Microsoft Certified: Azure Security Engineer AssociateImplement platform protectionMedium
A security architect is designing the network topology for a highly sensitive application hosted in Azure. The application's backend database, an Azure SQL Database, must not be accessible via the public internet, even from within the Azure VNet where the application servers reside. All traffic to the database must traverse a private endpoint within the VNet. Which Azure networking feature should the architect implement?
- AService Endpoints
- BAzure VPN Gateway
- CNetwork Security Groups (NSGs)
- DPrivate Link
Show answer & explanationAnswer & explanation
Correct answer: D. Private Link
Azure Private Link enables you to access Azure PaaS services (like Azure SQL Database) and Azure hosted customer/partner services over a private endpoint in your virtual network. This ensures that traffic remains entirely on the Microsoft backbone network, eliminating exposure to the public internet.
Why the other options are wrong
- A. Service Endpoints extend your VNet's private address space and identity to Azure services, but traffic still uses the public backbone, albeit with VNet source IP.
- B. Azure VPN Gateway connects on-premises networks to Azure VNets, not for privately accessing Azure PaaS services from within Azure.
- C. NSGs filter traffic at the network interface or subnet level, but don't inherently remove public endpoints for PaaS services.
Azure Private Link
Azure Private Link provides private connectivity from your Azure virtual networks to Azure PaaS services, customer-owned services, or partner services, ensuring traffic stays on the Microsoft backbone network.
- Exposes services via a private endpoint in your VNet.
- Traffic travels over the Azure backbone network, not public internet.
- Improves security by eliminating data exfiltration risks.
- Supports various Azure PaaS services (SQL, Storage, Key Vault, etc.).
Memory trick: Private Link: Your secret tunnel to Azure services.