Exam DP-201 topic 3 question 18 discussion

ACE D - is for finding the vulnerability. Question is not for finding the vulnerability but identify the sensitive data and monitor the access.

correct answer - ACE , I believe

ACD Reference Whizlabs Course.

I would go for ACE https://docs.microsoft.com/en-us/azure/azure-sql/database/data-discovery-and-classification-overview https://docs.microsoft.com/en-us/azure/azure-sql/database/threat-detection-overview

https://docs.microsoft.com/en-us/learn/modules/secure-your-azure-sql-database/5-monitor-your-database Data discovery & classification (currently in preview)

ACE is correct answer

**Correct Answer** A. Enable Data Discovery and Classification C. Enable Auditing E. Use Advanced Threat Protection.

ACE A) reporting the sensitive data in your databases + monitoring (auditing) and alerting on anomalous access to sensitive data. https://docs.microsoft.com/en-us/azure/azure-sql/database/data-discovery-and-classification-overview C) Clicking View dashboard at the top of the Audit records page will open a dashboard displaying audit logs info, where you can drill down into Security Insights, Access to Sensitive Data and more. https://docs.microsoft.com/en-us/azure/azure-sql/database/auditing-overview E) detects anomalous activities indicating unusual and potentially harmful attempts to access or exploit databases. https://docs.microsoft.com/en-us/azure/azure-sql/database/threat-detection-overview

ACE: https://docs.microsoft.com/en-us/learn/modules/secure-your-azure-sql-database/5-monitor-your-database

vulnerability assessment can't be the right choice here, Vulnerability assessment is manual check and it doesn't integrate with monitor. ACE is the best choice here.

I think it's ACE. A) for identify sensitive data, C) Threat Detection requires Auditing (see link), and E) - ATP should meet the monitor access to the sensitive data. (C) - https://docs.microsoft.com/en-us/azure/azure-sql/database/threat-detection-overview#overview. The issue is when you read about "Vulnerability Assessment", it seems to encapsulate A & E. The key is 'Run' Vulnerability Assessment, instead of 'Enable' or 'Use' <X>. The run VA seems to be a once of to get reports, where as the requirement is constant and live.

A, D, E https://docs.microsoft.com/en-us/azure/azure-sql/database/data-discovery-and-classification-overview

Vulnerability Assessment is a scanning service built into Azure SQL Database. The service employs a knowledge base of rules that flag security vulnerabilities. It highlights deviations from best practices, such as misconfigurations, excessive permissions, and unprotected sensitive data. https://docs.microsoft.com/en-us/azure/sql-database/sql-vulnerability-assessment

"You need to identify sensitive data that is stored in the database and monitor access to the data" this should be A, Discovery and Classification. ADE

but Data Discovery & Classification introduces a new tool built into SQL Server Management Studio (SSMS) for discovering, classifying, labeling & reporting the sensitive data in your databases.