Implement Security for Data at Rest and Data in Transit DP-300 Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   Your Azure SQL Database is accessed by an application in a virtual network. You want to restrict access to the database so that only traffic from that virtual network is allowed, and you want to minimize configuration overhead. What should you configure?

   • AAn Azure VPN gateway and a firewall rule for the VPN address space.
   • BA virtual network service endpoint and a virtual network firewall rule.
   • CA server-level firewall rule for the VM's public IP.
   • DA private endpoint for the database.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is a primary benefit of Always Encrypted in Azure SQL Database?

   • AIt provides a secure tunnel for data in transit using TLS 1.2
   • BIt encrypts the entire database at rest without requiring application changes
   • CIt automatically masks sensitive data in query results for non-privileged users
   • DIt ensures that sensitive data is encrypted on the client side and never appears in plaintext to the database engine
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A company is migrating an on-premises SQL Server database to Azure SQL Database. The database contains sensitive financial data. The security policy requires that the entire database be encrypted at rest with a key that is automatically rotated by the platform. You need to ensure that the data is encrypted as soon as the database is created in Azure. What should you do?

   • AEnable TDE on the Azure SQL Database using the default service-managed key.
   • BEnable Always Encrypted on the sensitive columns.
   • CUse dynamic data masking to protect the sensitive columns.
   • DConfigure a customer-managed key for TDE in Azure Key Vault.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A company runs an analytics workload on Azure VMs in a specific subnet. The VMs need to connect to an Azure SQL Database, and the network team wants to restrict access so that only traffic from that subnet can reach the database. They do not require the database to be completely removed from the public internet, but they want to avoid opening the database to all Azure services. What should you configure?

   • AConfigure a database-level firewall rule that allows the VM's private IP addresses.
   • BAdd a server-level firewall rule that allows the public IP range of the entire virtual network.
   • CEnable a service endpoint for Microsoft.Sql on the subnet and add a virtual network firewall rule for that subnet.
   • DCreate a private endpoint for the database and disable public network access.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   Your Azure SQL Database is accessed by developers from a range of office IP addresses. You need to allow access only from those IPs and block all other public traffic. What should you configure?

   • AA virtual network service endpoint for the office network.
   • BA private endpoint for the database.
   • CA server-level firewall rule for the office IP range.
   • DA database-level firewall rule for the office IP range.
   Reveal Solution Discussion Select an answer first