AZ-900 Describe Azure architecture and services Practice Question
A company runs an Azure SQL Database that stores sensitive customer data. The security team mandates that all traffic to the database must remain entirely within the Microsoft Azure backbone network and never traverse the public internet. The database can only be accessed by a specific application running on virtual machines in a specific Azure virtual network. Which Azure feature should they configure to meet this requirement?
⚠ Common exam trap
Many exam-takers confuse Azure Service Endpoint with Private Endpoint, thinking that Service Endpoint also keeps traffic entirely off the public internet, but Service Endpoint still uses the service's public endpoint and does not provide a private IP address for the resource.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Private Endpoint
Azure Private Endpoint assigns a private IP address from your virtual network to the Azure SQL Database, allowing traffic to reach the database over the Microsoft backbone network without ever leaving the Azure network or traversing the public internet. This ensures that all communication between the application VMs and the database remains private and secure, meeting the mandate that traffic must never traverse the public internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Private Endpoint
Why this is correct
Correct. An Azure Private Endpoint assigns a private IP address from the virtual network to the Azure SQL Database, ensuring all traffic stays within the Microsoft backbone network and never traverses the public internet. The database is accessible only from the specified VNet.
- ✗
Azure Service Endpoint
Why it's wrong here
Incorrect. A Service Endpoint routes traffic to the Azure SQL Database over the Microsoft backbone, but it still uses the public endpoint of the service. While traffic does not leave the Azure network, the database remains accessible via its public IP, which could allow data exfiltration if not combined with additional controls. It does not meet the requirement that traffic never traverses the public internet at any network layer.
When this WOULD be correct
A scenario where the requirement is to restrict access to an Azure SQL Database from a specific VNet without needing private IP addresses, and the security policy allows traffic over the Microsoft backbone but not necessarily private IPs.
- ✗
VNet Peering
Why it's wrong here
Incorrect. VNet Peering connects two Azure virtual networks so that resources in each VNet can communicate. It does not directly connect a VNet to an Azure PaaS service like SQL Database and does not provide a private endpoint for that service.
When this WOULD be correct
A company has two Azure virtual networks in different regions that need to communicate privately and securely without going through the public internet. VNet Peering would be the correct answer to enable direct connectivity between the VNets over the Microsoft backbone.
- ✗
Azure Firewall
Why it's wrong here
Incorrect. Azure Firewall is a managed network security service that filters traffic based on rules. While it can be used to control outbound traffic from a VNet, it does not provide a private network interface for the Azure SQL Database and does not ensure traffic stays off the public internet.
When this WOULD be correct
A company needs to centrally control and log outbound traffic from a virtual network to the internet, and filter inbound traffic to specific subnets. Azure Firewall would be the correct answer if the question asked for a managed firewall service to enforce network security policies across multiple VNets.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Azure Private EndpointCorrect answer▾
Why this is correct
Correct. An Azure Private Endpoint assigns a private IP address from the virtual network to the Azure SQL Database, ensuring all traffic stays within the Microsoft backbone network and never traverses the public internet. The database is accessible only from the specified VNet.
✗Azure Service EndpointWrong answer — click to see why▾
Why this is wrong here
Azure Service Endpoint does not ensure traffic stays entirely within the Microsoft backbone; it only exposes the service to a specific VNet via a public endpoint, and traffic still traverses the public internet.
★ When this WOULD be the correct answer
A scenario where the requirement is to restrict access to an Azure SQL Database from a specific VNet without needing private IP addresses, and the security policy allows traffic over the Microsoft backbone but not necessarily private IPs.
Why candidates choose this
Candidates confuse Service Endpoints with Private Endpoints, thinking both provide private connectivity, but Service Endpoints still use public IPs for the service endpoint.
✗VNet PeeringWrong answer — click to see why▾
Why this is wrong here
VNet Peering connects two virtual networks, but it does not ensure that traffic to Azure PaaS services like Azure SQL Database stays on the Microsoft backbone; traffic can still traverse the public internet unless a private endpoint or service endpoint is used.
★ When this WOULD be the correct answer
A company has two Azure virtual networks in different regions that need to communicate privately and securely without going through the public internet. VNet Peering would be the correct answer to enable direct connectivity between the VNets over the Microsoft backbone.
Why candidates choose this
Candidates may confuse VNet Peering with private connectivity to PaaS services, thinking that peering VNets automatically keeps all traffic within the backbone, but it only applies to VNet-to-VNet traffic, not to PaaS services.
✗Azure FirewallWrong answer — click to see why▾
Why this is wrong here
Azure Firewall is a network security service that filters traffic at the perimeter, but it does not ensure traffic stays entirely within the Microsoft backbone and never traverses the public internet. It cannot provide a private IP connection to Azure SQL Database without public endpoint exposure.
★ When this WOULD be the correct answer
A company needs to centrally control and log outbound traffic from a virtual network to the internet, and filter inbound traffic to specific subnets. Azure Firewall would be the correct answer if the question asked for a managed firewall service to enforce network security policies across multiple VNets.
Why candidates choose this
Candidates may think Azure Firewall can secure database access by filtering traffic, but they overlook that it does not eliminate public internet exposure for PaaS services like Azure SQL Database.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Feature
A feature is a distinct unit of functionality that delivers value to the user, often managed and tracked throughout the software development lifecycle.
Key term
Azure Virtual Network
Azure Virtual Network is a cloud service that lets you create a private, isolated network in the Microsoft Azure cloud, allowing your virtual machines and other resources to communicate securely with each other, the internet, and your on-premises network.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.