Memory hook: Identity plus network; replicas plus history.
Must remember
- Prefer supported Entra identity and data-plane RBAC for applications, with narrowly scoped permissions. Control-plane roles and data access roles solve different problems; avoid distributing broad account keys.
- Restrict network access using supported firewall/private endpoint controls and correct private DNS. Authentication still applies on a private path; test public-network settings independently.
- Use encryption, auditing and supported data masking according to the API/feature. Dynamic masking changes what selected users see; it does not replace authorization or encryption against privileged access.
- Multi-region reads improve locality; multi-region writes require conflict and consistency design. Configure preferred regions, failover priorities and supported partition/failover options, then test client behavior.
- Periodic and continuous backup/PITR options have different capabilities and retention. Replication copies current state; recovery history is needed for accidental corruption or deletion.
- Test restored data, identities, endpoints and application reconnection. Keep recovery permissions and retained backups usable while protecting production deletion paths.
Choose under exam pressure
| Requirement | Choice and reason |
|---|---|
| An application needs only one container | Scoped data-plane permissions through a supported identity. |
| Recover a valid state before an accidental update | A supported backup/PITR restore workflow. |
Traps
- A private endpoint does not grant database access.
- Multi-region writes do not remove the need to understand conflicts and consistency.
Active recall
1. Why prefer identity over shared keys?
Scoped authorization, auditability and reduced secret distribution.
2. What must a regional failover test include?
Client routing/retries, consistency expectations and actual application operations.
3. Does masking protect data from every privileged query?
No; it is a limited presentation control, not a universal security boundary.
4. How do replicas differ from backups?
Replicas serve availability/current state; backups retain recoverable history.
5. Why test private DNS?
A correctly configured endpoint can still be unusable if clients resolve the wrong address.