HOTSPOT (Drag and Drop is not supported)You have an Azure SQL database that contains a table named Customer. Customer has the columns shown in the following table.You plan to implement a dynamic data mask for the Customer_Phone column. The mask must meet the following requirements:The first six numerals of each customer's phone number must be masked.The last four digits of each customer's phone number must be visible.Hyphens must be preserved and displayed.How should you configure the dynamic data mask? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: 0Custom String : Masking method that exposes the first and last letters and adds a custom padding string in the middle. prefix,[padding],suffixBox 2: xxx-xxxBox 3: 5
https://docs.microsoft.com/en-us/sql/relational-databases/security/dynamic-data-masking
DRAG DROP (Drag and Drop is not supported)You have an Azure SQL database that contains a table named Employees. Employees contains a column named Salary.You need to encrypt the Salary column. The solution must prevent database administrators from reading the data in the Salary column and must provide the most secure encryption.Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.Select and Place:
Step 1: Create a column master keyCreate a column master key metadata entry before you create a column encryption key metadata entry in the database and before any column in the database can be encrypted using Always Encrypted.Step 2: Create a column encryption key.Step 3: Encrypt the Salary column by using the randomized encryption type. Randomized encryption uses a method that encrypts data in a less predictable manner. Randomized encryption is more secure, but prevents searching, grouping, indexing, and joining on encrypted columns.Note: A column encryption key metadata object contains one or two encrypted values of a column encryption key that is used to encrypt data in a column. Each value is encrypted using a column master key.Incorrect Answers:Deterministic encryption.Deterministic encryption always generates the same encrypted value for any given plain text value. Using deterministic encryption allows point lookups, equality joins, grouping and indexing on encrypted columns. However, it may also allow unauthorized users to guess information about encrypted values by examining patterns in the encrypted column, especially if there's a small set of possible encrypted values, such as True/ False, or North/South/East/West region.
https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/always-encrypted-database- engine
HOTSPOT (Drag and Drop is not supported)You have an Azure SQL database named DB1 that contains two tables named Table1 and Table2. Both tables contain a column named a Column1. Column1 is used for joins by an application named App1.You need to protect the contents of Column1 at rest, in transit, and in use.How should you protect the contents of Column1? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Column encryption KeyAlways Encrypted uses two types of keys: column encryption keys and column master keys. A column encryption key is used to encrypt data in an encrypted column. A column master key is a key-protecting key that encrypts one or more column encryption keys.Incorrect Answers:TDE encrypts the storage of an entire database by using a symmetric key called the Database Encryption Key (DEK).Box 2: DeterministicAlways Encrypted is a feature designed to protect sensitive data, such as credit card numbers or national identification numbers (for example, U.S. social security numbers), stored in Azure SQL Database or SQL Server databases. Always Encrypted allows clients to encrypt sensitive data inside client applications and never reveal the encryption keys to the Database Engine (SQL Database or SQL Server).Always Encrypted supports two types of encryption: randomized encryption and deterministic encryption. Deterministic encryption always generates the same encrypted value for any given plain text value. Using deterministic encryption allows point lookups, equality joins, grouping and indexing on encrypted columns.Incorrect Answers:Randomized encryption uses a method that encrypts data in a less predictable manner. Randomized encryption is more secure, but prevents searching, grouping, indexing, and joining on encrypted columns. Transparent data encryption (TDE) helps protect Azure SQL Database, Azure SQL Managed Instance, andAzure Synapse Analytics against the threat of malicious offline activity by encrypting data at rest. It performs real-time encryption and decryption of the database, associated backups, and transaction log files at rest without requiring changes to the application.
You have 40 Azure SQL databases, each for a different customer. All the databases reside on the same Azure SQL Database server.You need to ensure that each customer can only connect to and access their respective database.Which two actions should you perform? Each correct answer presents part of the solution.Note: Each correct selection is worth one point.
Answer(s): B,E
E: Generating LoginsLogins are server wide login and password pairs, where the login has the same password across all databases. Here is some sample Transact-SQL that creates a login:CREATE LOGIN readonlylogin WITH password='1231!#ASDF!a';You must be connected to the master database on SQL Azure with the administrative login (which you get from the SQL Azure portal) to execute the CREATE LOGIN command.B: Creating Users.Users are created per database and are associated with logins. You must be connected to the database in where you want to create the user. In most cases, this is not the master database. Here is some sample Transact-SQL that creates a user:CREATE USER readonlyuser FROM LOGIN readonlylogin;Incorrect Answers:Not C: Database-level firewall rules only apply to individual databases. However, we need to create logins and users.Not D: Server-level IP firewall rules apply to all databases within the same server.
https://azure.microsoft.com/en-us/blog/adding-users-to-your-sql-azure-database/
DRAG DROP (Drag and Drop is not supported)You have an Azure SQL Database instance named DatabaseA on a server named Server1.You plan to add a new user named App1 to DatabaseA and grant App1 db_datareader permissions. App1 will use SQL Server Authentication.You need to create App1. The solution must ensure that App1 can be given access to other databases by using the same credentials.Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.Select and Place:
Step 1: On the master database, run CREATE LOGIN [App1] WITH PASSWORD = 'p@aaW0rd!' Logins are server wide login and password pairs, where the login has the same password across all databases. Here is some sample Transact-SQL that creates a login:CREATE LOGIN readonlylogin WITH password='1231!#ASDF!a';You must be connected to the master database on SQL Azure with the administrative login (which you get from the SQL Azure portal) to execute the CREATE LOGIN command.Step 2: On DatabaseA, run CREATE USER [App1] FROM LOGIN [App1] Users are created per database and are associated with logins. You must be connected to the database in where you want to create the user. In most cases, this is not the master database. Here is some sample Transact-SQL that creates a user:CREATE USER readonlyuser FROM LOGIN readonlylogin;Step 3: On DatabaseA run ALTER ROLE db_datareader ADD Member [App1] Just creating the user does not give them permissions to the database. You have to grant them access. In the Transact-SQL example below the readonlyuser is given read only permissions to the database via the db_datareader role.EXEC sp_addrolemember 'db_datareader', 'readonlyuser';
Post your Comments and Discuss Microsoft DP-300 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the DP-300 content, but please register or login to continue.