Practice Test
True/False: Azure Service Endpoints allows access to Azure PaaS services using private IP addresses.
- True
- False
Answer: True
Explanation: Azure service endpoints provide secure and direct connectivity to Azure PaaS services over Microsoft’s backbone network, allowing access to these services using private IP addresses instead of internet routable ones.
Which of the following are benefits of using Azure Service Endpoints? Select all that apply.
- a) Increased data transfer rates
- b) Enhanced security
- c) Reduced latency
- d) Direct connectivity to Azure services using private IP addresses
Answer: b, d
Explanation: Azure Service Endpoints enhance the security by extending your virtual network private address space to the Azure service. They also provide direct connectivity to Azure services over the backbone network.
True/False: Azure Service Endpoints change the public-facing IP of your service to a private IP.
- True
- False
Answer: True
Explanation: Azure Service Endpoints switch your public IP to a private IP within a selected subnet.
Azure Service Endpoints can be enabled for which of these services? Select all that apply.
- a) Azure Storage
- b) Azure SQL Database
- c) Azure Key Vault
- d) Azure App Service
Answer: a, b, c
Explanation: Azure Service Endpoints can be enabled for various Azure services, including Azure Storage, Azure SQL Database and Azure Key Vault.
What protocol is used to connect to Azure services over Microsoft’s global network backbone when using Azure Service Endpoints?
- a) HTTP
- b) TCP
- c) UDP
- d) HTTPS
Answer: d
Explanation: Azure Service Endpoints use HTTP but the route connection to the services is done securely via HTTPS.
True/False: You can’t integrate Azure Service Endpoints with Azure Policy to enforce using virtual network service endpoints?
- True
- False
Answer: False
Explanation: You can integrate Service Endpoints with Azure Policy and enable the ‘Approved location’ property to enforce the use of service endpoints for virtual network access to services.
The Azure Service Endpoint is resilient to which type of attack?
- a) DNS hijacking
- b) IP spoofing
- c) Man-in-the-middle
- d) All of the above
Answer: d
Explanation: Azure Service Endpoints provide protection against data leakage risks, providing resilience against attacks such as IP spoofing, man-in-the-middle and DNS hijacking.
True/False: Azure Service Endpoints improve the reliability of applications by eliminating dependencies on public internet routes.
- True
- False
Answer: True
Explanation: Azure Service Endpoints eliminate internet route dependency, hence improving the reliability of applications.
Azure Service Endpoints enable you to secure Azure service resources to:
- a) Only your Azure Virtual Network
- b) Only your on-premises networks
- c) Both on-premises and Azure Virtual Network
- d) Neither on-premises nor Azure Virtual Network
Answer: a
Explanation: Azure Service Endpoints allow you to secure your Azure service resources to only your Azure Virtual Network.
True/False: Azure Service Endpoints can be implemented at the subscription level, service level, and individual resource level.
- True
- False
Answer: True
Explanation: Azure Service Endpoints offer granularity, allowing its implementation at various levels including the subscription, service, and individual resource levels.
What do you need to route traffic through Azure Service Endpoints?
- a) Public IP address
- b) Private IP address
- c) Both a and b
- d) Neither a nor b
Answer: b
Explanation: Azure Service Endpoints switch your public IP address to a private one, hence, you would need a private IP address.
True/False: Azure Service Endpoints support Azure Load Balancer.
- True
- False
Answer: False
Explanation: Currently, Azure Service Endpoints do not support Azure Load Balancer.
By enabling Azure Service Endpoints firewall, what type of traffic is allowed?
- a) Any internet-based traffic
- b) Only traffic from your virtual network
- c) Only traffic from your virtual network and Azure
- d) Only traffic from on-premise and Azure
Answer: c
Explanation: By enabling Azure Service Endpoints firewall, you only allow traffic from your virtual network and Azure’s infrastructure services.
Which of the following services can utilize Azure Service Endpoints for Vnet traffic filtering?
- a) Azure SQL Database
- b) Azure App Services
- c) Azure Storage Account
- d) All of the above
Answer: d
Explanation: Services like Azure SQL Database, App Services and Storage Account can all utilize Azure Service Endpoints to restrict access to its resources to a specific Vnet.
True/False: Azure service endpoints provide secure and direct connectivity to Azure PaaS services only.
- True
- False
Answer: True
Explanation: Azure service endpoints enable you to secure Azure service resources to only your Virtual Network and provide secure and direct connectivity to Azure PaaS services.
Interview Questions
What are Azure Service Endpoints?
Azure Service Endpoints are a feature of Azure that allows for secure and direct connectivity between your on-premises networks and your Azure services over Microsoft’s network.
What is the key benefit of implementing Azure Service Endpoints?
The key benefit is enhanced network security. Service Endpoints secure Azure services by eliminating exposure from the public internet and allowing access only from your virtual network.
Can Azure Service Endpoints be implemented for all Azure services?
No, Azure Service Endpoints can only be implemented for specific Azure services that support it, such as Azure Storage, Azure SQL Database, and others.
How do Azure Service Endpoints handle traffic routing?
Azure Service Endpoints make sure that all traffic destined for a service remains on Microsoft’s network, enhancing reliability and security.
How do I enable Azure Service Endpoints?
Azure Service Endpoints can be enabled via the Azure portal, PowerShell, CLI, or REST. You need to enable it for the specific subnet within the virtual network.
Can Azure Service Endpoints be used along with Azure Private Endpoints?
Yes, both Azure Private Endpoints and Azure Service Endpoints can be used together, depending on the compliance and networking requirements.
Can an Azure Service Endpoint be changed after it has been created?
Yes, an Azure Service Endpoint can be modified or deleted after creation. The changes take effect immediately.
What security measures can be paired with Azure Service Endpoints?
Network security group rules and Azure Firewall can be used to further secure your Azure Service Endpoints.
Does enabling Azure Service Endpoints incur any additional charges?
No, enabling Azure Service Endpoints does not incur any additional charges, but the standard pricing for the Azure services accessed by the endpoint still applies.
Can I use Azure Service Endpoints for access from on-premises networks to Azure services?
Yes, you can enable Azure Service Endpoints for on-premises networks by connecting them to Azure through a VPN gateway or ExpressRoute connection.
What is the effect of azure service endpoints on the public IP address of the Azure service?
Once the azure service endpoint is configured, the Azure service will seem to have an IP address within your Virtual Network (VNet) address space for all the resources within the subnet with the endpoint.
Can I restrict access to my Azure Storage Account using Azure Service Endpoints?
Yes, you can configure Azure Storage firewalls and virtual networks to allow requests only from specific subnets using Azure Service Endpoints.
Can I create service endpoints in Peered VNETs?
Yes, Create service endpoints in peered VNets is allowed only if the peered VNets are in the same subscription.
Is it possible to use service endpoints with App Service Environments?
Yes, App Service Environments (ASE) makes use of service endpoints to secure your apps to only your virtual network. This helps in providing an increased level of protection.
Can I track the network traffic that is flowing through the Service Endpoints?
Yes, Azure Monitor, along with Azure Log Analytics and Network Watcher, can help you to monitor and log network traffic that is going through your Service Endpoints.
extutorials.com