SC-100 Certification Practice Question #179

Question

You have an Azure subscription that contains the resources shown in the following table.

You need to recommend a network security solution for App1. The solution must meet the following requirements:

•	Only the virtual machines that are connected to Subnet1 must be able to connect to DB1.
•	DB1 must be inaccessible from the internet.
•	Costs must be minimized.

What should you include in the recommendation? To answer, select the options in the answer area.

NOTE: Each correct answer is worth one point.

Accepted Answer

Two requirements drive each row. "Only the virtual machines connected to Subnet1 can connect to DB1" plus "DB1 must be inaccessible from the internet" plus "minimize cost" point to a private endpoint for DB1: MS Learn states a private endpoint gives the Azure SQL logical server a private IP inside the VNet and, with public network access denied, the database is reachable only through the VNet — eliminating internet access. For enforcing the network-security restriction limiting access to a specific subnet, Azure SQL's native virtual network rules are the cost-minimized, purpose-built feature ("accepts communications sent from particular subnets in virtual networks"), avoiding the extra spend of Azure Firewall and the fact that NSGs don't natively scope SQL access by subnet without service tags. The Highly Voted comment says "private endpoint and NSG," but NSGs are a subnet/NIC traffic filter rather than the SQL-side restriction the row asks for; Ali96's pairing (private endpoint + virtual network rules) aligns precisely with the dropdown wording and MS Learn, so it carries the row-2 decision. Confidence is 82 because the community is split between NSG and virtual network rules for row 2 and no explicit Suggested Answer letter was captured, though MS Learn clearly favors virtual network rules for subnet-scoped SQL access.

More SC-100 practice questions