Microsoft Certified: Azure Security Engineer AssociateImplement platform protectionMedium
A security architect is designing the network topology for a highly sensitive application in Azure. The application's virtual machines (VMs) must not have direct internet access but still need to connect to Azure services like Azure Storage and Azure SQL Database securely, using the Azure backbone network instead of public endpoints. Which network security feature should be implemented to achieve this secure and private connectivity to Azure services?
- ANetwork Security Groups (NSGs)
- BAzure Virtual WAN
- CAzure Private Link
- DVPN Gateway
Show answer & explanationAnswer & explanation
Correct answer: C. Azure Private Link
Azure Private Link enables private connectivity to Azure platform as a service (PaaS) services directly from your Azure Virtual Networks over a private endpoint. This ensures that traffic remains within the Azure backbone network, enhancing security by eliminating exposure to the public internet.
Why the other options are wrong
- A. NSGs filter traffic but do not change the public nature of service endpoints or route traffic over the private backbone to PaaS services.
- B. Azure Virtual WAN is a networking service that brings many networking, security, and routing functionalities together to provide a single operational interface, but it's not the specific feature for private PaaS connectivity from within a VNet.
- D. VPN Gateway connects your on-premises networks to Azure, or Azure VNets to each other, but doesn't provide private access to Azure PaaS services from within a VNet.
Azure Private Link
A service that enables you to access Azure PaaS services (for example, Azure Storage and Azure SQL Database) and Azure-hosted customer/partner services over a private endpoint in your virtual network.
- Traffic remains on the Microsoft Azure backbone network.
- Eliminates data exposure to the public internet.
- Simplifies network architecture by keeping traffic within your VNet.
Memory trick: Private Link is your secret tunnel to Azure services.