Microsoft Certified: DevOps Engineer ExpertDevelop a security and compliance planHard
A DevOps team is developing a new serverless application using Azure Functions. The application needs to connect to an on-premises database securely, without exposing the Azure Function to the public internet or requiring complex network configurations. The on-premises network has a site-to-site VPN connection to an Azure Virtual Network (VNet). Which Azure Functions networking feature should be enabled to allow secure, private access to the on-premises database?
- AAzure Front Door with Web Application Firewall (WAF)
- BHybrid Connections for Azure Function
- CPrivate Endpoint connection to Azure Function
- DVNet Integration for Azure Function
Show answer & explanationAnswer & explanation
Correct answer: D. VNet Integration for Azure Function
Azure Functions VNet Integration allows your function app to access resources within your VNet, including resources reachable through VNet gateways (like a VPN Gateway connecting to an on-premises network). This enables secure, private access to the on-premises database without exposing the function to the public internet.
Why the other options are wrong
- A. Azure Front Door with WAF protects *inbound* traffic to web applications and does not facilitate outbound connectivity from an Azure Function to an on-premises database.
- B. Hybrid Connections provide a secure, simplified way to connect to on-premises resources, but VNet Integration is generally preferred and more robust for complex VNet scenarios with VPNs, offering full VNet capabilities.
- C. Private Endpoint provides *inbound* private access to the Azure Function, but the requirement is for *outbound* access from the Function to an on-premises resource.
Azure Functions VNet Integration
A networking feature that allows an Azure Function app to access resources within an Azure Virtual Network and resources reachable through that VNet, including on-premises networks via VPN/ExpressRoute.
- Enables outbound traffic from the Function into the VNet.
- Does not provide inbound access to the Function from the VNet.
- Simplifies secure connectivity to private resources without public internet exposure.
Memory trick: Integrate your Function into the VNet, and it can 'see' On-Prem!