Question 870
A developer assumes a SQL firewall rule alone authenticates callers to Azure SQL. Which technical principle BEST explains the relevant design decision?
Explanation
Correct Answer
Network allowlisting does not establish user identity or object authorization. This explains why the corrective action is to require encrypted transport and a verified principal alongside network access restrictions. Confirm the diagnosis when an unapproved identity is denied even from an allowed network.
Incorrect Answers
Managed identities remove a static SQL password from the deployed application configuration. The actual technical constraint is that network allowlisting does not establish user identity or object authorization.
Read filtering alone does not necessarily stop unauthorized DML that changes row ownership. The actual technical constraint is that network allowlisting does not establish user identity or object authorization.
API generation does not automatically imply that exposed data is appropriately authorized. The actual technical constraint is that network allowlisting does not establish user identity or object authorization.