Q: 22

DRAG DROP You have an on-premises datacenter. You have an Azure subscription that contains a virtual machine named VM1. VM1 is connected to a virtual network named VNet1. VNet1 is connected to the on-premises datacenter by using a Site-to- Site (S2S) VPN. You plan to create an Azure storage account named storage1 and App1. You need to ensure that network communication to each resource meets the following requirements:
• Connections to App1 must be allowed only from corporate network NAT addresses.
• Connections from VNet1 to storage1 must use the Microsoft backbone network.
• The solution must minimize costs.
What should you configure for each resource? To answer, drag the appropriate components to the correct resources. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

Drag & Drop

Enable JavaScript to use the Drag & Drop feature.

A private endpoint
A service endpoint
An access restriction rule
Azure Private Link

Correct Answer:

Answer Area storage1:: B. A service endpoint App1:: C. An access restriction rule

Explanation

For storage1, the goal is to keep traffic from VNet1 on the Microsoft backbone network while minimizing costs. A service endpoint achieves this by extending the virtual network's private address space to the Azure service, ensuring traffic from the VNet to the storage account travels over the Azure backbone. Service endpoints are free of charge, making them the most cost-effective solution that meets the requirement.

For App1, access must be restricted to specific corporate network NAT addresses. An access restriction rule is the native feature within Azure App Service designed for this purpose. It allows you to create a priority-ordered list of allow/deny rules based on source IP addresses, directly fulfilling the requirement to filter incoming traffic.

References

Virtual Network service endpoints: Microsoft's official documentation states that service endpoints provide secure and direct connectivity to Azure services over the Azure backbone network. It also confirms their cost-effectiveness: "There's no additional charge for using service endpoints."

Source: Microsoft Learn, Virtual Network service endpoints, "Key benefits" and "Pricing and limits" sections.

Azure App Service access restrictions: This feature is used to filter inbound traffic to an App Service. The documentation details how to "add an access restriction rule" based on an IP address range to allow or deny traffic. This directly matches the requirement for App1.

Source: Microsoft Learn, Set up Azure App Service access restrictions, "Add access restriction rules" section.

Comparing Private Endpoints and Service Endpoints: While both can secure traffic, service endpoints are generally more cost-effective for securing access from a VNet. Private endpoints have associated costs for the endpoint itself and data processing. For the scenario described, a service endpoint is the most economical choice.

Source: Microsoft Learn, Compare Private Endpoints and Service Endpoints, "Comparison" table.

Microsoft Azure AZ-500 Real Exam Questions [2026 Update] Quiz

Premium Access Includes