AZ-104 Question 190
Single answerYou manage an Azure Web App that must securely connect to an Azure SQL Database without sending traffic over the public Internet. The SQL Database is in the same Azure region, and both resources must remain in separate subnets for compliance. Which configuration should you implement to meet these requirements?
- A
Create a private endpoint for the Azure SQL Database and enable regional VNet Integration for the Web App
- B
Configure IP access restrictions on the Web App to allow the SQL Database’s public IP only
- C
Enable ‘Always On’ in the Web App and use Azure Traffic Manager for regional routing
- D
Configure a service endpoint for the SQL Database subnet without modifying the Web App’s networking
Show answer and explanation
Correct answer: A
Explanation
To keep data in transit on the internal Azure network and implement subnet-level controls, a private endpoint for Azure SQL Database combined with regional VNet Integration in the App Service is the correct approach. This configuration provides private IP-based connectivity and secures traffic without traversing the public Internet.
- A. Correct.
By creating a private endpoint for the SQL Database and enabling regional VNet Integration on the Web App, all traffic remains on the internal Azure network. This setup ensures compliance by isolating the resources in separate subnets while preventing public Internet exposure.
- B. Incorrect.
IP access restrictions limit which IP addresses can reach the Web App but do not force traffic off the public Internet route for the connection to Azure SQL Database.
- C. Incorrect.
Enabling ‘Always On’ prevents the App Service from idling and Azure Traffic Manager helps with load balancing and traffic distribution, but this does not establish a private network path to the SQL Database.
- D. Incorrect.
A service endpoint secures traffic between the subnet and the Azure resource, but without VNet Integration, the Web App would still lack a private route to the SQL Database.