A new Azure SQL Managed Instance will store lock telemetry and must stay off the public Internet. Which network placement and endpoint setting should the security engineer use?
Select an answer to reveal the explanation.
Short Explanation
SQL MI wants its own subnet and the public endpoint left off. Clients should hitch a ride through the VNet—VPN, peering, Private Link—not a public TDS door.
Full Explanation
Azure SQL Managed Instance is VNet-injected into a dedicated MI subnet. Leaving the public endpoint disabled keeps clients on the VNet-local endpoint reached through VPN, peering, or Private Link patterns. Enabling a public TDS listener and compensating with dynamic masking or TDE mixes Domain 3 data controls into a Domain 2 networking decision. Always Encrypted and TDE protect data at rest or in use; they do not replace public-endpoint disablement or correct MI subnet placement.