SQL

Question 1

All Azure SQL Servers and Databases are encrypted using:

Answer 1

Transparent Data Encryption (TDE)
-SQL columns are encrypted through using AlwaysEncrypted
TDE allows for the confiruration of BYOK scenarioes through integration with Azure Key Vault. BYOK is enabled in TDE configuration of Azure SQL Server

Question 2

AlwaysEncrypted

Answer 2

-designed to protect sensitive data stored in specific database columns from access.
-this includes database columns or other privileged users who are authorized to access the database to perform management tasks, but have no business need to access the particular data in the encrypted columns
-To used AlwaysEncrypted you need to use either Windows certificate store or an Azur Key Vault to store the Master key!

Question 3

Column Encrypted Key

Answer 3

used to encrypt data in an encrypted column

Question 4

Column Master Key

Answer 4

a key protecting key that encrypted one or more column encrypted keys

Question 5

As part of an Azure SQL Database AlwaysEncrypted configuration where are the encryption keys stored?

Answer 5

Column Master Key: Azure Key Vault

Column Encryption Key: SQL

Question 6

Your company wants to use Azure AD identities and secure a connection of a Azure web app and Azure SQL database. Steps include:

Answer 6

1. In Azure SQL database, create contained users
2. In Azure AD create a system assigned managed identity for Web app
3. Connect to database using SQL Server Management Studio

Question 7

What are three advanced data security capabilities of Azure SQL Database?

Answer 7

-Vulnerability assessment
-Data Classification
Advanced Threat Protection

Question 8

SQL Advanced Threat Protection will alert on the following:

Answer 8

-“password’ OR 1=1” enter into a password field is an attempted at SQL Injection
-Login from an unusual location or Azure region
Login by an unfamiliar principle
-Access from a potentially harmful application
-Brute force attempt on SQL Authentication

Question 9

If you wanted to secure a Web app against SQL injection you would deploy:

Answer 9

Azure Application Gateway with Application Firewal;

Question 10

For every contained users relative to An Azure AD users, you can:

Answer 10

Log into the database using either Action Directory Universal with MFA or Active Directory passwor