DP-300 Implement a secure environment Practice Question
Your company uses Azure SQL Database with Elastic Jobs to run maintenance scripts. You need to ensure that the Elastic Job agent can connect to the target databases securely. The agent runs in an Azure virtual network and uses a managed identity. The target databases are in a different Azure region and have public endpoint disabled. What is the most secure way to connect the Elastic Job agent to the target databases?
⚠ Common exam trap
Many candidates confuse virtual network service endpoints with private endpoints, assuming service endpoints provide the same private connectivity when public endpoints are disabled, but service endpoints still rely on the public endpoint of the Azure service and cannot bypass it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure a private endpoint for each target database and grant the Elastic Job agent's managed identity access to the databases via a contained database user.
It combines Azure Private Link (private endpoint) for network-level isolation with managed identity for authentication, eliminating exposure to the public internet and removing the need for passwords. The Elastic Job agent's managed identity is mapped to a contained database user in each target database, enabling secure, passwordless connections even across regions when public endpoints are disabled.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use virtual network service endpoints to allow the agent's subnet to connect to the target databases.
Why it's wrong here
Service endpoints are not supported across regions and are less secure than private endpoints.
- ✓
Configure a private endpoint for each target database and grant the Elastic Job agent's managed identity access to the databases via a contained database user.
Why this is correct
Private endpoints keep traffic within Microsoft's network and managed identity avoids credential management.
- ✗
Add the agent's public IP address to the target database firewall rules.
Why it's wrong here
Public IP address and firewall rules expose the database to the public internet.
- ✗
Create a SQL authentication login for the Elastic Job agent and use that in the job credentials.
Why it's wrong here
SQL authentication is less secure and requires managing passwords.
Go deeper
Related to this question
Learn chapter
Overview of Azure Data Platform Options
Key term
Azure SQL Performance Tuning
Azure SQL Performance Tuning is the process of optimizing the speed and efficiency of queries and database operations in Microsoft Azure SQL Database or SQL Managed Instance to reduce latency and improve throughput.
About these practice questions
This DP-300 question is part of Courseiva's 906-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-300 exam.