AZ-500 Question 78
Single answerYour organization runs a mission-critical application in an Azure virtual machine subnet. The application relies on an Azure SQL Database containing sensitive information. To meet compliance requirements, you need to ensure that only traffic originating from this subnet can access the SQL Database, and all other direct internet traffic must be blocked. You plan to use a virtual network Service Endpoint for Azure SQL Database to enforce this restriction. Which action should you take to properly secure the SQL Database with Service Endpoints?
- A
Enable the SQL Database firewall to allow all Azure services and select the ‘Allow access to Azure services’ option without further subnet rules.
- B
Configure the Service Endpoint for Azure SQL Database in the application subnet and update the SQL Database firewall to allow only that subnet’s traffic.
- C
Create an Azure Private Endpoint for the SQL Database and remove all firewall rules to block any traffic that isn’t coming from the private endpoint.
- D
Use Network Security Groups (NSGs) in the subnet to block all public IP addresses while leaving the SQL Database’s public IP open.
Show answer and explanation
Correct answer: B
Explanation
To secure Azure SQL Database traffic using virtual network Service Endpoints, you must enable the endpoint for the specific subnet in which your application resides. Then, configure the SQL Database firewall to accept connections only from that subnet. This ensures that traffic to the database is routed through the Azure backbone network and is restricted to authorized subnet resources. For more details, refer to official Microsoft Azure documentation on configuring Service Endpoints for Azure SQL Database.
- A. Incorrect.
Option 1 is incorrect. Simply enabling ‘Allow access to Azure services’ and setting no further rules exposes the database to all Azure IP ranges, which violates the requirement to restrict access strictly to the VM subnet.
- B. Correct.
Option 2 is correct. You must configure the Service Endpoint for Azure SQL Database in the specified subnet and then update the Azure SQL Database firewall settings to allow only that subnet’s traffic, effectively blocking all other inbound traffic.
- C. Incorrect.
Option 3 is incorrect. While a Private Endpoint also restricts access, the question specifically focuses on using a virtual network Service Endpoint, not replacing it with a Private Endpoint. Private Endpoints require additional setup and are a different approach to restricting access.
- D. Incorrect.
Option 4 is incorrect. NSGs can help control inbound/outbound traffic at the subnet level, but they do not alone restrict traffic specifically to the Azure SQL Database if its public endpoint remains open. A Service Endpoint combined with SQL Database firewall rules is needed for secure and granular control.