DP-300 Plan and implement data platform resources Practice Question
You are deploying Azure SQL Database for a new application. You need to ensure that connections from Azure services use a private IP address and do not traverse the public internet. What should you configure?
⚠ Common exam trap
Many candidates confuse Virtual Network service endpoints (which still use the public endpoint and do not provide a private IP) with Private Link (which provides a true private IP), or incorrectly assume Azure SQL Database can be deployed inside a VNet like a managed instance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Azure Private Link for Azure SQL Database
Azure Private Link creates a private endpoint in a virtual network, mapping the Azure SQL Database logical server to a private IP address within that VNet. Traffic from Azure services (e.g., VMs, App Service) to the database uses Microsoft's backbone network via the private endpoint, never traversing the public internet. This meets the requirement for private, non-internet-routed connectivity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Virtual Network service endpoints for Azure SQL Database
Why it's wrong here
Virtual Network service endpoints restrict traffic to specified subnets but the connection still resolves to the logical server's public IP address, so traffic does not use a private IP. Service endpoints suit restricting access by subnet without requiring private connectivity.
- ✓
Use Azure Private Link for Azure SQL Database
Why this is correct
Azure Private Link creates a private endpoint with a private IP address inside your virtual network, so connections from Azure services reach Azure SQL Database over the Microsoft backbone rather than the public internet, satisfying the private IP requirement.
- ✗
Configure the Azure SQL Database firewall to allow Azure services
Why it's wrong here
Allowing Azure services opens the server firewall to the public Azure backbone range, so connections still traverse the public internet using the public endpoint. This suits scenarios where Azure-hosted services must connect without private networking, not the private-IP requirement here.
- ✗
Deploy Azure SQL Database inside a virtual network
Why it's wrong here
Azure SQL Database cannot be deployed inside a virtual network; only a private endpoint or Managed Instance provides private IP connectivity. Private endpoints are the supported mechanism for PaaS SQL Database. This option is tempting because Managed Instance does sit in a subnet, but that is a different service, not Azure SQL Database.
Go deeper
Related to this question
Learn chapter
Deploying and Configuring Azure SQL Managed Instance
Key term
Azure SQL Performance Tuning
Azure SQL Performance Tuning is the process of optimizing the speed and efficiency of queries and database operations in Microsoft Azure SQL Database or SQL Managed Instance to reduce latency and improve throughput.
About these practice questions
Courseiva writes every DP-300 question from scratch — 574 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-300 exam.