Separate execution from reachability
A workload description may contain both a hosting decision and a network-access decision. First ask what runs and what control it requires. Azure Virtual Machines provide a customer-administered guest OS. Azure Functions runs code through an event-driven managed service, and Azure App Service is a managed application platform. These selected examples do not exhaust compute choices: containers, virtual desktop, scale sets and other VM options remain separate study gaps. Do not pick an execution model simply because the application also has a domain name.
A requirement can defeat a familiar default
A short task triggered by a new file can fit managed function execution when the stated runtime and control constraints permit it. A workload requiring administration of a custom guest OS points toward a VM relationship instead. Containers package an application and its dependencies as an execution image rather than a complete guest-OS deployment; Azure Container Instances illustrates managed container execution. A custom web application can fit a managed application platform when it does not need guest-OS control. None of these observations establishes a universal cheapest or fastest option.
Worked example
A fictional conservation group describes two independent needs. It wants a managed web platform for its own public information application, and it wants a name to resolve to the intended application endpoint. The application-hosting requirement concerns the runtime/control relationship; App Service illustrates that managed-platform role. The name-resolution requirement concerns DNS. Changing the hosting choice does not by itself create a DNS record, and configuring DNS does not choose who may perform management actions. Write a separate answer for each question before explaining how the components can cooperate.
Network scope and endpoint conditions
An Azure virtual network provides a logical network environment; DNS resolves names rather than acting as an identity-permission system. A private endpoint uses a private IP in a virtual network for connectivity to a supported service. A public endpoint is a different exposure/access arrangement. A private endpoint does not, by itself, settle application authentication, authorization or every public-network setting. This lesson distinguishes purposes, not complete network designs, subnet/peering behavior or VPN/ExpressRoute configuration.
Transfer check
A fictional project asks to reach a supported storage service through a private IP in its Azure virtual network. A colleague proposes changing only a public DNS label. What is missing? Check basis: name resolution alone does not supply the required private endpoint connectivity. The team must consider the service’s supported private connection and its separate access controls. Explain the reachability condition without inventing a production configuration. Then solve the independent tasks, each of which supplies its own hosting or network constraint.
Try it, then explain it.
Complete a short set without looking at the example. After each answer, explain which evidence or rule supports your decision and why the alternatives do not fit.
Sources & authorship
Original OpenExam explanations and examples. References support the concepts; they are not the source of copied questions. Independent educator review is pending.
Shared responsibility in the cloudWhat is Azure Functions?Virtual machines in AzureWhat is Azure Container Instances?What is Azure Virtual Network?Azure DNS overviewWhat is a private endpoint?