DP-300 Implement a secure environment Practice Question
Your company uses Azure SQL Database for a customer-facing application. You need to ensure that only the application can access the database, and that access is restricted to specific IP ranges. The application runs on Azure App Service with a dynamic outbound IP address. What should you do?
⚠ Common exam trap
Test-takers frequently assume VNet integration or private endpoints are always required for secure access, but the question explicitly states the application uses a dynamic outbound IP address, making a firewall rule for the IP range the most straightforward solution that meets the requirement of restricting access to specific IP ranges.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a firewall rule for the App Service's outbound IP address range.
The application runs on Azure App Service with a dynamic outbound IP address, and the requirement is to restrict access to specific IP ranges. By adding a firewall rule for the App Service's outbound IP address range (which can be found in the App Service properties or via the `WEBSITE_OUTBOUND_IP_ADDRESSES` app setting), you allow the application to connect to Azure SQL Database while blocking other traffic. This approach directly addresses the dynamic IP challenge without requiring VNet integration or private endpoints.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a VNet integration for the App Service and set the SQL firewall to allow the VNet subnet.
Why it's wrong here
VNet integration requires Premium App Service plan and does not directly provide outbound IP control.
- ✗
Migrate the database to Azure SQL Managed Instance and use a service endpoint.
Why it's wrong here
Service endpoints do not resolve the issue of dynamic outbound IP addresses from Azure App Service, as they are designed to extend virtual networks to services rather than managing unpredictable egress IPs. Migrating to a Managed Instance is an appropriate strategy when you require near-total compatibility with SQL Server instance-level features like Linked Servers or Agent jobs. This approach fails here because it does not address the requirement for IP-based restriction via Virtual Network integration.
- ✗
Create a private endpoint for the SQL Database and connect App Service to it via VNet peering.
Why it's wrong here
Private endpoint restricts access to the VNet, but App Service without VNet integration cannot use it natively.
- ✓
Add a firewall rule for the App Service's outbound IP address range.
Why this is correct
This allows App Service to connect even with dynamic IPs, as the range is known.
Go deeper
Related to this question
Learn chapter
Overview of Azure Data Platform Options
Key term
Azure SQL Performance Tuning
Azure SQL Performance Tuning is the process of optimizing the speed and efficiency of queries and database operations in Microsoft Azure SQL Database or SQL Managed Instance to reduce latency and improve throughput.
About these practice questions
One of 906 original DP-300 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-300 exam.