Fantastic.
You have finished the section,
and it's time for another section review.
In this lesson, hey, it's all a review.
If you come across something that you don't understand,
you should be jumping back into those lessons.
Second, just like always, we're focusing on the DP-203,
so I'm going to try and highlight things
that you definitely need to remember.
And then 3, again, if you don't know something, review.
At this point, we should start to see blended concepts.
So we should be looking
at a security concept that ties into HDInsight.
And from there, we're adding in additional concept
about Key Vault or optimization.
And so this will continue for this section,
and then on through the next couple of sections as well.
So if you find yourself missing topics
or not understanding something fully,
you may have to dive back into a previous lesson
but make sure that you do that.
So with that, let's get started.
First, it's all about the golden goose, your data.
You need to make sure that you are protecting your data.
And we do this through defense in depth,
building additional layers,
and each one of these layers helps
to separate your environment from your data.
And it provides multiple layers of security,
so when we look at those multiple layers,
if you breach through 1 layer,
hopefully you haven't gotten access to everything.
Defense in depth.
Next, we talked about data encryption, that's data at rest.
Data at rest is when your data is not moving.
So that is the data encryption of that.
You use symmetric encryption keys to do that.
Most services have data at rest on by default.
We also talked about data in motion.
This is when your data is moving.
We encrypt it, and we use Transport Layer Security,
or TLS, for that.
Most services have this on by default,
and it is recommended that you're using
at least version 1.2 of TLS.
Key here for the DP-203,
most data at rest and data in motion is on by default.
Types of masks.
We talked about masking data.
And remember, there's quite a few different types.
There's default, and credit card,
and email, and the random number, and custom.
When we look at these different types,
first you need to remember that masking is a security layer
for people that already in the environment.
It should not be designed to keep you
out of the environment.
It should be designed as a light security measure
for someone who needs access to the environment,
but maybe we want to mask a few things,
like credit card numbers.
The other piece to remember is,
I would actually take a minute, look through this list,
and memorize those 5 different types:
default, credit card, email, random number, and custom.
That's going to help you to know what's possible
and, briefly, what each one of those things does.
Why we audit.
We audit to track database events.
These are security concerns,
because if we have established a baseline
of what's happening in your environment,
we can start to see things that are out of the norm.
We talked about auditing for regulatory requirements.
This is not the only factor or the only reason we audit,
but auditing for regulatory requirements
is definitely something that you need to keep in mind.
We talked about trends.
Again, this is security and operations.
The trends help us to identify,
again, those security concerns.
If we see events that are out of place, if we see spikes
in outgoing data or things like that.
In addition, we can also look
at optimizations with auditing.
Can we run our queries at a different time?
Can we optimize by increasing or decreasing our compute?
It's important that you establish a good auditing practice
for your environment.
Where do we audit? Synapse and SQL, at least as a feature.
So you can audit in any service, obviously,
by looking at Azure Monitor or Log Analytics;
but in Synapse and SQL Database, there's actually a feature
that you can choose to turn on auditing.
So make sure that you're looking at that for the DP-203.
Service endpoints.
We talked about service endpoints being a place
that provides secure and direct connectivity
to Azure services.
It increases our defense in depth
and our security by directly connecting a virtual network
to an Azure resource.
This is only for endpoints in Azure virtual networks,
with the exception being
that down there at the bottom, we can use IP ranges
or our ExpressRoute, if we have an on-premise environment.
And this is also only
for traffic within the virtual network region.
You can't connect virtual networks
to resources in different regions.
Establishing best practices.
Do you have a data retention policy?
You should have a data retention policy
that includes lifetime and regulatory requirements.
Your data should move from active, to archive, to purge.
We should be watching preconfigured backups from services,
and what this means is when we spin up
an Azure Synapse environment, for instance,
is it preconfigured and storing backups for us?
If so, we just need to make sure
that we understand what that is, how long it's being stored,
and where it's going, because this is going to help us
with our regulatory requirements
and our overall data retention policy.
We want to purge off hours.
We don't want to tie up resources from the environment
during peak times, because it's not something
that is generally mission-critical for your business.
Next, we need to assess and run cost management analysis.
We should have a good understanding,
or at least a reasonable understanding,
of the storage that we have and the movement of data
as we move from that active, to archive, to purge.
Finally, for multi- and hybrid cloud environments, we need
to map storage, meaning our data retention policy needs
to take into account multi-cloud and hybrid
so we know where we're storing things.
RBAC. This one is an important one.
We talked about security principals,
role definitions, and scope.
And then we talked about that tie in,
which is the role assignment,
the marriage of all 3 of those principles.
Make sure that you take a look
at RBAC and spend some time here.
RBAC is something that is a critical concept
for any Azure certification.
It's also a critical concept for, really, anything in Azure.
So make sure that you understand
what a security principal is, role definition,
and scope, and how all those things play together
to make your role assignment and identity access management.
Talked about Azure Key Vault,
our place to securely store and access tokens,
passwords, certificates, and API keys.
We talked about it being a centralized place
to store our secrets.
So, secrets are just anything
that we want to control access to.
And then we also talked about Azure Key Vault being a way
to monitor access of keys
as they're used to decrypt things like a database.
It also provides us some separation, again,
from that defense in depth concept,
because we can have a security admin managing our keys,
we can have a database admin managing our database,
and then we could have, like, an analyst
that's accessing the database using the key
and their Azure Active Directory access
to authenticate them to access a database.
So we can have some additional separation there.
And so Azure Key Vault is definitely something
that you want to take advantage of.
We also talked about how we authenticate in Databricks.
This is through Azure Active Directory,
by defining our service principal and getting our token,
or through personal access tokens.
For the DP-203, you need to understand
the 2 different options that are possible
to authenticate in Databricks.
Also, just a public service announcement,
tokens should be used in place of passwords.
Don't hardcode passwords, use tokens instead.
In summary, this is not a comprehensive list.
We talked about more in this section,
but these are the concepts
that I felt were the most important for the DP-203
to jump back in and take a look at.
This section is also a smaller percent of the DP-203.
So don't spend a massive amount of time
in the Security section,
because it is going to be probably
between 10 and 20% of the exam.
Don't forget about the labs.
If you've heard that before,
congratulations, that means you're moving through the course
at a pretty good clip.
We've talked about that several times.
Don't forget about the lab;
you need those for the exam and for your career.
Finally, if this course is helpful for you,
don't forget to smash that thumbs up button on those videos.
I greatly appreciate it.
Congrats again on finishing the section.
The best news yet:
there's only 3 sections to go,
including the conclusion section.
So you're almost there.
Keep it up, and I'll see you in the next section.