DP300 Topic 2 Quiz 3

You have a new Azure SQL database. The database contains a column that stores confidential information.

You need to track each time values from the column are returned in a query. The tracking information must be stored for 365 days from the date

the query was executed.

Which three actions should you perform? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

• A. Turn on auditing and write audit logs to an Azure Storage account.

• B. Add extended properties to the column.

• C. Turn on auditing and write audit logs to an Event Hub

• D. Apply sensitivity labels named Highly Confidential to the column.

• E. Turn on Azure Defender for SQL

Answer explanation

Correct Answer: ADE

D: You can apply sensitivity-classification labels persistently to columns by using new metadata attributes that have been added to the SQL

Server database engine. This metadata can then be used for advanced, sensitivity-based auditing and protection scenarios.

A: An important aspect of the information-protection paradigm is the ability to monitor access to sensitive data. Azure SQL Auditing has been

enhanced to include a new field in the audit log called data_sensitivity_information. This field logs the sensitivity classifications (labels) of the

data that was returned by a query. E: Enable Microsoft Defender for Azure SQL Database at the subscription level from Microsoft Defender for Cloud.

Note: Microsoft Defender for SQL is a unified package for advanced SQL security capabilities. Microsoft Defender for Cloud is available for

Azure SQL Database,

Azure SQL Managed Instance, and Azure Synapse Analytics.

You have an Azure virtual machine named VM1 on a virtual network named VNet1. Outbound traffic from VM1 to the internet is blocked.

You have an Azure SQL database named SqlDb1 on a logical server named SqlSrv1.

You need to implement connectivity between VM1 and SqlDb1 to meet the following requirements:

✑ Ensure that all traffic to the public endpoint of SqlSrv1 is blocked.

✑ Minimize the possibility of VM1 exfiltrating data stored in SqlDb1.

What should you create on VNet1?

• A. a VPN gateway

• B. a service endpoint

• C. a private link

• D. an ExpressRoute gateway

Answer explanation

Correct Answer: C

Azure Private Link enables you to access Azure PaaS Services (for example, Azure Storage and SQL Database) and Azure hosted customerowned/

partner services over a private endpoint in your virtual network.

Traffic between your virtual network and the service travels the Microsoft backbone network. Exposing your service to the public internet is no

longer necessary.

You have 40 Azure SQL databases, each for a different customer. All the databases reside on the same Azure SQL Database server.

You need to ensure that each customer can only connect to and access their respective database.

Which two actions should you perform? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

• A. Implement row-level security (RLS).

• B. Create users in each database.

• C. Configure the database firewall

• D. Configure the server firewall.

• E. Create logins in the master database.

You have an Azure virtual machine named VM1 on a virtual network named VNet1. Outbound traffic from VM1 to the internet is blocked.

You have an Azure SQL database named SqlDb1 on a logical server named SqlSrv1.

You need to implement connectivity between VM1 and SqlDb1 to meet the following requirements:

✑ Ensure that VM1 cannot connect to any Azure SQL Server other than SqlSrv1.

✑ Restrict network connectivity to SqlSrv1.

What should you create on VNet1?

• A. a VPN gateway

• B. a service endpoint

• C. a private link

• D. an ExpressRoute gateway

Answer explanation

Correct Answer: C

Azure Private Link enables you to access Azure PaaS Services (for example, Azure Storage and SQL Database) and Azure hosted customerowned/

partner services over a private endpoint in your virtual network.

Traffic between your virtual network and the service travels the Microsoft backbone network. Exposing your service to the public internet is no

longer necessary.

You are developing an application that uses Azure Data Lake Storage Gen 2.

You need to recommend a solution to grant permissions to a specific application for a limited time period.

What should you include in the recommendation?

• A. role assignments

• B. account keys

• C. shared access signatures (SAS)

• D. Azure Active Directory (Azure AD) identities

You are designing an enterprise data warehouse in Azure Synapse Analytics that will contain a table named Customers. Customers will contain

credit card information.

You need to recommend a solution to provide salespeople with the ability to view all the entries in Customers. The solution must prevent all the

salespeople from viewing or inferring the credit card information.

What should you include in the recommendation?

• A. row-level security

• B. data masking

• C. Always Encrypted

• D. column-level security

Answer explanation

Correct Answer: B

Azure SQL Database, Azure SQL Managed Instance, and Azure Synapse Analytics support dynamic data masking. Dynamic data masking limits

sensitive data exposure by masking it to non-privileged users.

The Credit card masking method exposes the last four digits of the designated fields and adds a constant string as a prefix in the form of a

credit card.

You have a data warehouse in Azure Synapse Analytics.

You need to ensure that the data in the data warehouse is encrypted at rest.

What should you enable?

• A. Transparent Data Encryption (TDE)

• B. Advanced Data Security for this database

• C. Always Encrypted for all columns

• D. Secure transfer required

Answer explanation

Correct Answer: A

Transparent data encryption (TDE) helps protect Azure SQL Database, Azure SQL Managed Instance, and Azure Synapse Analytics against the

threat of malicious offline activity by encrypting data at rest.

You are designing a security model for an Azure Synapse Analytics dedicated SQL pool that will support multiple companies.

You need to ensure that users from each company can view only the data of their respective company.

Which two objects should you include in the solution? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

• A. a column encryption key

• B. asymmetric keys

• C. a function

• D. a custom role-based access control (RBAC) role

• E. a security policy

You have an Azure subscription that contains an Azure Data Factory version 2 (V2) data factory named df1. DF1 contains a linked service.

You have an Azure Key vault named vault1 that contains an encryption kay named key1.

You need to encrypt df1 by using key1.

What should you do first?

• Disable purge protection on vault1.

• Remove the linked service from df1.

• Create a self-hosted integration runtime.

• Disable soft delete on vault1.

You have an Azure subscription that contains a server named Server1. Server1 hosts two Azure SQL databases named DB1 and DB2.

You plan to deploy a Windows app named App1 that will authenticate to DB2 by using SQL authentication.

You need to ensure that App1 can access DB2. The solution must meet the following requirements:

✑ App1 must be able to view only DB2.

✑ Administrative effort must be minimized.

What should you create?

• A. a contained database user for App1 on DB2

• B. a login for App1 on Server1

• C. a contained database user from an external provider for App1 on DB2

• D. a contained database user from a Windows login for App1 on DB2