DP-200 Azure Data Security and Compliance 2 — Questions and Answers
Question 1: What is the purpose of Azure Private Endpoint for Azure Storage?
- To enable public internet access to storage
- To provide a private IP within your VNet for secure access to storage without traversing the public internet (Correct answer)
- To accelerate CDN delivery of static assets
- To replicate storage across regions
Correct answer: To provide a private IP within your VNet for secure access to storage without traversing the public internet
A Private Endpoint assigns a private IP address within your VNet to a storage account, ensuring traffic never leaves the Microsoft backbone network.
Question 2: Which Azure service provides centralized audit logging for data access and queries across Azure SQL Database and Azure Synapse Analytics?
- Azure Monitor Logs
- Azure SQL Auditing (Correct answer)
- Microsoft Sentinel
- Azure Service Health
Correct answer: Azure SQL Auditing
Azure SQL Auditing tracks database events and writes them to an audit log in Azure Storage, Log Analytics, or Event Hubs for compliance and forensics.
Question 3: What is Microsoft Purview (formerly Azure Purview) primarily used for in a data platform context?
- Real-time stream processing
- Unified data governance, cataloging, and lineage tracking across hybrid data sources (Correct answer)
- Database backup and restore
- ETL pipeline orchestration
Correct answer: Unified data governance, cataloging, and lineage tracking across hybrid data sources
Microsoft Purview provides a unified data governance solution with automated data discovery, cataloging, classification, and lineage visualization.
Question 4: In the context of DP-200, what does Azure Managed Identity enable when accessing Azure Key Vault or ADLS Gen2 from a data service?
- Encrypted data transfer using TLS 1.3
- Passwordless authentication using an Azure AD identity assigned to the service (Correct answer)
- Multi-factor authentication for service accounts
- Automatic key rotation for storage account keys
Correct answer: Passwordless authentication using an Azure AD identity assigned to the service
Managed Identity allows Azure data services to authenticate to other Azure resources without storing credentials, using an Azure AD-issued token.
Question 5: Which Azure Key Vault object type is used to store and manage symmetric or asymmetric cryptographic keys for data encryption?
- Secrets
- Certificates
- Keys (Correct answer)
- Policies
Correct answer: Keys
Azure Key Vault Keys store cryptographic key material and support operations like encrypt, decrypt, sign, and verify for data protection scenarios.
Question 6: What Azure feature enables you to define and enforce policies that require all Azure SQL Databases in a subscription to have TDE enabled?
- Azure Blueprints
- Azure Policy (Correct answer)
- Microsoft Defender for SQL
- Azure Security Center Recommendations
Correct answer: Azure Policy
Azure Policy can enforce compliance rules (like mandatory TDE) and audit or remediate non-compliant resources automatically.
DP-200 Azure Data Security and Compliance 2
What is the purpose of Azure Private Endpoint for Azure Storage?