Connect to and consume Azure services and third-party services →mediumMultiple ChoiceObjective-mapped
AZ-204 Practice Question: Connect to and consume Azure services and third-party services
You are building an integration solution that connects an on-premises SQL Server database to Azure Data Factory. The on-premises network does not allow direct inbound connections from Azure. You need to securely transfer data from the database to Azure Blob Storage. Which data factory component should you use?
⚠ Common exam trap
It's easy for candidates to confuse the Azure Integration Runtime (which works only for cloud-to-cloud scenarios) with the Self-hosted Integration Runtime, assuming Azure's built-in runtime can somehow tunnel into on-premises networks without explicit configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Self-hosted Integration Runtime
The Self-hosted Integration Runtime (SHIR) is required because the on-premises SQL Server database resides in a network that blocks direct inbound connections from Azure. SHIR acts as a bridge, running on a local machine or VM within the on-premises network, enabling Azure Data Factory to securely connect to the database via outbound HTTPS (port 443) or the Microsoft Service Bus. It handles data movement and transformation without exposing the on-premises network to inbound traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Self-hosted Integration Runtime
Why this is correct
The Self-hosted Integration Runtime is the correct choice because it is specifically designed to be installed on a machine within the on-premises network. This runtime acts as a secure, outbound-only gateway, initiating connections to Azure Data Factory via HTTPS. It allows Azure services to securely access on-premises data sources like SQL Server without requiring any inbound firewall ports to be opened, aligning perfectly with strict security requirements for hybrid data movement.
- ✗
Azure Integration Runtime
Why it's wrong here
The Azure Integration Runtime operates entirely within the Azure cloud and is primarily used for cloud-to-cloud data movement or activities that do not require access to private networks. It cannot directly connect to on-premises resources without specific network configurations like a VPN, ExpressRoute, or opening inbound firewall ports on the on-premises network. Since opening inbound ports is explicitly disallowed by the security requirements, Azure IR is unsuitable for this hybrid scenario.
- ✗
Azure-SSIS Integration Runtime
Why it's wrong here
The Azure-SSIS Integration Runtime is specifically designed for lifting and shifting SQL Server Integration Services (SSIS) packages to Azure Data Factory for execution. While it runs in Azure, it still requires a secure network path, such as a Virtual Network integration combined with a VPN or ExpressRoute, or even a Self-hosted IR acting as a proxy, to access on-premises data sources. It does not inherently provide direct, secure access to on-premises systems without violating the inbound port restriction.
- ✗
Azure Data Lake Storage connector
Why it's wrong here
An Azure Data Lake Storage connector is merely a configuration object within Azure Data Factory that defines the connection properties to an Azure Data Lake Storage account. It specifies how to authenticate and locate the data store but does not provide any compute or network bridging capabilities. Connectors are distinct from Integration Runtimes, which are the compute infrastructure responsible for executing data movement and activity dispatch, especially for facilitating network connectivity to on-premises data sources.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.