DP-900 Practice Question: Identify considerations for relational data on Azure
A company needs to ensure that their Azure SQL Database is accessible only from a specific virtual network and deny access from public endpoints. Which feature should they configure?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Virtual network service endpoints and firewall rules
Virtual network service endpoints and firewall rules allow restricting access to a specific VNet while denying public access. Option A is incorrect because disabling public network access alone does not tie to a specific VNet; it would block all access unless combined with Private Link. Option C is incorrect because IP firewall rules allow access from specific public IP addresses, not from a VNet. Option D is incorrect because Azure Private Link provides private connectivity but does not deny public access by itself; it requires additional configuration to block public endpoints.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable public network access
Why it's wrong here
In Azure SQL Database, the 'Public network access' toggle (or Deny public network access) when set to Disabled (or Deny) blocks all connections over the public endpoint. However, without configuring a private endpoint (Private Link) or a virtual network service endpoint, the only way to connect is via the public endpoint; disabling it without any private connectivity paths denies all access, including legitimate internal clients. This is a blunt instrument, not a targeted solution to block just the public endpoint while permitting specific VNet traffic.
- ✓
Virtual network service endpoints and firewall rules
Why this is correct
Configure Azure SQL Database firewall to allow connections from a specific virtual network subnet by enabling a service endpoint for Microsoft.Sql on that subnet and adding a virtual network firewall rule. This extends the SQL database's public endpoint to accept traffic from that subnet only, while all other public internet traffic is blocked by default firewall rules. This pairs network-level isolation with firewall rules to restrict access to designated VNets without needing private IPs.
- ✗
IP firewall rules
Why it's wrong here
IP firewall rules are based on source IP address ranges, which apply to public internet connections. They cannot restrict traffic to a specific virtual network because VNet traffic typically comes from a private IP address that is not directly identifiable at the SQL database firewall layer unless using service endpoints. Thus IP rules alone allow any client with a matching public IP (or within a range) to connect, not just VNet resources, and they don't provide the same level of isolation as VNet-specific rules.
- ✗
Azure Private Link
Why it's wrong here
Azure Private Link (via a private endpoint) gives your SQL database a private IP address in your virtual network, enabling connections directly from your VNet without traversing the public internet. However, simply creating a private endpoint does not automatically disable the public endpoint; you must also set the database's 'Public network access' to Disabled or deny public access to fully restrict traffic. Without that extra step, both private and public connections remain possible, so Private Link alone doesn't meet the requirement to block the public endpoint.
Go deeper
Related to this question
Learn chapter
Azure SQL Services
Key term
Azure SQL Database
Azure SQL Database is a fully managed relational database-as-a-service (DBaaS) in Microsoft Azure, based on the SQL Server engine, that handles scaling, backups, patching, and high availability automatically.
Key term
Service
A service is a software component or system that performs a specific function and is available to be used by other programs or users over a network.
About these practice questions
One of 820 original DP-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-900 exam.