HOTSPOT (Drag and Drop is not supported)You have an Azure SQL database named DB1.You have 10 Azure virtual machines that connect to a virtual network subnet named Subnet1.You need to implement a database-level firewall that meets the following requirements:Ensures that only the 10 virtual machines can access DB1Follows the principle of least privilegeHow should you configure the firewall rule, and how should you establish network connectivity from the virtual machines to DB1?To answer, select the appropriate options in the answer area.Hot Area:
Answer(s): A
Box 1: Add your client IPv4 adress.Firewall ruleUse virtual network service endpoints and rules for servers in Azure SQL DatabaseIP firewall rulesIP firewall rules grant or deny access to your Azure Synapse workspace based on the originating IP address of each request. You can configure IP firewall rules for your workspace. IP firewall rules configured at the workspace level apply to all public endpoints of the workspace (dedicated SQL pools, serverless SQL pool, and development). The maximum number of IP firewall rules is limited to 128. If you have the Allow Azure Services and resources to access this server setting enabled, this counts as a single firewall rule for the workspace.Box 2: Create a service endpointNetwork connectivity:Merely setting a firewall rule doesn't help secure the server. You must also turn on virtual network service endpoints for the security to take effect.
https://learn.microsoft.com/en-us/azure/azure-sql/database/vnet-service-endpoint-rule-overview https://learn.microsoft.com/en-us/azure/synapse-analytics/security/synapse-workspace-ip-firewall
You have an Azure subscription that contains an Azure SQL database named DB1.You need to host elastic jobs by using DB1. DB1 will also be configured as a job target. The solution must support the use of location-based Conditional Access policies.What should the elastic jobs use to access DB1?
Answer(s): C
Use credentials scoped to DB1.Azure SQL Database Conditional accessMicrosoft Entra Conditional Access enables organizations to create policy decisions at the tenant level for access to resources. For example, this article uses a conditional access policy to require multifactor authentication for user access to any Azure SQL or Azure Synapse Analytics resources in a tenant.Note:Login: A login is any principal that is granted access to a SQL Server instance. The access can be granted to domain users, domain group, or SQL Server authenticated accounts.Credential: A credential is a record that contains the authentication information that is required to connect to a resource outside SQL Server.A database scoped credential is a record that contains the authentication information that is required to connect to a resource outside SQL Server.Incorrect:Conditional access policies only apply to users, and not to programmatic connections, such as service principals and managed identities [Not A, not D].
https://learn.microsoft.com/en-us/azure/azure-sql/database/conditional-access-configure https://learn.microsoft.com/en-us/sql/relational-databases/security/authentication-access/credentials-database- engine
HOTSPOT (Drag and Drop is not supported)You have an Azure subscription that contains a resource group named RG1. RG1 contains an Azure SQL Server named Server1 in the West US Azure region.You need to ensure that any Azure services deployed to RG1 can access Server1.How should you complete the Azure Command-Line Interface (CLI) command? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
To ensure that any Azure services deployed to RG1 can access Server1, you need to create a firewall rule that allows access from Azure services. The correct Azure CLI command is:az sql server firewall-rule create \--resource-group rg1 \--server server1 \--name AllowAzureServices \--start-ip-address 0.0.0.0 --end-ip-address 0.0.0.0This command creates a firewall rule that allows access from all Azure services, which is typically represented by the IP address range 0.0.0.0 to 0.0.0.0.The firewall-rule option is chosen because the task is to allow access to the SQL Server by configuring its firewall settings. The other options like ipv6-firewall-rule, outbound-firewall-rule, and vnet-rule are not applicable here because they pertain to different scenarios, such as IPv6 addresses, outbound traffic, or virtual network rules.The range 0.0.0.0 to 0.0.0.0 is a special configuration in Azure SQL Database firewall settings that allows access from all Azure services. This is often used when you want to ensure that any service within Azure, such as Azure Functions, Azure Logic Apps, or other Azure-hosted services, can access your SQL Server without specifying individual IP addresses.This configuration is a common practice when setting up Azure SQL Databases to interact with other Azure services securely and efficiently, without exposing the server to the broader internet.
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have the on-premises networks shown in the following table.You have an Azure subscription that contains an Azure SQL Database server named SQL1. SQL1 contains two databases named DB1 and DB2.You need to configure access to DB1 and DB2. The solution must meet the following requirements:Ensure that DB1 can be accessed only by users in Branch1.Ensure that DB2 can be accessed only by users in Branch2.Solution: You connect to DB1 and run the following command.EXECUTE sp_set_firewall_rule `Allow db1 users', `131.107.10.0', `131.107.10.255'You connect to DB2 and run the following command.EXECUTE sp_set_database_firewall_rule `Allow db2 users', `131.107.11.0', `131.107.11.255'Does this meet the goal?
Answer(s): B
Correct:* : You connect to DB1 and run the following command.EXECUTE sp_set_database_firewall_rule `Allow db1 users', `131.107.10.0', `131.107.10.255'You connect to DB2 and run the following command.EXECUTE sp_set_database_firewall_rule `Allow db2 users', `131.107.11.0', `131.107.11.255'Note:Use the sp_set_database_firewall_rule command twice. Once for db1 and once for db2.Incorrect:* You connect to DB1 and run the following command.EXECUTE sp_set_firewall_rule `Allow db1 users', `131.107.10.0', `131.107.10.255' You connect to DB2 and run the following command.EXECUTE sp_set_database_firewall_rule `Allow db2 users', `131.107.11.0', `131.107.11.255'Note:Use sp_set_database_firewall_rule for both databases.* : You connect to DB1 and run the following command.EXECUTE sp_set_firewall_rule `Deny db1 users', `131.107.11.0', `131.107.11.255' You connect to DB2 and run the following command.EXECUTE sp_set_database_firewall_rule `Deny db2 users', `131.107.10.0', `131.107.10.255'--This command attempts to deny access from the opposite branch subnets, but it does not explicitly allow the correct subnets access to the respective databases. Moreover, denying a range is not a typical configuration for SQL Database firewall rules, which are generally based on allowing specific IP ranges.* You connect to the master of SQL1 and run the following command.EXECUTE sp_set_firewall_rule `Allow db1 and db2 users', `131.107.11.0', `131.107.11.255'--This command sets a firewall rule at the server level (master database), allowing both DB1 and DB2 to be accessed from the Branch2 subnet. This does not meet the requirement of restricting DB1 access to Branch1 only.Instead use sp_set_database_firewall_rule, and use it for once for each database.* You connect to the master of SQL1 and run the following command.EXECUTE sp_set_firewall_rule `Allow db1 and db2 users', `131.107.10.0', `131.107.10.255'--Instead use sp_set_database_firewall_rule, and use it for once for each database.Note:sp_set_database_firewall_rule (Azure SQL Database)Creates or updates the database-level firewall rules for your Azure SQL Database. Database firewall rules can be configured for the master database, and for user databases on SQL Database. Database firewall rules can be useful when using contained database users.Syntax sp_set_database_firewall_rule[ @name = ] N'name', [ @start_ip_address = ] 'start_ip_address', [ @end_ip_address = ] 'end_ip_address'[ ; ]sp_set_firewall_rule (Azure SQL Database)Creates or updates the server-level firewall settings for your SQL Database server. This stored procedure is only available in the master database to the server-level principal login or assigned Microsoft Entra ID (formerly Azure Active Directory) principal.Syntax sp_set_firewall_rule[ @name = ] N'name', [ @start_ip_address = ] 'start_ip_address', [ @end_ip_address = ] 'end_ip_address'[ ; ]
https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-set-database-firewall- rule-azure-sql-database https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-set-firewall-rule-azure- sql-database
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have the on-premises networks shown in the following table.You have an Azure subscription that contains an Azure SQL Database server named SQL1. SQL1 contains two databases named DB1 and DB2.You need to configure access to DB1 and DB2. The solution must meet the following requirements:Ensure that DB1 can be accessed only by users in Branch1.Ensure that DB2 can be accessed only by users in Branch2.Solution: You connect to the master of SQL1 and run the following command.EXECUTE sp_set_firewall_rule `Allow db1 and db2 users', `131.107.11.0', `131.107.11.255'Does this meet the goal?
This command sets a firewall rule at the server level (master database), allowing both DB1 and DB2 to be accessed from the Branch2 subnet. This does not meet the requirement of restricting DB1 access to Branch1 only.
Post your Comments and Discuss Microsoft DP-300 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the DP-300 content, but please register or login to continue.