Azure Data Security and Compliance Flashcards

Which Azure feature allows you to classify and label sensitive data in Azure SQL Database and Azure Synapse Analytics?

Answer: Data Discovery & Classification

Data Discovery & Classification scans databases to identify, label, and report on columns containing sensitive data like PII or financial information.

What does Transparent Data Encryption (TDE) protect in Azure SQL Database?

Answer: Data at rest by encrypting database files, backups, and transaction logs

TDE encrypts the entire database at the storage level, protecting data files, backups, and transaction logs at rest.

Which Azure SQL Database feature allows encrypting specific sensitive columns so that data is only decrypted by authorized client applications?

Answer: Always Encrypted

Always Encrypted ensures that sensitive column data is encrypted at the client and never exposed in plaintext to the database engine or DBAs.

What does Azure SQL Dynamic Data Masking do?

Answer: Limits exposure of sensitive data by masking it for non-privileged users in query results

Dynamic Data Masking obscures sensitive column values (e.g., showing XXXX-1234 for credit card numbers) in query results for non-privileged users.

Which mechanism in Azure Data Lake Storage Gen2 allows you to grant a service principal read access to a specific directory without granting access to the entire storage account?

Answer: POSIX ACLs

POSIX ACLs in ADLS Gen2 allow granular, directory- and file-level permissions to be assigned to service principals and users.

In Azure Synapse Analytics, what feature allows row-level access control so different users see only the rows they are authorized to view?

Answer: Row-level security (RLS)

Row-Level Security in Synapse Analytics uses security policies and predicate functions to filter rows based on the executing user's identity.