Exam Bundle

A supported query performs the approved confidential operation with enclave attestation while plaintext keys remain outside ordinary engine access. That result is evidence for another corrective change: Evaluate Always Encrypted with secure enclaves and the required hardware, driver and database feature support for the intended computations. The alternative problem is: An application requires supported computations on encrypted database columns but is deployed with Always Encrypted columns without enclave capability. The current Oakridge Public Services issue is instead: A database stores customer payment tokens in reversible plaintext even though only a small service needs to decrypt selected fields. Its decisive acceptance evidence would be: Only the approved service returns plaintext from the test column and unauthorized SQL readers cannot recover its sensitive values.

The approved client reaches the database and a separate outside-IP test is rejected by the Azure SQL network access policy. That result is evidence for another corrective change: Replace broad access with the narrow approved client range or private connectivity and remove expired rules after testing. The alternative problem is: A team allows the Azure SQL server-wide firewall rule for every address just to support one temporary developer laptop. The current Oakridge Public Services issue is instead: A database stores customer payment tokens in reversible plaintext even though only a small service needs to decrypt selected fields. Its decisive acceptance evidence would be: Only the approved service returns plaintext from the test column and unauthorized SQL readers cannot recover its sensitive values.

An authorized application decrypts a test value while a database administrator query sees ciphertext rather than plaintext. That result is evidence for another corrective change: Use Always Encrypted for suitable columns with keys managed outside the database engine and supported client-side encryption. The alternative problem is: A team wants an administrator who can run queries to be unable to see highly sensitive column values, but proposes only transparent data encryption. The current Oakridge Public Services issue is instead: A database stores customer payment tokens in reversible plaintext even though only a small service needs to decrypt selected fields. Its decisive acceptance evidence would be: Only the approved service returns plaintext from the test column and unauthorized SQL readers cannot recover its sensitive values.

Use Always Encrypted for suitable columns with keys managed outside the database engine and supported client-side encryption. That relates to a separate SQL administration problem: A team wants an administrator who can run queries to be unable to see highly sensitive column values, but proposes only transparent data encryption. The Meadowbrook Finance requirement is instead: A database stores customer payment tokens in reversible plaintext even though only a small service needs to decrypt selected fields. That approach does not directly establish the required fix; the requested acceptance evidence is: Only the approved service returns plaintext from the test column and unauthorized SQL readers cannot recover its sensitive values.

Configure transparent data encryption with an eligible customer-managed key in Azure Key Vault or managed HSM according to the service rules. That relates to a separate SQL administration problem: A regulated Azure SQL Database uses default platform-managed encryption keys but requires customer-controlled key rotation and revocation evidence. The Meadowbrook Finance requirement is instead: A database stores customer payment tokens in reversible plaintext even though only a small service needs to decrypt selected fields. That approach does not directly establish the required fix; the requested acceptance evidence is: Only the approved service returns plaintext from the test column and unauthorized SQL readers cannot recover its sensitive values.

Configure a private endpoint and private DNS with appropriate network rules and disable unnecessary public network access. That relates to a separate SQL administration problem: An Azure SQL Database is reachable through a public endpoint from unrestricted networks even though only an internal application subnet should connect. The Meadowbrook Finance requirement is instead: A database stores customer payment tokens in reversible plaintext even though only a small service needs to decrypt selected fields. That approach does not directly establish the required fix; the requested acceptance evidence is: Only the approved service returns plaintext from the test column and unauthorized SQL readers cannot recover its sensitive values.

The approved client reaches the database and a separate outside-IP test is rejected by the Azure SQL network access policy. That result is evidence for another corrective change: Replace broad access with the narrow approved client range or private connectivity and remove expired rules after testing. The alternative problem is: A team allows the Azure SQL server-wide firewall rule for every address just to support one temporary developer laptop. The current Meadowbrook Finance issue is instead: A database stores customer payment tokens in reversible plaintext even though only a small service needs to decrypt selected fields. Its decisive acceptance evidence would be: Only the approved service returns plaintext from the test column and unauthorized SQL readers cannot recover its sensitive values.

A test connection negotiates the required TLS channel and a deliberately noncompliant client connection is denied. That result is evidence for another corrective change: Require supported encrypted SQL connections and validate server certificates and client driver encryption settings. The alternative problem is: An application attempts to connect to Azure SQL by unencrypted TDS because it assumes VPN transport replaces all database-layer TLS requirements. The current Meadowbrook Finance issue is instead: A database stores customer payment tokens in reversible plaintext even though only a small service needs to decrypt selected fields. Its decisive acceptance evidence would be: Only the approved service returns plaintext from the test column and unauthorized SQL readers cannot recover its sensitive values.

An authorized application decrypts a test value while a database administrator query sees ciphertext rather than plaintext. That result is evidence for another corrective change: Use Always Encrypted for suitable columns with keys managed outside the database engine and supported client-side encryption. The alternative problem is: A team wants an administrator who can run queries to be unable to see highly sensitive column values, but proposes only transparent data encryption. The current Meadowbrook Finance issue is instead: A database stores customer payment tokens in reversible plaintext even though only a small service needs to decrypt selected fields. Its decisive acceptance evidence would be: Only the approved service returns plaintext from the test column and unauthorized SQL readers cannot recover its sensitive values.

Replace broad access with the narrow approved client range or private connectivity and remove expired rules after testing. That relates to a separate SQL administration problem: A team allows the Azure SQL server-wide firewall rule for every address just to support one temporary developer laptop. The Meadowbrook Finance requirement is instead: An organization opens all inbound traffic to SQL Managed Instance because internal client DNS and subnet routing were never configured. That approach does not directly establish the required fix; the requested acceptance evidence is: The authorized private application resolves and connects on permitted ports while a forbidden subnet cannot establish a SQL session.

Require supported encrypted SQL connections and validate server certificates and client driver encryption settings. That relates to a separate SQL administration problem: An application attempts to connect to Azure SQL by unencrypted TDS because it assumes VPN transport replaces all database-layer TLS requirements. The Meadowbrook Finance requirement is instead: An organization opens all inbound traffic to SQL Managed Instance because internal client DNS and subnet routing were never configured. That approach does not directly establish the required fix; the requested acceptance evidence is: The authorized private application resolves and connects on permitted ports while a forbidden subnet cannot establish a SQL session.

Use Always Encrypted for suitable columns with keys managed outside the database engine and supported client-side encryption. That relates to a separate SQL administration problem: A team wants an administrator who can run queries to be unable to see highly sensitive column values, but proposes only transparent data encryption. The Meadowbrook Finance requirement is instead: An organization opens all inbound traffic to SQL Managed Instance because internal client DNS and subnet routing were never configured. That approach does not directly establish the required fix; the requested acceptance evidence is: The authorized private application resolves and connects on permitted ports while a forbidden subnet cannot establish a SQL session.

A supported query performs the approved confidential operation with enclave attestation while plaintext keys remain outside ordinary engine access. That result is evidence for another corrective change: Evaluate Always Encrypted with secure enclaves and the required hardware, driver and database feature support for the intended computations. The alternative problem is: An application requires supported computations on encrypted database columns but is deployed with Always Encrypted columns without enclave capability. The current Meadowbrook Finance issue is instead: An organization opens all inbound traffic to SQL Managed Instance because internal client DNS and subnet routing were never configured. Its decisive acceptance evidence would be: The authorized private application resolves and connects on permitted ports while a forbidden subnet cannot establish a SQL session.

The application decrypts through its authorized key store and the configuration repository contains no recoverable master keys. That result is evidence for another corrective change: Move encryption key material to a supported external key store and apply controlled identity access and rotation procedures. The alternative problem is: An application uses Always Encrypted but stores column master key secrets inside the same plaintext application configuration repository. The current Meadowbrook Finance issue is instead: An organization opens all inbound traffic to SQL Managed Instance because internal client DNS and subnet routing were never configured. Its decisive acceptance evidence would be: The authorized private application resolves and connects on permitted ports while a forbidden subnet cannot establish a SQL session.

An approved private client connects using the intended private address and an unapproved external connection fails. That result is evidence for another corrective change: Configure a private endpoint and private DNS with appropriate network rules and disable unnecessary public network access. The alternative problem is: An Azure SQL Database is reachable through a public endpoint from unrestricted networks even though only an internal application subnet should connect. The current Meadowbrook Finance issue is instead: An organization opens all inbound traffic to SQL Managed Instance because internal client DNS and subnet routing were never configured. Its decisive acceptance evidence would be: The authorized private application resolves and connects on permitted ports while a forbidden subnet cannot establish a SQL session.

Distinguish service endpoints from Private Link and select private endpoints when private-address access and public exposure reduction are required. That relates to a separate SQL administration problem: A security team assumes a service endpoint automatically gives a database a private IP address inside the application's subnet. The Alpine Healthcare requirement is instead: An organization opens all inbound traffic to SQL Managed Instance because internal client DNS and subnet routing were never configured. That approach does not directly establish the required fix; the requested acceptance evidence is: The authorized private application resolves and connects on permitted ports while a forbidden subnet cannot establish a SQL session.

Replace broad access with the narrow approved client range or private connectivity and remove expired rules after testing. That relates to a separate SQL administration problem: A team allows the Azure SQL server-wide firewall rule for every address just to support one temporary developer laptop. The Alpine Healthcare requirement is instead: An organization opens all inbound traffic to SQL Managed Instance because internal client DNS and subnet routing were never configured. That approach does not directly establish the required fix; the requested acceptance evidence is: The authorized private application resolves and connects on permitted ports while a forbidden subnet cannot establish a SQL session.

Use Always Encrypted for suitable columns with keys managed outside the database engine and supported client-side encryption. That relates to a separate SQL administration problem: A team wants an administrator who can run queries to be unable to see highly sensitive column values, but proposes only transparent data encryption. The Alpine Healthcare requirement is instead: An organization opens all inbound traffic to SQL Managed Instance because internal client DNS and subnet routing were never configured. That approach does not directly establish the required fix; the requested acceptance evidence is: The authorized private application resolves and connects on permitted ports while a forbidden subnet cannot establish a SQL session.

The TDE protector becomes operational and a test key rotation completes without key-access or database-availability errors. That result is evidence for another corrective change: Grant the supported least-privilege key permissions or role assignments for the database encryption protector identity. The alternative problem is: A customer-managed TDE deployment points at an Azure Key Vault key but the SQL service identity lacks the required key operations. The current Alpine Healthcare issue is instead: An organization opens all inbound traffic to SQL Managed Instance because internal client DNS and subnet routing were never configured. Its decisive acceptance evidence would be: The authorized private application resolves and connects on permitted ports while a forbidden subnet cannot establish a SQL session.

DNS queries from approved clients resolve the private endpoint address and the SQL login succeeds without public routing. That result is evidence for another corrective change: Configure the correct private DNS zone linkage or conditional forwarding for the Azure SQL private endpoint hostname. The alternative problem is: A network migration replaces a database's public hostname with a private endpoint but client DNS still resolves the old public address. The current Alpine Healthcare issue is instead: An organization opens all inbound traffic to SQL Managed Instance because internal client DNS and subnet routing were never configured. Its decisive acceptance evidence would be: The authorized private application resolves and connects on permitted ports while a forbidden subnet cannot establish a SQL session.

The database reports the intended TDE protector and a controlled key-rotation test completes without application data exposure. That result is evidence for another corrective change: Configure transparent data encryption with an eligible customer-managed key in Azure Key Vault or managed HSM according to the service rules. The alternative problem is: A regulated Azure SQL Database uses default platform-managed encryption keys but requires customer-controlled key rotation and revocation evidence. The current Alpine Healthcare issue is instead: An organization opens all inbound traffic to SQL Managed Instance because internal client DNS and subnet routing were never configured. Its decisive acceptance evidence would be: The authorized private application resolves and connects on permitted ports while a forbidden subnet cannot establish a SQL session.

Require supported encrypted SQL connections and validate server certificates and client driver encryption settings. That relates to a separate SQL administration problem: An application attempts to connect to Azure SQL by unencrypted TDS because it assumes VPN transport replaces all database-layer TLS requirements. The Alpine Healthcare requirement is instead: A security team assumes a service endpoint automatically gives a database a private IP address inside the application's subnet. That approach does not directly establish the required fix; the requested acceptance evidence is: A client resolves the expected private endpoint DNS chain and reaches the service over the permitted private route.

Configure the correct private DNS zone linkage or conditional forwarding for the Azure SQL private endpoint hostname. That relates to a separate SQL administration problem: A network migration replaces a database's public hostname with a private endpoint but client DNS still resolves the old public address. The Alpine Healthcare requirement is instead: A security team assumes a service endpoint automatically gives a database a private IP address inside the application's subnet. That approach does not directly establish the required fix; the requested acceptance evidence is: A client resolves the expected private endpoint DNS chain and reaches the service over the permitted private route.

Configure the managed instance's supported private connectivity, name resolution and narrow network security group access. That relates to a separate SQL administration problem: An organization opens all inbound traffic to SQL Managed Instance because internal client DNS and subnet routing were never configured. The Alpine Healthcare requirement is instead: A security team assumes a service endpoint automatically gives a database a private IP address inside the application's subnet. That approach does not directly establish the required fix; the requested acceptance evidence is: A client resolves the expected private endpoint DNS chain and reaches the service over the permitted private route.

A supported query performs the approved confidential operation with enclave attestation while plaintext keys remain outside ordinary engine access. That result is evidence for another corrective change: Evaluate Always Encrypted with secure enclaves and the required hardware, driver and database feature support for the intended computations. The alternative problem is: An application requires supported computations on encrypted database columns but is deployed with Always Encrypted columns without enclave capability. The current Alpine Healthcare issue is instead: A security team assumes a service endpoint automatically gives a database a private IP address inside the application's subnet. Its decisive acceptance evidence would be: A client resolves the expected private endpoint DNS chain and reaches the service over the permitted private route.

Only the approved service returns plaintext from the test column and unauthorized SQL readers cannot recover its sensitive values. That result is evidence for another corrective change: Use a suitably governed column or application encryption design with key management and limited decrypt permissions. The alternative problem is: A database stores customer payment tokens in reversible plaintext even though only a small service needs to decrypt selected fields. The current Alpine Healthcare issue is instead: A security team assumes a service endpoint automatically gives a database a private IP address inside the application's subnet. Its decisive acceptance evidence would be: A client resolves the expected private endpoint DNS chain and reaches the service over the permitted private route.

An approved private client connects using the intended private address and an unapproved external connection fails. That result is evidence for another corrective change: Configure a private endpoint and private DNS with appropriate network rules and disable unnecessary public network access. The alternative problem is: An Azure SQL Database is reachable through a public endpoint from unrestricted networks even though only an internal application subnet should connect. The current Alpine Healthcare issue is instead: A security team assumes a service endpoint automatically gives a database a private IP address inside the application's subnet. Its decisive acceptance evidence would be: A client resolves the expected private endpoint DNS chain and reaches the service over the permitted private route.

Use Always Encrypted for suitable columns with keys managed outside the database engine and supported client-side encryption. That relates to a separate SQL administration problem: A team wants an administrator who can run queries to be unable to see highly sensitive column values, but proposes only transparent data encryption. The Keystone BioLabs requirement is instead: A security team assumes a service endpoint automatically gives a database a private IP address inside the application's subnet. That approach does not directly establish the required fix; the requested acceptance evidence is: A client resolves the expected private endpoint DNS chain and reaches the service over the permitted private route.

Configure the correct private DNS zone linkage or conditional forwarding for the Azure SQL private endpoint hostname. That relates to a separate SQL administration problem: A network migration replaces a database's public hostname with a private endpoint but client DNS still resolves the old public address. The Keystone BioLabs requirement is instead: A security team assumes a service endpoint automatically gives a database a private IP address inside the application's subnet. That approach does not directly establish the required fix; the requested acceptance evidence is: A client resolves the expected private endpoint DNS chain and reaches the service over the permitted private route.

Replace broad access with the narrow approved client range or private connectivity and remove expired rules after testing. That relates to a separate SQL administration problem: A team allows the Azure SQL server-wide firewall rule for every address just to support one temporary developer laptop. The Keystone BioLabs requirement is instead: A security team assumes a service endpoint automatically gives a database a private IP address inside the application's subnet. That approach does not directly establish the required fix; the requested acceptance evidence is: A client resolves the expected private endpoint DNS chain and reaches the service over the permitted private route.

The approved client reaches the database and a separate outside-IP test is rejected by the Azure SQL network access policy. That result is evidence for another corrective change: Replace broad access with the narrow approved client range or private connectivity and remove expired rules after testing. The alternative problem is: A team allows the Azure SQL server-wide firewall rule for every address just to support one temporary developer laptop. The current Keystone BioLabs issue is instead: A security team assumes a service endpoint automatically gives a database a private IP address inside the application's subnet. Its decisive acceptance evidence would be: A client resolves the expected private endpoint DNS chain and reaches the service over the permitted private route.

The authorized private application resolves and connects on permitted ports while a forbidden subnet cannot establish a SQL session. That result is evidence for another corrective change: Configure the managed instance's supported private connectivity, name resolution and narrow network security group access. The alternative problem is: An organization opens all inbound traffic to SQL Managed Instance because internal client DNS and subnet routing were never configured. The current Keystone BioLabs issue is instead: A security team assumes a service endpoint automatically gives a database a private IP address inside the application's subnet. Its decisive acceptance evidence would be: A client resolves the expected private endpoint DNS chain and reaches the service over the permitted private route.

The TDE protector becomes operational and a test key rotation completes without key-access or database-availability errors. That result is evidence for another corrective change: Grant the supported least-privilege key permissions or role assignments for the database encryption protector identity. The alternative problem is: A customer-managed TDE deployment points at an Azure Key Vault key but the SQL service identity lacks the required key operations. The current Keystone BioLabs issue is instead: A security team assumes a service endpoint automatically gives a database a private IP address inside the application's subnet. Its decisive acceptance evidence would be: A client resolves the expected private endpoint DNS chain and reaches the service over the permitted private route.