Implement Data Security and Compliance DP-800 Practice Questions (Page 11)

Questions 51–55

1. 51expert · hard

   A multinational company uses Azure SQL Database for a global sales application. Sales managers must see data for their own region only. The company has a hybrid identity environment with Microsoft Entra ID. You need to design a Row-Level Security solution that minimizes administrative overhead and works for new managers without code changes. What should you do?

   • AUse application-defined session context and require the application to set the region.
   • BCreate a security policy that uses a lookup table mapping user names to regions.
   • CHard-code region names in the predicate function using USER_NAME().
   • DCreate separate database roles for each region and grant SELECT on region-specific views.
   Reveal Solution Discussion Select an answer first
2. 52expert · hard

   A customer support application uses Azure SQL Database. The support team needs to see customer names and email addresses, but the email address must be partially masked. The compliance team also requires that support managers be able to see full email addresses. You need to design a masking strategy that is easy to maintain and does not require application changes. What should you do?

   • AUse Always Encrypted with randomized encryption on the email column.
   • BCreate two views: one with masked email and one with full email, and grant permissions accordingly.
   • CApply Dynamic Data Masking with an email mask to the email column and grant UNMASK to the support managers.
   • DUse Row-Level Security to filter which rows support staff can see.
   Reveal Solution Discussion Select an answer first
4. 53foundation · easy

   Which permission allows a user to see the original data in a column that has Dynamic Data Masking applied?

   • ASELECT
   • BCONTROL
   • CVIEW DEFINITION
   • DUNMASK
   Reveal Solution Discussion Select an answer first
5. 54foundation · easy

   Which type of encryption is applied to a specific column using a symmetric key and is available in SQL Server and Azure SQL Database?

   • ACell-level encryption using ENCRYPTBYKEY
   • BAlways Encrypted with a column master key
   • CDynamic Data Masking
   • DTransparent Data Encryption
   Reveal Solution Discussion Select an answer first
6. 55application · medium

   A compliance audit requires that all SELECT statements executed against a sensitive table in Azure SQL Database be logged for 90 days. You need to configure auditing with minimal administrative overhead. What should you do?

   • AUse Extended Events to capture sql_statement_completed events and store them in a ring buffer.
   • BCreate a server-level trigger that inserts audit records into a custom audit table.
   • CEnable Azure SQL auditing and configure the audit log destination to a Log Analytics workspace.
   • DEnable Dynamic Data Masking on the sensitive table and review the masking logs.
   Reveal Solution Discussion Select an answer first