6.3.3. Compute, Storage, and Database Questions

Question 7

An external vendor needs to upload files to a specific blob container for 5 days. The vendor runs applications on-premises.

What should you provide?

• A. Storage account access key
• B. Account SAS with 5-day expiry
• C. Service SAS with 5-day expiry
• D. User Delegation SAS with 5-day expiry

Answer: C

Explanation: Service SAS is scoped to a single container/blob (least privilege). Account SAS provides broader access than needed. User Delegation SAS requires Azure AD authentication, which on-premises apps can't use directly. Access keys never expire and provide full access.

Question 8

You need to mask credit card numbers in query results so support staff see "XXXX-XXXX-XXXX-1234" while the Finance team sees the full number.

What should you configure?

• A. Dynamic Data Masking with default() function; grant UNMASK to Finance
• B. Dynamic Data Masking with partial(0,"XXXX-XXXX-XXXX-",4); grant UNMASK to Finance
• C. Always Encrypted with deterministic encryption
• D. TDE with customer-managed keys

Answer: B

Explanation: partial() function shows the last 4 digits, which is the industry standard for credit cards. default() would hide all digits. UNMASK permission allows Finance to see full values. Always Encrypted and TDE don't support partial masking.

Question 9

You need to ensure that database administrators cannot view sensitive column data, even when they have full database access.

Which feature should you implement?

• A. Transparent Data Encryption (TDE)
• B. Dynamic Data Masking
• C. Always Encrypted
• D. Row-Level Security

Answer: C

Explanation: Always Encrypted keeps encryption keys on the client—the database server (and DBAs) never sees plaintext. TDE encrypts at rest but decryption is transparent to DBAs. Dynamic Data Masking can be bypassed by DBAs. Row-Level Security filters rows, not columns.