SC-100 Design security solutions for infrastructure Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Azure Service Endpoints

  Why it's wrong here

  Azure Service Endpoints do not encrypt any virtual machine traffic. They simply extend a VNet's identity and firewall rules to Azure PaaS services by exposing service-specific IP addresses, forcing traffic to those services over the Microsoft backbone instead of the public internet. However, the data payload between two VMs, even in the same subnet, remains unencrypted and untouched by service endpoints. Because zero trust requires protecting all VM-to-VM traffic, service endpoints only address a narrow PaaS access scenario and cannot meet this requirement.

• ✗

  Azure VPN Gateway

  Why it's wrong here

  Azure VPN Gateway creates IPsec tunnels only across untrusted boundaries, such as site-to-site VPNs from on-premises networks to Azure, or point-to-site VPNs from individual clients. It does not intercept, encrypt, or otherwise alter traffic that flows between virtual machines inside the same virtual network; such traffic is routed directly by the Azure fabric. The gateway itself is just a terminating endpoint for hybrid connectivity, not an inline proxy for internal east-west traffic. Therefore, it cannot satisfy a zero-trust requirement to encrypt all data in transit within Azure.

• ✗

  Azure Private Link

  Why it's wrong here

  Azure Private Link provides private connectivity from a VNet to Azure platform services or your own service by creating a private endpoint with a network interface in the VNet. It does not analyze, encrypt, or influence traffic between two VMs in the same network; it only changes the path for a specific PaaS service, removing exposure to public endpoints. Even for the private endpoint traffic itself, Private Link does not add IPsec encryption—it just relies on the underlying Azure network. Hence, it is fundamentally not a mechanism for VM-to-VM encryption and fails the zero-trust test.

• ✓

  Azure Virtual Network encryption

  Why this is correct

  Azure Virtual Network encryption is the correct solution because it applies IPsec encryption to all traffic between virtual machines and virtual network scale sets in the same VNet and between peered VNets. It uses AES-256-GCM with per-flow session keys that are negotiated automatically, and it is enforced on the Azure hypervisor vSwitch, making it transparent to applications and operating systems. This directly fulfills the zero-trust principle of 'assume breach' by ensuring no VM-to-VM traffic travels in plaintext, even within the trusted network perimeter.

Go deeper

Related to this question