Basic Concept: This question tests secure database administration, where the control must match the data state, access boundary, identity model, or compliance requirement.
Why B is Correct: A private endpoint exposes an Azure service through a private IP address in a virtual network, avoiding public endpoint dependency. The scenario asks for: You need to configure a connection between VM1 and MIL The solution must meet the following requirements: * The connection must be encrypted. That makes private endpoints the option that satisfies the required Azure SQL layer and operational outcome.
Why A is Wrong: virtual network peering is a security-related control, but its value depends on whether the requirement is identity, encryption, auditing, network isolation, or data exposure reduction. It does not satisfy the required identity, encryption, firewall, auditing, or data-exposure boundary described in the scenario: You need to configure a connection between VM1 and MIL The solution must meet the following requirements: * The connection must be encrypted.
Why C is Wrong: A service endpoint secures traffic to an Azure service over the Azure backbone but still targets the service public endpoint rather than giving it a private IP in the VNet. It is not the right enforcement point for this case; the scenario needs the control that governs the data or identity path being tested.
Why D is Wrong: a site-to-site VPN is a security-related control, but its value depends on whether the requirement is identity, encryption, auditing, network isolation, or data exposure reduction. It does not satisfy the required identity, encryption, firewall, auditing, or data-exposure boundary described in the scenario: You need to configure a connection between VM1 and MIL The solution must meet the following requirements: * The connection must be encrypted.