Pass Your Microsoft SC-500 Exam Easy!

SQL firewall and DNS validation may be needed for connectivity, but they do not replace SQL administrative passwords with workload identity.

Encryption at rest does not remove the embedded administrator credential or reduce what a connection can execute.

A private endpoint limits network exposure but does not eliminate or invalidate a hardcoded administrator credential.

TDE protects database files and backups against offline exposure. It does not limit which remote IP addresses can reach the SQL public login endpoint, so the present excessive network exposure remains.

TLS protects connection confidentiality and peer validation, not the geographic or organizational origin of client traffic. With a broad public firewall, TLS-enabled unsolicited connection attempts can still reach the database endpoint.

SQL authorization is evaluated after network connectivity and authentication. Giving db_owner to a client worsens least-privilege risk and does not prevent unrelated networks from reaching the public endpoint.

Microsoft Entra authentication improves identity lifecycle and sign-in controls, but database role membership still determines what the authenticated user can query. Retaining db_owner does not enforce reporting-only rights.

TDE encrypts data at rest and transparently decrypts it for authorized engine operations. It is not a substitute for scoped SQL GRANT and role assignments, and db_owner members can still query data.

An IP firewall can limit the source network but cannot reduce SQL permissions after a connection is permitted. The operator would still have unnecessarily broad object and schema rights from db_owner.

Least-privilege SQL permissions reduce the impact of a compromised user, but they do not authenticate the network peer or prevent credential interception through an unvalidated TLS connection.

TDE controls the encryption of stored database pages and backups. Rotating its protector is unrelated to authenticating the server at TLS connection establishment and cannot detect a fraudulent peer certificate.

A minimum TLS protocol version can reject obsolete cryptography, but it does not cause a client that ignores certificate trust to reject a man-in-the-middle certificate. Client trust must be corrected.

A private endpoint limits network reachability to the service; it does not revoke authorized SQL data-plane permissions. A privileged user connecting through the approved network can still query the granted data.

Key rotation changes how the database encryption key is protected, not the permissions granted by SQL roles. Previously authorized database queries remain subject to their SQL grants, not to the old TDE protector version.

TDE operates below the SQL permissions layer: the database engine decrypts pages for query execution. The TDE protector is not a user-by-user decryption permission, so an authorized SELECT can return plaintext.

Dynamic Data Masking affects how selected query output appears to certain database principals. It does not change the TDE database encryption key protector or provide cryptographic custody of the at-rest key.

db_owner governs SQL database operations and cannot stand in for the Azure Key Vault data-plane role needed by the logical server identity. Giving the operator broad SQL rights also defeats separation of duties.

Service-managed TDE supplies at-rest protection but Microsoft controls the protector lifecycle. It does not give the customer the required ownership, rotation authority and key-use auditing for a customer-managed policy.

TDE protects database files and backups at rest; it neither separates service-level principals nor restricts their query permissions. The investigation and lateral-movement risks remain unchanged.

Private connectivity limits who can reach the SQL endpoint but does not distinguish the applications once they connect using the same login. A breach still grants that shared principal all database permissions.

A single shared managed identity still collapses attribution and compromise boundaries, and the retained db_owner authorization grants excessive privileges. Removing a password is valuable but does not by itself resolve the two risks in the scenario.

The private endpoint is a network address, not a valid replacement for the SQL gateway routing hostname in application connection strings. Direct-IP connections can fail because SQL expects the server FQDN, and they bypass the actual DNS fault.

SQL database roles govern authorization after connectivity is established. Granting db_owner cannot correct the destination hostname or network packet path and would unnecessarily broaden data privileges.

Allow Azure services expands public access, including beyond the intended client subscription, and does not repair the spoke private-resolution path. It violates the requirement to keep the workload private.

TDE prevents offline reading of stored database files, not plaintext returned by authorized SQL queries. An analyst who can SELECT a column through db_owner can still receive its values from the engine.

Row-Level Security filters which rows are visible to a caller; it does not by itself restrict which columns can be read in a row. The scenario requires reducing column-level and privileged access.

Dynamic Data Masking can reduce accidental exposure for low-privilege query users, but privileged principals may bypass it and ad hoc queries can infer values. Leaving db_owner in place undermines the claimed confidentiality boundary.

Inspecting scope and delivery helps troubleshoot auditing, but it does not establish the required auditing coverage for financial-record write operations.

Checking product support is a prerequisite, not evidence that the specified write events are actually being collected for this database.

Auditing records selected statements/events; it does not parameterize input, prevent injection or grant safer data permissions.

SQL audit action groups specify which database events are collected; they do not grant Azure Storage data access to the resulting .xel objects. The investigator would still lack the Blob role or permitted network route.

Public anonymous reads would disclose potentially sensitive audit actor and statement evidence. Correct the evidence-reader role on the private sink instead of bypassing data authorization or publishing logs.

db_owner expands SQL schema and data authority, but it does not confer Azure Storage Blob data-role membership. It would therefore expose production data while leaving the external audit-file read problem unresolved.