Enforce Secure Configuration of Azure SQL Database with Azure Policy
Which TWO Azure policies should you assign to enforce secure configuration of Azure SQL Database? (Select two.)
Quick Answer
The answer is to assign the Azure Policy built-in initiatives for enabling Auditing on Azure SQL Database and for configuring Firewall and virtual network settings. Auditing is correct because it captures all database events and writes them to an audit log in your Azure storage account, Log Analytics workspace, or Event Hubs, providing a fundamental security control for compliance and forensic analysis by recording who did what and when. The firewall policy is equally essential as it enforces network-level access restrictions, preventing unauthorized connections from public endpoints. On the Microsoft Cybersecurity Architect exam, this pairing tests your understanding that secure configuration requires both detective controls (auditing) and preventive controls (network isolation), with a common trap being to select only one policy or to confuse auditing with threat detection. Remember the mnemonic “Audit the Access, Lock the Network” to recall that you need both event logging and firewall rules to enforce secure configuration of Azure SQL Database with Azure Policy.
⚠ Common exam trap
Candidates often confuse SQL Server VM policies (like TDE or SQL Server-level audit settings) with Azure SQL Database policies, or they mistakenly apply storage account policies to SQL Database, which is a separate Azure service with its own security controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ensure that 'Auditing' is set to 'On' for SQL Database
Enabling Auditing on Azure SQL Database captures all database events and writes them to an audit log in your Azure storage account, Log Analytics workspace, or Event Hubs. This is a fundamental security control for compliance and forensic analysis, as it provides a record of who did what and when, which is essential for detecting and investigating unauthorized access or changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Ensure that 'Auditing' is set to 'On' for SQL Database
Why this is correct
This policy enables auditing for Azure SQL Database.
- ✗
Ensure that 'TDE' is enabled for SQL Server VMs
Why it's wrong here
This policy applies to SQL Server on VMs, not Azure SQL Database.
- ✗
Audit SQL Server level audit setting
Why it's wrong here
This policy is for SQL Server level, not Azure SQL Database.
- ✓
Ensure that 'Firewall and virtual network settings' for SQL Database are configured
Why this is correct
This policy enforces network security rules.
- ✗
Ensure secure transfer to storage accounts is enabled
Why it's wrong here
This policy applies to storage accounts, not SQL Database.
Go deeper
Related to this question
About these practice questions
This SC-100 question is part of Courseiva's 208-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-100
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Azure SQL Database with Azure AD authentication. You need to ensure that database administrators (DBAs) can only perform management tasks from a specific Azure region and only during business hours. Which solution should you use?
hard- ✓ A.Azure AD Conditional Access policies
- B.Azure RBAC with custom roles
- C.Azure Policy with custom policy
- D.Azure SQL Database firewall rules
Why A: Azure AD Conditional Access can enforce location and time restrictions for Azure AD authenticated users. Option B is wrong because Azure RBAC with custom roles can only control permissions based on role assignments, not enforce location or time restrictions. Option C is wrong because Azure Policy cannot enforce time-based access. Option D is wrong because Azure SQL Database firewall rules filter by IP address, not user identity or time.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.