DP-200 Azure Data Security and Compliance 1 — Questions and Answers
Question 1: Which Azure feature allows you to classify and label sensitive data in Azure SQL Database and Azure Synapse Analytics?
- Azure Policy
- Data Discovery & Classification (Correct answer)
- Microsoft Defender for Cloud
- Azure Purview
Correct answer: Data Discovery & Classification
Data Discovery & Classification scans databases to identify, label, and report on columns containing sensitive data like PII or financial information.
Question 2: What does Transparent Data Encryption (TDE) protect in Azure SQL Database?
- Data in transit between client and server
- Data at rest by encrypting database files, backups, and transaction logs (Correct answer)
- Column-level data from unauthorized queries
- Row-level data based on user identity
Correct answer: Data at rest by encrypting database files, backups, and transaction logs
TDE encrypts the entire database at the storage level, protecting data files, backups, and transaction logs at rest.
Question 3: Which Azure SQL Database feature allows encrypting specific sensitive columns so that data is only decrypted by authorized client applications?
- Transparent Data Encryption (TDE)
- Row-Level Security (RLS)
- Always Encrypted (Correct answer)
- Dynamic Data Masking
Correct answer: Always Encrypted
Always Encrypted ensures that sensitive column data is encrypted at the client and never exposed in plaintext to the database engine or DBAs.
Question 4: What does Azure SQL Dynamic Data Masking do?
- Encrypts data at rest
- Limits exposure of sensitive data by masking it for non-privileged users in query results (Correct answer)
- Prevents unauthorized schema changes
- Audits all data access to a log
Correct answer: Limits exposure of sensitive data by masking it for non-privileged users in query results
Dynamic Data Masking obscures sensitive column values (e.g., showing XXXX-1234 for credit card numbers) in query results for non-privileged users.
Question 5: Which mechanism in Azure Data Lake Storage Gen2 allows you to grant a service principal read access to a specific directory without granting access to the entire storage account?
- Storage account key rotation
- POSIX ACLs (Correct answer)
- Shared Access Signature (SAS) token
- Azure Policy
Correct answer: POSIX ACLs
POSIX ACLs in ADLS Gen2 allow granular, directory- and file-level permissions to be assigned to service principals and users.
Question 6: In Azure Synapse Analytics, what feature allows row-level access control so different users see only the rows they are authorized to view?
- Dynamic Data Masking
- Column-level security
- Row-level security (RLS) (Correct answer)
- Always Encrypted
Correct answer: Row-level security (RLS)
Row-Level Security in Synapse Analytics uses security policies and predicate functions to filter rows based on the executing user's identity.
DP-200 Azure Data Security and Compliance 1
Which Azure feature allows you to classify and label sensitive data in Azure SQL Database and Azure Synapse Analytics?