Secure storage, databases, and networking

Restricting Public Network Access to PaaS Resources

Azure platform services such as storage accounts, SQL databases, and Key Vault are reachable over the public internet by default. Securing them for an enterprise workload means layering network controls that progressively remove that public exposure.

Exam tip. Watch for a scenario where a private endpoint was created but public access still works. The missing step is almost always disabling public network access on the resource itself, or the private DNS zone was never linked to the virtual network.

Microsoft Purview: From Discovery to Enforcement

Microsoft Purview's information protection tools form a pipeline: find the sensitive data, classify it, then enforce protection and prevent its loss. Each stage uses a different feature, and exam scenarios usually hinge on picking the right stage.

Exam tip. If a scenario asks how to find out where sensitive data already exists before any policy is built, the answer is DSPM, not a DLP policy. DLP only acts once you tell it what pattern to look for and where to enforce it.

1. Fenwick Health Partners connected an on-premises datacenter to Azure over a VPN and created a private endpoint for Key Vault, but on-premises clients cannot resolve the vault's fully qualified domain name to the private endpoint's private IP address, so requests still route over the public internet path. What should be configured to fix name resolution?

• A. An Azure Private DNS zone for the Key Vault linked to the VNet, with on-premises DNS forwarding to Azure's DNS resolvercorrect
• B. A public DNS record pointing the vault's FQDN to its private IP address
• C. A network security group rule permitting DNS traffic
• D. A service endpoint added to the Key Vault's subnet

Private endpoint name resolution requires an Azure Private DNS zone linked to the VNet holding the private endpoint's record, and on-premises clients need DNS forwarding configured to route queries for that zone to Azure's DNS resolver. A public DNS record for a private IP would not be reachable from on-premises without the VPN and forwarding in place, and NSG rules or service endpoints do not address name resolution.

2. Brackenfield Financial stores sensitive customer records in an Azure Storage account. The security team wants application traffic to reach the storage account over the Microsoft backbone network using a private IP address, with no exposure to the public internet, while still allowing the storage firewall to deny all public network access. What should they implement?

• A. A service endpoint on the subnet
• B. A Network Security Group rule allowing the storage service tag
• C. Azure DDoS Network Protection on the virtual network
• D. A private endpoint for the storage account, connected through Azure Private Link, with public network access disabledcorrect

A private endpoint backed by Azure Private Link assigns the storage account a private IP inside the virtual network, allowing traffic to stay on the Microsoft backbone while public network access is disabled entirely. Service endpoints keep traffic on the Azure backbone too but the storage account still has a public endpoint and is reached via its public IP, not a private one. NSG rules with service tags only filter traffic, they do not create a private connection. DDoS Network Protection defends against volumetric attacks, it is unrelated to private connectivity.

3. Driftmoor Outfitters exposes a public web storefront through Azure Application Gateway. The security team wants to protect the application from common web exploits such as injection attacks and cross site scripting, using managed rule sets that are updated by Microsoft, without deploying additional infrastructure. What should they enable?

• A. Web Application Firewall on the Application Gateway, using the OWASP managed rule setcorrect
• B. A private endpoint for the Application Gateway
• C. Microsoft Defender for Containers
• D. A stored access policy on the backend storage account

Web Application Firewall integrated with Application Gateway inspects HTTP traffic against managed rule sets, such as the OWASP core rule set, to detect and block common web exploits like injection and cross site scripting at layer 7. A private endpoint changes network reachability, it does not inspect application layer content. Defender for Containers protects container workloads, unrelated to a public web gateway. A stored access policy governs storage SAS tokens, not web traffic inspection.