AZ-500 Secure networking Practice Question
You are configuring Azure Private Link for a SQL Database. You want to ensure that all traffic from your virtual network to the SQL Database stays within the Microsoft Azure backbone network. What is the primary benefit of using Azure Private Link over a service endpoint?
⚠ Common exam trap
Test-takers frequently confuse service endpoints with Private Link, thinking both provide the same level of isolation, but service endpoints still route to the public endpoint of the Azure service, whereas Private Link assigns a private IP and completely removes public internet exposure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Private Link assigns a private IP address to the SQL Database within your virtual network, preventing exposure to the public internet.
Azure Private Link exposes the SQL Database as a private endpoint within your virtual network, assigning it a private IP address from your VNet's address space. This ensures that all traffic to the database stays on the Microsoft backbone network and never traverses the public internet, which is the primary benefit over a service endpoint. Service endpoints still route traffic to the public endpoint of the SQL Database, even though the source traffic originates from the VNet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Private Link provides higher throughput than service endpoints.
Why it's wrong here
Throughput for Azure SQL Database is determined by the selected service tier (DTU or vCore) and not by the connectivity method. Both Private Link and service endpoints route traffic over Microsoft's backbone, and neither adds a separate throughput ceiling. Therefore, the claim that Private Link provides higher throughput is false.
- ✓
Private Link assigns a private IP address to the SQL Database within your virtual network, preventing exposure to the public internet.
Why this is correct
Private Link creates a private endpoint, which is a network interface with a private IP address assigned from your virtual network's subnet. When you connect to the SQL Database's FQDN, traffic is resolved and sent to this private IP, bypassing the public endpoint entirely. Combined with the 'Deny public network access' setting, the database is not reachable from the internet.
- ✗
Private Link enables access to the SQL Database from on-premises via VPN/ExpressRoute without traversing the internet.
Why it's wrong here
This statement incorrectly implies the VPN/ExpressRoute scenario is exclusive to Private Link. If your on-premises site is connected to an Azure virtual network over VPN or ExpressRoute, that same VNet can also use service endpoints, and traffic from those connected clients reaches Azure SQL over the Microsoft backbone, not the public internet. So Private Link is not required for internet-free on-premises access.
- ✗
Private Link allows you to use NSGs to filter traffic to the SQL Database.
Why it's wrong here
NSG filtering is also supported with service endpoints, so this is not a benefit unique to Private Link. With service endpoints you can use service tags and the VirtualNetwork service tag in NSG rules to restrict traffic to your SQL Database. Private Link does not confer a special NSG-only filtering capability; any such filtering is configured in the same way on the client side.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.