Implement Data Security DP-203 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A data engineering team uses Azure Databricks to process sensitive customer data. The team wants to restrict access to specific tables and files so that only certain users can read them. They also want to ensure that when a DataFrame containing sensitive data is loaded, the data is not written to unintended locations. What should the team implement?

   • AUse Azure Key Vault to store credentials and configure the cluster to use a service principal with read-only access to the storage account.
   • BUse table ACLs and file ACLs in Databricks to grant granular permissions, and use resource tokens to scope access to specific clusters and jobs.
   • CUse dynamic data masking in Databricks to hide sensitive columns and rely on the default cluster configuration to prevent unintended writes.
   • DUse Azure RBAC to assign the Databricks Contributor role to all users and rely on cluster-level permissions to restrict data access.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   When loading a DataFrame with sensitive information in Azure Databricks, which approach helps prevent data leakage?

   • AStoring credentials in plain text in the notebook
   • BDisabling cluster auto-scaling
   • CUsing a shared cluster with multiple users
   • DUsing a secret scope to reference credentials
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   You need to ensure that sales representatives can only view customer records for their assigned region in an Azure SQL Database. Which feature should you implement?

   • ARow-Level Security
   • BDynamic Data Masking
   • CColumn-Level Security
   • DTransparent Data Encryption
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   Your company has an Azure SQL Database that is accessed by applications running on Azure VMs in the same region. You need to ensure that all connections to the database are encrypted in transit. You also want to minimize the attack surface by ensuring that the database is not reachable from the public internet. What should you do?

   • ASet the 'Minimum TLS version' to 1.2 on the SQL server and enable 'Allow Azure services and resources to access this server' to allow the VMs to connect.
   • BConfigure a private endpoint for the SQL server and set the 'Minimum TLS version' to 1.2.
   • CUse an Azure VPN gateway to connect the VMs to the SQL server and rely on the default TLS settings.
   • DAdd a network security group (NSG) rule on the SQL server's subnet to allow only the VMs' IP addresses.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company uses Azure SQL Database for a multi-tenant application. Each tenant's data is stored in a shared table with a TenantID column. The application uses a single database user for all tenants. The company wants to ensure that tenants can only see their own rows and that a sensitive column, such as CreditCardNumber, is masked for non-admin users. What should you implement?

   • AUse a view that filters by TenantID and grant the application user access to the view instead of the base table.
   • BApply dynamic data masking to the CreditCardNumber column and rely on the application to filter rows by TenantID.
   • CImplement row-level security using a security predicate that filters by TenantID based on the SESSION_CONTEXT, and apply dynamic data masking to the CreditCardNumber column.
   • DCreate a separate database user for each tenant and use column-level permissions to restrict access to the CreditCardNumber column.
   Reveal Solution Discussion Select an answer first