Question

Your company deploys a private endpoint for an Azure SQL Database into a subnet named snet-data in a hub-spoke topology. A security team requires that only VMs in the app-tier subnet be allowed to reach the private endpoint, and all other subnets must be denied. The private endpoint subnet already has network policies enabled. What must you do to enforce this traffic filtering using network security groups?

Accepted Answer

Ensure network policies for private endpoints are enabled on snet-data, then create an NSG with rules that allow the app-tier subnet and deny other sources, and associate it with snet-data

Answer

Create a service endpoint policy on snet-data restricting access to the specific SQL Database resource

Answer

Disable network policies on snet-data because NSGs cannot filter traffic to a private endpoint while policies are enabled

Answer

Apply the NSG to the app-tier subnet only, since NSGs cannot be associated with a subnet that contains a private endpoint