AZ-500 Secure networking Practice Question
A company has an Azure SQL Database with a private endpoint connection. The database is accessed from on-premises via ExpressRoute and from other Azure virtual networks (VNets) via VNet peering. The security team wants to ensure that all queries from both on-premises and peered VNets go through the private endpoint and NEVER use the public endpoint, even as a fallback. Which additional configuration is required to enforce this?
⚠ Common exam trap
Candidates often confuse 'private endpoint' with 'service endpoint' or think that NSGs or monitoring can enforce private-only access, when in fact the only way to guarantee that no traffic uses the public endpoint is to disable public network access at the server level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable public network access on the Azure SQL server.
Disabling public network access on the Azure SQL server explicitly blocks all traffic that does not originate from a private endpoint. This setting ensures that even if a client attempts to connect using the public endpoint (e.g., via a misconfigured connection string or DNS resolution fallback), the server will reject the connection. This is the only configuration that enforces the requirement that all queries—from on-premises via ExpressRoute or from peered VNets—must go through the private endpoint and never use the public endpoint.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a Network Security Group (NSG) on the subnet hosting the private endpoint to deny outbound traffic to the public endpoint's IP addresses.
Why it's wrong here
Applying an NSG to the private endpoint subnet cannot prevent clients from resolving the server's public endpoint and connecting directly over the internet, because that traffic does not traverse the subnet's NSG. Moreover, NSGs are not applied to traffic originating from on-premises networks, so a subnet-level deny rule would be ineffective for hybrid workloads. The public endpoint remains open, making this a partial and unenforceable approach.
- ✗
Enable Azure SQL Auditing and configure a log analytics workspace to monitor for public endpoint calls, then manually block them.
Why it's wrong here
Auditing and Log Analytics are detective controls that record connection attempts after the fact, giving no real-time prevention and leaving the public endpoint fully accessible until a human intervenes. Manual blocking is reactive, prone to delay, and cannot guarantee that an authorized user bypassing the audit process won't connect. This approach does not enforce a network-level deny, so it fails the requirement that only private endpoint connections be used.
- ✓
Disable public network access on the Azure SQL server.
Why this is correct
Correct. Disabling public network access on the SQL server blocks all traffic from the public internet, leaving only the private endpoint as the entry point. This ensures all traffic from on-premises and peered VNets must use the private endpoint.
- ✗
Configure a service endpoint for Azure SQL on the VNet and associate a firewall rule allowing only the VNet traffic.
Why it's wrong here
A service endpoint routes VNet-to-Azure SQL traffic over the Microsoft backbone but does not restrict the logical server's public endpoint, which remains reachable from any public IP unless explicitly disabled. Adding a firewall rule for the VNet creates an allow rule for that source, but it does not deny all other sources, including the internet or other networks. Consequently, this configuration permits public endpoint connections and does not enforce exclusive use of the private endpoint.
Visual reference
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.