QUESTION: 71 Exam Topic: Implement a Secure Environment Questions

You have a new Azure SQL database. The database contains a column that stores confidential information.

You need to track each time values from the column are returned in a query. The tracking information must be stored for 365 days from the date the query was executed.

Which three actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

Turn on auditing and write audit logs to an Azure Storage account.
Add extended properties to the column.
Turn on auditing and write audit logs to an Event Hub.
Apply sensitivity labels named Highly Confidential to the column.
Turn on Azure Advanced Threat Protection (ATP).

Answer(s): A,D,E

Explanation:

D: You can apply sensitivity-classification labels persistently to columns by using new metadata attributes that have been added to the SQL Server database engine. This metadata can then be used for advanced, sensitivity-based auditing and protection scenarios.
A: An important aspect of the information-protection paradigm is the ability to monitor access to sensitive data. Azure SQL Auditing has been enhanced to include a new field in the audit log called data_sensitivity_information. This field logs the sensitivity classifications (labels) of the data that was returned by a query. Here's an example:

E: Enable Microsoft Defender for Azure SQL Database at the subscription level from Microsoft Defender for Cloud.
Note: Microsoft Defender for SQL is a unified package for advanced SQL security capabilities. Microsoft Defender for Cloud is available for Azure SQL Database,
Azure SQL Managed Instance, and Azure Synapse Analytics.

Reference:

https://docs.microsoft.com/en-us/azure/azure-sql/database/data-discovery-and-classification-overview https://docs.microsoft.com/en-us/azure/azure-sql/database/azure-defender-for-sql

Reveal Solution Next Question

QUESTION: 72 Exam Topic: Implement a Secure Environment Questions

You have an Azure virtual machine named VM1 on a virtual network named VNet1. Outbound traffic from VM1 to the internet is blocked.

You have an Azure SQL database named SqlDb1 on a logical server named SqlSrv1.
You need to implement connectivity between VM1 and SqlDb1 to meet the following requirements:
-Ensure that all traffic to the public endpoint of SqlSrv1 is blocked.
-Minimize the possibility of VM1 exfiltrating data stored in SqlDb1.

What should you create on VNet1?

a VPN gateway
a service endpoint
a private link
an ExpressRoute gateway

Answer(s): C

Explanation:

Azure Private Link enables you to access Azure PaaS Services (for example, Azure Storage and SQL Database) and Azure hosted customer-owned/partner services over a private endpoint in your virtual network.

Traffic between your virtual network and the service travels the Microsoft backbone network. Exposing your service to the public internet is no longer necessary.

Reference:

https://docs.microsoft.com/en-us/azure/private-link/private-link-overview

Reveal Solution Next Question

QUESTION: 73 Exam Topic: Implement a Secure Environment Questions

DRAG DROP (Drag and Drop is not supported)
You have a new Azure SQL database named DB1 on an Azure SQL server named AzSQL1. The only user who was created is the server administrator.
You need to create a contained database user in DB1 who will use Azure Active Directory (Azure AD) for authentication.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Select and Place:

See Explanation section for answer.

Answer(s): A

Explanation:

Step 1: Set up the Active Directory Admin for AzSQL1.
Step 2: Connect to DB1 by using the server administrator.
Sign into your managed instance with an Azure AD login granted with the sysadmin role.
Step 3: Create a user by using the FROM EXTERNAL PROVIDER clause.
FROM EXTERNAL PROVIDER is available for creating server-level Azure AD logins in SQL Database managed instance. Azure AD logins allow database-level Azure AD principals to be mapped to server-level Azure AD logins. To create an Azure AD user from an Azure AD login use the following syntax:
CREATE USER [AAD_principal] FROM LOGIN [Azure AD login]

Reference:

https://docs.microsoft.com/en-us/sql/t-sql/statements/create-user-transact-sql

Reveal Solution Next Question

QUESTION: 74 Exam Topic: Implement a Secure Environment Questions

HOTSPOT (Drag and Drop is not supported)
You have an Azure SQL database that contains a table named Customer. Customer has the columns shown in the following table.

You plan to implement a dynamic data mask for the Customer_Phone column. The mask must meet the following requirements:

-The first six numerals of each customer’s phone number must be masked.
-The last four digits of each customer’s phone number must be visible.
-Hyphens must be preserved and displayed.

How should you configure the dynamic data mask? To answer, select the appropriate options in the answer area.
Hot Area:

See Explanation section for answer.

Answer(s): A

Explanation:

Box 1: 0
Custom String : Masking method that exposes the first and last letters and adds a custom padding string in the middle. prefix,[padding],suffix
Box 2: xxx-xxx
Box 3: 5

Reference:

https://docs.microsoft.com/en-us/sql/relational-databases/security/dynamic-data-masking

Reveal Solution Next Question

Free DP-300 Exam Braindumps (page: 42)

QUESTION: 71 Exam Topic: Implement a Secure Environment Questions

Explanation:

Reference:

QUESTION: 72 Exam Topic: Implement a Secure Environment Questions

Explanation:

Reference:

QUESTION: 73 Exam Topic: Implement a Secure Environment Questions

Explanation:

Reference:

QUESTION: 74 Exam Topic: Implement a Secure Environment Questions

Explanation:

Reference: