How Do You Give VM3 Private Access to VM1 and VM2 Across Tenants?
DRAG DROP
You have an Azure subscription named Sub1 that contains a virtual network named VNet1.
VNet1 contains multiple virtual machines, including two virtual machines named VM1 and VM2.
Sub1 is linked to a Microsoft Entra tenant named contoso.com.
A partner company has an Azure subscription named Sub2 that contains a virtual network named VNet2. VNet2 contains a virtual machine named VM3.
Sub2 is linked to a Microsoft Entra tenant named fabrikam.com.
VM1 and VM2 contain data used by an application that runs on VM3.
You need to ensure that VM3 can access VM1 and VM2. The solution must deny VM3 access to any other resources in Sub1.
What should you configure on each virtual network? To answer, drag the components to the correct virtual networks. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Community Insight
You must map Azure Private Link roles correctly: the resource-owning VNet gets the Private Link service and the accessing VNet gets the private endpoint, which is the opposite of what many candidates drag.
This SC-500 scenario tests cross-tenant private connectivity between a provider VNet in contoso.com and a consumer VNet in fabrikam.com. The page establishes that the provider side uses an Azure Private Link service and the consumer side uses a private endpoint, so VM3 reaches only VM1 and VM2 rather than the whole Sub1 network.
The most common error is reversing the components by placing the private endpoint in VNet1 and the Private Link service in VNet2, or choosing VNet peering, which would grant broader access than the scoped VM1/VM2 requirement allows.
Community Discussion (2 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
VNet1 belongs to Sub1 and contoso.com and hosts the target workloads VM1 and VM2. Azure Private Link requires the resource owner to publish the service through a Private Link service, typically associated with an internal load balancer frontend, so VNet1 must contain the Private Link service. VNet2 belongs to Sub2 and fabrikam.com, and VM3 is the consumer that needs access; the consumer creates a private endpoint in its own VNet that points to the provider's Private Link service. This gives VM3 a private IP address in VNet2 that maps only to the published service, satisfying the requirement to deny VM3 access to any other resources in Sub1.Why Other Candidate Answers Are Wrong
Placing the private endpoint on VNet1 and the Private Link service on VNet2 reverses the provider and consumer roles and does not match how Private Link is provisioned across tenants. VNet peering between VNet1 and VNet2 would connect the networks far more broadly and would not naturally restrict VM3 to VM1 and VM2 only. Service endpoints are for Azure platform services such as Storage or SQL, not for exposing arbitrary virtual machines. A site-to-site VPN or ExpressRoute connection would also provide broader network reachability and does not provide the per-service scoping required here.Community Comment Notes
As kungfumaster noted, "The options should be swapped," which reflects the frequent confusion about which VNet receives which Private Link component. jayelamos points to the correct doctrine that the "provider creates the Private Link Service and the consumer creates a endpoint" pointing to it. That provider-consumer split is the key to answering this drag-and-drop item correctly.Official Reference
Exam Strategy
Anchor on ownership: the VNet that owns the resources to be shared gets the Private Link service, and the VNet containing the client that needs access gets the private endpoint. When a question adds a deny-other-resources requirement, prefer Private Link over peering or VPN because it exposes a specific service rather than the entire network.
Frequently Asked Questions
Why does VNet1 get the Private Link service instead of the private endpoint?
VNet1 is the provider VNet that owns VM1 and VM2, so it publishes them through a Private Link service. The consumer VNet2 then creates the private endpoint that VM3 uses.
Could VNet peering meet the requirement to deny VM3 access to other Sub1 resources?
No. Peering connects the VNets broadly and does not provide per-service scoping, whereas Private Link exposes only the specific service behind the Private Link service.
Related Analysis
Practice All SC-500 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SC-500 Practice Test →