AZ-104 Question 226
Select 2You manage an Azure environment that hosts a web application in Azure App Service and an Azure SQL Database. The web application is configured with a subnet in a Virtual Network, and you want to ensure Azure SQL Database only accepts traffic from that subnet using a Service Endpoint. Which two actions must you perform?
- A
Enable the Microsoft.Sql service endpoint on the subnet containing the web application.
- B
Enable Virtual Network Integration for Azure App Service in the same region as the subnet.
- C
Add the subnet address range to the Azure SQL Database server firewall settings after enabling the service endpoint.
- D
Disable the 'Allow Azure services and resources to access this server' setting in Azure SQL Database.
Show answer and explanation
Correct answers: A, C
Explanation
Service endpoints allow traffic from a specific virtual network to securely reach Azure PaaS services. In this scenario, you must enable the Microsoft.Sql service endpoint on the private subnet and add that subnet's address range to the SQL server firewall rules so the database accepts traffic only from that subnet.
- A. Correct.
Enabling the service endpoint for Microsoft.Sql on the subnet is necessary for the database to recognize inbound traffic from that subnet as private.
- B. Incorrect.
While enabling VNet Integration for the App Service is required to route traffic through the subnet, the scenario implies that the web app is already on the subnet. If the App Service were not already integrated, this would be necessary.
- C. Correct.
After enabling the service endpoint, you must configure the SQL Database firewall with the subnet's address range so only that subnet can access the database.
- D. Incorrect.
Disabling the 'Allow Azure services and resources to access this server' option is recommended for further restriction, but not strictly required to enable service endpoint traffic from the subnet.