AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Create a private endpoint for the Azure SQL server in the VNet.

  Why this is correct

  A private endpoint creates a network interface in your VNet with a private IP address that is mapped to the Azure SQL server, placing the service effectively inside the VNet. All traffic from the VM to SQL then travels over the Microsoft backbone rather than the public internet, and the SQL server's FQDN resolves to that private IP in the linked private DNS zone. This satisfies the requirement by ensuring the VM connects without ever exposing the SQL server to a public endpoint.

• ✓

  Link the private DNS zone for the SQL private link domain to the VNet.

  Why this is correct

  Linking the private DNS zone for the SQL private link domain (privatelink.database.windows.net) to the VNet is essential for name resolution. Once linked, the A record for the SQL server FQDN points to the private endpoint's IP, so the VM resolves the database name to a private address instead of the public IP. Without this zone linkage, the VM would still attempt to connect to the public endpoint, bypassing the private connectivity and likely failing if public access is disabled.

• ✗

  Enable a service endpoint for Microsoft.Sql on the subnet.

  Why it's wrong here

  Enabling a service endpoint for Microsoft.Sql on the subnet adds the subnet's source IP as a permitted network in the SQL firewall, but it does not create a private IP address for the SQL server and does not change DNS resolution. The SQL server's FQDN still resolves to its public endpoint, so traffic would traverse the internet even though the firewall allows it. Service endpoints are not equivalent to a private endpoint; they are simply a source-based firewall filter on the public endpoint, so this option cannot satisfy the requirement of connecting without exposing the service publicly.

  When this WOULD be correct

  A question where the requirement is to restrict access to Azure SQL from a specific subnet without disabling public endpoint, and the database name can resolve to a public IP. For example: 'You need to ensure that only traffic from a specific subnet can reach Azure SQL Database. Public endpoint access must remain enabled for other clients.'

• ✗

  Grant the VM's managed identity Reader on the SQL server.

  Why it's wrong here

  Granting the VM's managed identity the Reader role on the SQL server is irrelevant to network connectivity. The Reader role only allows Azure Resource Manager read operations, not SQL data-plane access, and it does not influence how the SQL server's endpoint is resolved or whether traffic stays private. SQL connections are authenticated through SQL logins or Microsoft Entra tokens, not through Azure RBAC roles on the server resource. Therefore, this option does nothing to enable a private connection from the VM.

  When this WOULD be correct

  If the question required the VM to authenticate to Azure SQL Database using a managed identity without using SQL authentication, then granting the managed identity a role (e.g., Contributor or SQL DB Contributor) on the SQL server would be correct, combined with enabling Azure AD authentication.

• ✗

  Keep public network access enabled and restrict the firewall to the VNet.

  Why it's wrong here

  Keeping public network access enabled and adding a firewall rule that restricts to the VNet only makes the SQL server accessible via a service endpoint, not via a private IP. The SQL server still has a public DNS record and its public endpoint remains reachable from the internet; the firewall rule only limits the source IPs. This approach does not place the SQL server inside the VNet, does not provide a private IP, and leaves the public endpoint exposed, so it fails the requirement of avoiding public internet connectivity.

  When this WOULD be correct

  If the question required connecting from a VM to Azure SQL Database using the public endpoint but with access restricted to the VNet's public IP range, enabling public network access and configuring a VNet firewall rule would be correct.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”