QuestionQ75

VerifiedSecure, optimize, and deploy database solutions

Existing Environment

Azure Environment

Fabrikam has one Azure subscription in the East US 2 Azure region. The subscription contains an Azure SQL database named DB1. DB1 contains the following tables:

  • Patients
  • Employees
  • Procedures
  • Transactions
  • UsefulPrompts
  • ProcedureDocuments

You store a column master key as a secret in Azure Key Vault.

You have an on-premises application named TransactionProcessing that uses a hard-coded username and password in a connection string to access DB1.

Problem Statements

Users report that after running a long-running stored procedure named sp_UpdateProcedureForPatient, updates to the underlying data are sometimes inconsistent.

Requirements

Planned Changes

Fabrikam plans to manage all changes to Azure SQL Database objects by using source control in GitHub. Every pull request submitted to production will be validated before it can be merged. Deployments must use the Release configuration.

Security Requirements

Fabrikam identifies the following security requirements:

  • The TransactionProcessing application must use a passwordless connection to DB1.
  • The Employees table contains two columns named TaxID and Salary that must be encrypted at rest.
  • Auditors must have a tamper-evident history of transactions with cryptographic proof of changes to the employee data.

Database Performance Requirements

Records accessed by using sp_UpdateProcedureForPatient must NOT be changed by other transactions while the stored procedure runs.

AI Search, Embeddings, and Vector Indexing

Fabrikam identifies the following AI-related requirements:

  • Queries to the ProcedureDocuments table must use Reciprocal Rank Fusion (RRF).
  • Users must be able to query the data in DB1 by using prompts in Copilot in Microsoft Fabric.
  • The UsefulPrompts table will store prompts that doctors can use to help diagnose patient illness by connecting to an Azure OpenAI endpoint.

Development Requirements

Fabrikam identifies the following development requirements:

  • Provide the functionality to retrieve all the transactions of a given patient between two dates, showing a running total.
  • Expose a Data API builder (DAB) configuration file to enable Azure services to perform the following operations over a REST API:
    • Read data from the procedures table without authentication.
    • Read and insert data into the Transactions table once authenticated.
    • Execute the sp_UpdateProcedurePatient stored procedure.
  • Provide the functionality to retrieve a list of the names of patients who underwent medical procedures during the last 30 days.
  • Information for each medical procedure will be stored in a table. The table will be used with a large language model (LLM) for user querying and will have the following structure.

Scenario Image

DAB

You create a DAB configuration file that meets the development requirements for DB1 and includes the following entities.

Scenario Image

You need to recommend a solution for the TransactionProcessing application that fulfills the security requirements.

What should you include in the recommendation?

Explanation

An on-premises workload cannot use an Azure managed identity directly. A Microsoft Entra service principal provides an application identity for programmatic authentication to Azure SQL Database, replacing the hard-coded SQL username and password. Microsoft recommends a service principal when a workload is hosted outside Azure.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!