An app running on an Azure VM must access Azure SQL Database over a private IP inside the VNet. The team also wants the SQL server name to resolve to that private address without using custom host-file entries. What should be configured?

A service endpoint on the VM subnet and a firewall rule on Azure SQL Database.

Service endpoints do not create a private IP address for the SQL resource, so the name will still not resolve to a private endpoint address.

A public IP address on the VM and a SQL server firewall exception.

This keeps traffic on the public internet path and does not satisfy the private IP or private DNS requirement.

An NSG rule that allows outbound TCP 1433 to the SQL server.

NSGs can permit traffic, but they do not provide private service IPs or DNS name resolution changes.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: A private endpoint for Azure SQL Database and a linked private DNS zone. — A private endpoint is the Azure feature that maps a supported PaaS service to a private IP address in your VNet. To make the server name resolve correctly, the VNet should also be linked to the appropriate private DNS zone so the standard FQDN points to that private endpoint address. This is the cleanest way to keep SQL traffic off the public internet and avoid custom name-resolution workarounds. Why others are wrong: Service endpoints extend VNet identity to the service, but they do not create a private IP for the service or change DNS to a private address. A public IP on the VM and firewall exception still use public connectivity. An NSG rule may allow port 1433, but it does not create private access or DNS resolution behavior.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.