Question
You have an Azure subscription. The subscription contains an Azure SQL database named SalesDB and an Azure App Service app named sales-api. sales-api uses virtual network integration to a subnet named vnet-prod/subnet-app and reads from SalesDB.
You need to configure authentication and network access to meet the following requirements:
- Ensure that sales-api connects to SalesDB by using passwordless authentication.
- Ensure that all the database traffic remains within the subscription.
The solution must minimize administrative effort.
What should you configure? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation
Authentication for sales-api: a managed identity with Microsoft Entra authentication is passwordless, and Azure handles the credential, so there is nothing to store or rotate. Rotated SQL credentials and a SQL login in Azure Key Vault still rely on passwords, and Azure SQL Database does not authenticate clients by an App Service client certificate setting.
Network access for SalesDB: a private endpoint gives SalesDB a private address in the virtual network that sales-api is already integrated with, and disabling public network access means that path is the only one. Allowing Azure services and adding IP firewall rules both keep traffic on the public endpoint, and a rule for support IP addresses has nothing to do with the app.
