Implement Data Security DP-203 Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   Your company stores sensitive data in Azure Blob Storage. You need to ensure that the data is encrypted at rest using customer-managed keys (CMK). You have configured the storage account to use a CMK from Azure Key Vault. However, you find that the storage account is still using a Microsoft-managed key. What is the most likely cause?

   • AThe storage account was created before CMK was supported and needs to be recreated.
   • BThe key vault is in a different region than the storage account.
   • CThe key vault does not have the 'Get', 'Wrap Key', and 'Unwrap Key' permissions assigned to the storage account's managed identity.
   • DThe storage account's encryption type is set to 'Infrastructure encryption' instead of 'Customer-managed keys'.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   Your company stores sensitive financial data in Azure Blob Storage. You need to ensure that the data is encrypted at rest using a customer-managed key, and you also need to restrict access to the storage account so that only requests from your corporate network's public IP range are allowed. You have already created an Azure Key Vault and a key. What should you configure?

   • ASet the storage account's encryption type to 'Customer-managed keys' and select the key from Key Vault, then add a network rule to allow only the corporate IP range.
   • BApply an Azure RBAC role that grants only the corporate network's IP range access to the storage account.
   • CUse Azure Storage Service Encryption (SSE) with a service-managed key and configure a private endpoint for the storage account.
   • DEnable infrastructure encryption on the storage account and configure a network rule to allow only the corporate IP range.
   Reveal Solution Discussion Select an answer first
4. 33expert · medium

   A multi-tenant SaaS application uses Azure SQL Database. The application uses a single database user for all tenants. The company wants to enforce row-level security so that tenants only see their own data. They also want to mask a sensitive column for non-admin users. The application sets a TenantID in the session context. Which approach should you use?

   • AUse column-level permissions to restrict access to the sensitive column and rely on the application to filter rows.
   • BUse a view that filters by TenantID and grant the application user access to the view.
   • CCreate a separate database user for each tenant and use a security predicate that filters by USER_NAME().
   • DCreate a security predicate that uses SESSION_CONTEXT to filter rows by TenantID, and apply dynamic data masking to the sensitive column.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   You need to prevent a group of users from seeing the 'Salary' column in a table in Azure SQL Database, while still allowing them to see other columns. Which feature should you use?

   • ATransparent Data Encryption
   • BColumn-Level Security
   • CDynamic Data Masking
   • DRow-Level Security
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   When writing encrypted data to a table in Azure Databricks, which feature ensures the data is encrypted at rest?

   • AAzure Storage Service Encryption
   • BTransparent Data Encryption
   • CDynamic Data Masking
   • DAlways Encrypted
   Reveal Solution Discussion Select an answer first