Connection from applications in Azure - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

How does Azure App Service connect to an Azure SQL Database securely?

You have an Azure App Service and an Azure SQL Database in the same subscription. You want the app to connect securely without exposing the database to the public internet. What is the behavior of the connection when you enable Private Endpoint on the SQL Database?

A The App Service cannot connect to the SQL Database once Private Endpoint is enabled unless you use a VPN.

B The App Service connects over the public internet using the database's public IP address.

C The App Service connects through the Azure backbone network using the Private Endpoint IP, avoiding the public internet.

D The App Service connects using a shared access signature token over HTTP.

💡 Hint

Think about how Private Endpoints route traffic inside Azure.

When Private Endpoint is enabled, the Azure SQL Database gets a private IP in your virtual network. The App Service connects through Azure's internal network to this private IP, avoiding exposure to the public internet.

❓ Architecture

intermediate

Choosing the best connection method for an on-premises app to Azure Storage

You have an application running on-premises that needs to connect to Azure Blob Storage. You want to minimize latency and secure the connection without exposing storage to the public internet. Which architecture option achieves this?

A Connect over the internet using the storage account's public endpoint with HTTPS.

B Use Azure ExpressRoute with a private peering connection to access the storage account's private endpoint.

C Connect via VPN to Azure and use the storage account's public endpoint.

D Use Azure CDN to cache blobs and connect to the CDN endpoint over the internet.

💡 Hint

Consider private, high-speed connections from on-premises to Azure.

ExpressRoute with private peering allows on-premises apps to connect privately and with low latency to Azure services like Blob Storage using private endpoints, avoiding the public internet.

❓ security

advanced

What happens if you configure an Azure SQL Database firewall rule to allow all IP addresses (0.0.0.0 - 255.255.255.255)?

You set the Azure SQL Database server firewall rule to allow all IP addresses (0.0.0.0 to 255.255.255.255). What is the security impact and connection behavior?

A The database accepts connections from any IP address, increasing exposure to attacks.

B The database only accepts connections from Azure services but blocks external IPs.

C The database rejects all connections because 0.0.0.0 is invalid as a start IP.

D The database requires VPN connections despite the firewall rule.

💡 Hint

Think about what allowing all IPs means for access control.

Allowing all IP addresses disables IP-based firewall restrictions, making the database accessible from anywhere, which is a security risk.

✅ Best Practice

advanced

Which method is best to connect an Azure Function to a private Azure Cosmos DB account securely?

You have an Azure Function and an Azure Cosmos DB account configured with a private endpoint in a virtual network. What is the best way for the function to connect securely to Cosmos DB?

A Use a shared access signature token over HTTP to connect to Cosmos DB.

B Use the Cosmos DB public endpoint with a connection string containing the primary key.

C Expose Cosmos DB to the internet temporarily during function execution.

D Enable the function to run inside the same virtual network using VNet integration and connect via the private endpoint IP.

💡 Hint

Consider how Azure Functions can access resources inside a virtual network.

VNet integration allows the Azure Function to access resources inside the virtual network, including private endpoints, ensuring secure communication without exposing Cosmos DB publicly.

🧠 Conceptual

expert

What is the effect of enabling 'Allow trusted Microsoft services to access this resource' on an Azure Storage account firewall?

You enable the option 'Allow trusted Microsoft services to access this resource' on an Azure Storage account firewall. Which of the following describes the connection behavior?

A Only Azure services marked as trusted can bypass the firewall and connect to the storage account.

B All internet traffic is allowed to connect to the storage account regardless of firewall rules.

C Only services in the same subscription can connect, others are blocked.

D The storage account disables all firewall rules and becomes publicly accessible.

💡 Hint

Think about what 'trusted Microsoft services' means in Azure firewall context.

This setting allows specific Azure services, like Azure Backup or Azure DevOps, to access the storage account even if firewall rules restrict other traffic, without opening access to the public internet.

Practice

1. What is the main purpose of a connection string when an application connects to an Azure service?

easy

A. It stores the application's source code.

B. It provides the necessary information to authenticate and access the service.

C. It defines the user interface of the application.

D. It manages the billing details for the Azure subscription.

Solution

1. Step 1: Understand connection string role

   A connection string contains credentials and endpoint details needed to connect securely to an Azure service.

2. Step 2: Eliminate unrelated options

   Options about source code, UI, or billing are unrelated to connection strings.

3. Final Answer:

   It provides the necessary information to authenticate and access the service. -> Option B

4. Quick Check:

   Connection string = authentication info [OK]

Hint: Connection strings hold access info, not code or UI [OK]

Common Mistakes:

• Confusing connection strings with application code
• Thinking connection strings manage billing
• Assuming connection strings define UI

2. Which of the following is the correct format for an Azure Storage Account connection string?

easy

A. AccountName=youraccount;Password=yourpassword;Region=us-east

B. https://youraccount.blob.core.windows.net/yourcontainer

C. DefaultEndpointsProtocol=https;AccountName=youraccount;AccountKey=yourkey;EndpointSuffix=core.windows.net

D. Server=yourserver;Database=yourdb;User Id=youruser;Password=yourpassword;

Solution

1. Step 1: Identify Azure Storage connection string format

   Azure Storage connection strings include protocol, account name, account key, and endpoint suffix as in DefaultEndpointsProtocol=https;AccountName=youraccount;AccountKey=yourkey;EndpointSuffix=core.windows.net.

2. Step 2: Compare other options

   https://youraccount.blob.core.windows.net/yourcontainer is a URL, not a connection string. AccountName=youraccount;Password=yourpassword;Region=us-east uses wrong keys and lacks protocol. Server=yourserver;Database=yourdb;User Id=youruser;Password=yourpassword; is a SQL Server connection string format.

3. Final Answer:

   DefaultEndpointsProtocol=https;AccountName=youraccount;AccountKey=yourkey;EndpointSuffix=core.windows.net -> Option C

4. Quick Check:

   Storage connection string = protocol + account info [OK]

Hint: Look for protocol, account name, and key in connection string [OK]

Common Mistakes:

• Confusing URLs with connection strings
• Using SQL connection string format for Azure Storage
• Missing protocol or key in connection string

3. Given this Python code snippet connecting to Azure Blob Storage, what will be the output if the connection string is invalid?

from azure.storage.blob import BlobServiceClient
try:
    conn_str = "InvalidConnectionString"
    blob_service_client = BlobServiceClient.from_connection_string(conn_str)
    print("Connection successful")
except Exception as e:
    print(f"Connection failed: {e}")

medium

A. Connection failed: Invalid connection string format

B. Connection successful

C. SyntaxError

D. No output

Solution

1. Step 1: Analyze code behavior on invalid connection string

   The BlobServiceClient.from_connection_string method raises an exception if the string is invalid.

2. Step 2: Check exception handling output

   The except block catches the exception and prints "Connection failed:" with the error message.

3. Final Answer:

   Connection failed: Invalid connection string format -> Option A

4. Quick Check:

   Invalid string triggers exception message [OK]

Hint: Invalid connection strings cause exceptions caught and printed [OK]

Common Mistakes:

• Assuming connection always succeeds
• Expecting syntax errors instead of runtime exceptions
• Ignoring exception handling output

4. You wrote this code to connect to Azure Key Vault but get an authentication error:

from azure.identity import DefaultAzureCredential
from azure.keyvault.secrets import SecretClient

credential = DefaultAzureCredential()
client = SecretClient(vault_url="https://myvault.vault.azure.net/", credential=credential)
secret = client.get_secret("MySecret")
print(secret.value)

What is the most likely cause of the error?

medium

A. The SecretClient class is deprecated and cannot be used.

B. The vault URL is incorrect and missing the .com suffix.

C. The secret name "MySecret" is invalid because it contains uppercase letters.

D. The application lacks proper Azure AD permissions or managed identity is not enabled.

Solution

1. Step 1: Understand authentication with DefaultAzureCredential

   This credential requires the app to have Azure AD permissions or a managed identity enabled to access Key Vault.

2. Step 2: Evaluate other options

   The vault URL format is correct without .com. SecretClient is current and uppercase secret names are allowed.

3. Final Answer:

   The application lacks proper Azure AD permissions or managed identity is not enabled. -> Option D

4. Quick Check:

   Authentication error = missing permissions or identity [OK]

Hint: Check Azure AD permissions and managed identity setup first [OK]

Common Mistakes:

• Assuming URL must end with .com
• Thinking SecretClient is deprecated
• Believing secret names cannot have uppercase letters

5. You want your Azure web app to securely connect to Azure SQL Database without storing credentials in code. Which approach is best practice?

hard

A. Use Managed Identity for the web app and configure Azure SQL to allow Azure AD authentication.

B. Store the SQL username and password in the web app's environment variables.

C. Embed the SQL connection string with username and password directly in the application code.

D. Use a public IP whitelist to restrict SQL access and use SQL authentication.

Solution

1. Step 1: Identify secure connection methods without hardcoding credentials

   Managed Identity allows the app to authenticate to Azure SQL using Azure AD without secrets in code.

2. Step 2: Compare other options for security risks

   Storing credentials in environment variables or code risks exposure. IP whitelisting alone does not remove credential storage.

3. Final Answer:

   Use Managed Identity for the web app and configure Azure SQL to allow Azure AD authentication. -> Option A

4. Quick Check:

   Managed Identity + Azure AD = secure no-secret connection [OK]

Hint: Managed Identity avoids storing secrets in code [OK]

Common Mistakes:

• Hardcoding credentials in code
• Relying only on IP whitelisting
• Storing secrets in environment variables without encryption