Implement Data Security and Compliance DP-800 Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A healthcare organization uses a SQL database for patient records. Doctors should see all records for their own patients, but nurses should only see records for patients in their department. The application uses Azure AD authentication and passes the user's role and department via SESSION_CONTEXT. Which design should you implement?

   • AUse Dynamic Data Masking to hide patient names based on role
   • BCreate separate views for doctors and nurses
   • CCreate two separate security policies, one for doctors and one for nurses
   • DCreate a single Row-Level Security predicate that checks both role and department via SESSION_CONTEXT
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which database object is used to define the predicate logic for Row-Level Security?

   • ATrigger
   • BStored procedure
   • CInline table-valued function
   • DView
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company is migrating an on-premises application to Azure. The application connects to Azure SQL Database using SQL authentication with a username and password. The security team wants to eliminate passwords and use managed identities. The application is a .NET application running in Azure App Service. What is the recommended migration path?

   • ACreate a SQL login for the managed identity and use a connection string with User ID=managedidentity.
   • BUse a connection string with Integrated Security=True and rely on Windows authentication.
   • CChange the connection string to use the managed identity and update the application to use the Microsoft.Data.SqlClient with Active Directory Managed Identity authentication.
   • DKeep SQL authentication but store the password in Azure Key Vault and retrieve it at runtime.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A global bank is migrating its customer database to Azure SQL Database. The database contains account numbers, balances, and transaction history. Compliance requires encryption at rest and in transit, and auditors need to verify who accessed sensitive data. The bank also wants to minimize performance impact for queries that filter on account numbers. Which design should you choose?

   • AEnable TDE, use column-level encryption with a symmetric key, and enable auditing
   • BEnable TDE, use Always Encrypted with deterministic encryption for account numbers, and enable auditing
   • CEnable TDE, use randomized Always Encrypted for account numbers, and enable auditing
   • DEnable TDE, use Dynamic Data Masking for account numbers, and enable auditing
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A financial application uses Azure SQL Database. The reporting team needs to read data from the Sales schema but must not be able to modify any data. The team connects using Azure Active Directory (now Microsoft Entra ID) authentication. You need to grant the minimum permissions required. What should you do?

   • AAdd the reporting team's Entra ID group to the db_datareader fixed database role.
   • BCreate a user in the database for the Entra ID group and grant SELECT on the Sales schema to that user.
   • CGrant the group the db_datawriter role and deny INSERT, UPDATE, DELETE on the Sales schema.
   • DCreate a contained database user with a password and grant SELECT on the Sales schema.
   Reveal Solution Discussion Select an answer first