DP-300 Certification Practice Question #72

Question

You have an Azure virtual machine named VM1 on a virtual network named VNet1. Outbound traffic from VM1 to the internet is blocked.
You have an Azure SQL database named SqlDb1 on a logical server named SqlSrv1.
You need to implement connectivity between VM1 and SqlDb1 to meet the following requirements:
✑ Ensure that VM1 cannot connect to any Azure SQL Server other than SqlSrv1.
✑ Restrict network connectivity to SqlSrv1.
What should you create on VNet1?

Accepted Answer

To ensure that `VM1` can only connect to `SqlSrv1` and no other Azure SQL Server (thereby preventing data exfiltration to other servers), you must implement Azure Private Link (Private Endpoint). Service Endpoints (B) apply to the entire Azure SQL Database service across the region, which would allow `VM1` to connect to other SQL servers. Private Link maps a specific SQL server instance to a private IP address within `VNet1`, satisfying both the constraint to block other SQL servers and restricting network connectivity to `SqlSrv1` over a private path.

More DP-300 practice questions