What's changed: Created DP-420 Chapter 5, completing the textbook (Domain 5: monitoring (Normalized RU Consumption hot-partition detection/status codes 429-449-503-408/server-side latency/Azure Monitor alerts/resource logs diagnostic settings→Log Analytics/cross-partition monitoring); backup and restore (periodic vs continuous/PITR/restore point/restore into a new account); security, data movement, DevOps (service-managed vs CMK Key Vault/Private Endpoint-IP-VNet/control-plane Azure RBAC-data-plane Entra ID RBAC/Always Encrypted/CORS/data movement ADF-Spark-Kafka-Stream Analytics-IoT Hub/DevOps declarative ARM-imperative PowerShell-CLI standard↔autoscale-failover)).
5.3Security, data movement, and DevOps
Understand service-managed vs customer-managed keys (CMK), network access control, control-plane RBAC vs data-plane Entra ID, Key Vault, Always Encrypted, data movement (ADF/Spark/Kafka/Stream Analytics), and DevOps via ARM templates and PowerShell/CLI.
In production, design security (encryption, network, access control), getting data in/out, and reproducible deployment (DevOps).
5.3.1Encryption, network, and access control
Data at rest is encrypted with service-managed keys by default; when you must manage keys, configure customer-managed keys (CMK) via Azure Key Vault. Restrict network access with Private Endpoint, an IP firewall, and VNet service endpoints. Access control has two planes: the control plane (account/config management) uses Azure RBAC, and the data plane (read/write items) uses Microsoft Entra ID-based RBAC—prefer token auth over account keys. Store account keys safely in Key Vault, and client-side encrypt sensitive fields with Always Encrypted. Use CORS to control browser origins.
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.