AZ-305 Design infrastructure solutions Practice Question
A company is deploying a multi-tier application on Azure. The web tier runs on Azure App Service, and the database tier runs on Azure SQL Database. The company wants to secure the connection between the web tier and the database by using a private endpoint for Azure SQL Database. They also want to ensure that the web tier can resolve the private endpoint's DNS name. What should you recommend?
⚠ Common exam trap
The trap here is assuming that service endpoints or custom DNS records are sufficient for private endpoint resolution, but only an Azure Private DNS zone linked to the virtual network provides the correct DNS resolution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a private endpoint for Azure SQL Database and integrate an Azure Private DNS zone with the virtual network used by the web tier.
To securely connect to Azure SQL Database using a private endpoint, you must create the private endpoint and integrate an Azure Private DNS zone with the virtual network. The Private DNS zone automatically creates the necessary A record for the SQL server's FQDN, resolving to the private IP. This allows the web tier to connect securely without exposing traffic to the public internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a private endpoint for Azure SQL Database and use Azure Firewall to redirect DNS queries.
Why it's wrong here
Azure Firewall can be used for DNS proxy, but it is not required for private endpoint DNS resolution. The standard approach is to use Azure Private DNS zones. Using Azure Firewall adds unnecessary complexity and cost, and it does not automatically provide the required DNS records for the private endpoint.
- ✓
Configure a private endpoint for Azure SQL Database and integrate an Azure Private DNS zone with the virtual network used by the web tier.
Why this is correct
A private endpoint for Azure SQL Database creates a private IP address within a virtual network. To resolve the private endpoint's DNS name, you must integrate an Azure Private DNS zone with the virtual network. This ensures that the web tier can resolve the database's FQDN to the private IP, enabling secure connectivity.
- ✗
Configure a service endpoint for Azure SQL Database and enable Azure Private Link.
Why it's wrong here
Service endpoints provide secure access to Azure services over the Azure backbone, but they do not provide a private IP address for the database. Azure Private Link is the underlying technology for private endpoints, but simply enabling it without configuring a private endpoint and DNS integration does not meet the requirement.
- ✗
Configure a private endpoint for Azure SQL Database and add a custom DNS record in the Azure DNS zone for the web tier's domain.
Why it's wrong here
Adding a custom DNS record in a public Azure DNS zone does not resolve the private endpoint's IP address within the virtual network. The correct approach is to use an Azure Private DNS zone linked to the virtual network, which automatically manages the necessary A records for the private endpoint.
Visual reference
Go deeper
Related to this question
About these practice questions
This AZ-305 question is part of Courseiva's 795-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.