Implement Security for an Azure Cosmos DB Solution DP-420 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A financial services company is deploying a new application that will access Azure Cosmos DB. The application runs on Azure VMs in a peered virtual network. The security team requires that all traffic to Cosmos DB remain on the Microsoft backbone and never traverse the public internet. They also want to minimize the number of public IP addresses that need to be managed. What should you implement?

   • AEnable Azure Private Link and create a private endpoint in the peered virtual network.
   • BAdd the VM public IP addresses to the Cosmos DB IP firewall rules.
   • CConfigure a virtual network service endpoint for Cosmos DB and add the subnet to the firewall allow list.
   • DUse a shared access signature (SAS) token with a restricted IP range.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company has an Azure Cosmos DB account that is used by a development team. The team accesses the account from a set of known IP addresses. They want to ensure that only those IP addresses can access the account. What should you do?

   • AUse a private endpoint and disable public network access.
   • BEnable a service endpoint for the development team's subnet.
   • CAdd the known IP addresses to the IP firewall.
   • DDisable public network access and use Azure Bastion.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which Azure Cosmos DB feature restricts access to the service from only selected networks?

   • ANetwork-level access control
   • BAzure Active Directory authentication
   • CShared access signatures
   • DIP firewall rules
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   When configuring an IP firewall rule for Azure Cosmos DB, what must you specify?

   • AThe IP address or range of IP addresses to allow.
   • BThe Azure Active Directory tenant ID.
   • CThe name of the virtual network that can access the account.
   • DThe Azure region where the account is hosted.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A large enterprise has multiple Azure Cosmos DB accounts across different resource groups. They want to grant a team of database administrators the ability to manage all Cosmos DB accounts in the subscription, but they should NOT be able to manage other resource types. They also want to ensure that the team can view access keys but not regenerate them. What should you do?

   • AAssign the Reader role at the subscription scope and the Cosmos DB Account Contributor role at each resource group.
   • BAssign the Cosmos DB Account Contributor role at the subscription scope.
   • CAssign the Cosmos DB Operator role at the subscription scope.
   • DCreate a custom role that includes the necessary Microsoft.DocumentDB permissions, including reading keys but not regenerating them, and assign it at the subscription scope.
   Reveal Solution Discussion Select an answer first