A software vendor hosts one internal service inside its virtual network and must let a handful of customer networks reach that service over private addresses. Customers must not see the rest of the vendor's network, and the service must stay off the public internet. Which approach fits these constraints?
Show answer and explanation
Answer: D
A Private Link service publishes a single service placed behind a Standard Load Balancer, and each consumer creates a private endpoint in its own VNet to reach it over private IPs. Consumers see only that service, not the provider network, and nothing is exposed publicly. Peering exposes whole address spaces, a public balancer exposes the service to the internet, and service endpoints only cover Azure PaaS services rather than custom workloads.
Why the other options are wrong
- A. Peering each customer network with the vendor network would give those customers routing into the entire provider address space, which goes well beyond a single-service scope.
- B. A public load balancer is reachable from the internet by design. An IP allowlist limits who connects, but the service would still be publicly exposed, violating the requirement.
- C. Service endpoints extend a subnet's identity to Azure PaaS resources such as storage accounts. They do not publish a customer-hosted application to other tenants' networks.
Exam tip. Publish your own service privately to consumer VNets with Private Link service and private endpoints.