Exam SC-100 topic 12 question 2 discussion

Yes the best way to connect to a sql db from a web app is managed identity with token retrieval. Either by system assigned or user assigned. You will have to create a user in sys.principal table with an SID of the system assigned or user assigned client id. This value is send when a connection is made to the db. One could even supply this value in the configuration settings of the web app by setting AZURE_CLIENT_ID. The other part is a private endpoint, this way you will create a private ip for the sql instance and any settings on the db will not open up the sql to public. I have dealt with this scenario for a couple of projects and these are the correct answers.

1. private endpoint 2. managed identity https://learn.microsoft.com/en-us/azure/azure-sql/database/private-endpoint-overview?view=azuresql Private Link allows you to connect to various PaaS services in Azure via a private endpoint. A private endpoint is a private IP address within a specific VNet and subnet. https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview While developers can securely store the secrets in Azure Key Vault, services need a way to access Azure Key Vault. Managed identities provide an automatically managed identity in Azure Active Directory (Azure AD) for applications to use when connecting to resources that support Azure AD authentication. Applications can use managed identities to obtain Azure AD tokens without having to manage any credentials.

I venture to claim that a Service Endpoint is a better and more correct choice that Private Endpoint here. Please prove me wrong Both options fulfill the requirements: * ClaimsApp will access data in ClaimsDB. * ClaimsDB must be accessible only from Azure virtual networks. Service Endpoint will make it possible to firewall ClaimsDB to accept only from the Vnets if Litewire. The Private Endpoint alternative will also give some other benefits such as giving the target service (the ClaimsDB) a private IP and thus making it possible to lock down ClaimsApp (through NSGs for example) so that it cannot use any other DB of the same type (not inherently possible with Service Endpoints), which is a protection against data exfiltration for example. However those benefits are not among the stated requirements. And its usually best to choose the simplest and cheapest option in exams if there is no evidence for the more complex or costly one.

Box1: private endpoint Box2 : managed identity https://www.youtube.com/watch?v=r-P-2lGzPFQ&list=PLQ2ktTy9rklhzzkSEZvDZT4QSIVUQZD-Y&index=9 Question 115

private endpoint nor correct, it will allow the connection from on-prem network as well. The requirement clearly states it should be only from VNET. Hence the answer should be Service endpoint and managed identity

Box1: private endpoint https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-overview Box2 : managed identity

Box1: managed identity Box2 : private endpoint https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-overview

Given answer looks good to me