The canal authority wants to publish an internal lock-scheduling API behind a Standard load balancer so another tenant can reach it without VNet peering, a public IP, or site-to-site VPN. What should they create?
Select an answer to reveal the explanation.
Short Explanation
You’re the publisher with an ILB API—stand up a Private Link service and let the other tenant hang a Private Endpoint on it. That’s not WAF-on-public or peering cosplay.
Full Explanation
A Private Link service on a Standard internal load balancer publishes an internal API so another tenant or subscription can attach a Private Endpoint without VNet peering, a public IP, or site-to-site VPN. Create that Private Link service on the lock-scheduling API’s ILB for the canal authority’s sharing model.
Putting Application Gateway WAF with a public listener in front of the ILB fails the no-public-IP requirement. VNet peering to the partner hub is not a Private Link service. A Service Endpoint policy on the partner subnet that aliases the ILB frontend fails by concept.
Exam caveat: Private Link service is how you privately share your own ILB-fronted service. Operational check: create the PLS on the ILB, share the alias/resource ID, have the consumer create a PE, approve as needed, and test API calls without peering. In municipal Azure estates, document the decision in the change record, validate with a nonproduction rehearsal, and confirm monitoring still pages the on-call operator when the control fails closed during an incident drill. In municipal Azure estates, document the decision in the change record, validate with a nonproduction rehearsal, and confirm monitoring still pages the on-call operator when the control fails closed during an incident drill.