Data Discovery & Classification introduces a set of advanced capabilities aimed at protecting data and not just the data warehouse itself. Classification/Labeling - Sensitivity classification labels tagged on the columns can be persisted in the data warehouse itself.
References:
https://azure.microsoft.com/sv-se/blog/announcing-public-preview-of-data-discovery-classification-formicrosoft-azure-sql-data-warehouse/
Topic 5, Data Engineer for Trey Research
Overview
You are a data engineer for Trey Research. The company is close to completing a joint project with the government to build smart highways infrastructure across North America. This involves the placement of sensors and cameras to measure traffic flow, car speed, and vehicle details.
You have been asked to design a cloud solution that will meet the business and technical requirements of the smart highway.
Solution components
Telemetry Capture
The telemetry capture system records each time a vehicle passes in front of a sensor. The sensors run on a custom embedded operating system and record the following telemetry data:
* Time
* Location in latitude and longitude
* Speed in kilometers per hour (kmph)
* Length of vehicle in meters
Visual Monitoring
The visual monitoring system is a network of approximately 1,000 cameras placed near highways that capture images of vehicle traffic every 2 seconds. The cameras record high resolution images. Each image is approximately 3 MB in size.
Requirements: Business
The company identifies the following business requirements:
* External vendors must be able to perform custom analysis of data using machine learning technologies.
* You must display a dashboard on the operations status page that displays the following metrics: telemetry, volume, and processing latency.
* Traffic data must be made available to the Government Planning Department for the purpose of modeling changes to the highway system. The traffic data will be used in conjunction with other data such as information about events such as sporting events, weather conditions, and population statistics. External data used during the modeling is stored in on-premises SQL Server 2016 databases and CSV files stored in an Azure Data Lake Storage Gen2 storage account.
* Information about vehicles that have been detected as going over the speed limit during the last 30 minutes must be available to law enforcement officers. Several law enforcement organizations may respond to speeding vehicles.
* The solution must allow for searches of vehicle images by license plate to support law enforcement investigations. Searches must be able to be performed using a query language and must support fuzzy searches to compensate for license plate detection errors.
Requirements: Security
The solution must meet the following security requirements:
* External vendors must not have direct access to sensor data or images.
* Images produced by the vehicle monitoring solution must be deleted after one month. You must minimize costs associated with deleting images from the data store.
* Unauthorized usage of data must be detected in real time. Unauthorized usage is determined by looking for unusual usage patterns.
* All changes to Azure resources used by the solution must be recorded and stored. Data must be provided to the security team for incident response purposes.
Requirements: Sensor data
You must write all telemetry data to the closest Azure region. The sensors used for the telemetry capture system have a small amount of memory available and so must write data as quickly as possible to avoid losing telemetry data.

When you create a new server in Azure SQL Database or Azure Synapse Analytics named mysqlserver, for example, a server-level firewall blocks all access to the public endpoint for the server (which is accessible at mysqlserver.database.windows.net).
Connection attempts from the internet and Azure must pass through the firewall before they reach your server or database, as the following diagram shows.

Incorrect Answers:
C: Azure Application Gateway is a web traffic load balancer that enables you to manage traffic to your web applications.
D: A VPN gateway is a specific type of virtual network gateway that is used to send encrypted traffic between an Azure virtual network and an on-premises location over the public Internet.
Reference:
https://docs.microsoft.com/en-us/azure/azure-sql/database/firewall-configure

Explanation

Tagging data must be uploaded to the cloud from the New York office location.
Tagging data must be replicated to regions that are geographically close to company office locations.

Explanation

Box1: API App

* Events generated from the IoT data sources are sent to the stream ingestion layer through Azure HDInsight Kafka as a stream of messages. HDInsight Kafka stores streams of data in topics for a configurable of time.
* Kafka consumer, Azure Databricks, picks up the message in real time from the Kafka topic, to process the data based on the business logic and can then send to Serving layer for storage.
* Downstream storage services, like Azure Cosmos DB, Azure SQL Data warehouse, or Azure SQL DB, will then be a data source for presentation and action layer.
* Business analysts can use Microsoft Power BI to analyze warehoused data. Other applications can be built upon the serving layer as well. For example, we can expose APIs based on the service layer data for third party uses.
Box 2: Cosmos DB Change Feed
Change feed support in Azure Cosmos DB works by listening to an Azure Cosmos DB container for any changes. It then outputs the sorted list of documents that were changed in the order in which they were modified.
The change feed in Azure Cosmos DB enables you to build efficient and scalable solutions for each of these patterns, as shown in the following image:

References:
https://docs.microsoft.com/bs-cyrl-ba/azure/architecture/example-scenario/data/realtime-analytics-vehicle-iot?vie

Explanation:
All cloud data must be encrypted at rest and in transit.
Box 1: Transparent data encryption
Encryption of the database file is performed at the page level. The pages in an encrypted database are encrypted before they are written to disk and decrypted when read into memory.
Box 2: Encryption at rest
Encryption at Rest is the encoding (encryption) of data when it is persisted.
References:
https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/transparent-data-encryption?view=sql-server-2017
https://docs.microsoft.com/en-us/azure/security/azure-security-encryption-atrest