Pass Your Microsoft SC-500 Exam Easy!

A working Blob private endpoint already exists. Creating another or disabling public access without fixing the spoke resolver would still leave this client resolving the wrong address.

On-premises hybrid forwarding is a separate scenario. This fault occurs in a spoke VNet whose custom DNS server forwards Blob names outside the linked private-zone resolution path.

Separate endpoint subresources are necessary when using other Storage APIs, but Blob is already available privately and its spoke DNS forwarding is the remaining defect.

Changing private DNS is unwarranted when the client already resolves and connects to the approved private endpoint.

Recreating a private endpoint addresses reachability, but the endpoint is already approved and the client reaches the intended private service address.

Adding a storage subresource private endpoint enables a separate API, not the data permission denied by this already connected endpoint.

Refreshing a private DNS A record is premature when the target resource has not approved the requested endpoint association.

Creating a private DNS zone does not approve a pending Private Endpoint connection on the destination service.

Changing application permissions cannot activate an endpoint whose provider-side connection state is still Pending.

Azure RBAC controls data permissions, not which IP address DNS returns or which network route carries the request.

Changing unrelated storage firewall rules does not correct this client’s name resolution to the target Blob endpoint.

Storage private endpoints are scoped to service subresources such as blob and file. A file endpoint does not automatically provide the Blob hostname and its private DNS record.

Linking a private DNS zone to an Azure VNet does not automatically make the zone resolvable by on-premises DNS servers without a suitable forwarding/resolver path.

Private DNS record validation is one part of the solution but alone does not provide the on-premises client with a routed path to the endpoint IP.

Building a second private endpoint does not establish hybrid DNS forwarding and private transport from the existing on-premises subnet.

A Blob private endpoint already secures Blob; repeating general private endpoint creation does not enable Azure Files or Queue subresources.

Disabling the account public endpoint can tighten exposure but cannot supply the additional service-specific private addresses required by other Storage APIs.

Storage data-plane RBAC does not substitute for a missing private link subresource to the Files or Queue API.

Hybrid transit routing cannot update an obsolete private A record that still points to the deleted endpoint’s old private IP.

Creating another private endpoint is unnecessary if the replacement endpoint is already working; the stale manual DNS mapping is the specific cause.

Endpoint owner approval may be required for a new connection, but it will not automatically correct an unrelated manually maintained stale DNS entry.

Consumer DNS and route troubleshooting happens after an endpoint exists and does not create the publisher-side private service reference.

Revoking endpoints applies when customer access must be withdrawn, not when the provider is initially publishing a new private service.

Provider-side SNAT and app identity are important considerations, but are not a substitute for publishing the endpoint-enabled TCP service.

Comparing service endpoints and Private Link clarifies product categories, not why this consumer connection remains Pending.

Revoking a connection is the opposite of the action needed to activate a legitimate requested Private Link service connection.

Visibility and auto-approval settings define who may request or be pre-approved, but do not prove this specific pending request has been approved.

Reviewing public ingress can detect a different exposure path, but the defect here is uncontrolled approval of Private Link service consumers.

Reviewing a single current connection state does not prevent new private endpoint requests from arbitrary untrusted subscriptions being approved.

Revoking one connection without correcting the overbroad auto-approval configuration permits the same subscription or another unwanted one to reconnect.

Creating another Private Link service does not expose the original source identity behind already NAT-translated private-link requests.

Revoking an unrelated consumer connection does not explain NAT addresses presented by legitimate approved private endpoint traffic.

Checking the public load-balancer frontend is appropriate for public exposure assessment, but the incident concerns observed private-link source translation.