A VM-based application must connect to Azure SQL Database over a private IP inside the VNet. The SQL server name must resolve to that private IP, and public network access must remain disabled. What should the administrator deploy?

A service endpoint for Microsoft.Sql on the subnet.

A service endpoint does not create a private IP address or change name resolution to the VNet.

A user-defined route that points SQL traffic to the Internet.

Routing to the Internet cannot satisfy a requirement for private IP connectivity inside the VNet.

An NSG rule that allows TCP 1433 from the subnet to Azure SQL.

NSGs can permit traffic, but they do not provide private addressing or private DNS resolution.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: A private endpoint for the SQL server and a private DNS zone linked to the VNet. — A private endpoint is required when the service must be reachable through a private IP inside the VNet. Because the application also needs the SQL server name to resolve to that private address, the administrator should link an appropriate private DNS zone to the VNet. Disabling public network access ensures the service is only reachable through the private path, which matches the stated security requirement exactly. Why others are wrong: A service endpoint still uses the service’s public endpoint and does not satisfy the private IP requirement. A user-defined route to the Internet directly contradicts the need for private connectivity. An NSG rule can permit the port, but it cannot create private name resolution or replace the public endpoint with a private one.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.