For data protection durability section, focus on the layered security model often referred to as “defense and depth.” <\/p>\n\n\n\n
Use a layered (defense in depth) approach to data protection.<\/p>\n\n\n\n
We want to start with the network security and you want to understand how vNets, firewalls, network security groups, and private links are used to control and isolate traffic in your data sources. <\/p>\n\n\n\n
Network security: <\/strong><\/p>\n\n\n\n VNet Next, you want to dive in to identity and access. Study the different authentication methods like, the Entra ID, SQL authentication, and Windows authentication. Know how Azure RBAC works; how to assign roles and permissions and how to implement role-level security as well. <\/p>\n\n\n\n Identity and access: <\/strong><\/p>\n\n\n\n Authentication options: Azure AD, SQL Auth, Windows Auth Then move into data protection techniques. You should be familiar with encryption-in-use, which is always encrypted; encryption-at-rest, using things like transparent data encryption; and encryption-in-flight, which uses TLS. Also review how to use user-managed keys for more control over your encryption and how dynamic data masking helps protect your sensitive data. <\/p>\n\n\n\n Data protection: <\/strong><\/p>\n\n\n\n Encryption-in-use (Always encrypted) Design security for data at rest, data in motion, and data in use<\/a><\/p>\n\n\n\n And finally, you’ll want to cover the security management tools. This includes security auditing within SQL, log analytics, vulnerability assessments, data classification, and Microsoft Defender for Cloud. These are going to be important. <\/p>\n\n\n\n Security management:<\/strong><\/p>\n\n\n\n Advanced threat detection So, understanding how these layers work together is going to be a savings for you on your exam in preparation.<\/p>\n\n\n\n Recommend a solution for database availability<\/a><\/p>\n\n\n\n Design for storage security<\/a><\/p>\n\n\n\n
Firewall rules, NSG
Private link<\/p>\n\n\n\n
Azure RBAC
Roles and permissions
Row level security<\/p>\n\n\n\n
Encryption-at-rest (TDE)
Encryption-in-flight (TLS)
User-managed keys
Dynamic data masking<\/p>\n\n\n\n
SQL audit
Audit integration with log analytics and event hubs
Vulnerability assessment
Data discovery and classification
Microsoft Defender for Cloud<\/p>\n\n\n\n