DP-300 Certification Practice Question #112

Question

You have an Azure SQL database named DB1.

You have 10 Azure virtual machines that connect to a virtual network subnet named Subnet1.

You need to implement a database-level firewall that meets the following requirements:

•	Ensures that only the 10 virtual machines can access DB1
•	Follows the principle of least privilege

How should you configure the firewall rule, and how should you establish network connectivity from the virtual machines to DB1?

To answer, select the appropriate options in the answer area.

Accepted Answer

The question specifically requests a **database-level** firewall. In Azure SQL Database, database-level firewall rules are stored in the database itself and can only be configured as IP-based firewall rules via T-SQL (`sp_set_database_firewall_rule`). They do not support Virtual Network rules or Service Endpoints, which are server-level features. Therefore, to ensure that only the 10 virtual machines can access DB1 using a database-level firewall, we must assign static public IP addresses to the virtual machines (so their IPs do not change) and add these public IP addresses to the database-level firewall (corresponding to the "Add your client IPv4 address" option).

More DP-300 practice questions