Manage database access by adding users to the database, or allowing user access with secure connection strings.
Database-level firewall rules only apply to individual databases.
Reference:
https://docs.microsoft.com/en-us/azure/azure-sql/database/secure-database-tutorial Basic Concept: This question tests secure database administration, where the control must match the data state, access boundary, identity model, or compliance requirement.
Why B and E is Correct: Create users in each database. is a security-related control, but its value depends on whether the requirement is identity, encryption, auditing, network isolation, or data exposure reduction. This fits the case because the requested outcome is: You need to ensure that each customer can only connect to and access their respective database. The selected feature addresses that outcome directly rather than relying on a workaround. Create logins in the master database. is a security-related control, but its value depends on whether the requirement is identity, encryption, auditing, network isolation, or data exposure reduction. In this scenario, the important constraint is: You need to ensure that each customer can only connect to and access their respective database. Create logins in the master database. satisfies that constraint without adding an unrelated service or manual process.
Why A is Wrong: Row-Level Security filters rows returned by queries based on a predicate function, allowing different users or tenants to see different subsets of the same tables. It is not the right enforcement point for this case; the scenario needs the control that governs the data or identity path being tested.
Why C is Wrong: Database-level firewall rules restrict access to a specific Azure SQL database and are more granular than server-level firewall rules. It protects or manages a different security layer, so the required database access or protection behavior would still be incomplete.
Why D is Wrong: Server-level firewall rules apply to all databases on the logical server and are broader than database-level firewall rules. It is not the right enforcement point for this case; the scenario needs the control that governs the data or identity path being tested.
Why F is Wrong: Always Encrypted protects sensitive columns from exposure to the database engine by encrypting and decrypting data at the client side with keys protected outside the database. It protects or manages a different security layer, so the required database access or protection behavior would still be incomplete.