Question

Your company hosts an Azure SQL Database that must be accessed only by application servers running inside a specific Azure virtual network. A security audit requires that no traffic to the database traverse the public internet and that the database's public endpoint be unreachable. Which combination of actions meets these requirements with the least administrative effort?

Accepted Answer

Create a private endpoint for the SQL logical server in the application subnet and set 'Public network access' to Disabled on the server.

Answer

Add a server-level firewall rule that allows only the virtual network's public IP range and leave public network access enabled.

Answer

Enable a service endpoint for Microsoft.Sql on the subnet and add a virtual network rule, keeping the public endpoint enabled for management.

Answer

Configure Transparent Data Encryption and enforce TLS 1.2 on all client connections to the database.