Azure Data Security and Compliance Flashcards

What does Microsoft Defender for SQL detect in an Azure SQL Database environment?

Answer: Anomalous database activities and potential SQL injection attacks

Microsoft Defender for SQL monitors for anomalous activities—such as SQL injection, unusual login patterns, and privilege escalation—and generates security alerts.

Which encryption option ensures Azure Cosmos DB data is encrypted both at rest and in transit?

Answer: Encryption at rest is enabled by default; in-transit uses TLS automatically

Cosmos DB encrypts all data at rest by default using Microsoft-managed keys, and all data in transit is protected by TLS automatically.

In Azure Synapse Analytics, what is the purpose of column-level security?

Answer: To restrict access to specific table columns based on user permissions using GRANT/DENY on columns

Column-level security uses T-SQL GRANT/DENY statements on individual columns to restrict which users or roles can SELECT specific fields.

What role does Azure Active Directory (Azure AD) play in securing Azure data services?

Answer: It serves as the identity provider for authentication and RBAC-based authorization to data services

Azure AD acts as the central identity provider, enabling authentication and role-based access control for Azure data services like SQL, Synapse, and ADLS.

When implementing customer-managed keys (CMK) for Azure Storage encryption, where must the keys be stored?

Answer: In Azure Key Vault or Azure Managed HSM

Customer-managed encryption keys for Azure Storage must be stored in Azure Key Vault or Azure Managed HSM, giving customers full control over key lifecycle.

What is the shared responsibility model implication for data security in Azure PaaS data services like Azure SQL Database?

Answer: Microsoft manages infrastructure security; the customer is responsible for data classification, access control, and encryption configuration

In PaaS, Microsoft handles infrastructure, physical security, and OS patching, while customers retain responsibility for data governance, access policies, and encryption choices.