How should remote developers securely access Azure SQL Managed Instance?

Case study - This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided. To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study. At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section. To start the case study - To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question. Overview - ADatum Corporation is a financial services company that has a main office in New York City. Existing Environment. Licensing Agreement ADatum has a Microsoft Volume Licensing agreement that includes Software Assurance. Existing Environment. Network Infrastructure ADatum has an on-premises datacenter and an Azure subscription named Sub1. Sub1 contains a virtual network named Network1 in the East US Azure region. The datacenter is connected to Network1 by using a Site-to-Site (S2S) VPN. Existing Environment. Identity Environment The on-premises network contains an Active Directory Domain Services (AD DS) forest. The forest contains a single domain named corp.adatum.com. The corp.adatum.com domain syncs with a Microsoft Entra tenant named adatum.com. Existing Environment. Database Environment The datacenter contains the servers shown in the following table. DB1 and DB2 are used for transactional and analytical workloads by an application named App1. App1 runs on Microsoft Entra hybrid joined servers that run Windows Server 2022. App1 uses Kerberos authentication. DB3 stores compliance data used by two applications named App2 and App3. DB3 performance is monitored by using Extended Events sessions, with the event_file target set to a file share on a local disk of SVR3. Resource allocation for DB3 is managed by using Resource Governor. Requirements. Planned Changes - ADatum plans to implement the following changes: • Deploy an Azure SQL managed instance named Instance1 to Network1. • Migrate DB1 and DB2 to Instance1. • Migrate DB3 to Azure SQL Database. • Following the migration of DB1 and DB2, hand over database development to remote developers who use Microsoft Entra joined Windows 11 devices. • Following the migration of DB3, configure the database to be part of an auto-failover group. Requirements. Availability Requirements ADatum identifies the following post-migration availability requirements: • For DB1 and DB2, offload analytical workloads to a read-only database replica in the same Azure region. • Ensure that if a regional disaster occurs, DB1 and DB2 can be recovered from backups. • After the migration, App1 must maintain access to DB1 and DB2. • For DB3, manage potential performance issues caused by resource demand changes by App2 and App3. • Ensure that DB3 will still be accessible following a planned failover. • Ensure that DB3 can be restored if the logical server is deleted. • Minimize downtime during the migration of DB1 and DB2. Requirements. Security Requirements ADatum identifies the following security requirements for after the migration: • Ensure that only designated developers who use Microsoft Entra joined Windows 11 devices can access DB1 and DB2 remotely. • Ensure that all changes to DB3, including ones within individual transactions, are audited and recorded. Requirements. Management Requirements ADatum identifies the following post-migration management requirements: • Continue using Extended Events to monitor DB3. • In Azure SQL Database, automate the management of DB3 by using elastic jobs that have database-scoped credentials. Requirements. Business Requirements ADatum identifies the following business requirements: • Minimize costs whenever possible, without affecting other requirements. • Minimize administrative effort. You need to recommend a solution that will enable remote developers to access DB1 and DB2. The solution must support the planned changes and meet the security requirements. What should you include in the recommendation? -

a public endpoint via a database-level firewall rule
a Point-to-Site (P2S) VPN
a public endpoint via a server-level firewall rule
a private endpoint Source Reference Answer

Community Votes

60%

40%

60% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The question tests secure remote developer connectivity to SQL Managed Instance; the common trap is choosing a P2S VPN, which adds infrastructure cost and complexity versus a private endpoint.

Remote developers on Microsoft Entra joined Windows 11 devices need secure access to an Azure SQL Managed Instance deployed in a virtual network. Community consensus favors a private endpoint as the most secure, cost-effective, and management-friendly solution.

Many choose B (Point-to-Site VPN) because it seems intuitive for remote access, but it requires deploying and managing a VPN gateway, increasing cost and administrative effort compared to a private endpoint.

Community Discussion (6 comments)

JamC 👍 1 Selected: B

Answer is B. From: https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-about A Point-to-Site (P2S) VPN gateway connection lets you create a secure connection to your virtual network from an individual client computer. A P2S connection is established by starting it from the client computer. This solution is useful for telecommuters who want to connect to Azure virtual networks from a remote location, such as from home or a conference.

voodoo_sh 👍 1 Selected: B

I think it is B - Point-to-Site VPN to on-premises datacenter (and it has connection to Azure's Network1), or P2S VPN directly to Azure Network1. D: Private endpoint doesn't make any sense here for me. It would make sense if SQL MI was in some different vNet, such as "Network2", and you would want to use private endpoint to connect MI to Network1 and then connect to MI from there.

2f5c7cd 👍 1

I think B-P2S, the requirement is developer to MI https://learn.microsoft.com/en-us/azure/azure-sql/managed-instance/connect-application-instance?view=azuresql#connect-a-developer-box

bingomutant 👍 1

D Private Endpoint - satisfies the requirements - No Need for VPN Gateways: Unlike using a Point-to-Site (P2S) VPN, a private endpoint does not require the deployment of additional infrastructure such as a VPN gateway, which can incur extra costs. Reduced Network Traffic Costs: With a private endpoint, all traffic between your Azure resources and the SQL database remains within the Azure backbone network, avoiding egress charges that might apply if traffic were routed through the public internet or through a VPN - Administrative Effort Minimization: Simplified Network Configuration: Once the private endpoint is configured, it provides a straightforward way to secure the connection. You won't need to manage or configure VPN connections, which can require additional maintenance.

voodoo_sh 👍 1

I think correct answer is B: a Point-to-Site (P2S) VPN Configure P2S VPN, so remote developers can connect to virtual network using the Azure VPN Client over VPN, using their Microsoft Entra (domain) accounts. And then connect to SQL MI's internal endpoint (hidden within virtual network), also using the Microsoft Entra accounts with MFA. Incorrect answers: Not A, C - because SQL Managed Instance doesn't have server-level or database-level firewall rules. Its possible to limit connections to public endpoint, using the Network Security Group's inbound rules, but that relates to NSG, not a MI's firewall. Not D - not a private endpoint - because private endpoint feature simply provides local IP address for SQL MI in a chosen virtual network.

JJJR 👍 3 Selected: D

I'd say D because of following: There are three options to connect to a SQL Managed Instance in a different virtual network: Private endpoints Azure VNet peering VNet-to-VNet VPN gateway (Azure portal, PowerShell, Azure CLI) Of the three, private endpoints are the most secure and resource-economical option because they: only expose the SQL Managed Instance from its virtual network. only allow one-way connectivity. require just one IP address in the application's virtual network. https://learn.microsoft.com/en-us/azure/azure-sql/managed-instance/connect-application-instance?view=azuresql#connect-from-inside-a-different-vnet

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

A private endpoint (Option D) exposes the SQL Managed Instance only within the virtual network using a private IP address, keeping traffic entirely on the Azure backbone. It satisfies the security requirement that only designated developers on Microsoft Entra joined Windows 11 devices can access the instance remotely. As noted in Comment [1], private endpoints are the most secure and resource-economical option because they avoid extra infrastructure like VPN gateways. Comment [5] reinforces that private endpoints reduce network traffic costs and eliminate the need for additional gateway infrastructure, aligning with the business requirement to minimize costs and administrative effort.

Why the Other Options Are Wrong

Options A and C (public endpoint via database-level or server-level firewall rule) are incorrect because SQL Managed Instance does not support public endpoints; it is inherently deployed inside a virtual network and only accessible via private connectivity. Option B (Point-to-Site VPN) is a plausible distractor, but as Comment [6] points out, it requires deploying a VPN gateway, incurring extra cost and management overhead. Comment [3] also notes that a private endpoint makes more sense when the MI is already in the target vNet, avoiding unnecessary VPN complexity.

Community Comment Notes

The community is split, with 60% voting D and 40% voting B. Comment [1] provides a strong rationale for D, citing Microsoft documentation that lists private endpoints as a top connectivity option. Comment [2] and [4] advocate for B, referencing P2S VPN documentation for remote developer connectivity. However, Comment [5] and [6] effectively counter the P2S argument by emphasizing cost and administrative efficiency, which aligns with the business requirements to minimize both.

Official Reference

Exam Strategy

Always align your answer with the business requirements stated in the case study. If minimizing cost and administrative effort is emphasized, choose the solution that avoids additional infrastructure like VPN gateways, such as a private endpoint.

Related Analysis

Practice All DP-300 Questions

Access 105 questions with complete answers and detailed explanations.

View Full DP-300 Practice Test →

← Back to DP-300 Study Guide