Question 370
A developer assumes a SQL firewall rule alone authenticates callers to Azure SQL. Which technical action BEST resolves the primary problem?
Explanation
Correct Answer
Require encrypted transport and a verified principal alongside network access restrictions. This targets the primary issue because network allowlisting does not establish user identity or object authorization. Verification: An unapproved identity is denied even from an allowed network. Prevent recurrence: Keep firewall, identity and database grants under independent review.
Incorrect Answers
Managed identities remove a static SQL password from the deployed application configuration.
Identity permission at one Azure service does not imply access to adjacent resources.
Server-side encryption can decrypt inside SQL with authorized key access, unlike client-controlled Always Encrypted.