Microsoft Azure Security Engineer Associate AZ-500 Practice Question

Regional VNet Integration connects an App Service app to a subnet in the same region. Outbound traffic from the app to resources in that virtual network, such as an Azure SQL Managed Instance, is sent over private IP addresses and stays on the Microsoft backbone. Private Endpoint for the web app provides private inbound access to the app but does not make the app's outbound traffic private. Gateway-required VNet Integration uses a VPN gateway, is intended for cross-region scenarios, and is not needed here. A service endpoint for Microsoft.Sql secures traffic from a subnet to Azure SQL but does not apply to traffic that originates from an App Service app that is outside the virtual network.