A Flexible Server instance must accept connections from an AKS pod without exposing the database to the internet. Which connectivity method should you use?

1. A Public endpoint with firewall rules
2. ✓ B Private endpoint or VNet integration (correct answer)
3. C Disable SSL and use IP allowlist
4. D Azure Bastion

Shortcut: Private endpoint creates a private IP for the PostgreSQL server within the VNet, or VNet injection (Flexible Server) places the server directly in a delegated subnet. No public exposure needed.