What's changed: Created DP-420 Chapter 5, completing the textbook (Domain 5: monitoring (Normalized RU Consumption hot-partition detection/status codes 429-449-503-408/server-side latency/Azure Monitor alerts/resource logs diagnostic settings→Log Analytics/cross-partition monitoring); backup and restore (periodic vs continuous/PITR/restore point/restore into a new account); security, data movement, DevOps (service-managed vs CMK Key Vault/Private Endpoint-IP-VNet/control-plane Azure RBAC-data-plane Entra ID RBAC/Always Encrypted/CORS/data movement ADF-Spark-Kafka-Stream Analytics-IoT Hub/DevOps declarative ARM-imperative PowerShell-CLI standard↔autoscale-failover)).
5.3Security, data movement, and DevOps
Understand service-managed vs customer-managed keys (CMK), network access control, control-plane RBAC vs data-plane Entra ID, Key Vault, Always Encrypted, data movement (ADF/Spark/Kafka/Stream Analytics), and DevOps via ARM templates and PowerShell/CLI.
In production, design security (encryption, network, access control), getting data in/out, and reproducible deployment (DevOps).
5.3.1Encryption, network, and access control
Data at rest is encrypted with service-managed keys by default; when you must manage keys, configure customer-managed keys (CMK) via Azure Key Vault. Restrict network access with Private Endpoint, an IP firewall, and VNet service endpoints. Access control has two planes: the control plane (account/config management) uses Azure RBAC, and the data plane (read/write items) uses Microsoft Entra ID-based RBAC—prefer token auth over account keys. Store account keys safely in Key Vault, and client-side encrypt sensitive fields with Always Encrypted. Use CORS to control browser origins.
5.3.2Data movement and DevOps
Choose data movement by purpose: bulk migration via SDK bulk operations or Azure Data Factory/Synapse pipelines; streaming ingestion via the Apache Kafka connector or Azure Stream Analytics; Spark analytics via the Cosmos DB Spark connector; IoT via an Azure IoT Hub custom endpoint. For DevOps, use declarative (ARM templates / Bicep) to provision/maintain resources and indexing policies reproducibly, and imperative (PowerShell / Azure CLI) for operational actions like migrating between standard and autoscale or initiating a regional failover. Manage production indexing policies via ARM templates to prevent drift.
Cues: "manage keys yourself" = CMK (Key Vault). "account/config management rights" = control-plane Azure RBAC; "read/write item rights" = data-plane Entra ID RBAC. "private connectivity" = Private Endpoint. "client-encrypt specific fields" = Always Encrypted. "reproducible provisioning/maintain indexing policy" = ARM templates (declarative); "migrate standard↔autoscale / initiate failover" = PowerShell/CLI (imperative).
Watch the mix-ups: (1) Control-plane RBAC (management ops) vs data-plane Entra ID RBAC (data read/write). (2) CMK depends on Key Vault key rotation/access—deleting the key makes data undecryptable. (3) Always Encrypted (client-side field encryption) and at-rest encryption (CMK) are different layers. (4) Use declarative (ARM) vs imperative (CLI) by purpose.
5.3.3Section summary
- Encryption = service-managed by default / CMK (Key Vault) on requirement; sensitive fields Always Encrypted; network Private Endpoint
- Access control = control-plane Azure RBAC (management) / data-plane Entra ID RBAC (read/write)
- Data movement = ADF/Spark/Kafka/Stream Analytics; DevOps = declarative ARM (reproduce/maintain indexing) + imperative CLI (migrate/failover)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want to manage the at-rest encryption key yourself, controlling rotation and revocation. Best?
Q2. You want to grant an app read/write access to Cosmos DB items via identity rather than account keys. Best?
Q3. You want to limit network access to the Cosmos DB account to private connectivity. Best?
Q4. You want to provision/maintain production resources and indexing policies declaratively and reproducibly. Best?
Q5. You want to migrate between standard and autoscale throughput or initiate a regional failover (imperative operations). Best?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.