An app on a VM must connect to Azure SQL Database without using the public endpoint. The database name must resolve to a private IP inside the VNet, and public network access should be disabled. Which two actions should the administrator take? Select two.

Enable a service endpoint for Microsoft.Sql on the subnet.

Service endpoints do not create a private IP address for the SQL server or change its DNS name.

Grant the VM's managed identity Reader on the SQL server.

Identity permissions are unrelated to whether the service resolves privately or publicly.

Keep public network access enabled and restrict the firewall to the VNet.

This still relies on the public endpoint rather than a private IP inside the virtual network.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Create a private endpoint for the Azure SQL server in the VNet. — Private endpoints are the correct way to expose Azure SQL over a private IP in a VNet. They place a private address on a NIC in your subnet and, when combined with the appropriate private DNS zone, allow the SQL server name to resolve to that private address. Disabling public network access prevents fallback to the public endpoint, which matches the security requirement exactly. Why others are wrong: Service endpoints extend subnet identity to the service but keep traffic on the public endpoint and do not provide private DNS resolution. Managed identity permissions control authorization, not networking. Leaving public access enabled preserves the public path, which conflicts with the requirement for private-only connectivity.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.