AZ-500 Question 171
Select 2You are a security engineer for a financial organization that needs to store sensitive customer data in an Azure SQL Database. The data must not be publicly exposed on the internet, and your compliance requirement states that any sensitive columns must remain encrypted even if an unauthorized party gains access to the database contents. Which two actions should you take to meet these security requirements?
- A
Enable Transparent Data Encryption (TDE).
- B
Configure Always Encrypted for sensitive columns.
- C
Create a Private Endpoint for the Azure SQL Database.
- D
Enable Azure AD authentication for the SQL Database.
- E
Set up geo-replication for disaster recovery.
Show answer and explanation
Correct answers: B, C
Explanation
To ensure that an Azure SQL Database is not publicly accessible, you should configure a private endpoint, which restricts traffic to your virtual network. To protect sensitive fields beyond at-rest encryption (Transparent Data Encryption), Always Encrypted allows you to encrypt columns so that the data remains protected even if the database is compromised. For more details, refer to official documentation on Azure SQL Database Private Link and Always Encrypted at https://learn.microsoft.com/azure/azure-sql/database/security-overview.
- A. Incorrect.
Although TDE helps encrypt data at rest and is often enabled by default, it does not protect data if an attacker is able to query the database directly or exfiltrate data in unencrypted form. Therefore, by itself, TDE does not meet the requirement of ensuring column-level encryption against unauthorized access to the data content.
- B. Correct.
Always Encrypted provides end-to-end encryption of specific columns, which ensures that sensitive data remains encrypted not only at rest but also in use on the server side. This meets the requirement to keep sensitive columns protected even if someone gains access to the database.
- C. Correct.
Creating a Private Endpoint for the Azure SQL Database ensures that traffic travels over a private IP address in your virtual network, blocking public internet access. This addresses the requirement to eliminate public exposure of the database.
- D. Incorrect.
While enabling Azure AD authentication is a strong security practice, it does not directly address the requirement of preventing public exposure (a Private Endpoint is needed) or ensuring column-level encryption. Azure AD authentication helps enforce role-based access, but by itself does not protect data at rest or in transport beyond normal encryption in transit.
- E. Incorrect.
Geo-replication is useful for high availability and disaster recovery, but it does not specifically help prevent public exposure or enforce additional column-level encryption. It’s more about replicating data to different regions rather than adding security layers.