Using a private endpoint to connect an App Service to SQL Server on Azure VMs

Specify requirements for securing SaaS, PaaS, and IaaS services
Answer Correct answer: B — A private endpoint gives the App Service a private connection to the SQL Server VMs without public exposure, working across regions.

You have an Azure subscription that contains SQL Server on Azure virtual machines located in the West US Azure region. The virtual machines are only accessible by using private IP addresses. You plan to deploy a Windows-based Azure App Service web apps in the East US Azure region. You need to recommend a solution to provide the web apps access to the SQL Server databases. What should you include in the recommendation?

  1. an Azure VPN gateway
  2. a private endpoint Correct Answer
  3. a service endpoint
  4. an Azure Bastion host
azure private endpoint app service to sql vm private cross region private connectivity

Community Votes

B
71%
A
29%

71% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

A private endpoint provides secure private connectivity to the SQL servers; a service endpoint is regional (same region only) and Bastion is for management access, not app data; a VPN gateway is heavier than the required private link.

To let an Azure App Service web app privately reach SQL Server on Azure VMs (private IP only) across regions, use a private endpoint, which gives the web app a private connection to the SQL servers without exposing them publicly.

Choosing a service endpoint (C) — it works only within the same region (East US web app to West US SQL would fail) and is for PaaS, not for reaching a cross-region SQL VM privately.

Community Discussion (6 comments)

SkunkMan190 👍 1 Selected: A
Since the SQL-server on a VM is not a PaaS-service, I'm gonna try A
sweetykaur 👍 1 Selected: B
B. a private endpoint A private endpoint will create a private connection between your Azure App Service web apps and the SQL Server on Azure virtual machines, ensuring secure communication over a private IP address. This will allow your web apps to access the SQL Server databases without exposing them to the public internet.
Ali96 👍 1 Selected: B
The correct solution for providing secure and private access between the web apps in East US and the SQL Server in West US would be Option B: a private endpoint
Lrrr_FromOmicronPersei8 👍 2 Selected: B
The answer is B, Private Endpoint, as per https://learn.microsoft.com/en-us/azure/private-link/private-link-faq#can-private-endpoint-connect-to-azure-paas-resources-across-azure-regions- Q: Can Private Endpoint connect to Azure PaaS resources across Azure regions? A: Yes. Private Endpoints can connect to Azure PaaS resources across Azure regions.
676ae1a 👍 1 Selected: B
Un punto final privado permite que las aplicaciones web accedan a los recursos de SQL Server mediante direcciones IP privadas, evitando la exposición a Internet y mejorando la seguridad.
tuyi2 👍 1 Selected: A
Chat GPT suggests connecting via Azure VPN Gateway

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

A private endpoint provides a private IP-based connection from the App Service's network into the SQL Server environment, allowing the web apps to reach the SQL Server databases over private addresses without public exposure, and it works across Azure regions.

Why the Other Options Are Wrong

A service endpoint (C) is regional only and cannot connect an East US web app to a West US SQL VM. Azure Bastion (D) is for administrative RDP/SSH access, not application data paths. An Azure VPN gateway (A) is a heavier connectivity option than the private link the scenario needs.

Community Comment Notes

The community favored B (71 votes). Comments cite the private-link FAQ confirming private endpoints can connect across regions, and note the SQL VM's private-only accessibility makes a private endpoint the fit; a minority (A, 29 votes) suggested a VPN gateway.

Official Reference

https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-overview

Related Analysis

You have multiple Azure subscriptions that each contains mul

S-Grade

You have an on-premises app named App1. Remote users access

A-Grade

You have a Microsoft Entra tenant that contains 10 Windows 1

S-Grade

Practice All SC-100 Questions

Access 110 questions with complete answers and detailed explanations.

View Full SC-100 Practice Test →

← Back to SC-100 Study Guide