DP-300 Implement a secure environment Practice Question
You are a database administrator for a healthcare company. You have an Azure SQL Database that stores patient records. The database is currently accessible from the public internet via firewall rules. You need to implement a secure environment that meets the following requirements: - All traffic to the database must be private and not traverse the internet. - The database must be accessible from an Azure Virtual Machine in a specific VNet. - The solution must minimize management overhead and cost. - You need to ensure that the database can be failed over to a secondary region in case of an outage.
What should you do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a private endpoint in the VNet, disable public network access, and configure a failover group with a private endpoint in the secondary region.
It meets all requirements: a private endpoint ensures all traffic to the database stays within the Microsoft backbone network and never traverses the internet. Disabling public network access enforces that no public traffic can reach the database, fulfilling the private traffic requirement. Configuring a failover group with a private endpoint in the secondary region provides geo-replication and automatic failover while maintaining private connectivity, with minimal management overhead and no additional cost for VPNs. Option A is incorrect because restricting the firewall to the VM's public IP still allows traffic over the public internet, violating the private traffic requirement. Option B is incorrect because a point-to-site VPN adds complexity and cost, and still uses a VPN connection that may traverse the internet, and does not provide the same seamless private connectivity as a private endpoint. Option D is incorrect because a VNet service endpoint does not make traffic private; it still uses the public endpoint of the database, and keeping public access enabled fails the requirement to disable public internet access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Restrict firewall rules to only the VM's public IP and enable active geo-replication.
Why it's wrong here
Traffic still goes over the internet, violating the private traffic requirement.
- ✗
Configure a point-to-site VPN from the VM to the database and set up geo-replication.
Why it's wrong here
VPN adds overhead and is not the recommended method for private connectivity.
- ✓
Create a private endpoint in the VNet, disable public network access, and configure a failover group with a private endpoint in the secondary region.
Why this is correct
This ensures private connectivity and disaster recovery.
- ✗
Create a VNet service endpoint and a failover group. Keep public access enabled for failover.
Why it's wrong here
Service endpoints do not make traffic completely private; the public endpoint remains.
Go deeper
Related to this question
Learn chapter
Overview of Azure Data Platform Options
Key term
Azure SQL Performance Tuning
Azure SQL Performance Tuning is the process of optimizing the speed and efficiency of queries and database operations in Microsoft Azure SQL Database or SQL Managed Instance to reduce latency and improve throughput.
About these practice questions
This DP-300 question is part of Courseiva's 906-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-300 exam.