Azure SQL firewall rules - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

Understanding Azure SQL firewall rule effect

You create an Azure SQL server with a firewall rule allowing IP range 192.168.1.0 to 192.168.1.255. A client with IP 192.168.2.10 tries to connect. What happens?

A The client connection is blocked by the firewall.

B The client connection is allowed because it is in the same subnet.

C The client connection is allowed because Azure SQL ignores IP ranges.

D The client connection is allowed only if the client uses SQL authentication.

💡 Hint

Firewall rules restrict access by IP address ranges.

Azure SQL firewall rules allow or block client IP addresses. Only IPs within the allowed range can connect. 192.168.2.10 is outside the allowed range, so connection is blocked.

❓ Configuration

intermediate

Configuring Azure SQL firewall rule via Azure CLI

Which Azure CLI command correctly creates a firewall rule named 'AllowOffice' for IP 203.0.113.5 on an Azure SQL server named 'myserver' in resource group 'mygroup'?

A az sql server firewall-rule create --resource-group mygroup --server myserver --rule AllowOffice --ip 203.0.113.5

B az sql firewall-rule add --resource-group mygroup --server myserver --rule-name AllowOffice --ip 203.0.113.5

C az sql server firewall-rule add --resource-group mygroup --server myserver --name AllowOffice --ip-address 203.0.113.5

D az sql server firewall-rule create --resource-group mygroup --server myserver --name AllowOffice --start-ip-address 203.0.113.5 --end-ip-address 203.0.113.5

💡 Hint

Check Azure CLI syntax for creating firewall rules on SQL servers.

The correct command uses 'az sql server firewall-rule create' with parameters for resource group, server, rule name, and start/end IP addresses.

❓ security

advanced

Security implications of enabling 'Allow Azure services' in Azure SQL firewall

What is the security impact of enabling the 'Allow Azure services and resources to access this server' option in Azure SQL firewall?

A It enables multi-factor authentication for all Azure SQL connections.

B It blocks all external IP addresses except those explicitly allowed.

C It allows any Azure service from any subscription to connect to the SQL server, potentially increasing exposure.

D It restricts access only to Azure services within the same resource group.

💡 Hint

Think about what 'Allow Azure services' means for network access scope.

Enabling this option allows all Azure services, regardless of subscription or resource group, to access the server. This broadens access and can increase risk if not managed carefully.

❓ Architecture

advanced

Designing Azure SQL firewall rules for hybrid cloud access

You have an on-premises network with dynamic IP addresses connecting to Azure SQL. Which approach best secures access while allowing connectivity?

A Manually update firewall rules daily with current on-premises IP addresses.

B Use a VPN or ExpressRoute to connect on-premises network to Azure, then allow Azure SQL access only from the VPN gateway IP.

C Allow all IP addresses in Azure SQL firewall to avoid connection issues.

D Disable Azure SQL firewall to allow all connections.

💡 Hint

Consider secure network connectivity options between on-premises and Azure.

Using VPN or ExpressRoute provides a fixed IP or range for on-premises traffic, allowing firewall rules to be precise and secure. Dynamic IPs are hard to manage manually.

✅ Best Practice

expert

Optimizing Azure SQL firewall rules for least privilege access

You want to follow the least privilege principle for Azure SQL firewall rules. Which practice is best?

A Create firewall rules with the smallest possible IP ranges and remove unused rules regularly.

B Allow all IP addresses to avoid connection failures and simplify management.

C Enable 'Allow Azure services' and rely on SQL authentication for security.

D Create one large IP range covering all possible client IPs to reduce rule count.

💡 Hint

Least privilege means granting only the access needed, no more.

Small IP ranges limit exposure. Removing unused rules reduces attack surface. Broad ranges or enabling all Azure services without control increases risk.