A consumption-plan Azure Function that posts canal lock telemetry still cannot reach a VNet-injected internal API. The Function already has the same outbound-versus-inbound split pattern as App Service documented for private access. What should the security engineer change first?
Select an answer to reveal the explanation.
Short Explanation
Consumption Functions can’t hop the VNet fence the way Premium/Dedicated App Service plans can. Move to a plan that supports regional VNet integration, then wire outbound the same way you would for App Service—don’t try to NSG your way around a SKU limit.
Full Explanation
Consumption-plan Azure Functions share App Service’s outbound-versus-inbound networking model, but regional VNet integration is not available on Consumption. For canal lock telemetry that must call a VNet-injected internal API, the security engineer must first move the Function to a plan or SKU that documents regional VNet integration (Premium/Dedicated-class), then configure outbound VNet integration so private destinations are reachable without publishing the API on the public Internet.
Keeping Consumption and opening an NSG allow-any rule toward the multi-tenant front-end VIP fails by concept: Consumption cannot establish the documented private outbound path, and exposing the API publicly contradicts the private-access goal. Rewriting the Function in Azure Container Instances and relying on Azure Policy initiatives fails by concept because Policy audits or denies resource configuration—it does not create Functions VNet integration, and ACI is a different hosting model. Enabling Always Encrypted and Microsoft Entra database authentication on the API’s SQL backend fails by concept: those are Domain 3 data-plane controls and do not grant the Function a private network path to the internal API.
Exam caveat: AZ-500 expects you to treat Functions networking like App Service—SKU eligibility for VNet integration comes before NSG or data-security distractors. Operational check: confirm the Function app plan supports regional VNet integration, attach integration to the canal VNet/subnet with the required delegation, verify the Function can resolve and reach the internal API privately, and confirm the API remains without a public listener.