Using a private endpoint to connect an App Service to SQL Server on Azure VMs

SC-100 By islever Editorial Last updated

Specify requirements for securing SaaS, PaaS, and IaaS services

Short answer

B A private endpoint gives the App Service a private connection to the SQL Server VMs without public exposure, working across regions.

Question

You have an Azure subscription that contains SQL Server on Azure virtual machines located in the West US Azure region. The virtual machines are only accessible by using private IP addresses. You plan to deploy a Windows-based Azure App Service web apps in the East US Azure region. You need to recommend a solution to provide the web apps access to the SQL Server databases. What should you include in the recommendation?
  1. an Azure VPN gateway
  2. a private endpoint Correct Answer
  3. a service endpoint
  4. an Azure Bastion host

Key Takeaways

A private endpoint provides secure private connectivity to the SQL servers; a service endpoint is regional (same region only) and Bastion is for management access, not app data; a VPN gateway is heavier than the required private link.

To let an Azure App Service web app privately reach SQL Server on Azure VMs (private IP only) across regions, use a private endpoint, which gives the web app a private connection to the SQL servers without exposing them publicly.

Common mistake: Choosing a service endpoint (C) — it works only within the same region (East US web app to West US SQL would fail) and is for PaaS, not for reaching a cross-region SQL VM privately.

Expert Analysis

Why the Answer Is Correct

A private endpoint provides a private IP-based connection from the App Service's network into the SQL Server environment, allowing the web apps to reach the SQL Server databases over private addresses without public exposure, and it works across Azure regions.

Why the Other Options Are Wrong

A service endpoint (C) is regional only and cannot connect an East US web app to a West US SQL VM. Azure Bastion (D) is for administrative RDP/SSH access, not application data paths. An Azure VPN gateway (A) is a heavier connectivity option than the private link the scenario needs.

Community Comment Notes

The community favored B (71 votes). Comments cite the private-link FAQ confirming private endpoints can connect across regions, and note the SQL VM's private-only accessibility makes a private endpoint the fit; a minority (A, 29 votes) suggested a VPN gateway.

Official Reference

https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-overview

This link opens the official vendor documentation in a new tab.

Community Votes

B
71%
A
29%

71% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. Lrrr_FromOmicronPersei8 👍 2 Answered B
    The answer is B, Private Endpoint, as per https://learn.microsoft.com/en-us/azure/private-link/private-link-faq#can-private-endpoint-connect-to-azure-paas-resources-across-azure-regions- Q: Can Private Endpoint connect to Azure PaaS resources across Azure regions? A: Yes. Private Endpoints can connect to Azure PaaS resources across Azure regions.
  2. sweetykaur 👍 1 Answered B
    B. a private endpoint A private endpoint will create a private connection between your Azure App Service web apps and the SQL Server on Azure virtual machines, ensuring secure communication over a private IP address. This will allow your web apps to access the SQL Server databases without exposing them to the public internet.
  3. 676ae1a 👍 1 Answered B
    Un punto final privado permite que las aplicaciones web accedan a los recursos de SQL Server mediante direcciones IP privadas, evitando la exposición a Internet y mejorando la seguridad.
  4. Ali96 👍 1 Answered B
    The correct solution for providing secure and private access between the web apps in East US and the SQL Server in West US would be Option B: a private endpoint
  5. SkunkMan190 👍 1 Answered A
    Since the SQL-server on a VM is not a PaaS-service, I'm gonna try A
Show 1 more comment
  1. tuyi2 👍 1 Answered A
    Chat GPT suggests connecting via Azure VPN Gateway

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Using Microsoft Entra Permissions Management to find unused RBAC assignments

S-grade

Scenarios supported by compliant network check in Global Secure Access

S-grade

Removing the inbound firewall rule for an Entra application proxy connector

S-grade

Changing DNS MX records to route all inbound mail through Defender for Office 365

S-grade

Practice All SC-100 Questions

Access 110 questions with complete answers and detailed explanations.

View Full SC-100 Practice Test →

← Back to SC-100 Study Guide