You have an Azure virtual machine named VM1 on a virtual network named VNet1.

[Reference:, https://docs.microsoft.com/en-us/azure/private-link/private-link-overview, , , , , , , , Basic Concept: This question tests plan and implement data platform resources in the DP-300 exam context. The correct choice is determined by the exact service boundary and operational requirement stated in the scenario., Why B is Correct: A service endpoint secures traffic to an Azure service over the Azure backbone but still targets the service public endpoint rather than giving it a private IP in the VNet. This fits the case because the requested outcome is: You need to implement connectivity between VM1 and SqlDb1 to meet the following requirements: Ensure that VM1 cannot connect to any Azure SQL Server other than SqlSrv1. The selected feature addresses that outcome directly rather than relying on a workaround., Why A is Wrong: a VPN gateway is an Azure data-platform feature, but it must match the workload model, service tier, migration path, or deployment constraint described in the scenario. It applies to a different Azure data-platform design than the one the question is testing., Why C is Wrong: a private link is an Azure data-platform feature, but it must match the workload model, service tier, migration path, or deployment constraint described in the scenario. It mismatches the target platform, migration method, compute tier, or deployment model described in the scenario, so it would not satisfy the workload as stated., Why D is Wrong: an ExpressRoute gateway is an Azure data-platform feature, but it must match the workload model, service tier, migration path, or deployment constraint described in the scenario. It applies to a different Azure data-platform design than the one the question is testing., ]