You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
- content: "Suppose a company wants clients in their Azure virtual network to have secure and nonpublic access to a particular Azure resource. Which of the following technologies should their IT staff add to their virtual network?"
18
-
choices:
19
-
- content: "Azure Service Endpoint"
20
-
isCorrect: false
21
-
explanation: "Incorrect. With Azure Service Endpoint, access to the resource still uses the resource's public IP address."
22
-
- content: "Azure Private Endpoint"
23
-
isCorrect: true
24
-
explanation: "Correct. Adding a Private Endpoint to a virtual network enables clients to access an Azure resource privately."
25
-
- content: "Azure Firewall"
26
-
isCorrect: false
27
-
explanation: "Incorrect. Implementing a firewall doesn't change resource access from public to private."
28
-
- content: "Suppose a company wants to give private access to Azure resources via an Azure virtual network. How does Azure Private Endpoint map an Azure resource to offer private access?"
29
-
choices:
30
-
- content: "By using an IP address from a subnet of an Azure virtual network."
31
-
isCorrect: true
32
-
explanation: "Correct. Private Endpoint maps an unused IP address from the address space of the subnet in which it resides."
33
-
- content: "By using a private IP address supplied by Azure."
34
-
isCorrect: false
35
-
explanation: "Incorrect. Azure doesn't supply an IP address to Private Endpoint."
36
-
- content: "By using Azure ExpressRoute private peering."
37
-
isCorrect: false
38
-
explanation: "Incorrect. ExpressRoute private peering is a technology that peers an on-premises network to an Azure virtual network."
39
-
- content: "Suppose a company wants to offer private access to a custom Azure service via Azure Private Link Service. Which of the following technologies is a requirement for implementing Private Link Service?"
40
-
choices:
41
-
- content: "Azure Application Gateway"
42
-
isCorrect: false
43
-
explanation: "Incorrect. Application Gateway isn't a requirement for using Private Link Service."
44
-
- content: "Azure Basic Load Balancer"
45
-
isCorrect: false
46
-
explanation: "Incorrect. Azure's basic version of its load balancer doesn't support Private Link Service."
47
-
- content: "Azure Standard Load Balancer"
48
-
isCorrect: true
49
-
explanation: "Correct. Azure's standard version of its load balancer is the one you must use for Private Link Service."
- content: "Suppose a company wants to give clients in their Azure virtual network secure and nonpublic access to a particular Azure resource. Which of the following technologies should their IT staff add to their virtual network?"
18
+
choices:
19
+
- content: "Azure Service Endpoint"
20
+
isCorrect: false
21
+
explanation: "Incorrect. With Azure Service Endpoint, access to the resource still uses the resource's public IP address."
22
+
- content: "Azure Private Endpoint"
23
+
isCorrect: true
24
+
explanation: "Correct. Adding a Private Endpoint to a virtual network enables clients to access an Azure resource privately."
25
+
- content: "Azure Firewall"
26
+
isCorrect: false
27
+
explanation: "Incorrect. Implementing a firewall doesn't change resource access from public to private."
28
+
- content: "Suppose a company wants to give private access to Azure resources via an Azure virtual network. How does Azure Private Endpoint map an Azure resource to offer private access?"
29
+
choices:
30
+
- content: "By using an IP address from a subnet of an Azure virtual network."
31
+
isCorrect: true
32
+
explanation: "Correct. Private Endpoint maps an unused IP address from the address space of the subnet in which it resides."
33
+
- content: "By using a private IP address supplied by Azure."
34
+
isCorrect: false
35
+
explanation: "Incorrect. Azure doesn't supply an IP address to Private Endpoint."
36
+
- content: "By using Azure ExpressRoute private peering."
37
+
isCorrect: false
38
+
explanation: "Incorrect. ExpressRoute private peering is a technology that peers an on-premises network to an Azure virtual network."
39
+
- content: "Suppose a company wants to offer private access to a custom Azure service via Azure Private Link Service. Which of the following technologies is a requirement for implementing Private Link Service?"
40
+
choices:
41
+
- content: "Azure Application Gateway"
42
+
isCorrect: false
43
+
explanation: "Incorrect. Application Gateway isn't a requirement for using Private Link Service."
44
+
- content: "Azure Basic Load Balancer"
45
+
isCorrect: false
46
+
explanation: "Incorrect. Azure's basic version of its load balancer doesn't support Private Link Service."
47
+
- content: "Azure Standard Load Balancer"
48
+
isCorrect: true
49
+
explanation: "Correct. Azure's standard version of its load balancer is the one you must use for Private Link Service."
Copy file name to clipboardExpand all lines: learn-pr/azure-networking/introduction-azure-private-link/includes/2-what-is-azure-private-link.md
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
Before you learn about Azure Private Link and its features and benefits, let's examine the problem that Private Link is designed to solve.
2
2
3
-
Contoso has an Azure virtual network and you want to connect to a PaaS resource such as an Azure SQL database. When you create such resources, you normally specify a *public endpoint* as the connectivity method.
3
+
Contoso has an Azure virtual network and wants to connect it to a PaaS resource such as an Azure SQL database. When you create such resources, you normally specify a *public endpoint* as the connectivity method.
4
4
5
5
Having a public endpoint means that the resource is assigned a public IP address. So, even though both your virtual network and the Azure SQL database are located within the Azure cloud, the connection between them takes place over the internet.
6
6
@@ -29,26 +29,26 @@ Private Link provides secure access to Azure services. Private Link achieves tha
29
29
Private Endpoint is the key technology behind Private Link. Private Endpoint is a network interface that enables a private and secure connection between your virtual network and an Azure service. In other words, Private Endpoint is the network interface that replaces the resource's public endpoint.
30
30
31
31
> [!NOTE]
32
-
> Private Endpoint is not a free service. You pay a set fee per hour, as well as a set fee per gigabyte for both inbound and outbound traffic that passes through the Private Endpoint.
32
+
> Private Endpoint isn't a free service. You pay a set fee per hour, and a set fee per gigabyte for both inbound and outbound traffic that passes through the Private Endpoint.
33
33
34
34
## What is Azure Private Link Service?
35
35
36
-
Private Link gives you private access from your Azure virtual network to PaaS services and Microsoft Partner services in Azure. However, what if your company has created its own Azure services for your company's customers to consume? Is it possible to offer those customers a private connection to your company's services?
36
+
Private Link gives you private access from your Azure virtual network to PaaS services and Microsoft Partner services in Azure. However, what if your company creates its own Azure services for your company's customers to consume? Is it possible to offer those customers a private connection to your company's services?
37
37
38
38
Yes, by using Azure Private Link Service. This service lets you offer Private Link connections to your custom Azure services. Consumers of your custom services can then access those services privately—that is, without using the internet—from their own Azure virtual networks.
39
39
40
40
> [!NOTE]
41
-
> There is no charge to use Private Link Service.
41
+
> There's no charge to use Private Link Service.
42
42
43
43
## Key benefits of Private Link
44
44
45
45
Private Link working together with Private Endpoint and Private Link Service provides the following benefits:
46
46
47
47
* Private access to PaaS services and Microsoft Partner services on Azure. When you use Private Endpoint, Azure services are mapped to your Azure virtual network. It doesn't matter that the Azure resource is in a different virtual network and in a different Active Directory tenant. To users in your Azure virtual network, the resource appears to be part of that network.
48
48
* Private access to Azure services in any region. Private Link works globally. The private connection to an Azure service works even if that service's virtual network is in a different region than your own virtual network.
49
-
* Nonpublic routes to Azure services. Once an Azure service has been mapped to your virtual network, the traffic route changes. All inbound and outbound traffic between your virtual network and the Azure service travels over the Microsoft Azure backbone network. The public internet is never used for service traffic.
49
+
* Nonpublic routes to Azure services. Once an Azure service is mapped to your virtual network, the traffic route changes. All inbound and outbound traffic between your virtual network and the Azure service travels over the Microsoft Azure backbone network. The public internet is never used for service traffic.
50
50
* Public endpoints are no longer required. Because all traffic to and from a mapped Azure service now flows over the Microsoft Azure backbone, the public endpoint for the service is no longer required. You can disable that public endpoint and therefore eliminate a possible security threat.
51
-
* Your peered Azure virtual networks also get access to Private Link-powered resources. If you're using one or more peered Azure virtual networks, no extra configuration is needed for those peered networks to access a private Azure resource. Clients within any peered network can access whatever Private Endpoint you've mapped to an Azure service.
51
+
* Your peered Azure virtual networks also get access to Private Link-powered resources. If you're using one or more peered Azure virtual networks, no extra configuration is needed for those peered networks to access a private Azure resource. Clients within any peered network can access whatever Private Endpoint you map to an Azure service.
52
52
* Your on-premises network also gets access to Private Link-powered resources. Does your on-premises network connect to your Azure virtual network using either ExpressRoute private peering or a VPN tunnel? If so, no extra configuration is needed for clients within the on-premises network to access a private Azure resource.
53
53
* Protection against data exfiltration. When you map a Private Endpoint to an Azure service, you map to a specific instance of that service. For example, if you're setting up private access to Azure Storage, you map the access to a blob, table, or other storage instance. If a virtual machine in your network gets compromised, the attacker can't move or copy data to another resource instance.
54
54
* Private access to your own Azure services. You can implement Private Link Service and offer customers private access to your custom Azure services.
Copy file name to clipboardExpand all lines: learn-pr/azure-networking/introduction-azure-private-link/includes/3-how-azure-private-link-works.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -21,7 +21,7 @@ Private Endpoint takes an unused private IP address from the address space of a
21
21
Private Endpoint gets an IP address from the same address space, such as 10.1.0.32. Private Endpoint then maps that address to a specified Azure service. Using the private IP address effectively brings the service into your virtual network.
22
22
23
23
> [!NOTE]
24
-
> Clients that connect to a Private Link resource don't need to use the Private Endpoint's assigned IP address in the connection string. Instead, if you configure the Private Endpoint to integrate with your private DNS zone, then Azure automatically assigns a FQDN to the endpoint. For example, if the Private Link resource is an Azure Storage table, the FQDN will be something like mystorageaccount1234.table.core.windows.net.
24
+
> Clients that connect to a Private Link resource don't need to use the IP address assigned to the Private Endpoint in the connection string. Instead, if you configure the Private Endpoint to integrate with your private DNS zone, then Azure automatically assigns a fully qualified domain name (FQDN) to the endpoint. For example, if the Private Link resource is an Azure Storage table, the FQDN is something like mystorageaccount1234.table.core.windows.net.
25
25
26
26
Here are a few key points to consider when evaluating Private Endpoint:
27
27
@@ -34,11 +34,11 @@ Here are a few key points to consider when evaluating Private Endpoint:
34
34
* You can map a maximum of 1,000 Private Endpoint interfaces to the same Private Link resource.
35
35
36
36
> [!CAUTION]
37
-
> Although it's possible to map multiple Private Endpoint interfaces to a single resource, it's not recommended because doing so can lead to DNS conflicts and other problems. The best practice is to map only a single Private Endpoint to a single Private Link resource.
37
+
> Although it's possible to map multiple Private Endpoint interfaces to a single resource, it isn't recommended. Doing so can lead to Domain Name System (DNS) conflicts and other problems. The best practice is to map only a single Private Endpoint to a single Private Link resource.
38
38
39
39
* Connections are one way, meaning that only clients can connect to a Private Endpoint interface. If an Azure service is mapped to a Private Endpoint interface, the provider of that service can't connect to (or even perceive) the Private Endpoint interface.
40
40
* A deployed Private Endpoint interface is read-only, meaning that no one can modify it. For example, no one can map the interface to a different resource, nor can anyone change the interface's IP address.
41
-
*Although you must deploy the Private Endpoint in the same region as your virtual network, the Private Link resource can be located in a different region.
41
+
*You must deploy the Private Endpoint in the same region as your virtual network, but the Private Link resource can be located in a different region.
42
42
43
43
> [!NOTE]
44
44
> What is the difference between a service endpoint and a private endpoint? A *service endpoint* configures an Azure resource to allow connections only from a specified virtual network. However, that connection is still made via the resource's public endpoint, so some security risks remain. Private Endpoint removes those risks by supporting the disabling of a resource's public endpoint.
Copy file name to clipboardExpand all lines: learn-pr/azure-networking/introduction-azure-private-link/includes/4-when-to-use-azure-private-link.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,7 +11,7 @@ As part of your Azure Private Link evaluation, you know that Contoso has several
11
11
12
12
## Bringing Azure PaaS services into your virtual network
13
13
14
-
Depending on the resource and how it's configured, connecting to Azure PaaS services can be complicated. Private Link reduces that complexity by making Azure services appear to be just another node on your Azure virtual network. With a Private Link resource now effectively part of your virtual network, clients can use a relatively straightforward FQDN to make the connection.
14
+
Depending on the resource and how you configure it, connecting to Azure PaaS services can be complicated. Private Link reduces that complexity by making Azure services appear to be just another node on your Azure virtual network. With a Private Link resource now effectively part of your virtual network, clients can use a relatively straightforward fully qualified domain name (FQDN) to make the connection.
15
15
16
16
## Securing traffic between your company network and the Azure cloud
17
17
@@ -27,7 +27,7 @@ Most Azure PaaS resources are internet-facing. These resources have, by default,
27
27
28
28
The public endpoint exposes the resource to the internet, which is by design. However, that endpoint can also act as an attack point for black-hat hackers seeking a way to infiltrate or disrupt the service.
29
29
30
-
Private Link doesn't do anything to prevent such attacks. However, once you've created a Private Endpoint and mapped it to the Azure resource, you no longer need the resource's public endpoint. Fortunately, you can configure the resource to disable its public endpoint so that it no longer presents an attack surface to the internet.
30
+
Private Link doesn't do anything to prevent such attacks. However, once you create a Private Endpoint and map it to the Azure resource, you no longer need the resource's public endpoint. Fortunately, you can configure the resource to disable its public endpoint so that it no longer presents an attack surface to the internet.
31
31
32
32
## Accessing Azure PaaS resources across networks
33
33
@@ -43,7 +43,7 @@ Without Private Link, these networks must create their own connections to a spec
43
43
44
44
Suppose a virtual machine in your network is connected to an Azure service. It's often possible for a user on the virtual machine to access multiple resources in the Azure service. For example, if the service is Azure Storage, a user could access multiple blobs, tables, files, and so on.
45
45
46
-
Now suppose that the user is a malicious infiltrator who has taken control of the virtual machine. In that scenario, the user could move data from one resource to another one that they control.
46
+
Now suppose that the user is a malicious infiltrator who takes control of the virtual machine. In that scenario, the user could move data from one resource to another one that they control.
47
47
48
48
This scenario is an example of *data exfiltration*. Private Link lowers the risk of data exfiltration by mapping a Private Endpoint to a single instance of an Azure resource. An attacker might still be able view the data, but has no way to copy or move it to another resource.
49
49
@@ -57,7 +57,7 @@ Suppose your company creates custom Azure services. Who consumes those services?
57
57
* Company suppliers or vendors.
58
58
* Your company's employees.
59
59
60
-
You can say that each consumer in the above list is a *customer* of your service.
60
+
You can say that each consumer in this list is a *customer* of your service.
61
61
62
62
There's an excellent chance that the data accessed and created by those customers is every bit as important as your company's data. So your customer's data deserves the same level of privacy and security as your company data.
0 commit comments