How Do You Give VM3 Private Access to VM1 and VM2 Across Tenants?
Short answer
Configure a Private Link service on VNet1 and a private endpoint on VNet2. VM3 connects through the endpoint to only the Private Link service frontend, not other Sub1 resources.
Question
You have an Azure subscription named Sub1 that contains a virtual network named VNet1.
VNet1 contains multiple virtual machines, including two virtual machines named VM1 and VM2.
Sub1 is linked to a Microsoft Entra tenant named contoso.com.
A partner company has an Azure subscription named Sub2 that contains a virtual network named VNet2. VNet2 contains a virtual machine named VM3.
Sub2 is linked to a Microsoft Entra tenant named fabrikam.com.
VM1 and VM2 contain data used by an application that runs on VM3.
You need to ensure that VM3 can access VM1 and VM2. The solution must deny VM3 access to any other resources in Sub1.
What should you configure on each virtual network? To answer, drag the components to the correct virtual networks. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Key Takeaways
You must map Azure Private Link roles correctly: the resource-owning VNet gets the Private Link service and the accessing VNet gets the private endpoint, which is the opposite of what many candidates drag.
This SC-500 scenario tests cross-tenant private connectivity between a provider VNet in contoso.com and a consumer VNet in fabrikam.com. The page establishes that the provider side uses an Azure Private Link service and the consumer side uses a private endpoint, so VM3 reaches only VM1 and VM2 rather than the whole Sub1 network.
Common mistake: The most common error is reversing the components by placing the private endpoint in VNet1 and the Private Link service in VNet2, or choosing VNet peering, which would grant broader access than the scoped VM1/VM2 requirement allows.
Expert Analysis
Why the Answer Is Correct
VNet1 belongs to Sub1 and contoso.com and hosts the target workloads VM1 and VM2. Azure Private Link requires the resource owner to publish the service through a Private Link service, typically associated with an internal load balancer frontend, so VNet1 must contain the Private Link service. VNet2 belongs to Sub2 and fabrikam.com, and VM3 is the consumer that needs access; the consumer creates a private endpoint in its own VNet that points to the provider's Private Link service. This gives VM3 a private IP address in VNet2 that maps only to the published service, satisfying the requirement to deny VM3 access to any other resources in Sub1.
Why Other Candidate Answers Are Wrong
Placing the private endpoint on VNet1 and the Private Link service on VNet2 reverses the provider and consumer roles and does not match how Private Link is provisioned across tenants. VNet peering between VNet1 and VNet2 would connect the networks far more broadly and would not naturally restrict VM3 to VM1 and VM2 only. Service endpoints are for Azure platform services such as Storage or SQL, not for exposing arbitrary virtual machines. A site-to-site VPN or ExpressRoute connection would also provide broader network reachability and does not provide the per-service scoping required here.
Community Comment Notes
As kungfumaster noted, "The options should be swapped," which reflects the frequent confusion about which VNet receives which Private Link component. jayelamos points to the correct doctrine that the "provider creates the Private Link Service and the consumer creates a endpoint" pointing to it. That provider-consumer split is the key to answering this drag-and-drop item correctly.
Official Reference
- https://learn.microsoft.com/en-us/azure/private-link/private-link-service-overview
- https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-overview
These links open the official vendor documentation in a new tab.
Exam Strategy
Anchor on ownership: the VNet that owns the resources to be shared gets the Private Link service, and the VNet containing the client that needs access gets the private endpoint. When a question adds a deny-other-resources requirement, prefer Private Link over peering or VPN because it exposes a specific service rather than the entire network.
Frequently Asked Questions
Why does VNet1 get the Private Link service instead of the private endpoint?
Could VNet peering meet the requirement to deny VM3 access to other Sub1 resources?
Discussion 2 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 2
-
kungfumaster 👍 2The options should be swapped
-
jayelamos 👍 1That's not correct https://learn.microsoft.com/hr-hr/azure/private-link/private-link-service-overview The provider creates the Private Link Service and the consumer creates a endpoint pointing to that Private Link Service.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SC-500 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SC-500 Practice Test →