An Azure SQL Database accepts clients from the whole office because Allow Azure services is checked and a 0.0.0.0–255.255.255.255 firewall rule exists. What network control should the security engineer tighten?
Select an answer to reveal the explanation.
Short Explanation
Wide-open SQL firewall plus “Allow Azure services” is a welcome mat for the whole Internet neighborhood. Tighten server firewall and VNet rules—TDE and auditing don’t replace that network gate.
Full Explanation
Azure SQL Database firewall and virtual-network rules are network controls that limit which clients can reach the logical server. Removing a 0.0.0.0–255.255.255.255 rule and an overly broad Allow Azure services exception reduces exposure. Transparent Data Encryption, auditing, and dynamic masking are important data controls but do not substitute for tightening the SQL network firewall. Azure RBAC does not make firewall rules optional.