Microsoft Certified: Azure Security Engineer AssociateSecure data and applicationsMedium
A compliance officer needs to ensure that all Azure SQL Databases are configured to automatically identify and report potential database vulnerabilities, such as misconfigurations, excessive permissions, and unencrypted sensitive data. The solution must also provide actionable steps to remediate these findings. Which Azure security feature should be enabled on the SQL Databases?
- ADynamic Data Masking (DDM)
- BAzure Security Center (Free tier)
- CAzure SQL Database Auditing
- DSQL Vulnerability Assessment (part of Microsoft Defender for Cloud)
Show answer & explanationAnswer & explanation
Correct answer: D. SQL Vulnerability Assessment (part of Microsoft Defender for Cloud)
SQL Vulnerability Assessment, which is a component of Microsoft Defender for Cloud (formerly Azure Security Center Standard tier), specifically scans SQL databases for security misconfigurations and vulnerabilities, providing actionable recommendations for remediation.
Why the other options are wrong
- A. DDM obscures sensitive data in query results for non-privileged users but does not identify underlying database vulnerabilities or misconfigurations.
- B. Azure Security Center (Free tier) provides basic security posture management but lacks the detailed vulnerability assessment for SQL databases.
- C. SQL Database Auditing records events in the database but does not proactively identify vulnerabilities or provide remediation steps.
SQL Vulnerability Assessment
A service that provides an easy-to-configure solution that can discover, track, and remediate potential database vulnerabilities. It runs scans, identifies security misconfigurations, and makes recommendations for improving the security posture of Azure SQL Databases.
- Continuously scans for security misconfigurations and vulnerabilities.
- Identifies excessive permissions and sensitive data exposure.
- Provides actionable remediation steps and compliance tracking.
Memory trick: SQL VA: the database's security check-up with a to-do list.