AZ-900 Describe Azure architecture and services Practice Question
Which Azure networking service allows you to privately access Azure PaaS services from your virtual network using a private IP address?
⚠ Common exam trap
Watch out — candidates often confuse Azure Service Endpoint with Private Endpoint; candidates often think Service Endpoint provides a private IP, but it only secures traffic to the service’s public endpoint via the Azure backbone, not a private IP address.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Private Endpoint
Azure Private Endpoint is correct because it assigns a private IP address from your virtual network to an Azure PaaS service (e.g., Azure SQL Database, Storage), enabling secure, private connectivity without traversing the public internet. This uses Azure Private Link to bring the service into your VNet, ensuring traffic stays within the Microsoft backbone network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Service Endpoint
Why it's wrong here
Azure Service Endpoints extend your VNet's identity and rules to an Azure service like Storage or SQL Database, but the service still resolves to its public IP address from the VNet's perspective. Traffic is routed over Microsoft's backbone rather than the public internet, yet no private IP from the VNet is assigned to the PaaS service. This makes it unsuitable when the requirement is a purely private connection with a private IP address.
- ✓
Azure Private Endpoint
Why this is correct
Azure Private Endpoint creates a network interface in your VNet with a private IP address, granting the PaaS service (e.g., SQL Database, Storage) a presence directly inside your virtual network. Traffic destined for that service traverses Microsoft's backbone and never leaves the network boundary, eliminating exposure to the public internet. This is precisely how you achieve private, IP-based access to Azure PaaS services with full VNet integration.
- ✗
Azure NAT Gateway
Why it's wrong here
Azure NAT Gateway provides outbound internet connectivity for subnets by translating private IPs to public IPs for initiated traffic from resources like VMs. It does not accept inbound connections or offer any private IP for PaaS services, so it cannot be used to bring a service like Storage or SQL into your VNet. Since the requirement is private inbound access to PaaS, NAT Gateway's outbound-only nature makes it an incorrect choice.
- ✗
Azure VPN Gateway
Why it's wrong here
Azure VPN Gateway establishes an encrypted IPSec/IKE tunnel between your on-premises network and an Azure VNet, enabling hybrid connectivity across the public internet. It is designed for site-to-site or point-to-site connectivity between networks, not for assigning a private IP to a PaaS service within a VNet. Thus, while it provides secure tunnels, it does not fulfill the scenario of connecting to an Azure PaaS service privately via a private endpoint.
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
PaaS
Platform as a Service (PaaS) is a cloud computing model that provides a managed platform for developers to build, run, and manage applications without dealing with the underlying infrastructure.
Key term
VNet
A virtual private network inside a cloud provider that lets you securely connect and isolate your cloud resources.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.