Correct Answer: Create Private Endpoints for Azure Storage and Azure Key Vault and link them to the VNet's private DNS zone
Private Endpoints inject a private IP address from your VNet into the service (Storage, Key Vault), so all traffic stays within the Azure backbone and never traverses the public in...
Correct Answer
Create Private Endpoints for Azure Storage and Azure Key Vault and link them to the VNet's private DNS zone
Why This Answer Is Correct
Private Endpoints inject a private IP address from your VNet into the service (Storage, Key Vault), so all traffic stays within the Azure backbone and never traverses the public internet. Service Endpoints still route traffic over the Azure backbone, but the service endpoint IP is public-facing. Private Endpoints provide the strongest isolation and disable the public endpoint option.
This question evaluates your knowledge of Network Security — a core concept tested in Microsoft Certified: Azure Security Engineer Associate (AZ-500). Understanding Network Security is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.
You have a web application running on Azure VMs behind an Azure Application Gateway. You need to protect the application from SQL injection and cross-site scripting (XSS) attacks. Which feature of Application Gateway provides this?
Your organization has multiple VNets across different Azure regions. You need to ensure all traffic between VNets is inspected by a centralized Azure Firewall before being forwarded. Which Azure networking topology supports this at scale?