AZ-204 Implement Azure security Practice Question
You are designing a solution for a multi-tenant SaaS application where each tenant's data is stored in separate Azure SQL databases. You need to ensure that no tenant can access another tenant's database, even if the application is compromised. What should you implement?
⚠ Common exam trap
Watch out — candidates often confuse network-level security (firewall rules) or data-level filtering (RLS) with proper authentication and authorization isolation, failing to recognize that a compromised application with a shared identity can bypass both network and row-level controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign each tenant a managed identity with a dedicated SQL login and database-level permissions
Assigning each tenant a managed identity with a dedicated SQL login and database-level permissions ensures that even if the application is compromised, the attacker cannot access another tenant's database. Managed identities provide an Azure AD-backed identity for the application, and by mapping each tenant to a separate SQL login with permissions scoped to their specific database, you enforce tenant isolation at the database authentication and authorization layer. This prevents cross-tenant access because the application can only authenticate to the database corresponding to the tenant's managed identity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a server-level firewall rule for each tenant's IP range
Why it's wrong here
Configuring server-level firewall rules for each tenant's IP range primarily controls network access to the Azure SQL Database server, not logical access to specific tenant data within the database. While it restricts which client IPs can connect, it does not provide tenant isolation at the application or database level. If a single application instance serves multiple tenants, or if the application itself is compromised, firewall rules offer no protection against one tenant's data being accessed by another through the application layer, as the application's IP would be allowed.
- ✓
Assign each tenant a managed identity with a dedicated SQL login and database-level permissions
Why this is correct
Assigning each tenant a dedicated managed identity, coupled with a unique SQL login and database-level permissions restricted to *only* that tenant's specific database, provides robust tenant isolation. Managed identities eliminate the need for managing credentials, enhancing security. By ensuring each tenant's application component authenticates with its own identity and possesses least privilege access solely to its designated database, this strategy effectively prevents cross-tenant data access even in the event of a compromise of one tenant's application instance.
- ✗
Implement connection pooling with a single identity
Why it's wrong here
Implementing connection pooling with a single identity is an optimization technique for database performance and resource efficiency, not a security mechanism for tenant isolation. While connection pooling reuses established connections, if all tenants share the same underlying database identity, there is no inherent database-level control to differentiate or restrict access between tenants. The application would still be solely responsible for enforcing tenant boundaries, which is a weaker security posture and does not leverage the database's native authorization capabilities for isolation.
- ✗
Use a single database-level login and row-level security (RLS) to filter data
Why it's wrong here
Using a single database-level login combined with Row-Level Security (RLS) to filter data offers a degree of isolation within a shared database, but it is not as robust as dedicated databases per tenant. The primary vulnerability lies in the single login having access to all data (even if filtered by RLS). If the application layer is compromised, an attacker might be able to bypass RLS logic by manipulating the session context or executing queries directly with the broad permissions of the shared login, potentially exposing other tenants' data.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.