Microsoft Cybersecurity Architect (SC-100)Design security for applications and dataMedium
A healthcare organization is deploying a new patient portal application to Azure App Service. The application needs to securely connect to a backend Azure SQL Database that contains sensitive patient health information (PHI). To comply with HIPAA regulations, all traffic between the App Service and the SQL Database must remain entirely within the Azure backbone network and not traverse the public internet. The security architect also needs to ensure that the SQL Database is not publicly accessible. Which networking service should be used to establish this secure and private connection?
- AAzure Traffic Manager
- BAzure Firewall
- CAzure Private Link
- DAzure CDN
Show answer & explanationAnswer & explanation
Correct answer: C. Azure Private Link
Azure Private Link enables you to access Azure PaaS Services (like Azure SQL Database) and Azure hosted customer/partner services over a private endpoint in your virtual network. This keeps traffic entirely within the Azure backbone network, ensuring it does not traverse the public internet and making the database privately accessible.
Why the other options are wrong
- A. Azure Traffic Manager is a DNS-based traffic load balancer, not for establishing private network connections to PaaS services.
- B. Azure Firewall provides network security and filtering but does not establish private connectivity to PaaS services from within a VNet.
- D. Azure CDN (Content Delivery Network) is used for content caching and delivery, not for private connectivity to backend services.
Azure Private Link
Azure Private Link provides private connectivity from your virtual network to Azure PaaS services, customer-owned services, or Microsoft partner services. It uses private endpoints, ensuring traffic remains on the Microsoft Azure backbone network.
- Access Azure PaaS services privately.
- Traffic stays on the Azure backbone.
- Protects against data exfiltration.
- Simplifies network architecture.
Memory trick: Private Link is like a dedicated, secure tunnel to Azure services.