You have a virtual network named VNet1 that contains a subnet named Subnet1.

A private endpoint is the correct solution because it assigns a private IP address from an Azure virtual network to the Azure SQL logical server connection , allowing clients with connectivity to that virtual network to reach SQL Database without traversing the public endpoint. After the private endpoint is configured, public network access can be disabled on Server1 , ensuring that database connectivity occurs exclusively through Azure Private Link. Microsoft specifically documents that App Service applications using VNet Integration can connect to Azure SQL Database through a private endpoint , provided DNS resolves the SQL server name to the private endpoint address.

A service endpoint does not satisfy the requirement because Azure SQL still exposes and uses its public service endpoint; the service endpoint only identifies and secures traffic originating from an authorized subnet. A Private Link service is used to privately expose a customer-owned service, typically behind a Standard Load Balancer, rather than to consume an existing Azure PaaS service such as Azure SQL. A routing table cannot provide Server1 with private PaaS connectivity.

The SC-500 study guide explicitly includes configuring Azure private endpoints to secure access to Azure PaaS resources under the Secure storage, databases, and networking domain.