A company stores financial data in Azure Cosmos DB. The security team wants to ensure that data is encrypted at rest using keys managed by the company. What should you do?

Use a private endpoint to encrypt data at rest.

Rely on platform-managed keys, which are enabled by default.

Enable customer-managed keys in Azure Key Vault.

Enable Azure Active Directory authentication for the account.

Which protocol is used to encrypt data in transit between a client and Azure Cosmos DB?

IPsec (Internet Protocol Security)

A company requires that all traffic to Azure Cosmos DB be encrypted in transit and that the database not be accessible from the public internet. The application runs on Azure VMs in a virtual network. What should you implement?

Enable a private endpoint and disable public network access.

Use a shared access signature (SAS) token with a restricted IP range.

Add the VM public IP addresses to the IP firewall rules.

Enable a virtual network service endpoint and add the subnet to the firewall allow list.

A company has an Azure Cosmos DB account that must be accessible only from a specific virtual network. The network team has already created a private endpoint for the account. However, the application team reports that they can still connect from a VM in a different subnet that is not in the private endpoint's subnet. What is the most likely cause?

Public network access is still enabled on the Cosmos DB account.

The private endpoint is in a different region than the VM.

The private endpoint is not approved.

The VM is using a different DNS resolver.

What is the purpose of IP firewall rules in Azure Cosmos DB?

To encrypt data in transit between clients and the database.

To authenticate users connecting to the database.

To monitor network traffic for security threats.

To restrict access to the Cosmos DB account to a set of allowed IP addresses.

Microsoft Certified:Azure Cosmos DB Developer Specialty

Domain 5Objective 3

Implement Security for an Azure Cosmos DB Solution DP-420 Practice Questions (Page 2)

Part of the Maintain an Azure Cosmos DB solution domain, which makes up ~22% of our current practice bank. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

9concepts

Questions 6–10

6application · easy
A company stores financial data in Azure Cosmos DB. The security team wants to ensure that data is encrypted at rest using keys managed by the company. What should you do?
Select an answer first
7foundation · easy
Which protocol is used to encrypt data in transit between a client and Azure Cosmos DB?
Select an answer first
8application · medium
A company requires that all traffic to Azure Cosmos DB be encrypted in transit and that the database not be accessible from the public internet. The application runs on Azure VMs in a virtual network. What should you implement?
Select an answer first
9expert · hard
A company has an Azure Cosmos DB account that must be accessible only from a specific virtual network. The network team has already created a private endpoint for the account. However, the application team reports that they can still connect from a VM in a different subnet that is not in the private endpoint's subnet. What is the most likely cause?
Select an answer first
10foundation · easy
What is the purpose of IP firewall rules in Azure Cosmos DB?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DP-420

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “DP-420” is a trademark of its owner, used for identification only.