DP-300 Implement a secure environment Practice Question
Which TWO are valid methods to connect to an Azure SQL Database without exposing a public endpoint?
⚠ Common exam trap
Candidates often confuse network-level access controls (firewall rules, VPNs) with endpoint exposure, mistakenly thinking that encrypting traffic or routing through a VPN eliminates the public endpoint's existence, when in fact the public DNS name and IP remain reachable from the internet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a service endpoint
A service endpoint extends your virtual network private address space and the identity of your VNet to Azure SQL Database over a direct connection on the Azure backbone network. This allows you to secure your logical SQL server to accept traffic only from a specific subnet, eliminating the need for a public endpoint while still using the public endpoint's DNS name internally.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Always Encrypted
Why it's wrong here
Always Encrypted is an encryption feature, not a connectivity method.
- ✗
Use a public endpoint with a firewall rule
Why it's wrong here
This exposes a public endpoint.
- ✓
Use a service endpoint
Why this is correct
Service endpoint secures traffic to Azure SQL from your VNet without a public IP.
- ✗
Use a site-to-site VPN gateway and connect to public endpoint
Why it's wrong here
VPN gateway still uses the public endpoint, though traffic is encrypted.
- ✓
Use a private endpoint
Why this is correct
Private endpoint uses a private IP from your VNet, no public exposure.
Visual reference
Go deeper
Related to this question
Learn chapter
Overview of Azure Data Platform Options
Key term
Azure SQL Performance Tuning
Azure SQL Performance Tuning is the process of optimizing the speed and efficiency of queries and database operations in Microsoft Azure SQL Database or SQL Managed Instance to reduce latency and improve throughput.
About these practice questions
Courseiva writes every DP-300 question from scratch — 906 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-300 exam.