AZ-500 Secure compute, storage, and databases Practice Question
You need to securely connect to an Azure SQL Database from an on-premises application without exposing the database to the public internet. Which solution should you use?
⚠ Common exam trap
Watch out — candidates often confuse service endpoints (which still use the public endpoint) with private endpoints (which provide truly private connectivity), leading them to choose Option D thinking it eliminates internet exposure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Azure Private Link to connect via a private endpoint
Azure Private Link allows you to access Azure SQL Database over a private endpoint within your virtual network, using a private IP address from your on-premises network via ExpressRoute or VPN. This ensures traffic never traverses the public internet, meeting the requirement for secure, non-public connectivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a firewall rule to allow the on-premises public IP address
Why it's wrong here
Configuring a firewall rule to allow the on-premises public IP address still exposes the database to the internet via the public endpoint. Even with an IP restriction, the SQL Database remains reachable from any source that can spoof or bypass the IP filter, and the public endpoint is a larger attack surface. This approach does not provide a private, isolated network path and is less secure than using a private endpoint.
- ✓
Use Azure Private Link to connect via a private endpoint
Why this is correct
Azure Private Link creates a private endpoint inside your virtual network, assigning the database a private IP address that is reachable only through your network. On-premises clients can securely connect to this endpoint via a VPN gateway or ExpressRoute, ensuring traffic never traverses the public internet. This eliminates exposure to the public endpoint and provides the highest level of network security for connecting to Azure SQL Database.
- ✗
Enable Always Encrypted on the database
Why it's wrong here
Always Encrypted is a client-side encryption feature that protects sensitive data at rest and in transit by encrypting it before it reaches the database. It does not alter the network connectivity path or control how clients connect, as the connection still uses the database's public or private endpoint. While it enhances data confidentiality, it offers no protection against insecure network configurations or unauthorized access at the connection level.
- ✗
Use a virtual network service endpoint for Azure SQL Database
Why it's wrong here
Virtual network service endpoints for Azure SQL Database route traffic from a virtual network over the Azure backbone, but they still rely on the database's public IP address for the service endpoint. Service endpoints are designed for traffic originating from within a VNet and do not directly support on-premises connections without additional components, such as a VPN gateway. Private Link provides a private IP without exposing a public endpoint, making it a more secure and flexible solution for on-premises connectivity.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.