AZ-900 Describe Azure architecture and services Practice Question
Which Azure service enables the creation of private endpoints so that Azure PaaS services like Storage and SQL Database are accessible only through a private IP within a VNet?
⚠ Common exam trap
Candidates often confuse VNet Service Endpoints with Private Endpoints, not realizing that Service Endpoints still use the service's public endpoint (though with source network identity), while Private Endpoints provide a true private IP address within the VNet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Private Link with Private Endpoints
Azure Private Link with Private Endpoints is the correct service because it enables you to access Azure PaaS services (e.g., Storage, SQL Database) over a private IP address within your Virtual Network (VNet). This ensures traffic never traverses the public internet, as the private endpoint uses a network interface with a private IP from your VNet, mapping the PaaS service to your VNet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
VNet Service Endpoints
Why it's wrong here
VNet Service Endpoints extend the VNet identity to an Azure service, and traffic from the VNet to the service is routed over the Microsoft backbone. However, the service's endpoint remains a public IP address; only the source VNet is identified, not the destination as private. This reduces exposure but does not create a fully private connection with a private IP for the PaaS service. Therefore, it falls short of the requirement for using a private IP address.
- ✓
Azure Private Link with Private Endpoints
Why this is correct
Azure Private Link with Private Endpoints creates a network interface with a private IP from a VNet that maps to a specific PaaS service, such as Azure SQL Database or Azure Storage. Traffic to that private endpoint remains entirely within the Microsoft network and never traverses the public internet. This meets the requirement of using a private VNet IP address while keeping the connection fully private and secure. Because the PaaS service is effectively accessible via a private IP, all other conditions are satisfied.
- ✗
Azure Firewall
Why it's wrong here
Azure Firewall is a managed, cloud-based firewall that filters inbound and outbound traffic based on network and application rules. It can be placed in a hub VNet to inspect traffic headed to PaaS services, but it does not assign a private IP address to the PaaS service itself. The service still resolves to a public IP, and Azure Firewall merely controls access to that public endpoint. Thus, it fails to satisfy the requirement of using a private IP for the PaaS service.
- ✗
Network Security Groups
Why it's wrong here
Network Security Groups are stateful filters that allow or deny traffic based on source and destination IP addresses, ports, and protocols. Applying an NSG can restrict which VNet IPs can reach a PaaS service, but it does not assign a private IP address to the service or change its public endpoint. The PaaS service still has a public IP, and the NSG merely operates as a firewall rule set. Hence, NSGs cannot provide the required private IP connectivity.
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Virtual network
A virtual network is a software-based network that connects computers, servers, and devices over the internet or within a cloud environment, simulating a physical network without requiring dedicated hardware.
Key term
VNet
A virtual private network inside a cloud provider that lets you securely connect and isolate your cloud resources.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.