Exam Bundle

The approved client reaches the database and a separate outside-IP test is rejected by the Azure SQL network access policy. That result is evidence for another corrective change: Replace broad access with the narrow approved client range or private connectivity and remove expired rules after testing. The alternative problem is: A team allows the Azure SQL server-wide firewall rule for every address just to support one temporary developer laptop. The current Keystone BioLabs issue is instead: A security team assumes a service endpoint automatically gives a database a private IP address inside the application's subnet. Its decisive acceptance evidence would be: A client resolves the expected private endpoint DNS chain and reaches the service over the permitted private route.

The authorized private application resolves and connects on permitted ports while a forbidden subnet cannot establish a SQL session. That result is evidence for another corrective change: Configure the managed instance's supported private connectivity, name resolution and narrow network security group access. The alternative problem is: An organization opens all inbound traffic to SQL Managed Instance because internal client DNS and subnet routing were never configured. The current Keystone BioLabs issue is instead: A security team assumes a service endpoint automatically gives a database a private IP address inside the application's subnet. Its decisive acceptance evidence would be: A client resolves the expected private endpoint DNS chain and reaches the service over the permitted private route.

The TDE protector becomes operational and a test key rotation completes without key-access or database-availability errors. That result is evidence for another corrective change: Grant the supported least-privilege key permissions or role assignments for the database encryption protector identity. The alternative problem is: A customer-managed TDE deployment points at an Azure Key Vault key but the SQL service identity lacks the required key operations. The current Keystone BioLabs issue is instead: A security team assumes a service endpoint automatically gives a database a private IP address inside the application's subnet. Its decisive acceptance evidence would be: A client resolves the expected private endpoint DNS chain and reaches the service over the permitted private route.

Configure transparent data encryption with an eligible customer-managed key in Azure Key Vault or managed HSM according to the service rules. That relates to a separate SQL administration problem: A regulated Azure SQL Database uses default platform-managed encryption keys but requires customer-controlled key rotation and revocation evidence. The Keystone BioLabs requirement is instead: An application uses Always Encrypted but stores column master key secrets inside the same plaintext application configuration repository. That approach does not directly establish the required fix; the requested acceptance evidence is: The application decrypts through its authorized key store and the configuration repository contains no recoverable master keys.

Grant the supported least-privilege key permissions or role assignments for the database encryption protector identity. That relates to a separate SQL administration problem: A customer-managed TDE deployment points at an Azure Key Vault key but the SQL service identity lacks the required key operations. The Keystone BioLabs requirement is instead: An application uses Always Encrypted but stores column master key secrets inside the same plaintext application configuration repository. That approach does not directly establish the required fix; the requested acceptance evidence is: The application decrypts through its authorized key store and the configuration repository contains no recoverable master keys.

Replace broad access with the narrow approved client range or private connectivity and remove expired rules after testing. That relates to a separate SQL administration problem: A team allows the Azure SQL server-wide firewall rule for every address just to support one temporary developer laptop. The Keystone BioLabs requirement is instead: An application uses Always Encrypted but stores column master key secrets inside the same plaintext application configuration repository. That approach does not directly establish the required fix; the requested acceptance evidence is: The application decrypts through its authorized key store and the configuration repository contains no recoverable master keys.

A supported query performs the approved confidential operation with enclave attestation while plaintext keys remain outside ordinary engine access. That result is evidence for another corrective change: Evaluate Always Encrypted with secure enclaves and the required hardware, driver and database feature support for the intended computations. The alternative problem is: An application requires supported computations on encrypted database columns but is deployed with Always Encrypted columns without enclave capability. The current Keystone BioLabs issue is instead: An application uses Always Encrypted but stores column master key secrets inside the same plaintext application configuration repository. Its decisive acceptance evidence would be: The application decrypts through its authorized key store and the configuration repository contains no recoverable master keys.

The TDE protector becomes operational and a test key rotation completes without key-access or database-availability errors. That result is evidence for another corrective change: Grant the supported least-privilege key permissions or role assignments for the database encryption protector identity. The alternative problem is: A customer-managed TDE deployment points at an Azure Key Vault key but the SQL service identity lacks the required key operations. The current Keystone BioLabs issue is instead: An application uses Always Encrypted but stores column master key secrets inside the same plaintext application configuration repository. Its decisive acceptance evidence would be: The application decrypts through its authorized key store and the configuration repository contains no recoverable master keys.

The approved client reaches the database and a separate outside-IP test is rejected by the Azure SQL network access policy. That result is evidence for another corrective change: Replace broad access with the narrow approved client range or private connectivity and remove expired rules after testing. The alternative problem is: A team allows the Azure SQL server-wide firewall rule for every address just to support one temporary developer laptop. The current Keystone BioLabs issue is instead: An application uses Always Encrypted but stores column master key secrets inside the same plaintext application configuration repository. Its decisive acceptance evidence would be: The application decrypts through its authorized key store and the configuration repository contains no recoverable master keys.

Distinguish service endpoints from Private Link and select private endpoints when private-address access and public exposure reduction are required. That relates to a separate SQL administration problem: A security team assumes a service endpoint automatically gives a database a private IP address inside the application's subnet. The Riverton Utilities requirement is instead: An application uses Always Encrypted but stores column master key secrets inside the same plaintext application configuration repository. That approach does not directly establish the required fix; the requested acceptance evidence is: The application decrypts through its authorized key store and the configuration repository contains no recoverable master keys.

Replace broad access with the narrow approved client range or private connectivity and remove expired rules after testing. That relates to a separate SQL administration problem: A team allows the Azure SQL server-wide firewall rule for every address just to support one temporary developer laptop. The Riverton Utilities requirement is instead: An application uses Always Encrypted but stores column master key secrets inside the same plaintext application configuration repository. That approach does not directly establish the required fix; the requested acceptance evidence is: The application decrypts through its authorized key store and the configuration repository contains no recoverable master keys.

Grant the supported least-privilege key permissions or role assignments for the database encryption protector identity. That relates to a separate SQL administration problem: A customer-managed TDE deployment points at an Azure Key Vault key but the SQL service identity lacks the required key operations. The Riverton Utilities requirement is instead: An application uses Always Encrypted but stores column master key secrets inside the same plaintext application configuration repository. That approach does not directly establish the required fix; the requested acceptance evidence is: The application decrypts through its authorized key store and the configuration repository contains no recoverable master keys.

A client resolves the expected private endpoint DNS chain and reaches the service over the permitted private route. That result is evidence for another corrective change: Distinguish service endpoints from Private Link and select private endpoints when private-address access and public exposure reduction are required. The alternative problem is: A security team assumes a service endpoint automatically gives a database a private IP address inside the application's subnet. The current Riverton Utilities issue is instead: An application uses Always Encrypted but stores column master key secrets inside the same plaintext application configuration repository. Its decisive acceptance evidence would be: The application decrypts through its authorized key store and the configuration repository contains no recoverable master keys.

A test connection negotiates the required TLS channel and a deliberately noncompliant client connection is denied. That result is evidence for another corrective change: Require supported encrypted SQL connections and validate server certificates and client driver encryption settings. The alternative problem is: An application attempts to connect to Azure SQL by unencrypted TDS because it assumes VPN transport replaces all database-layer TLS requirements. The current Riverton Utilities issue is instead: An application uses Always Encrypted but stores column master key secrets inside the same plaintext application configuration repository. Its decisive acceptance evidence would be: The application decrypts through its authorized key store and the configuration repository contains no recoverable master keys.

The authorized private application resolves and connects on permitted ports while a forbidden subnet cannot establish a SQL session. That result is evidence for another corrective change: Configure the managed instance's supported private connectivity, name resolution and narrow network security group access. The alternative problem is: An organization opens all inbound traffic to SQL Managed Instance because internal client DNS and subnet routing were never configured. The current Riverton Utilities issue is instead: An application uses Always Encrypted but stores column master key secrets inside the same plaintext application configuration repository. Its decisive acceptance evidence would be: The application decrypts through its authorized key store and the configuration repository contains no recoverable master keys.

Grant the supported least-privilege key permissions or role assignments for the database encryption protector identity. That relates to a separate SQL administration problem: A customer-managed TDE deployment points at an Azure Key Vault key but the SQL service identity lacks the required key operations. The Riverton Utilities requirement is instead: A network migration replaces a database's public hostname with a private endpoint but client DNS still resolves the old public address. That approach does not directly establish the required fix; the requested acceptance evidence is: DNS queries from approved clients resolve the private endpoint address and the SQL login succeeds without public routing.

Distinguish service endpoints from Private Link and select private endpoints when private-address access and public exposure reduction are required. That relates to a separate SQL administration problem: A security team assumes a service endpoint automatically gives a database a private IP address inside the application's subnet. The Riverton Utilities requirement is instead: A network migration replaces a database's public hostname with a private endpoint but client DNS still resolves the old public address. That approach does not directly establish the required fix; the requested acceptance evidence is: DNS queries from approved clients resolve the private endpoint address and the SQL login succeeds without public routing.

Evaluate Always Encrypted with secure enclaves and the required hardware, driver and database feature support for the intended computations. That relates to a separate SQL administration problem: An application requires supported computations on encrypted database columns but is deployed with Always Encrypted columns without enclave capability. The Riverton Utilities requirement is instead: A network migration replaces a database's public hostname with a private endpoint but client DNS still resolves the old public address. That approach does not directly establish the required fix; the requested acceptance evidence is: DNS queries from approved clients resolve the private endpoint address and the SQL login succeeds without public routing.

The database reports the intended TDE protector and a controlled key-rotation test completes without application data exposure. That result is evidence for another corrective change: Configure transparent data encryption with an eligible customer-managed key in Azure Key Vault or managed HSM according to the service rules. The alternative problem is: A regulated Azure SQL Database uses default platform-managed encryption keys but requires customer-controlled key rotation and revocation evidence. The current Riverton Utilities issue is instead: A network migration replaces a database's public hostname with a private endpoint but client DNS still resolves the old public address. Its decisive acceptance evidence would be: DNS queries from approved clients resolve the private endpoint address and the SQL login succeeds without public routing.

The authorized private application resolves and connects on permitted ports while a forbidden subnet cannot establish a SQL session. That result is evidence for another corrective change: Configure the managed instance's supported private connectivity, name resolution and narrow network security group access. The alternative problem is: An organization opens all inbound traffic to SQL Managed Instance because internal client DNS and subnet routing were never configured. The current Riverton Utilities issue is instead: A network migration replaces a database's public hostname with a private endpoint but client DNS still resolves the old public address. Its decisive acceptance evidence would be: DNS queries from approved clients resolve the private endpoint address and the SQL login succeeds without public routing.

The TDE protector becomes operational and a test key rotation completes without key-access or database-availability errors. That result is evidence for another corrective change: Grant the supported least-privilege key permissions or role assignments for the database encryption protector identity. The alternative problem is: A customer-managed TDE deployment points at an Azure Key Vault key but the SQL service identity lacks the required key operations. The current Riverton Utilities issue is instead: A network migration replaces a database's public hostname with a private endpoint but client DNS still resolves the old public address. Its decisive acceptance evidence would be: DNS queries from approved clients resolve the private endpoint address and the SQL login succeeds without public routing.

Distinguish service endpoints from Private Link and select private endpoints when private-address access and public exposure reduction are required. That relates to a separate SQL administration problem: A security team assumes a service endpoint automatically gives a database a private IP address inside the application's subnet. The Granite SaaS requirement is instead: A network migration replaces a database's public hostname with a private endpoint but client DNS still resolves the old public address. That approach does not directly establish the required fix; the requested acceptance evidence is: DNS queries from approved clients resolve the private endpoint address and the SQL login succeeds without public routing.

Configure the managed instance's supported private connectivity, name resolution and narrow network security group access. That relates to a separate SQL administration problem: An organization opens all inbound traffic to SQL Managed Instance because internal client DNS and subnet routing were never configured. The Granite SaaS requirement is instead: A network migration replaces a database's public hostname with a private endpoint but client DNS still resolves the old public address. That approach does not directly establish the required fix; the requested acceptance evidence is: DNS queries from approved clients resolve the private endpoint address and the SQL login succeeds without public routing.

Evaluate Always Encrypted with secure enclaves and the required hardware, driver and database feature support for the intended computations. That relates to a separate SQL administration problem: An application requires supported computations on encrypted database columns but is deployed with Always Encrypted columns without enclave capability. The Granite SaaS requirement is instead: A network migration replaces a database's public hostname with a private endpoint but client DNS still resolves the old public address. That approach does not directly establish the required fix; the requested acceptance evidence is: DNS queries from approved clients resolve the private endpoint address and the SQL login succeeds without public routing.

A test connection negotiates the required TLS channel and a deliberately noncompliant client connection is denied. That result is evidence for another corrective change: Require supported encrypted SQL connections and validate server certificates and client driver encryption settings. The alternative problem is: An application attempts to connect to Azure SQL by unencrypted TDS because it assumes VPN transport replaces all database-layer TLS requirements. The current Granite SaaS issue is instead: A network migration replaces a database's public hostname with a private endpoint but client DNS still resolves the old public address. Its decisive acceptance evidence would be: DNS queries from approved clients resolve the private endpoint address and the SQL login succeeds without public routing.

The database reports the intended TDE protector and a controlled key-rotation test completes without application data exposure. That result is evidence for another corrective change: Configure transparent data encryption with an eligible customer-managed key in Azure Key Vault or managed HSM according to the service rules. The alternative problem is: A regulated Azure SQL Database uses default platform-managed encryption keys but requires customer-controlled key rotation and revocation evidence. The current Granite SaaS issue is instead: A network migration replaces a database's public hostname with a private endpoint but client DNS still resolves the old public address. Its decisive acceptance evidence would be: DNS queries from approved clients resolve the private endpoint address and the SQL login succeeds without public routing.

The approved client reaches the database and a separate outside-IP test is rejected by the Azure SQL network access policy. That result is evidence for another corrective change: Replace broad access with the narrow approved client range or private connectivity and remove expired rules after testing. The alternative problem is: A team allows the Azure SQL server-wide firewall rule for every address just to support one temporary developer laptop. The current Granite SaaS issue is instead: A network migration replaces a database's public hostname with a private endpoint but client DNS still resolves the old public address. Its decisive acceptance evidence would be: DNS queries from approved clients resolve the private endpoint address and the SQL login succeeds without public routing.

Select the relevant database audit action groups and retain both the intended identity and permission-change events. That relates to a separate SQL administration problem: A retention requirement needs fine-grained permission change auditing but the configured SQL audit policy records only failed logins. The Maplewood Schools requirement is instead: An enterprise discovers confidential national IDs in database columns but cannot consistently identify or classify sensitive data across databases. That approach does not directly establish the required fix; the requested acceptance evidence is: A classification report lists the intended sensitive columns and a review detects newly introduced unclassified data.

Differentiate temporal history retention from ledger tamper evidence and implement supported ledger verification when required. That relates to a separate SQL administration problem: A compliance analyst mistakes SQL temporal history tables for cryptographically tamper-evident ledger tables and claims immutable proof. The Maplewood Schools requirement is instead: An enterprise discovers confidential national IDs in database columns but cannot consistently identify or classify sensitive data across databases. That approach does not directly establish the required fix; the requested acceptance evidence is: A classification report lists the intended sensitive columns and a review detects newly introduced unclassified data.

Implement row-level security with an appropriate predicate tied to trusted session or identity context. That relates to a separate SQL administration problem: A multi-tenant database returns records from other customers because the application relies only on a WHERE tenant_id clause supplied by the caller. The Maplewood Schools requirement is instead: An enterprise discovers confidential national IDs in database columns but cannot consistently identify or classify sensitive data across databases. That approach does not directly establish the required fix; the requested acceptance evidence is: A classification report lists the intended sensitive columns and a review detects newly introduced unclassified data.

A least-privilege support identity sees the intended masked values and the authorized privileged user sees full values. That result is evidence for another corrective change: Configure suitable dynamic data masking for designated columns while separately enforcing underlying object and row permissions. The alternative problem is: A support operator needs limited display of customer email addresses but current queries show the full address and no masking policy exists. The current Maplewood Schools issue is instead: An enterprise discovers confidential national IDs in database columns but cannot consistently identify or classify sensitive data across databases. Its decisive acceptance evidence would be: A classification report lists the intended sensitive columns and a review detects newly introduced unclassified data.

The new test column receives the required classification label before the approved application release is completed. That result is evidence for another corrective change: Include sensitive-data discovery and schema review in the database deployment and classification workflow. The alternative problem is: A marketing team adds new payment fields that require classification but the annual audit process does not notice schema changes. The current Maplewood Schools issue is instead: An enterprise discovers confidential national IDs in database columns but cannot consistently identify or classify sensitive data across databases. Its decisive acceptance evidence would be: A classification report lists the intended sensitive columns and a review detects newly introduced unclassified data.

A controlled tenant-A session cannot retrieve tenant-B rows even when it submits an unrestricted SELECT query. That result is evidence for another corrective change: Implement row-level security with an appropriate predicate tied to trusted session or identity context. The alternative problem is: A multi-tenant database returns records from other customers because the application relies only on a WHERE tenant_id clause supplied by the caller. The current Maplewood Schools issue is instead: An enterprise discovers confidential national IDs in database columns but cannot consistently identify or classify sensitive data across databases. Its decisive acceptance evidence would be: A classification report lists the intended sensitive columns and a review detects newly introduced unclassified data.