Implement Security for an Azure Cosmos DB Solution DP-420 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company has an Azure Cosmos DB account that is accessed by an application running on Azure VMs in a specific subnet. They want to ensure that only the VMs in that subnet can access the Cosmos DB account, and they want to avoid exposing the account to the public internet. They also want to keep using the existing connection string without changing the application code. What should you do?

   • AUse IP firewall rules to allow only the VM's public IP addresses.
   • BCreate a private endpoint for the Cosmos DB account and update the application to use the private IP address.
   • CEnable a virtual network service endpoint for Cosmos DB on the subnet and add the subnet to the Cosmos DB account's allowed networks.
   • DDisable public network access and use Azure Bastion to connect to Cosmos DB.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the purpose of virtual network service endpoints for Azure Cosmos DB?

   • ATo allow access to Cosmos DB only from a specific virtual network.
   • BTo enable Azure Active Directory authentication for the database.
   • CTo encrypt data at rest using a customer-managed key.
   • DTo provide a private IP address for the Cosmos DB account.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company has an Azure Cosmos DB account that is used by a legacy application that runs on-premises. The application connects using a public IP address. The security team wants to restrict access to only that IP address. What should you configure?

   • AAdd the on-premises public IP address to the IP firewall rules.
   • BDisable public network access and use a private endpoint.
   • CUse a shared access signature (SAS) token with a restricted IP range.
   • DEnable a virtual network service endpoint for the on-premises network.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is required to use virtual network service endpoints with Azure Cosmos DB?

   • AA VPN gateway connection to the virtual network.
   • BAn Azure Private Endpoint configured for the Cosmos DB account.
   • CA public IP address assigned to the Cosmos DB account.
   • DA virtual network with a subnet that has the Microsoft.AzureCosmosDB service endpoint enabled.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   How is data encryption at rest enabled in Azure Cosmos DB?

   • AIt is enabled only for accounts in specific regions.
   • BIt is enabled by default and cannot be disabled.
   • CIt must be manually enabled during account creation.
   • DIt is enabled only when you use customer-managed keys.
   Reveal Solution Discussion Select an answer first