A water utility must harden SCADA-adjacent REST endpoints that read operational SQL data. Which combination is most appropriate?

Placing SCADA-adjacent REST endpoints on private networking and requiring Microsoft Entra authentication is the most appropriate combination for a water utility reading operational SQL data. Private networking keeps operational APIs off the public internet, while Entra authentication verifies which utility identities and applications may call them. Together, these controls address both network exposure and identity—important protections for APIs adjacent to operational SQL data. Exposing read-only endpoints through a public gateway and allowing unauthenticated requests fails by concept: read-only access can still enable reconnaissance and abuse, so these endpoints should not be treated as open data. Using HTTP on a memorable DNS name without identity checks exposes cleartext operational reads and skips authentication. Relying solely on a long URL path is obscurity, not authorization, and fails if the path leaks in logs or tickets. Exam caveat: API-hardening questions often expect defense in depth—private networking plus Entra—not either control alone. Public anonymous access may suit genuinely open data, but SCADA-adjacent operational SQL is not open by default. Modern Entra-protected endpoints should use HTTPS; private networking with cleartext HTTP is not a sound production design. Practical check: make the API reachable only from utility networks, require Entra tokens with app roles mapped to least-privilege SQL access, and verify that anonymous internet calls and URL guessing without a token fail. Disable HTTP listeners, monitor Entra sign-ins for the API app registration, and document audited break-glass access rather than anonymous paths.