A lock-status App Service must call a VM and a Private Endpoint SQL NIC inside the VNet, while inbound Internet to the app must stay closed. How should networking be split?
Select an answer to reveal the explanation.
Short Explanation
VNet integration is the app’s outbound tunnel into the VNet; Private Endpoint (or access restrictions) covers inbound. Don’t pretend integration locks the front door.
Full Explanation
Regional VNet integration lets App Service (and Functions) make outbound calls into a VNet to reach VMs and Private Endpoint addresses. Inbound private access is achieved with a Private Endpoint on the app and/or access restrictions—not by assuming VNet integration isolates inbound traffic. Hybrid Connections are not the first-class AZ-500 control for this pattern. Skipping integration leaves outbound-to-VNet requirements unmet.