AZ-204 Develop Azure compute solutions Practice Question
A image resize worker runs in Azure App Service and must call a private API hosted inside a virtual network. Which feature allows outbound access from the app to the VNet?
⚠ Common exam trap
Watch out — candidates often confuse inbound connectivity (Private Endpoint) with outbound connectivity (VNet integration), leading candidates to select Private Endpoint when the question asks for outbound access from the app to the VNet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Regional VNet integration
Regional VNet integration enables an Azure App Service app to make outbound calls to resources in a virtual network (VNet) over the Microsoft backbone network. It uses a delegated subnet in the VNet to assign the app a network interface in the VNet, allowing it to reach private APIs without exposing them to the public internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Regional VNet integration
Why this is correct
Regional VNet integration is the correct solution as it enables an Azure App Service to establish outbound connectivity to resources located within a specified Azure Virtual Network. By injecting the App Service's outbound traffic into a delegated subnet within the VNet, it can securely access private endpoints, virtual machines, or other services that are not publicly exposed. This allows the image resize worker to call internal services or storage accounts privately.
- ✗
Azure CDN custom domain
Why it's wrong here
An Azure CDN custom domain is used to map a user-friendly URL to a CDN endpoint, primarily for accelerating the delivery of static and dynamic content to end-users globally. While it enhances content distribution, it provides no mechanism for an Azure App Service to establish outbound network connectivity into a private Azure Virtual Network. Its function is entirely focused on content delivery, not internal service communication.
- ✗
Application Gateway path routing
Why it's wrong here
Application Gateway path routing is a Layer 7 load balancing feature that directs incoming web traffic to different backend pools based on the URL path in the request. This functionality is designed for managing and distributing inbound client requests to web applications. It does not provide any capability for an Azure App Service to initiate outbound connections to resources residing within a private virtual network.
- ✗
Private Endpoint for the web app only
Why it's wrong here
A Private Endpoint for the web app creates a private IP address within a specified Virtual Network, enabling secure inbound connectivity to the web app from resources within that VNet. While it secures access to the web app, it does not provide the web app itself with the ability to initiate outbound connections into the VNet to access other private resources. It's a one-way private access mechanism.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.