Plan and Implement Security for Azure SQL Database and Azure SQL Managed Instance AZ-500 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   You are configuring authentication for an Azure SQL Database. You want to allow users to authenticate using their Microsoft Entra ID credentials. Which two components must be set up to enable Microsoft Entra ID authentication?

   • AAn Azure AD admin for the SQL server and a contained database user mapped to an Azure AD identity
   • BAn Azure AD application registration and a service principal with a client secret
   • CA managed identity and a database role assignment
   • DA SQL Server authentication login and a database user with the same password
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which scenario is most appropriate for using Always Encrypted in Azure SQL Database?

   • APreventing unauthorized access to the physical database files
   • BProtecting specific sensitive columns (e.g., credit card numbers) from database administrators
   • CEncrypting the entire database to meet compliance requirements
   • DMasking data for non-privileged users in query results
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company is migrating a legacy application to Azure SQL Database. The application cannot be modified, and it uses a privileged SQL login for all connections. The security team requires that a specific column containing national IDs be hidden from the application's queries, while the data must remain encrypted at rest. What should you implement?

   • ADynamic data masking on the column, and rely on TDE for encryption at rest.
   • BTransparent Data Encryption with a customer-managed key and column-level permissions.
   • CAlways Encrypted on the column with a column master key in Key Vault.
   • DRow-level security to filter out the rows containing national IDs.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A hospital's Azure SQL Database contains patient names and diagnoses. Nurses should see full patient names, but billing staff should see masked names. The security team also wants to prevent the database engine from ever seeing the diagnosis column in plaintext. What should you implement?

   • AUse Always Encrypted for both the name and diagnosis columns.
   • BUse dynamic data masking for both columns.
   • CApply dynamic data masking to the name column for the billing role, and use Always Encrypted for the diagnosis column.
   • DUse row-level security to restrict billing staff to rows without diagnoses.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which statement accurately describes a benefit of using Microsoft Entra ID authentication for Azure SQL Database?

   • AIt automatically encrypts all data in the database.
   • BIt removes the need for a server-level admin.
   • CIt eliminates the need for any database-level permissions.
   • DIt allows users to use the same credentials across multiple Azure services.
   Reveal Solution Discussion Select an answer first