Exam DP-300 topic 1 question 35 discussion

During virtual network setup, if you use ExpressRoute with network peering to Microsoft, add the following service endpoints to the subnet in which the service will be provisioned: https://docs.microsoft.com/en-us/azure/dms/tutorial-sql-server-to-managed-instance

NSG is not enouhg, with NSG you only control the traffic, but it does not enable the integration between Azure Database Migration Service and the resources of the Vnet , option A is right

https://learn.microsoft.com/en-us/azure/dms/faq#setup " Azure Database Migration Service prerequisites that are common across all supported migration scenarios include the need to: Create a Microsoft Azure Virtual Network for Azure Database Migration Service by using the Azure Resource Manager deployment model, which provides site-to-site connectivity to your on-premises source servers by using either ExpressRoute or VPN. Ensure that your virtual network Network Security Group rules don't block the port 443 for ServiceTags of ServiceBus, Storage and AzureMonitor. For more detail on virtual network NSG traffic filtering, see the article Filter network traffic with network security groups. When using a firewall appliance in front of your source database(s), you may need to add firewall rules to allow Azure Database Migration Service to access the source database(s) for migration. "

D. NSG according this docu: https://learn.microsoft.com/en-us/azure/azure-sql/managed-instance/managed-instance-link-preparation?view=azuresql&tabs=ssms#network-ports-between-the-environments

D is correct

https://learn.microsoft.com/en-us/azure/dms/faq#setup

Answer is D - NSGs control traffic in and out of the virtual network and can allow or block specific ports and protocols needed for the migration (such as SQL Server ports) - it is not A - Service endpoints are used to extend VNet access to certain Azure services (like Azure SQL Database, Azure Storage), but they're not needed here because Azure SQL Managed Instance resides fully inside the VNet, and an ExpressRoute connection is used for connectivity from on-premises.

A is correct

A. Configure service endpoints: Service endpoints provide secure and direct connectivity to Azure services over the Azure backbone network. They are not typically used for connectivity between on-premises environments and Azure services. B. Configure virtual network peering: Virtual network peering is used to connect two Azure virtual networks seamlessly. Since your scenario involves an on-premises network and not another Azure virtual network, peering is not applicable. C. Deploy an Azure firewall: An Azure firewall is a network security service that protects Azure Virtual Network resources. It could be used to govern the traffic between your on-premises environment and the Azure SQL Managed Instance, but it is not the primary tool for enabling connectivity. D. Configure network security groups (NSGs): Network Security Groups are used to control inbound and outbound traffic to network interfaces (NIC), VMs, and subnets. By creating and applying NSG rules, you can ensure that traffic from the on-premises network can reach SQLMI1 over the ExpressRoute connection.

A is correct