AZ-104 Implement and Manage Virtual Networking Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  A private DNS zone linked to VNet-Prod

  Why this is correct

  A private DNS zone (privatelink.database.windows.net) linked to VNet-Prod is essential because the SQL server's FQDN must resolve to the private endpoint's IP address within the VNet. When you create a private endpoint, Azure automatically adds an A record in this zone, but only if the zone is linked to the VNet where clients operate. Without that link, name resolution for the FQDN would continue using public DNS, bypassing the private IP and defeating the private endpoint's purpose. This zone and link are the standard mechanism for enabling private name resolution for Azure PaaS services.

• ✗

  A user-defined route on the subnet

  Why it's wrong here

  A user-defined route (UDR) on the subnet only influences the next hop for network packets based on the destination IP; it has no effect on how hostnames are resolved to IP addresses. DNS resolution relies on DNS servers and zones — such as the private DNS zone — not on the subnet's routing table. Even if traffic destined to the private endpoint should remain local, the system route already provides the correct next hop, so a UDR is unnecessary for name resolution. Thus, a UDR cannot make the SQL server's FQDN resolve to the private endpoint.

  When this WOULD be correct

  A UDR would be correct if the question asked how to force traffic from VMs to the private endpoint through a firewall or network virtual appliance, or to override the default system route for a specific subnet.

• ✗

  An additional public IP address

  Why it's wrong here

  Adding a public IP address is incorrect because private endpoints exclusively use private IP addresses from the virtual network's address space, and they do not require any public-facing IP for DNS resolution. A public IP relates to the public endpoint of the SQL Database server, which you typically want to disable when enforcing a private connection. DNS resolution for the private endpoint is handled by the private DNS zone, not by any public IP assignment. Attempting to add a public IP would not change DNS records or route traffic to the private endpoint.

  When this WOULD be correct

  When you need to provide outbound internet connectivity from a subnet that lacks a default route, such as for a NAT gateway or a load balancer's outbound rules.

• ✗

  A Recovery Services vault

  Why it's wrong here

  Azure Recovery Services vault is a component for backup and site recovery workloads, providing storage and management for recovery points, not for DNS resolution or network connectivity. It has no role in mapping hostnames to IP addresses and cannot influence private endpoint name resolution. The vault operates at the control-plane level for data protection services and is entirely separate from the data-plane networking features used by private endpoints. Therefore, it is irrelevant to the requirement of resolving the SQL server's FQDN to the private endpoint.

  When this WOULD be correct

  You need to protect Azure SQL Database by enabling backup and restore operations, and you must store backup data in a Recovery Services vault with geo-redundancy.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”