Full AZ-500 Practice