AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Add an outbound NSG rule allowing TCP 1433 to the internet.

  Why it's wrong here

  An outbound NSG rule permitting TCP 1433 to the internet would only allow traffic to leave VNet B toward the SQL database's public endpoint. Since the SQL server's public endpoint was disabled when the private endpoint was created, the connection attempt would still be blocked by the server-side access control. This rule also does not address DNS resolution: clients in VNet B would still resolve the server name to the public IP (or fail to resolve), rather than to the private endpoint IP, so the rule is irrelevant to the core requirement.

  When this WOULD be correct

  In a scenario where a VM in a peered VNet cannot connect to an Azure SQL Database because outbound traffic on port 1433 is blocked by an NSG, and public network access is enabled, adding an outbound NSG rule allowing TCP 1433 to the internet would fix the connectivity issue.

• ✓

  Link the appropriate private DNS zone to VNet B.

  Why this is correct

  Clients in VNet B must resolve the SQL server name to the private endpoint address. Linking the private DNS zone to VNet B allows the VM to receive the correct private IP mapping through DNS.

• ✗

  Assign a public IP address to the private endpoint.

  Why it's wrong here

  A private endpoint is a network interface backed by a private IP address from the VNet address space; it does not accept a public IP assignment. Even if you could attach a public IP, doing so would expose the SQL server through a public route, defeating the entire purpose of private connectivity and potentially re-enabling public exposure. More importantly, adding a public IP to the private endpoint does nothing to make VNet B's DNS resolve the SQL server name to the private endpoint address, so the VM's DNS lookup would still return the public endpoint or fail.

  When this WOULD be correct

  If the question required enabling inbound internet access to an Azure SQL Database while keeping it private within a VNet, assigning a public IP to the database server (not the endpoint) and configuring firewall rules could be correct. However, this scenario is rare and typically avoided.

• ✗

  Replace the private endpoint with a service endpoint.

  Why it's wrong here

  A service endpoint does not assign a private IP address to Azure SQL Database; it only routes traffic from the VNet to the service's public endpoint over the Azure backbone. Because the SQL server's public endpoint is disabled (which is why the private endpoint was created), traffic sent via the service endpoint would still target the public endpoint and fail. Moreover, service endpoints do not integrate with private DNS zones, so clients in VNet B would still resolve the server name to the public IP, leaving the DNS resolution problem unsolved.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question