A payments team's application servers sit in a spoke network and must reach an Azure SQL logical server while keeping every packet on private addressing and off Microsoft's public endpoints. Which feature gives the database an address inside the team's own subnet?
Show answer and explanation
Answer: C
A private endpoint places a network interface with a private IP from the chosen subnet in front of the SQL logical server, so clients reach it over private addressing. Pairing it with a privatelink DNS zone makes the usual server name resolve to that private IP. Service endpoints keep the public address in use and only restrict the source. Routing through Azure Firewall adds inspection but gives the target no private address.
Why the other options are wrong
- A. A service endpoint extends the subnet's identity to the PaaS service, but the database keeps its public address, so the requirement for a private address inside the subnet is not met.
- B. A route table steers packets to a next hop but does not give the SQL server any address in the subnet; the server still sits on its public endpoint.
- D. Allow-listing public IPs on the SQL firewall keeps the database reachable over the public internet, which violates the requirement to stay off public endpoints.
Exam tip. Private endpoints give a PaaS service a private IP in your subnet, and the privatelink DNS zone is what makes name resolution work.