A private endpoint was created for Azure SQL Database in VNet A. A VM in peered VNet B can reach other resources, but it resolves the SQL server name to the public IP and connection attempts fail because public network access is disabled. What is the best fix?

Add an outbound NSG rule allowing TCP 1433 to the internet.

This would keep using the public endpoint path, which is disabled. It also does not correct DNS resolution to the private endpoint.

Assign a public IP address to the private endpoint.

Private endpoints use private IP addresses by design. Assigning a public IP would defeat the purpose and still would not solve the DNS design issue.

Replace the private endpoint with a service endpoint.

Service endpoints do not provide a private IP in the VNet and would not meet the same connectivity and exposure requirements as the private endpoint.

What does this AZ-104 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Link the appropriate private DNS zone to VNet B. — When a private endpoint is used, clients must resolve the service name to the private IP assigned in the VNet. If a peered VNet cannot resolve that name correctly, the private DNS zone is likely not linked to the client VNet. Linking the private DNS zone to VNet B ensures that workloads there can resolve the SQL server name to the private endpoint address and connect without using the public endpoint. Why others are wrong: Allowing outbound 1433 to the internet keeps traffic on the public path, which is disabled, so it does not solve the problem. A private endpoint should not receive a public IP because that breaks the security model. Service endpoints are a different feature and do not provide the same private DNS and private IP behavior required here.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.