DP-200 Azure Data Security and Compliance 3

Question 1

What does Microsoft Defender for SQL detect in an Azure SQL Database environment?

Accepted Answer

Anomalous database activities and potential SQL injection attacks

Answer

Microsoft Defender for SQL monitors for anomalous activities—such as SQL injection, unusual login patterns, and privilege escalation—and generates security alerts.

Question 2

Which encryption option ensures Azure Cosmos DB data is encrypted both at rest and in transit?

Accepted Answer

Encryption at rest is enabled by default; in-transit uses TLS automatically

Answer

Cosmos DB encrypts all data at rest by default using Microsoft-managed keys, and all data in transit is protected by TLS automatically.

Question 3

In Azure Synapse Analytics, what is the purpose of column-level security?

Accepted Answer

To restrict access to specific table columns based on user permissions using GRANT/DENY on columns

Answer

Column-level security uses T-SQL GRANT/DENY statements on individual columns to restrict which users or roles can SELECT specific fields.

Question 4

What role does Azure Active Directory (Azure AD) play in securing Azure data services?

Accepted Answer

It serves as the identity provider for authentication and RBAC-based authorization to data services

Answer

Azure AD acts as the central identity provider, enabling authentication and role-based access control for Azure data services like SQL, Synapse, and ADLS.

Question 5

When implementing customer-managed keys (CMK) for Azure Storage encryption, where must the keys be stored?

Accepted Answer

In Azure Key Vault or Azure Managed HSM

Answer

Customer-managed encryption keys for Azure Storage must be stored in Azure Key Vault or Azure Managed HSM, giving customers full control over key lifecycle.

DP-200 - Microsoft Azure Data Solutions Practice Test

DP-200 - Microsoft Azure Data Solutions Practice Test

DP-200 Azure Data Security and Compliance 3