Exam Bundle

An authorized application decrypts a test value while a database administrator query sees ciphertext rather than plaintext. That result is evidence for another corrective change: Use Always Encrypted for suitable columns with keys managed outside the database engine and supported client-side encryption. The alternative problem is: A team wants an administrator who can run queries to be unable to see highly sensitive column values, but proposes only transparent data encryption. The current Meadowbrook Finance issue is instead: An application requires supported computations on encrypted database columns but is deployed with Always Encrypted columns without enclave capability. Its decisive acceptance evidence would be: A supported query performs the approved confidential operation with enclave attestation while plaintext keys remain outside ordinary engine access.

Only the approved service returns plaintext from the test column and unauthorized SQL readers cannot recover its sensitive values. That result is evidence for another corrective change: Use a suitably governed column or application encryption design with key management and limited decrypt permissions. The alternative problem is: A database stores customer payment tokens in reversible plaintext even though only a small service needs to decrypt selected fields. The current Meadowbrook Finance issue is instead: An application requires supported computations on encrypted database columns but is deployed with Always Encrypted columns without enclave capability. Its decisive acceptance evidence would be: A supported query performs the approved confidential operation with enclave attestation while plaintext keys remain outside ordinary engine access.

DNS queries from approved clients resolve the private endpoint address and the SQL login succeeds without public routing. That result is evidence for another corrective change: Configure the correct private DNS zone linkage or conditional forwarding for the Azure SQL private endpoint hostname. The alternative problem is: A network migration replaces a database's public hostname with a private endpoint but client DNS still resolves the old public address. The current Meadowbrook Finance issue is instead: An application requires supported computations on encrypted database columns but is deployed with Always Encrypted columns without enclave capability. Its decisive acceptance evidence would be: A supported query performs the approved confidential operation with enclave attestation while plaintext keys remain outside ordinary engine access.

Require supported encrypted SQL connections and validate server certificates and client driver encryption settings. That relates to a separate SQL administration problem: An application attempts to connect to Azure SQL by unencrypted TDS because it assumes VPN transport replaces all database-layer TLS requirements. The Alpine Healthcare requirement is instead: An application requires supported computations on encrypted database columns but is deployed with Always Encrypted columns without enclave capability. That approach does not directly establish the required fix; the requested acceptance evidence is: A supported query performs the approved confidential operation with enclave attestation while plaintext keys remain outside ordinary engine access.

Configure the correct private DNS zone linkage or conditional forwarding for the Azure SQL private endpoint hostname. That relates to a separate SQL administration problem: A network migration replaces a database's public hostname with a private endpoint but client DNS still resolves the old public address. The Alpine Healthcare requirement is instead: An application requires supported computations on encrypted database columns but is deployed with Always Encrypted columns without enclave capability. That approach does not directly establish the required fix; the requested acceptance evidence is: A supported query performs the approved confidential operation with enclave attestation while plaintext keys remain outside ordinary engine access.

Configure transparent data encryption with an eligible customer-managed key in Azure Key Vault or managed HSM according to the service rules. That relates to a separate SQL administration problem: A regulated Azure SQL Database uses default platform-managed encryption keys but requires customer-controlled key rotation and revocation evidence. The Alpine Healthcare requirement is instead: An application requires supported computations on encrypted database columns but is deployed with Always Encrypted columns without enclave capability. That approach does not directly establish the required fix; the requested acceptance evidence is: A supported query performs the approved confidential operation with enclave attestation while plaintext keys remain outside ordinary engine access.

The TDE protector becomes operational and a test key rotation completes without key-access or database-availability errors. That result is evidence for another corrective change: Grant the supported least-privilege key permissions or role assignments for the database encryption protector identity. The alternative problem is: A customer-managed TDE deployment points at an Azure Key Vault key but the SQL service identity lacks the required key operations. The current Alpine Healthcare issue is instead: An application requires supported computations on encrypted database columns but is deployed with Always Encrypted columns without enclave capability. Its decisive acceptance evidence would be: A supported query performs the approved confidential operation with enclave attestation while plaintext keys remain outside ordinary engine access.

Only the approved service returns plaintext from the test column and unauthorized SQL readers cannot recover its sensitive values. That result is evidence for another corrective change: Use a suitably governed column or application encryption design with key management and limited decrypt permissions. The alternative problem is: A database stores customer payment tokens in reversible plaintext even though only a small service needs to decrypt selected fields. The current Alpine Healthcare issue is instead: An application requires supported computations on encrypted database columns but is deployed with Always Encrypted columns without enclave capability. Its decisive acceptance evidence would be: A supported query performs the approved confidential operation with enclave attestation while plaintext keys remain outside ordinary engine access.

The database reports the intended TDE protector and a controlled key-rotation test completes without application data exposure. That result is evidence for another corrective change: Configure transparent data encryption with an eligible customer-managed key in Azure Key Vault or managed HSM according to the service rules. The alternative problem is: A regulated Azure SQL Database uses default platform-managed encryption keys but requires customer-controlled key rotation and revocation evidence. The current Alpine Healthcare issue is instead: An application requires supported computations on encrypted database columns but is deployed with Always Encrypted columns without enclave capability. Its decisive acceptance evidence would be: A supported query performs the approved confidential operation with enclave attestation while plaintext keys remain outside ordinary engine access.

Use a suitably governed column or application encryption design with key management and limited decrypt permissions. That relates to a separate SQL administration problem: A database stores customer payment tokens in reversible plaintext even though only a small service needs to decrypt selected fields. The Alpine Healthcare requirement is instead: A customer-managed TDE deployment points at an Azure Key Vault key but the SQL service identity lacks the required key operations. That approach does not directly establish the required fix; the requested acceptance evidence is: The TDE protector becomes operational and a test key rotation completes without key-access or database-availability errors.

Require supported encrypted SQL connections and validate server certificates and client driver encryption settings. That relates to a separate SQL administration problem: An application attempts to connect to Azure SQL by unencrypted TDS because it assumes VPN transport replaces all database-layer TLS requirements. The Alpine Healthcare requirement is instead: A customer-managed TDE deployment points at an Azure Key Vault key but the SQL service identity lacks the required key operations. That approach does not directly establish the required fix; the requested acceptance evidence is: The TDE protector becomes operational and a test key rotation completes without key-access or database-availability errors.

Distinguish service endpoints from Private Link and select private endpoints when private-address access and public exposure reduction are required. That relates to a separate SQL administration problem: A security team assumes a service endpoint automatically gives a database a private IP address inside the application's subnet. The Alpine Healthcare requirement is instead: A customer-managed TDE deployment points at an Azure Key Vault key but the SQL service identity lacks the required key operations. That approach does not directly establish the required fix; the requested acceptance evidence is: The TDE protector becomes operational and a test key rotation completes without key-access or database-availability errors.

A client resolves the expected private endpoint DNS chain and reaches the service over the permitted private route. That result is evidence for another corrective change: Distinguish service endpoints from Private Link and select private endpoints when private-address access and public exposure reduction are required. The alternative problem is: A security team assumes a service endpoint automatically gives a database a private IP address inside the application's subnet. The current Alpine Healthcare issue is instead: A customer-managed TDE deployment points at an Azure Key Vault key but the SQL service identity lacks the required key operations. Its decisive acceptance evidence would be: The TDE protector becomes operational and a test key rotation completes without key-access or database-availability errors.

Only the approved service returns plaintext from the test column and unauthorized SQL readers cannot recover its sensitive values. That result is evidence for another corrective change: Use a suitably governed column or application encryption design with key management and limited decrypt permissions. The alternative problem is: A database stores customer payment tokens in reversible plaintext even though only a small service needs to decrypt selected fields. The current Alpine Healthcare issue is instead: A customer-managed TDE deployment points at an Azure Key Vault key but the SQL service identity lacks the required key operations. Its decisive acceptance evidence would be: The TDE protector becomes operational and a test key rotation completes without key-access or database-availability errors.

The authorized private application resolves and connects on permitted ports while a forbidden subnet cannot establish a SQL session. That result is evidence for another corrective change: Configure the managed instance's supported private connectivity, name resolution and narrow network security group access. The alternative problem is: An organization opens all inbound traffic to SQL Managed Instance because internal client DNS and subnet routing were never configured. The current Alpine Healthcare issue is instead: A customer-managed TDE deployment points at an Azure Key Vault key but the SQL service identity lacks the required key operations. Its decisive acceptance evidence would be: The TDE protector becomes operational and a test key rotation completes without key-access or database-availability errors.

Configure transparent data encryption with an eligible customer-managed key in Azure Key Vault or managed HSM according to the service rules. That relates to a separate SQL administration problem: A regulated Azure SQL Database uses default platform-managed encryption keys but requires customer-controlled key rotation and revocation evidence. The Keystone BioLabs requirement is instead: A customer-managed TDE deployment points at an Azure Key Vault key but the SQL service identity lacks the required key operations. That approach does not directly establish the required fix; the requested acceptance evidence is: The TDE protector becomes operational and a test key rotation completes without key-access or database-availability errors.

Use a suitably governed column or application encryption design with key management and limited decrypt permissions. That relates to a separate SQL administration problem: A database stores customer payment tokens in reversible plaintext even though only a small service needs to decrypt selected fields. The Keystone BioLabs requirement is instead: A customer-managed TDE deployment points at an Azure Key Vault key but the SQL service identity lacks the required key operations. That approach does not directly establish the required fix; the requested acceptance evidence is: The TDE protector becomes operational and a test key rotation completes without key-access or database-availability errors.

Evaluate Always Encrypted with secure enclaves and the required hardware, driver and database feature support for the intended computations. That relates to a separate SQL administration problem: An application requires supported computations on encrypted database columns but is deployed with Always Encrypted columns without enclave capability. The Keystone BioLabs requirement is instead: A customer-managed TDE deployment points at an Azure Key Vault key but the SQL service identity lacks the required key operations. That approach does not directly establish the required fix; the requested acceptance evidence is: The TDE protector becomes operational and a test key rotation completes without key-access or database-availability errors.

Only the approved service returns plaintext from the test column and unauthorized SQL readers cannot recover its sensitive values. That result is evidence for another corrective change: Use a suitably governed column or application encryption design with key management and limited decrypt permissions. The alternative problem is: A database stores customer payment tokens in reversible plaintext even though only a small service needs to decrypt selected fields. The current Keystone BioLabs issue is instead: A customer-managed TDE deployment points at an Azure Key Vault key but the SQL service identity lacks the required key operations. Its decisive acceptance evidence would be: The TDE protector becomes operational and a test key rotation completes without key-access or database-availability errors.

An authorized application decrypts a test value while a database administrator query sees ciphertext rather than plaintext. That result is evidence for another corrective change: Use Always Encrypted for suitable columns with keys managed outside the database engine and supported client-side encryption. The alternative problem is: A team wants an administrator who can run queries to be unable to see highly sensitive column values, but proposes only transparent data encryption. The current Keystone BioLabs issue is instead: A customer-managed TDE deployment points at an Azure Key Vault key but the SQL service identity lacks the required key operations. Its decisive acceptance evidence would be: The TDE protector becomes operational and a test key rotation completes without key-access or database-availability errors.

An approved private client connects using the intended private address and an unapproved external connection fails. That result is evidence for another corrective change: Configure a private endpoint and private DNS with appropriate network rules and disable unnecessary public network access. The alternative problem is: An Azure SQL Database is reachable through a public endpoint from unrestricted networks even though only an internal application subnet should connect. The current Keystone BioLabs issue is instead: A customer-managed TDE deployment points at an Azure Key Vault key but the SQL service identity lacks the required key operations. Its decisive acceptance evidence would be: The TDE protector becomes operational and a test key rotation completes without key-access or database-availability errors.

Use Always Encrypted for suitable columns with keys managed outside the database engine and supported client-side encryption. That relates to a separate SQL administration problem: A team wants an administrator who can run queries to be unable to see highly sensitive column values, but proposes only transparent data encryption. The Keystone BioLabs requirement is instead: An Azure SQL Database is reachable through a public endpoint from unrestricted networks even though only an internal application subnet should connect. That approach does not directly establish the required fix; the requested acceptance evidence is: An approved private client connects using the intended private address and an unapproved external connection fails.

Distinguish service endpoints from Private Link and select private endpoints when private-address access and public exposure reduction are required. That relates to a separate SQL administration problem: A security team assumes a service endpoint automatically gives a database a private IP address inside the application's subnet. The Keystone BioLabs requirement is instead: An Azure SQL Database is reachable through a public endpoint from unrestricted networks even though only an internal application subnet should connect. That approach does not directly establish the required fix; the requested acceptance evidence is: An approved private client connects using the intended private address and an unapproved external connection fails.

Configure the managed instance's supported private connectivity, name resolution and narrow network security group access. That relates to a separate SQL administration problem: An organization opens all inbound traffic to SQL Managed Instance because internal client DNS and subnet routing were never configured. The Keystone BioLabs requirement is instead: An Azure SQL Database is reachable through a public endpoint from unrestricted networks even though only an internal application subnet should connect. That approach does not directly establish the required fix; the requested acceptance evidence is: An approved private client connects using the intended private address and an unapproved external connection fails.

The TDE protector becomes operational and a test key rotation completes without key-access or database-availability errors. That result is evidence for another corrective change: Grant the supported least-privilege key permissions or role assignments for the database encryption protector identity. The alternative problem is: A customer-managed TDE deployment points at an Azure Key Vault key but the SQL service identity lacks the required key operations. The current Keystone BioLabs issue is instead: An Azure SQL Database is reachable through a public endpoint from unrestricted networks even though only an internal application subnet should connect. Its decisive acceptance evidence would be: An approved private client connects using the intended private address and an unapproved external connection fails.

The approved client reaches the database and a separate outside-IP test is rejected by the Azure SQL network access policy. That result is evidence for another corrective change: Replace broad access with the narrow approved client range or private connectivity and remove expired rules after testing. The alternative problem is: A team allows the Azure SQL server-wide firewall rule for every address just to support one temporary developer laptop. The current Keystone BioLabs issue is instead: An Azure SQL Database is reachable through a public endpoint from unrestricted networks even though only an internal application subnet should connect. Its decisive acceptance evidence would be: An approved private client connects using the intended private address and an unapproved external connection fails.

The database reports the intended TDE protector and a controlled key-rotation test completes without application data exposure. That result is evidence for another corrective change: Configure transparent data encryption with an eligible customer-managed key in Azure Key Vault or managed HSM according to the service rules. The alternative problem is: A regulated Azure SQL Database uses default platform-managed encryption keys but requires customer-controlled key rotation and revocation evidence. The current Keystone BioLabs issue is instead: An Azure SQL Database is reachable through a public endpoint from unrestricted networks even though only an internal application subnet should connect. Its decisive acceptance evidence would be: An approved private client connects using the intended private address and an unapproved external connection fails.

Configure the managed instance's supported private connectivity, name resolution and narrow network security group access. That relates to a separate SQL administration problem: An organization opens all inbound traffic to SQL Managed Instance because internal client DNS and subnet routing were never configured. The Riverton Utilities requirement is instead: An Azure SQL Database is reachable through a public endpoint from unrestricted networks even though only an internal application subnet should connect. That approach does not directly establish the required fix; the requested acceptance evidence is: An approved private client connects using the intended private address and an unapproved external connection fails.

Configure transparent data encryption with an eligible customer-managed key in Azure Key Vault or managed HSM according to the service rules. That relates to a separate SQL administration problem: A regulated Azure SQL Database uses default platform-managed encryption keys but requires customer-controlled key rotation and revocation evidence. The Riverton Utilities requirement is instead: An Azure SQL Database is reachable through a public endpoint from unrestricted networks even though only an internal application subnet should connect. That approach does not directly establish the required fix; the requested acceptance evidence is: An approved private client connects using the intended private address and an unapproved external connection fails.

Use a suitably governed column or application encryption design with key management and limited decrypt permissions. That relates to a separate SQL administration problem: A database stores customer payment tokens in reversible plaintext even though only a small service needs to decrypt selected fields. The Riverton Utilities requirement is instead: An Azure SQL Database is reachable through a public endpoint from unrestricted networks even though only an internal application subnet should connect. That approach does not directly establish the required fix; the requested acceptance evidence is: An approved private client connects using the intended private address and an unapproved external connection fails.

A test connection negotiates the required TLS channel and a deliberately noncompliant client connection is denied. That result is evidence for another corrective change: Require supported encrypted SQL connections and validate server certificates and client driver encryption settings. The alternative problem is: An application attempts to connect to Azure SQL by unencrypted TDS because it assumes VPN transport replaces all database-layer TLS requirements. The current Riverton Utilities issue is instead: An Azure SQL Database is reachable through a public endpoint from unrestricted networks even though only an internal application subnet should connect. Its decisive acceptance evidence would be: An approved private client connects using the intended private address and an unapproved external connection fails.

The approved client reaches the database and a separate outside-IP test is rejected by the Azure SQL network access policy. That result is evidence for another corrective change: Replace broad access with the narrow approved client range or private connectivity and remove expired rules after testing. The alternative problem is: A team allows the Azure SQL server-wide firewall rule for every address just to support one temporary developer laptop. The current Riverton Utilities issue is instead: An Azure SQL Database is reachable through a public endpoint from unrestricted networks even though only an internal application subnet should connect. Its decisive acceptance evidence would be: An approved private client connects using the intended private address and an unapproved external connection fails.

DNS queries from approved clients resolve the private endpoint address and the SQL login succeeds without public routing. That result is evidence for another corrective change: Configure the correct private DNS zone linkage or conditional forwarding for the Azure SQL private endpoint hostname. The alternative problem is: A network migration replaces a database's public hostname with a private endpoint but client DNS still resolves the old public address. The current Riverton Utilities issue is instead: An Azure SQL Database is reachable through a public endpoint from unrestricted networks even though only an internal application subnet should connect. Its decisive acceptance evidence would be: An approved private client connects using the intended private address and an unapproved external connection fails.