Implement Data Security and Compliance DP-800 Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is the primary purpose of Dynamic Data Masking (DDM) in a database?

   • ATo restrict which rows a user can access
   • BTo prevent data from being transmitted over the network
   • CTo prevent unauthorized users from seeing sensitive data in query results
   • DTo encrypt data at rest in the database files
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company exposes a GraphQL endpoint for a mobile app. The endpoint queries a SQL database. Security requirements include preventing unauthorized access and limiting the data that can be queried. Which combination of measures should you implement?

   • AEnable Azure AD authentication and implement field-level authorization in the resolver
   • BImplement query depth limits and use SQL authentication
   • CUse API keys and rely on database permissions
   • DDisable introspection and use a shared secret
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   An MCP endpoint allows AI agents to query a database that contains sensitive personal data. The security team requires that the data be encrypted at rest and that all queries be logged. The AI agents authenticate using Microsoft Entra ID. You need to ensure that the MCP endpoint cannot access data beyond what the agent is authorized to see. What should you implement?

   • AUse Dynamic Data Masking to hide sensitive columns and enable auditing.
   • BCreate a separate database user for each agent and grant SELECT on all tables.
   • CEnable Always Encrypted on all columns and use the agent's managed identity to authenticate.
   • DEnable TDE on the database, use the agent's managed identity to authenticate, and implement Row-Level Security.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A development team wants to connect to Azure SQL Database from a Python application running in Azure without storing credentials in the code. They plan to use Azure AD authentication. Which authentication method should they use?

   • AService principal with a client secret
   • BAzure AD username and password with multi-factor authentication
   • CSQL authentication with a username and password stored in environment variables
   • DAzure AD Managed Identity
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A support team needs to see the last four digits of customer credit card numbers in the Orders table, but not the full number. The compliance team requires that the full number never be visible to support staff, even if they run ad-hoc queries. You need to implement a solution that requires no changes to the application's SELECT statements. What should you configure?

   • AUse Row-Level Security to filter rows based on the support user's login.
   • BApply Dynamic Data Masking to the credit card column using a partial mask and do not grant UNMASK to support users.
   • CEncrypt the credit card column with Always Encrypted and provide the column encryption key to support users.
   • DCreate a view that selects only the last four digits and revoke SELECT on the base table from support users.
   Reveal Solution Discussion Select an answer first