You are designing a security model for an Azure Synapse Analytics dedicated SQL pool that will support multiple companies.You need to ensure that users from each company can view only the data of their respective company.Which two objects should you include in the solution? Each correct answer presents part of the solution.Note: Each correct selection is worth one point.
Answer(s): C,E
Row-Level Security (RLS) simplifies the design and coding of security in your application. RLS helps you implement restrictions on data row access. For example, you can ensure that workers access only those data rows that are pertinent to their department. Another example is to restrict customers' data access to only the data relevant to their company.Implement RLS by using the CREATE SECURITY POLICYTransact-SQL statement, and predicates created as inline table-valued functions.
https://docs.microsoft.com/en-us/sql/relational-databases/security/row-level-security
You have an Azure subscription that contains an Azure Data Factory version 2 (V2) data factory named df1.DF1 contains a linked service.You have an Azure Key vault named vault1 that contains an encryption kay named key1.You need to encrypt df1 by using key1.What should you do first?
Answer(s): B
A customer-managed key can only be configured on an empty data Factory. The data factory can't contain any resources such as linked services, pipelines and data flows. It is recommended to enable customer-managed key right after factory creation.Note: Azure Data Factory encrypts data at rest, including entity definitions and any data cached while runs are in progress. By default, data is encrypted with a randomly generated Microsoft-managed key that is uniquely assigned to your data factory.Incorrect Answers:A, D: Should enable Soft Delete and Do Not Purge on Azure Key Vault.Using customer-managed keys with Data Factory requires two properties to be set on the Key Vault, Soft Delete and Do Not Purge. These properties can be enabled using either PowerShell or Azure CLI on a new or existing key vault.
https://docs.microsoft.com/en-us/azure/data-factory/enable-customer-managed-key
You have an Azure subscription that contains a server named Server1. Server1 hosts two Azure SQL databases named DB1 and DB2.You plan to deploy a Windows app named App1 that will authenticate to DB2 by using SQL authentication.You need to ensure that App1 can access DB2. The solution must meet the following requirements:App1 must be able to view only DB2.Administrative effort must be minimized.What should you create?
Answer(s): A
Use contained database users to authenticate SQL Server and SQL Database connections at the database level. A contained database is a database that is isolated from other databases and from the instance of SQL Server/ SQL Database (and the master database) that hosts the database. SQL Server supports contained database users for both Windows and SQL Server authentication.
https://docs.microsoft.com/en-us/sql/relational-databases/security/contained-database-users-making-your- database-portable?view=sql-server-ver15
You create five Azure SQL Database instances on the same logical server.In each database, you create a user for a Microsoft Entra user named User1.User1 attempts to connect to the logical server by using Azure Data Studio and receives a login error.You need to ensure that when User1 connects to the logical server by using Azure Data Studio, User1 can see all the databases.What should you do?
Logins and users: A user account in a database can be associated with a login that is stored in the master database or can be a user name that is stored in an individual database.A login is an individual account in the master database, to which a user account in one or more databases can be linked. With a login, the credential information for the user account is stored with the login.A user account is an individual account in any database that may be, but does not have to be, linked to a login.With a user account that is not linked to a login, the credential information is stored with the user account.
https://docs.microsoft.com/en-us/azure/azure-sql/database/logins-create-manage
You have an Azure virtual machine named VM1 on a virtual network named VNet1. Outbound traffic from VM1 to the internet is blocked.You have an Azure SQL database named SqlDb1 on a logical server named SqlSrv1.You need to implement connectivity between VM1 and SqlDb1 to meet the following requirements:Ensure that VM1 cannot connect to any Azure SQL Server other than SqlSrv1.Restrict network connectivity to SqlSrv1.What should you create on VNet1?
Answer(s): C
A private endpoint is a network interface that uses a private IP address from your virtual network. This network interface connects you privately and securely to a service powered by Azure Private Link. By enabling a private endpoint, you're bringing the service into your virtual network.The service could be an Azure service such as:Azure StorageAzure Cosmos DBAzure SQL DatabaseYour own service using a Private Link Service.
https://docs.microsoft.com/en-us/azure/private-link/private-endpoint-overview
Post your Comments and Discuss Microsoft DP-300 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the DP-300 content, but please register or login to continue.