You have an Azure subscription. You create a logical SQL server that hosts four databases. Each database will be used by a separate customer. You need to ensure that each customer can access only…

Question

Options

• ADeny public access.
• BCreate a private endpoint.
• CCreate a database-level firewall rule.
• DCreate a network security group (NSG).
• ECreate a server-level firewall rule.

• A
  27% (6)
• B
  55% (12)
• D
  5% (1)
• E
  14% (3)

Explanation

Explanation

Creating a private endpoint (B) establishes a secure, private connection to the Azure SQL logical server through Azure Private Link, ensuring traffic doesn't traverse the public internet and restricts access to authorized networks only. Creating database-level firewall rules (C) allows you to grant specific customers access to only their individual database - unlike server-level rules, database-level rules are scoped per database, meaning Customer A cannot reach Customer B's database even on the same logical server. This combination achieves both network-level security and database isolation with minimal ongoing administrative effort.

Why the distractors are wrong:

• A (Deny public access) alone doesn't isolate customers from each other - it just blocks public internet access without enabling per-customer database isolation.
• D (NSG) controls traffic at the subnet/VM level, not at the SQL database level, making it insufficient for per-database customer isolation.
• E (Server-level firewall rule) grants access to all databases on the logical server, violating the requirement that each customer see only their own database.

Memory Tip

Think "Private door, personal key" - the private endpoint is the secure door into the building (server), and database-level firewall rules are the individual keys that only open each customer's specific room (database). Server-level rules give access to the whole building - never use those when customers need isolation!

No community discussion yet for this question.