AZ-500 Question 92
Select 2You have deployed an Azure SQL Managed Instance for a critical database. Your organization requires that only traffic from your on-premises network connected via VPN or ExpressRoute can access the instance, and all public internet traffic should be blocked. Which two actions should you perform to achieve this requirement?
- A
Enable the public endpoint on the Managed Instance and configure server-level firewall rules to allow only on-premises IP ranges.
- B
Associate a Network Security Group (NSG) with the subnet hosting the Managed Instance and allow inbound traffic only from your on-premises corporate IP ranges.
- C
Deploy an Application Gateway in front of the Managed Instance subnet to filter all inbound traffic.
- D
Disable public endpoint for the Managed Instance and ensure that no user-defined routes redirect 0.0.0.0/0 to a Network Virtual Appliance in the Managed Instance subnet.
- E
Configure a point-to-site VPN directly on the Managed Instance to secure all inbound connections from the internet.
Show answer and explanation
Correct answers: B, D
Explanation
To ensure Azure SQL Managed Instance is only accessible from on-premises networks and not from the public internet, you typically disable or avoid enabling the public endpoint (if it was ever enabled) and rely on network security configurations at the subnet level. Attaching an NSG that allows only on-premises IP ranges and ensuring no user-defined routes break the service traffic are essential steps. Refer to Microsoft documentation on Configure Azure SQL Managed Instance network security (https://learn.microsoft.com/azure/azure-sql/managed-instance/connect-virtual-network) for best practices.
- A. Incorrect.
Option 1 is incorrect. Enabling the public endpoint opens the Managed Instance to the internet, which conflicts with the requirement to block all public traffic. Server-level IP firewall rules at that point would not fully prevent traffic from reaching the public endpoint.
- B. Correct.
Option 2 is correct. By creating a Network Security Group (NSG) and attaching it to the Managed Instance subnet, you can allow inbound traffic exclusively from your on-premises IP ranges and block all other incoming requests.
- C. Incorrect.
Option 3 is incorrect. Application Gateway is not the recommended solution for restricting traffic to an Azure SQL Managed Instance. The Managed Instance must reside in a dedicated subnet and typically depends on NSGs or routing configurations for filtering, not an external application gateway.
- D. Correct.
Option 4 is correct. Azure SQL Managed Instances must not have user-defined routes (UDRs) sending 0.0.0.0/0 to a Network Virtual Appliance, because it can disrupt the management traffic required for the service. Disabling or leaving the public endpoint off also ensures that no direct public internet traffic is allowed.
- E. Incorrect.
Option 5 is incorrect. Point-to-site VPN connections are not configured directly on the Managed Instance. Network security is managed at the subnet or virtual network level, and Managed Instances rely on either site-to-site or ExpressRoute connections plus NSGs to restrict traffic.