Exam AZ-140 topic 6 question 3 discussion

The service endpoint is not for a Windows server. Peering is the answer. https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview Pool2 in vNet2 (West US) must access storage 1 in East US (with vNet1). A private endpoint is for the storage account.

The answer to Vnet 1 is Cross-Region Peering The answer to Vnet2 is Service Endpoint, which is NOT public. When you enable a service endpoint, it provides secure and direct connectivity to Azure services over the Azure backbone network. This means that the traffic between your virtual network (VNet) and the Azure service remains within the Azure network and does not traverse the public internet.

Vnet1 - virtual network peering Vnet2 - service endpoint

Peering Private endpoint - Must be routed via backbone, service publicly routable https://learn.microsoft.com/en-us/answers/questions/1638218/confusion-on-service-endpoint-and-private-endpoint

I believe the correct answer is not provided for vnet1: There are three options to achieve this connection between vnet1 and vnet3, which we’ll discuss in this post: Global VNET peering VNET-to-VNET connection Expressroute

The private endpoint must be deployed in the same region and subscription as the virtual network. So, service endpoint https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-overview

for private endpoint you would need Vnet peering, privateDNS zone and DNS server set on both Vnets service endpoint is less admin and runs on MS backbone 1 - peering 2 - service endpoint

Peering and Private Endpoint for me... It must go through the Microsoft Backbone and a service endpoint remains a publicly routable IP. https://learn.microsoft.com/en-us/azure/private-link/private-link-faq#what-is-the-difference-between-service-endpoints-and-private-endpoints-:~:text=What%20is%20the,endpoint%20is%20configured.

vNet1 need network peerinng. vNet2 needs a service endpoint to the storage account. I wonder how long it will take for the moderator to moderate my answers.

For VNet1: Virtual Network peering (to connect with VNet3) For VNet2: A Service Endpoint for Microsoft.Storage (to access storage1) There is no need for private endpoints or VPN gateways based on the requirements have here

To establish the Network connection between virtual machines in VNet1 (Pool1 Session Hosts) and Vnet3 (Server1) Vnet Peering would be the best solution. To establish Local (Microsoft Backbone) connectivity between the Storage Account in East US and the Virtual Machines in Vnet2 (Pool2 Session Hosts) located in West US - You'd use a Private Endpoint https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal#about-virtual-network-endpoints https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal#about-virtual-network-endpoints Private Endpoint Across Regions: https://learn.microsoft.com/en-us/azure/private-link/private-link-faq#can-private-endpoint-connect-to-azure-paas-resources-across-azure-regions-

VNet2 should be a service endpoint. Cross-region service endpoints for Azure Storage became generally available in April 2023

"The traffic between virtual machines in peered virtual networks uses the Microsoft backbone infrastructure" Azure supports the following types of peering: -Virtual network peering: Connecting virtual networks within the same Azure region. -Global virtual network peering: Connecting virtual networks across Azure regions.