A company is required to use customer-managed keys for Azure Cosmos DB. They have configured the key vault and assigned the necessary permissions. However, they want to ensure that if the key is accidentally deleted, the data remains recoverable. What should they do?

Create a backup of the key vault.

Use a key in a different region.

Enable soft-delete and purge protection on the key vault.

Assign the Key Vault Administrator role to the Cosmos DB account.

Which of the following is a method to implement network-level access control for Azure Cosmos DB?

Assigning a managed identity to the Cosmos DB account.

Enabling Azure Active Directory authentication.

Setting up a shared access signature token.

Configuring a firewall rule for a specific IP address range.

A company is moving a legacy application to Azure Cosmos DB. The application stores personally identifiable information (PII). The security team wants to ensure that the data is encrypted at rest using a key that is managed by the company. What should they do?

Use the default encryption provided by Azure Cosmos DB.

Enable encryption in transit using TLS.

Use Azure Storage Service Encryption on the Cosmos DB account.

Configure customer-managed keys in Azure Key Vault and associate them with the Cosmos DB account.

What is the default encryption mechanism for data at rest in Azure Cosmos DB?

Customer-managed keys stored in Azure Key Vault.

No encryption is applied by default.

Platform-managed keys that Microsoft manages.

Keys that you provide at the time of account creation.

Microsoft Certified:Azure Cosmos DB Developer Specialty

Domain 5Objective 3

Implement Security for an Azure Cosmos DB Solution DP-420 Practice Questions (Page 6)

Part of the Maintain an Azure Cosmos DB solution domain, which makes up ~22% of our current practice bank. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 34 practice questions to prepare you well beyond it. (estimate)

34questions here

7free pages

9concepts

Questions 26–30

26expert · hard
A company is required to use customer-managed keys for Azure Cosmos DB. They have configured the key vault and assigned the necessary permissions. However, they want to ensure that if the key is accidentally deleted, the data remains recoverable. What should they do?
Select an answer first
27foundation · easy
Which Azure resource is created to use Azure Private Link with Azure Cosmos DB?
Select an answer first
28foundation · easy
Which of the following is a method to implement network-level access control for Azure Cosmos DB?
Select an answer first
29application · medium
A company is moving a legacy application to Azure Cosmos DB. The application stores personally identifiable information (PII). The security team wants to ensure that the data is encrypted at rest using a key that is managed by the company. What should they do?
Select an answer first
30foundation · easy
What is the default encryption mechanism for data at rest in Azure Cosmos DB?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DP-420

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “DP-420” is a trademark of its owner, used for identification only.