Azure Private Link: Private Access to PaaS Services from Your VNet
Which Azure networking service provides private connectivity from a virtual network to Azure PaaS services without traffic going over the internet?
Quick Answer
Azure Private Link is the correct choice because it provides private connectivity from a virtual network to Azure PaaS services without traffic ever traversing the public internet. It works by creating a private endpoint within your VNet, which assigns a private IP address to the PaaS service, effectively bringing the service into your network. All data flows securely over the Microsoft Azure backbone network, eliminating exposure to the internet. On the AZ-900 exam, this concept tests your understanding of how to securely connect to services like Azure SQL Database or Storage while maintaining network isolation. A common trap is confusing Azure Private Link with Service Endpoints—remember that Private Link uses private IPs and is more granular, while Service Endpoints still route traffic over the Microsoft backbone but use public endpoints. For a memory tip, think “Private Link = Private IP, Private path” to recall that it keeps traffic completely off the internet.
⚠ Common exam trap
Many candidates confuse Azure Service Endpoints with Private Link, assuming both provide the same level of privacy, but Service Endpoints still use the service's public endpoint and do not offer the same isolation as Private Link's private IP mapping.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Private Link
Azure Private Link (option B) is correct because it exposes Azure PaaS services via private IP addresses within a virtual network, using private endpoints that map the service to a network interface in the VNet. This ensures all traffic to the PaaS service traverses the Microsoft Azure backbone network, never the public internet, providing true private connectivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Service Endpoints
Why it's wrong here
Service Endpoints route traffic to Azure PaaS over the Azure backbone but do not provide private IP connectivity from the virtual network, so they fail the private-connectivity requirement. They are tempting because they do keep traffic off the public internet, making them correct when only internet avoidance, not private addressing, is needed.
- ✓
Azure Private Link
Why this is correct
Azure Private Link maps a private endpoint inside the virtual network to a specific PaaS resource, so service traffic traverses the Microsoft backbone rather than the public internet. This directly satisfies the stem's requirement for private connectivity without internet exposure.
- ✗
Azure VNet Peering
Why it's wrong here
VNet peering connects virtual networks to each other over the Microsoft backbone, not a VNet to PaaS services. It is tempting because it is private and avoids internet transit, but it would be correct for joining two virtual networks, not for reaching a PaaS endpoint privately.
- ✗
Azure ExpressRoute
Why it's wrong here
ExpressRoute provides private connectivity to Azure, but via a dedicated circuit from on-premises through a connectivity provider, not from a virtual network to PaaS. It is tempting because it also bypasses the public internet, yet it addresses hybrid WAN links, not in-VNet private endpoint access to PaaS.
Go deeper
Related to this question
Learn chapter
Azure Virtual Networks (VNet)
Key term
PaaS
Platform as a Service (PaaS) is a cloud computing model that provides a managed platform for developers to build, run, and manage applications without dealing with the underlying infrastructure.
Key term
VNet
A virtual private network inside a cloud provider that lets you securely connect and isolate your cloud resources.
About these practice questions
This AZ-900 question is part of Courseiva's 983-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which Azure service enables the creation of private endpoints so that Azure PaaS services like Storage and SQL Database are accessible only through a private IP within a VNet?
medium- A.VNet Service Endpoints
- ✓ B.Azure Private Link with Private Endpoints
- C.Azure Firewall
- D.Network Security Groups
Why B: Azure Private Link with Private Endpoints is the correct service because it enables you to access Azure PaaS services (e.g., Storage, SQL Database) over a private IP address within your Virtual Network (VNet). This ensures traffic never traverses the public internet, as the private endpoint uses a network interface with a private IP from your VNet, mapping the PaaS service to your VNet.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.