Microsoft Certified: Azure AI Engineer AssociatePlan and manage an Azure AI solutionHard
A logistics company is developing an Azure AI solution to optimize delivery routes using Azure Maps and Azure Cognitive Services for geo-spatial analysis. They want to ensure that access to the Azure Maps service is restricted to specific applications within their virtual network and that all communication remains private. Which Azure networking feature should they use to achieve this?
- APublic endpoint with IP firewall rules.
- BVNet Service Endpoint.
- CAzure Private Endpoint.
- DNetwork Security Group (NSG) on the public endpoint.
Show answer & explanationAnswer & explanation
Correct answer: C. Azure Private Endpoint.
Azure Private Endpoint creates a private IP address for an Azure service within a virtual network, allowing private and secure access from within the VNet, effectively restricting access and keeping communication private without traversing the public internet.
Why the other options are wrong
- A. IP firewall rules on a public endpoint filter traffic but still expose the service to the public internet, which doesn't guarantee private communication within the VNet.
- B. VNet Service Endpoints extend your VNet's private address space to the Azure service, but Private Link/Endpoint offers a more comprehensive private connectivity solution, especially for services like Azure Maps that support it.
- D. An NSG on a public endpoint filters traffic but doesn't make the communication private within the VNet or prevent traffic from traversing the public internet.
Azure Private Endpoint
Azure Private Endpoint is a network interface that connects you privately and securely to a service powered by Azure Private Link. It uses a private IP address from your VNet, effectively bringing the service into your VNet.
- Provides private connectivity to Azure services from your VNet.
- Traffic travels over the Microsoft backbone network, not the public internet.
- Enhances security by eliminating public internet exposure.
Memory trick: Private Endpoint brings the service home, securely.