A public-health clinic must produce evidence of who accessed encounter tables for compliance reviews. How should SQL auditing be used?
Select an answer to reveal the explanation.
Short Explanation
Audit logs are the clinic’s attendance sheet for sensitive tables—ship them to SIEM so compliance can replay who touched encounter data, not rely on memory or a desktop folder.
Full Explanation
Feeding SQL audit logs into the organization’s SIEM or log analytics workspace as durable compliance evidence is how a public-health clinic should use SQL auditing for encounter-table access reviews. Auditing must not only be enabled; events need centralized, access-controlled, retained storage where compliance teams can query who read encounter data, when, and from which principal. SIEM or Log Analytics integration supports correlation, alerting, and evidence export during reviews—far stronger than local ephemeral traces.
Disabling auditing after go-live because Dynamic Data Masking already “proves” access history fails by concept: masking never records access events. Storing audit output only on an unsecured shared desktop folder with no retention policy creates tamper and loss risk and will not satisfy serious compliance scrutiny. Replacing auditing with a weekly email asking clerks to self-report which rows they read is unverifiable and incomplete by design.
Exam caveat: Enablement without retention and review is a common distractor pattern. DP-800 expects you to connect auditing to a monitored sink and to keep configuration changes themselves auditable. Also remember PHI/PII encounter access may require immutable storage or restricted modify rights on the log sink so clinic DBAs cannot silently erase evidence.
Operational check: Turn on Azure SQL auditing (or SQL Server audit) for SELECT on encounter tables, send logs to Log Analytics or a locked storage account, and set retention to policy. Run a test SELECT as a clinic identity and retrieve the corresponding SIEM event. Alert on audit stop/start and on mass export patterns. Schedule periodic compliance queries rather than only reactive investigation, and verify desktop-folder sinks are not used for official evidence.