DP-300 Certification Practice Question #65

Question

You have an Azure virtual machine named VM1 on a virtual network named VNet1. Outbound traffic from VM1 to the internet is blocked.
You have an Azure SQL database named SqlDb1 on a logical server named SqlSrv1.
You need to implement connectivity between VM1 and SqlDb1 to meet the following requirements:
✑ Ensure that all traffic to the public endpoint of SqlSrv1 is blocked.
✑ Minimize the possibility of VM1 exfiltrating data stored in SqlDb1.
What should you create on VNet1?

Accepted Answer

To block all traffic to the public endpoint of the SQL Server (`SqlSrv1`) and minimize the risk of data exfiltration from `VM1`, you should use Azure Private Link (Private Endpoint). Unlike Service Endpoints (which grant access to the entire Azure SQL service and still route traffic to the public IP of the service over the Azure backbone), Private Link creates a private network interface (NIC) with a private IP address from your virtual network. This allows you to disable public access to `SqlSrv1` completely and restricts connectivity to that specific database server instance, preventing a malicious user from exfiltrating data to an external SQL server.

More DP-300 practice questions