Exam AZ-700 topic 7 question 2 discussion

Azure Service Endpoint provides secure and direct connectivity to Azure PaaS services over an optimized route over the Azure backbone network. Traffic still left your VNet and hit the public endpoint of PaaS service. ==> Then it can't meet the goal because of the public IP Azure Private Link (or Private Endpoint) allows you to access Azure PaaS services over Private IP address within the VNet. It's then OK A is the answer

"Virtual Network (VNet) service endpoint provides secure and direct connectivity to Azure services over an optimized route over the Azure backbone network. Endpoints allow you to secure your critical Azure service resources to only your virtual networks. Service Endpoints enables private IP addresses in the VNet to reach the endpoint of an Azure service without needing a public IP address on the VNet." And it is cheaper

Service endpoints allow you to connect directly to Azure services (like storage accounts) from specific VNets. They extend your virtual network’s private IP space to Azure storage, ensuring access from VNet2 and VNet3 but preventing exposure of the public endpoint. • You cannot use a private endpoint here because it is designed for specific resource access (like databases), and service endpoints are the preferred choice for storage.

The whole reason why service endpoints are there is to provide secure access from Azure subnets to supported services like storage accounts. If you don't use a SE in this case, then when? It has no cost compared to a private endpoint and you can select the subnets to give access to and block the others and the public access. The way it works is that it uses public IP but instead of the route being directed through the internet, it goes through the Microsoft backbone network. So even with public access blocked, it's still reachable from selected networks.

To provide access to storage2 while meeting the PaaS networking requirements and the business requirements, you should use Private Endpoint. Private Endpoint allows a network interface with a private IP address to be created in your Azure Virtual Network (VNet). The private IP address provides secure and direct connectivity to your PaaS service, in this case storage2, over a private link. This ensures that the data between your VNet and storage2 traverses over the Microsoft backbone network, eliminating exposure to the public internet. This method aligns with the business requirement of minimizing costs as it does not require any additional outbound data transfer costs that are associated with other methods like service endpoints. It also satisfies the PaaS networking requirement of making storage2 accessible from Vnet2 and Vnet3 without exposing the public endpoint of storage2. Remember to set up the necessary DNS configurations for Private Endpoint to ensure that the requests to storage2 are routed through the private endpoint.

Service endpoint is free -- Business req --> minimise cost https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/service-endpoints-vs-private-endpoints/ba-p/3962134#:~:text=Cost,free%20of%20use)

i validate reponse D for low cost and fiting requiremnet

D - requirements met & better cost. As well, there shall not be access from on premises - additional work to filter

This question is likely EOL given: https://learn.microsoft.com/en-us/azure/expressroute/about-fastpath Virtual network (VNet) Peering FastPath sends traffic directly to any VM deployed in a virtual network peered to the one connected to ExpressRoute, bypassing the ExpressRoute virtual network gateway. This feature is available for both IPv4 and IPv6 connectivity. So with FastPath to Vnet1, it sends traffic directly to Vnet2 and Vnet3 as well (both being peered). I take this to mean no new connections for the circuit needed, and no need for a gateway transit in the peering.

It doesn't matter if a service endpoint uses the public IP. You can still use it without EXPOSING it (the requirement listed). You would just have public access disabled.

In exam Feb, 2023

"Virtual Network (VNet) Service Endpoint provides secure and direct connectivity to (native)Azure services"(NOT the private services provisioned by you). Private Endpoint brings the private services provisioned by you(like Azure Storage, Azure SQL Database etc.) to the VNet.

Both answers are technically correct (As the public ip is already blocked) except when it comes to costs. Service Endpoints are free and private endpoints include additional costs. So to minimise costs use Service Endpoints.

Service end point still connect to public IP of the storage account ...The question should have been better phrased to have proper use case for service endpoint..I

Storage 1 can be accessed from on prem via Private Endpoint only (Service Endpoint does not support on prem access) Storage 2 should be via Service Endpoint since the communication is within Azure only.

A - private endpoint - a service endpoint does not remove the public endpoint. The storage account could be accessed both through the service endpoint and publicly. I have a hard time imagining that service endpoint is the correct answer to any question that would appear on the test today.

D is correct