Exam AZ-500 topic 6 question 6 discussion

Yes, No, No is correct

Good explanation in following link https://stackoverflow.com/questions/73769449/azure-difference-between-service-endpoint-and-private-endpoint-in-simple-terms

Yes, No, NO: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview#:~:text=Service%20Endpoints%20enables%20private%20IP%20addresses%20in%20the%20VNet%20to%20reach%20the%20endpoint%20of%20an%20Azure%20service%20without%20needing%20a%20public%20IP%20address%20on%20the%20VNet.

Why do you all say that VMs use private IP to communicate just because there are service endpoints? We have no information about if KeyVault and StorageAccount firewalls are configured to connect via VNETs

Given answer is correct. YES - Service Endpoint itself has public IP (contrary to Private Endpoint), but still traffic originates from private IP NO - see above NO - Azure AD / Entra ID a public service on public IP, thus it uses public IP only

To support the question. https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview Virtual Network (VNet) service endpoint provides secure and direct connectivity to Azure services over an optimized route over the Azure backbone network. Endpoints allow you to secure your critical Azure service resources to only your virtual networks. Service Endpoints enables private IP addresses in the VNet to reach the endpoint of an Azure service without needing a public IP address on the VNet. The Microsoft.AzureActiveDirectory tag listed under services supporting service endpoints is used only for supporting service endpoints to ADLS Gen 1. Microsoft Entra ID doesn't support service endpoints natively. Answer = Y- N-N

I would go for Y,N,Y. 1. You connect to a Service Endpoint (Storage1) therefore you’ll use the private IP as outgoing. So the answer is Yes 2. You connect to a Service Endpoint (Vault1) Therefore you’ll use the private IP as outgoing. So the answer is No. 3. This is a wild guess, I would say both It might depend where to authenticate to. So I would go for Yes.

They still travel internally when going to another service endpoint in your tenant the service vs private is just that the service is also publicly routable if needed vs a private is only internal. Answers are Correct

THEY ARE REFERENCING A SERVICE ENDPOINT, NOT A PRIVATE ENDPOINT. THE ANSWERS ARE : N, Y, Y connections from VM1 to STORAGE 1 will always use PUBLIC IP connection from VM2 to VAULT 1 will always use PUBLIC IP authentication from VM3 to TENANT can use either PRIVATE or PUBLIC because it has no SERVICE ENDPOINT. Knew this already but the diagram here outlines it perfectly: https://stackoverflow.com/questions/73769449/azure-difference-between-service-endpoint-and-private-endpoint-in-simple-terms

On an exam on 7/8/23, agree with the answer provided.

what is the correct answer?