A startup is building a new application on Azure Cosmos DB. They want to ensure that data is encrypted at rest with minimal management overhead. They have no specific compliance requirements for key control. What should they do?

Enable customer-managed keys in Azure Key Vault.

Use a customer-managed key with automatic rotation.

Rely on platform-managed encryption keys, which are enabled by default.

Configure a private endpoint to encrypt data at rest.

A company is required to use customer-managed keys for Azure Cosmos DB. They have already configured a key in Azure Key Vault and assigned the necessary RBAC permissions. However, when they try to enable customer-managed keys on the Cosmos DB account, the operation fails. What is the most likely cause?

The Cosmos DB account is using a serverless capacity mode.

The key vault is in a different region than the Cosmos DB account.

The key vault has soft-delete and purge protection disabled.

A development team uses Azure Cosmos DB for a new application. The application is tested from a corporate office that has a NAT gateway with a static public IP address. The team also needs to manage the account from the Azure portal. The security policy requires that only the corporate office IP address can access the account. What should you configure?

Enable the Azure portal access setting and add the corporate office public IP address to the firewall rules.

Disable public network access and enable Azure Private Link.

Create a virtual network service endpoint and add the corporate office subnet.

Add the corporate office IP address to the firewall rules and disable the Azure portal access setting.

Microsoft Certified:Azure Cosmos DB Developer Specialty

Domain 5Objective 3

Implement Security for an Azure Cosmos DB Solution DP-420 Practice Questions (Page 4)

Part of the Maintain an Azure Cosmos DB solution domain, which makes up ~22% of our current practice bank. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

9concepts

Questions 16–20

16application · easy
A startup is building a new application on Azure Cosmos DB. They want to ensure that data is encrypted at rest with minimal management overhead. They have no specific compliance requirements for key control. What should they do?
Select an answer first
17expert · hard
A company is required to use customer-managed keys for Azure Cosmos DB. They have already configured a key in Azure Key Vault and assigned the necessary RBAC permissions. However, when they try to enable customer-managed keys on the Cosmos DB account, the operation fails. What is the most likely cause?
Select an answer first
18foundation · easy
What is the default minimum TLS version required by Azure Cosmos DB?
Select an answer first
19application · medium
A development team uses Azure Cosmos DB for a new application. The application is tested from a corporate office that has a NAT gateway with a static public IP address. The team also needs to manage the account from the Azure portal. The security policy requires that only the corporate office IP address can access the account. What should you configure?
Select an answer first
20foundation · easy
Which Azure service is used to store customer-managed encryption keys for Azure Cosmos DB?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DP-420

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “DP-420” is a trademark of its owner, used for identification only.

Implement Security for an Azure Cosmos DB Solution DP-420 Practice Questions (Page 4)

Questions 16–20

A startup is building a new application on Azure Cosmos DB. They want to ensure that data is encrypted at rest with minimal management overhead. They have no specific compliance requirements for key control. What should they do?

What is the default minimum TLS version required by Azure Cosmos DB?

Which Azure service is used to store customer-managed encryption keys for Azure Cosmos DB?

Keep studying — Maintain an Azure Cosmos DB solution