AZ-500 Question 93
Select 2Your company plans to deploy an Azure SQL Managed Instance to host sensitive financial data. The instance must be accessible only from your on-premises network over an existing site-to-site VPN and should not be reachable through the public internet. Which two network security configurations should you implement to ensure this requirement is met?
- A
Enable a public endpoint for the Azure SQL Managed Instance and then use Network Security Group (NSG) rules to limit inbound traffic.
- B
Place the Azure SQL Managed Instance in a dedicated subnet with an NSG allowing inbound traffic only from your on-premises IP ranges.
- C
Disable the public endpoint of the Azure SQL Managed Instance so connections use private IP addresses exclusively.
- D
Configure forced tunneling to direct all outbound traffic to the internet via your on-premises firewall.
Show answer and explanation
Correct answers: B, C
Explanation
To ensure an Azure SQL Managed Instance is only accessible from on-premises resources, you must disable the public endpoint and use private connectivity through VPN or ExpressRoute. Additionally, placing the instance in a dedicated subnet and configuring an NSG to allow inbound traffic exclusively from your on-premises IP ranges prevents unauthorized internet access. Refer to Microsoft documentation on configuring network access for Azure SQL Managed Instance for more details: https://learn.microsoft.com/azure/azure-sql/managed-instance/connectivity-architecture.
- A. Incorrect.
Option 1: Incorrect. Even with NSG restrictions, enabling a public endpoint exposes the instance to the internet, which conflicts with the requirement to avoid public exposure.
- B. Correct.
Option 2: Correct. Deploying the managed instance in a secure subnet and restricting inbound traffic to on-premises IP addresses via NSG rules ensures only authorized traffic arrives.
- C. Correct.
Option 3: Correct. Disabling the public endpoint confines traffic to private IP addresses, making the Managed Instance inaccessible over the public internet.
- D. Incorrect.
Option 4: Incorrect. Forced tunneling primarily manages outbound traffic paths. It does not replace disabling the public endpoint. While forced tunneling can help route traffic for inspection, it does not address restricting inbound connections from the public internet.