AZ-500 Question 91
Single answerYour company has deployed an Azure SQL Managed Instance into a dedicated subnet within a virtual network. You need to ensure that only connections from a set of known on-premises IP ranges can reach the SQL Managed Instance, while blocking all other inbound traffic from both the internet and other subnets. Which configuration should you implement to meet these requirements?
- A
Configure a Network Security Group (NSG) for the Managed Instance subnet to allow inbound traffic only from the known on-premises IP ranges and deny all other inbound requests.
- B
Create a public endpoint for the Managed Instance and define firewall rules within the SQL Managed Instance to only allow connections from the on-premises IP ranges.
- C
Enable service endpoints for Azure SQL on the VNet, ensuring that only traffic from Microsoft SQL service tags can reach the Managed Instance.
- D
Use a distributed denial-of-service (DDoS) Protection Plan on the VNet to block any inbound traffic that is not from the on-premises IP ranges.
Show answer and explanation
Correct answer: A
Explanation
Azure SQL Managed Instance resides in a dedicated subnet that must be isolated for proper security. To control inbound traffic, you apply an NSG at the subnet level to explicitly allow only the on-premises IP ranges and block other sources. DDoS protection and firewall rules at the Managed Instance level alone do not restrict inbound traffic to specific private IP ranges. For more details, refer to Microsoft documentation: https://learn.microsoft.com/azure/azure-sql/managed-instance/connectivity-architecture.
- A. Correct.
Option 1 is correct. By associating a Network Security Group (NSG) with the Managed Instance subnet, you can specifically allow incoming traffic from the on-premises IP ranges and deny all other inbound requests. This fulfills the requirement to restrict traffic to those known IPs. This approach leverages Azure’s native network security and ensures no unnecessary access paths are left open.
- B. Incorrect.
Option 2 is incorrect. Creating a public endpoint for the Managed Instance would expose it to the internet. Although firewall rules can filter allowed IP addresses, this contradicts the requirement to avoid inbound internet traffic altogether and introduces additional public exposure.
- C. Incorrect.
Option 3 is incorrect. Azure SQL Managed Instance does not use service endpoints like Azure SQL Database can. Instead, Managed Instances are designed to be accessed via private IP addresses in a VNet. Configuring service endpoints for the Managed Instance subnet would not exclusively restrict traffic to the known on-premises IPs.
- D. Incorrect.
Option 4 is incorrect. A DDoS Protection Plan helps protect against volumetric attacks but does not provide fine-grained access control to specific IP ranges. It does not replace an NSG's capability to filter inbound connections from specific IP addresses.