AZ-305 Design infrastructure solutions Practice Question
A company has an Azure SQL Database that they need to access from an on-premises data center over ExpressRoute. They want to use a private IP address to connect to the database, ensuring traffic never traverses the public internet. Which Azure service should they use?
⚠ Common exam trap
It's easy for candidates to confuse Azure Service Endpoints with Private Link: both keep traffic on the Azure backbone, but only Private Link provides a private IP address and removes exposure to the public endpoint, which is the key requirement in this scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Private Link
Azure Private Link allows you to access Azure SQL Database over a private endpoint within your virtual network, using a private IP address. When combined with ExpressRoute, traffic from your on-premises data center to the database traverses the Microsoft backbone network and never touches the public internet, meeting the requirement for a private, secure connection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Private Link
Why this is correct
Azure Private Link provisions a private endpoint inside your virtual network, assigning Azure SQL Database an interface with a private IP address. Traffic from on-premises to this endpoint flows over ExpressRoute or a site-to-site VPN and then through the Microsoft backbone, never touching the public internet. This also lets you disable public access to the database, so only clients reaching the private endpoint can connect.
- ✗
Azure Service Endpoints
Why it's wrong here
Service endpoints do not create a private IP for Azure SQL; they simply extend your virtual network's identity to the service and route VNet-originated traffic to the public endpoint over the Azure backbone. The database destination remains the public fully qualified domain name, so the connection is not isolated from public exposure, and on-premises clients are not supported unless they first enter a VNet. In contrast, a private endpoint makes the database appear inside the VNet with a private address.
- ✗
Azure VPN Gateway
Why it's wrong here
A VPN Gateway creates an IPsec tunnel between your on-premises network and an Azure virtual network, but that tunnel terminates at a gateway object, not at the database. Azure SQL Database is a PaaS resource with a public namespace; even though your traffic may traverse the tunnel, the SQL listener is still resolved via public DNS and does not receive a private address. For true private connectivity, you would still need Private Link or another mechanism to map the database into the VNet.
- ✗
Azure Front Door
Why it's wrong here
Azure Front Door is a global layer-7 load balancer and HTTP/S reverse proxy that routes traffic based on URL paths and latency, primarily for web applications and APIs. It operates at the public edge and cannot expose Azure SQL through a private IP, nor does it handle the TDS protocol used by SQL clients. Using Front Door for database access would force traffic through a public HTTP endpoint, offering neither private connectivity nor the required SQL wire protocol support.
Go deeper
Related to this question
About these practice questions
This AZ-305 question is part of Courseiva's 795-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.