Azure Private Endpoint for Secure PaaS Access

AZ-700 By islever Editorial Last updated

Design and implement Azure Private Link service and Azure private endpoints

Short answer

A Use a private endpoint to provide secure, private connectivity to storage2 within the VNet without exposing its public endpoint.

Question

You need to provide access to storage2. The solution must meet the PaaS networking requirements and the business requirements.
Which connectivity method should you use?
  1. a private endpoint Correct Answer
  2. Azure Firewall
  3. Azure Front Door
  4. a service endpoint

Key Takeaways

The main trap is confusing Service Endpoints (which use public IPs with firewall restrictions) with Private Endpoints (which use private IPs within the VNet), especially when the question specifies 'no public exposure'.

Learn why Azure Private Endpoint is required over Service Endpoints when accessing storage accounts without exposing public endpoints. Master AZ-700 networking concepts.

Common mistake: Choosing Service Endpoint (D) because it offers secure VNet integration. However, Service Endpoints still utilize the service's public endpoint infrastructure, violating the 'no public exposure' constraint.

Expert Analysis

Core Principle: Private Link vs. Service Endpoints

The decisive factor in this scenario is the requirement to access Azure Storage without exposing its public endpoint. This constraint points directly to Azure Private Link (implemented via a private endpoint) rather than a Service Endpoint. While both technologies allow secure connectivity from a Virtual Network (VNet) to Platform-as-a-Service (PaaS) resources, they operate on fundamentally different networking models.

Why Option A (Private Endpoint) is Correct: A private endpoint provisions a network interface card (NIC) with a private IP address from your VNet’s address space within the PaaS service (Storage2). This effectively brings the storage account into your VNet’s namespace. Traffic between the VNet and the storage account never traverses the public internet or uses the storage account’s public DNS name/IP. It satisfies the "no public exposure" requirement by design, as the resource is only accessible via its private IP.

Why Option D (Service Endpoint) is Incorrect: Service endpoints extend your VNet’s identity to supported Azure services but keep the resources outside your VNet. They still rely on the service’s public endpoint (public IP/DNS). Security is enforced via firewall rules that restrict access to specific VNets, but the underlying connectivity mechanism still uses the public infrastructure of Azure. Therefore, it does not meet the strict requirement of avoiding public endpoint exposure.

Analysis of Other Options:

  • Option B (Azure Firewall): This is a managed firewall service for filtering traffic, not a method for establishing direct private connectivity to a specific storage account.
  • Option C (Azure Front Door): This is a global HTTP load balancer/web application firewall, irrelevant for internal VNet-to-storage connectivity.

Community Insight: Comments highlight the distinction between keeping PaaS resources outside the VNet (Service Endpoints) versus bringing them in (Private Link). The consensus among experts who cite official documentation emphasizes that "without exposing the public endpoint" is the key phrase that eliminates Service Endpoints as a valid choice.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When answering networking questions involving PaaS services, always check for keywords like 'private IP', 'within VNet', or 'no public exposure'. These indicate Private Link/Private Endpoint. If the question mentions 'extending VNet identity' or 'firewall rules' while allowing public access, consider Service Endpoints. Differentiate based on the IP address type used for connectivity.

Frequently Asked Questions

What is the primary difference between Private Link and Service Endpoints?

Private Link brings the PaaS resource into your VNet using a private IP address, while Service Endpoints keep the resource outside the VNet but restrict access via firewall rules using public IPs.

Can I use Service Endpoints if I want to block public internet access?

Yes, you can restrict access to specific VNets, but the connectivity still technically uses the public endpoint infrastructure. Private Endpoint is required if the business rule strictly forbids any public exposure.

More AZ-700 FAQ →

Community Votes

A
50%
D
50%

50% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 42 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 42

  1. wsrudmen 👍 32 Answered A
    Azure Service Endpoint provides secure and direct connectivity to Azure PaaS services over an optimized route over the Azure backbone network. Traffic still left your VNet and hit the public endpoint of PaaS service. ==> Then it can't meet the goal because of the public IP Azure Private Link (or Private Endpoint) allows you to access Azure PaaS services over Private IP address within the VNet. It's then OK A is the answer
  2. Payday123 👍 16 Answered D
    "Virtual Network (VNet) service endpoint provides secure and direct connectivity to Azure services over an optimized route over the Azure backbone network. Endpoints allow you to secure your critical Azure service resources to only your virtual networks. Service Endpoints enables private IP addresses in the VNet to reach the endpoint of an Azure service without needing a public IP address on the VNet." And it is cheaper
  3. erima21 👍 9
    Correct! - Service endpoints does not remove public endpoint. - Private endpoints remove public access.
  4. chatlisi 👍 7 Answered D
    Storage 1 can be accessed from on prem via Private Endpoint only (Service Endpoint does not support on prem access) Storage 2 should be via Service Endpoint since the communication is within Azure only.
  5. RVR 👍 6
    Considering they want to meet business requirements as well which says "Litware wants to minimize costs whenever possible, as long as all other requirements are met" - a service endpoint will be fine
Show 25 more comments
  1. leocopek 👍 6
    correct answer is A. service endpoint still have public endpoint
  2. staffo 👍 5
    Both answers are technically correct (As the public ip is already blocked) except when it comes to costs. Service Endpoints are free and private endpoints include additional costs. So to minimise costs use Service Endpoints.
  3. derp12352 👍 5
    It doesn't matter if a service endpoint uses the public IP. You can still use it without EXPOSING it (the requirement listed). You would just have public access disabled.
  4. cerifyme85 👍 4 Answered D
    Service endpoint is free -- Business req --> minimise cost https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/service-endpoints-vs-private-endpoints/ba-p/3962134#:~:text=Cost,free%20of%20use)
  5. Jorex 👍 4
    That's a requirement for storage1.
  6. siddique12345 👍 3
    According to this link, service point is the answer: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview#key-benefits Service endpoints enable securing of Azure service resources to your virtual network by extending VNet identity to the service. Once you enable service endpoints in your virtual network, you can add a virtual network rule to secure the Azure service resources to your virtual network. The rule addition provides improved security by fully removing public internet access to resources and allowing traffic only from your virtual network.
  7. unclegrandfather 👍 3
    Appeared on exam Jun/28/22. There were two separate questions, one about storage1 and one about storage2. Understand the concepts behind both.
  8. Jorex 👍 3
    It is saying without exposing, so service endpoint still good, and cheaper.
  9. jkklim 👍 3
    agreed. It is A
  10. Fearless90 👍 2
    https://www.techtarget.com/searchcloudcomputing/tip/Compare-Azure-Private-Link-vs-service-endpoints#:~:text=What%20are%20the%20differences%3F,them%20directly%20into%20your%20VNet. What are the differences? The primary difference between these methods to restrict access is that while service endpoints keep PaaS resources outside your VNet, Private Link brings them directly into your VNet. https://samcogan.com/service-endpoints-and-private-link-whats-the-difference/ The key difference between Private Link and Service Endpoints is that with Private Link you are injecting the multi-tenant PaaS resource into your virtual network. With Service Endpoints, traffic still left you vNet and hit the public endpoint of the PaaS resource, with Private Link the PaaS resource sits within your vNet and gets a private IP on your vNet. When you send traffic to the PaaS resource, it does not leave the virtual network.
  11. Fearless90 👍 2 Answered A
    A. a private endpoint https://docs.microsoft.com/en-us/azure/private-link/private-link-overview What is Azure Private Link? Azure Private Link enables you to access Azure PaaS Services (for example, Azure Storage and SQL Database) and Azure hosted customer-owned/partner services over a private endpoint in your virtual network. Traffic between your virtual network and the service travels the Microsoft backbone network. Exposing your service to the public internet is no longer necessary. You can create your own private link service in your virtual network and deliver it to your customers. Setup and consumption using Azure Private Link is consistent across Azure PaaS, customer-owned, and shared partner services.
  12. Breadfan 👍 2
    Answer is D a service Endpoint. If you only need a secure connection between the virtual network and another resource, you should use a service endpoint, which means your resources will still have public exposure and you will be accessing those resources using the public endpoint of the resource. However, if you need to access your azure resources from on-premises through an Azure gateway, a regionally peered virtual network, or a globally peered virtual network, use a private endpoint. The private endpoint will allow connection using the private IP of the resources, eliminating the public exposure completely.
  13. manny72 👍 2 Answered D
    The whole reason why service endpoints are there is to provide secure access from Azure subnets to supported services like storage accounts. If you don't use a SE in this case, then when? It has no cost compared to a private endpoint and you can select the subnets to give access to and block the others and the public access. The way it works is that it uses public IP but instead of the route being directed through the internet, it goes through the Microsoft backbone network. So even with public access blocked, it's still reachable from selected networks.
  14. kinder2 👍 2 Answered A
    Azure Private Link provides the following benefits: On-premises and peered networks: Access services running in Azure from on-premises over ExpressRoute private peering, VPN tunnels, and peered virtual networks using private endpoints. There's no need to configure ExpressRoute Microsoft peering or traverse the internet to reach the service. Private Link provides a secure way to migrate workloads to Azure.
  15. TJ001 👍 2
    Service end point still connect to public IP of the storage account ...The question should have been better phrased to have proper use case for service endpoint..I
  16. Jorex 👍 2
    My bad, at the beginning it is saying public IP is blocked, so I misunderstood exposing, so agree, it is A in this case.
  17. cerifyme85 👍 2
    Sorry was wrong A PEP --> Removes public access totallt SEP --> Connection still made to Public endpoint .. privately
  18. Rododendron2 👍 2 Answered D
    D - requirements met & better cost. As well, there shall not be access from on premises - additional work to filter
  19. GBAU 👍 2
    How did this end up in this one, it was meant for the other version of the question, doh!
  20. HTD 👍 2
    also need access from onsite ...so private point is right
  21. c2e9cb4 👍 2 Answered D
    i validate reponse D for low cost and fiting requiremnet
  22. examtaker20398 👍 2 Answered A
    Service Endpoints expose a Public IP address still
  23. promto 👍 2 Answered A
    private ip - no public access
  24. Steveandlewis 👍 1
    To provide access to storage2 while meeting the PaaS networking requirements and the business requirements, you should use Private Endpoint. Private Endpoint allows a network interface with a private IP address to be created in your Azure Virtual Network (VNet). The private IP address provides secure and direct connectivity to your PaaS service, in this case storage2, over a private link. This ensures that the data between your VNet and storage2 traverses over the Microsoft backbone network, eliminating exposure to the public internet. This method aligns with the business requirement of minimizing costs as it does not require any additional outbound data transfer costs that are associated with other methods like service endpoints. It also satisfies the PaaS networking requirement of making storage2 accessible from Vnet2 and Vnet3 without exposing the public endpoint of storage2. Remember to set up the necessary DNS configurations for Private Endpoint to ensure that the requests to storage2 are routed through the private endpoint.
  25. Fearless90 👍 1
    https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview Virtual Network service endpoints Virtual Network (VNet) service endpoint provides secure and direct connectivity to Azure services over an optimized route over the Azure backbone network. Endpoints allow you to secure your critical Azure service resources to only your virtual networks. Service Endpoints enables private IP addresses in the VNet to reach the endpoint of an Azure service without needing a public IP address on the VNet. Note Microsoft recommends use of Azure Private Link for secure and private access to services hosted on Azure platform. For more information, see Azure Private Link.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Private Endpoint UDR Routing Prerequisite

S-grade

Minimum Azure Service Endpoints for Peered VNets

S-grade

Logging Application of Specific NSG Rules

S-grade

Azure DNS Private Resolver Minimum Deployment

S-grade

Practice All AZ-700 Questions

Access 100 questions with complete answers and detailed explanations.

View Full AZ-700 Practice Test →

← Back to AZ-700 Study Guide