Plan and implement data platform resources →mediumMultiple ChoiceObjective-mapped

DP-300 Plan and implement data platform resources Practice Question

Exhibit

Refer to the exhibit.

```json
{
  "properties": {
    "virtualNetworkRules": [
      {
        "id": "/subscriptions/.../virtualNetworks/vnet1/subnets/subnet1",
        "ignoreMissingVnetServiceEndpoint": false
      }
    ],
    "ipRules": [
      {
        "ipAddress": "0.0.0.0",
        "action": "Allow"
      }
    ],
    "minimalTlsVersion": "1.2",
    "publicNetworkAccess": "Disabled"
  }
}
```

You are reviewing the firewall and virtual network rules for an Azure SQL Database server as shown in the exhibit. The server has public network access disabled. A client application in a different virtual network (vnet2) needs to connect to the database. What must you do to allow the connection?

⚠ Common exam trap

Many candidates assume IP firewall rules can still work when public network access is disabled, but in reality, disabling public network access completely overrides all IP-based rules, making virtual network rules the only viable option for cross-VNet connectivity.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Add a virtual network rule that references subnet2 in vnet2.

Since public network access is disabled, the server rejects all public IP-based connections. To allow a client in a different virtual network (vnet2) to connect, you must create a virtual network rule that references subnet2 in vnet2. This rule establishes a private endpoint-like connection through the Azure backbone, bypassing the public internet and honoring the disabled public network access setting.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Add a virtual network rule that references subnet2 in vnet2.
Why this is correct
Virtual network rules allow traffic from specific subnets.
✗
Add the IP address of the client to the ipRules array.
Why it's wrong here
Public network access is disabled, so IP rules are not effective.
✗
Set publicNetworkAccess to 'Enabled' and add an IP firewall rule.
Why it's wrong here
This would expose the server to public internet, which may not be desired.
✗
Create a server-level firewall rule to allow all Azure services.
Why it's wrong here
Firewall rules are not used for virtual network traffic.

Visual reference

Go deeper

DP-300 Plan and implement data platform resources Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question