Task 4.3: Design solutions for securing an organization's data

• AAzure Policy that requires a data-classification tag on every storage account and SQL server

  Incorrect

  Tags record what owners declare; they don't discover what data a store actually holds.

• BPurview DLP policies that block financial data in email and SharePoint sharing

  Incorrect

  DLP prevents sensitive data from leaving, but it doesn't label content or show where data sits in the cloud data stores.

• CPurview sensitive information types and trainable classifiers, with auto-labeling for Microsoft 365

  Correct

  Purview classifies Microsoft 365 content and can apply sensitivity labels automatically.

• DMicrosoft cloud security benchmark recommendations in Defender for Cloud for the storage and database resources

  Incorrect

  Benchmark recommendations assess how resources are configured; they don't find which stores hold sensitive data.

• EData security posture management in Defender for Cloud for the Azure and AWS data stores

  Correct

  Defender for Cloud discovers sensitive data in cloud data stores and uses it in risk prioritization and attack paths.

Microsoft Purview identifies sensitive items with sensitive information types and trainable classifiers and can auto-apply sensitivity labels. Data security posture management in Defender for Cloud discovers sensitive data across cloud data stores in Azure, AWS and GCP and uses that context to prioritize risks and attack paths.

• AAlways Encrypted on the ID column, with secure enclaves for the richer queries

  Correct

  Always Encrypted keeps keys on the client so the database engine and its admins never see plaintext; enclaves add pattern matching and comparisons.

• BCustomer-managed keys for TDE

  Incorrect

  TDE with any key decrypts data for the engine, so DBAs still see plaintext.

• CDynamic data masking on the column

  Incorrect

  Masking isn't encryption: the values stay in plaintext inside the database engine, so it can't keep them from the people who run it.

• DRow-level security on the table

  Incorrect

  RLS limits rows, not visibility of a column's values to admins.

Always Encrypted protects sensitive data such as national identification numbers: the client driver encrypts data before sending it to the database engine and decrypts results, so the engine and its administrators don't see plaintext. Always Encrypted with secure enclaves supports pattern matching, comparison operators and in-place encryption. TDE encrypts data at rest only.

• ADefender for Endpoint on the back-office servers only

  Incorrect

  Endpoint scanning happens only after files reach the servers, too late for the pipeline.

• BMalware scanning in Microsoft Defender for Storage, on upload

  Correct

  Defender for Storage scans blobs on upload for malware, with results the processing pipeline can act on.

• CBlob soft delete with 30-day retention

  Incorrect

  Soft delete helps recovery, not malware detection.

• DA storage firewall that blocks all public networks

  Incorrect

  Customers must still upload, and a firewall doesn't scan files.

Microsoft Defender for Storage includes malware scanning, which scans blobs when they're uploaded, without agents, and reports results that can trigger automated responses.

• AEnable infrastructure encryption on the existing accounts next year, after testing it on a few lower-risk accounts first

  Incorrect

  It can't be turned on for an existing account.

• BInfrastructure encryption meets it, but only on new accounts or encryption scopes

  Correct

  Infrastructure encryption can't be enabled after the account exists, so new accounts or scopes are needed.

• CCustomer-managed keys alone provide double encryption

  Incorrect

  CMK changes who controls the service-level key; it doesn't add a second layer.

• DEnable TLS 1.2 to meet the requirement

  Incorrect

  TLS protects data in transit, not at rest.

Infrastructure encryption adds a second layer of encryption for Azure Storage at the infrastructure level with a different algorithm and keys. You must enable it when you create a storage account or encryption scope; it can't be enabled or disabled afterward.

• ARotate the primary key every month

  Incorrect

  Rotation keeps a full-access shared key in use.

• BUse the read-only key for all applications

  Incorrect

  Read-only keys are still shared, not per-application, and some apps need writes.

• CPut a private endpoint on the account and keep the keys, since only applications inside the virtual network could then reach it

  Incorrect

  Network isolation doesn't replace identity-based authorization.

• DData-plane role assignments per app identity, with key-based authentication disabled

  Correct

  Cosmos DB data-plane RBAC with Entra ID gives least privilege, and setting disableLocalAuth stops the keys from working.

Azure Cosmos DB for NoSQL supports Microsoft Entra ID with role-based access control for the data plane. Disabling key-based authentication, by setting disableLocalAuth on the account, requires applications to use Microsoft Entra ID. Key rotation is only a fallback for those still using keys.

• AAlways Encrypted

  Incorrect

  Always Encrypted must be configured per column.

• BDynamic data masking

  Incorrect

  Masking isn't encryption and is configured per column.

• CRow-level security

  Incorrect

  RLS restricts rows, not encryption.

• DTransparent data encryption

  Correct

  TDE is enabled by default for new databases.

Transparent data encryption encrypts Azure SQL Database and Managed Instance data, backups and logs at rest, and is enabled by default for newly created databases.

• AClassify content and apply protection such as encryption

  Correct

  Labels classify and can protect content with encryption and visual markings.

• BBack up labeled files to another region every night

  Incorrect

  Backup isn't a label function.

• CBlock phishing emails

  Incorrect

  That's email protection.

• DPatch Windows devices

  Incorrect

  That's update management.

Sensitivity labels from Microsoft Purview let you classify and protect your organization's data, for example by encrypting content and adding headers, footers or watermarks, while users keep working.

• AYes, it's off by default

  Incorrect

  It's on by default.

• BYes, for the hot access tier only

  Incorrect

  Encryption applies to all tiers.

• COnly when customer-managed keys are used

  Incorrect

  Encryption applies with Microsoft-managed keys too.

• DNo, Azure Storage always encrypts data at rest

  Correct

  Storage service encryption is always on and can't be disabled.

Azure Storage automatically encrypts data when it's persisted to the cloud, using 256-bit AES encryption. Encryption can't be disabled, and keys can be Microsoft-managed or customer-managed.

• AEncrypts the data on disk

  Incorrect

  That's TDE.

• BMasks sensitive values in results for non-privileged users

  Correct

  Masking limits exposure in results; the data itself isn't changed.

• CDeletes sensitive columns after 30 days

  Incorrect

  Masking doesn't delete data.

• DOverwrites the stored values with masked characters

  Incorrect

  Masking applies to query results; the data stored in the database isn't changed.

Dynamic data masking limits sensitive data exposure by masking it to non-privileged users in query results, according to masking rules that you define on designated columns. It doesn't change the data in the database.