DP-300 Implement a secure environment Practice Question
You are the database administrator for a company that uses Azure SQL Database. The company has a strict security policy requiring that all database connections be encrypted and that the server's firewall only allows connections from a list of approved IP addresses. You have configured the server-level firewall rules accordingly and enabled the 'Force encryption' setting on the server. However, after deployment, you notice that an application running on an Azure virtual machine is able to connect to the database even though its public IP address is not in the approved list. The virtual machine is in the same region as the database. What is the most likely cause?
⚠ Common exam trap
Many candidates assume private IPs or service endpoints automatically bypass firewall rules, but the actual cause is the default 'Allow Azure services' setting, which is frequently overlooked as a blanket permission that overrides specific IP restrictions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The 'Allow Azure services and resources to access this server' setting is enabled, which allows all Azure IPs to connect.
The 'Allow Azure services and resources to access this server' setting, when enabled, adds a firewall rule that permits connections from all Azure IP addresses, including those not in the approved list. This overrides the specific IP-based firewall rules, allowing the Azure VM (even with a public IP not on the approved list) to connect. The setting is designed to allow Azure services like Azure App Service or Azure VMs to bypass IP restrictions, which violates the strict security policy in this scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The virtual machine is using a private IP address that is automatically allowed.
Why it's wrong here
Firewall rules work on public IP addresses; private IPs are not used for public endpoint connections.
- ✗
The virtual machine is using a service endpoint that bypasses the firewall.
Why it's wrong here
Service endpoints are for private access; they do not bypass firewall rules for public IPs.
- ✗
The 'Force encryption' setting is misconfigured; it should be disabled to allow non-encrypted connections.
Why it's wrong here
Force encryption enforces encryption, but does not bypass firewall rules.
- ✓
The 'Allow Azure services and resources to access this server' setting is enabled, which allows all Azure IPs to connect.
Why this is correct
This setting bypasses firewall rules for Azure services.
Go deeper
Related to this question
Learn chapter
Overview of Azure Data Platform Options
Key term
Azure SQL Performance Tuning
Azure SQL Performance Tuning is the process of optimizing the speed and efficiency of queries and database operations in Microsoft Azure SQL Database or SQL Managed Instance to reduce latency and improve throughput.
About these practice questions
Courseiva writes every DP-300 question from scratch — 906 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-300 exam.