DP-300 Practice Test 17 — 15 Questions

Question 1

An Azure SQL Database contains personally identifiable information (PII). You need to mask the PII columns from non-administrative users while allowing administrators to see the actual data. Which feature should you use?

Accepted Answer

Dynamic Data Masking. Dynamic Data Masking (DDM) is the correct choice because it selectively obscures sensitive PII columns in query results for non-administrative users, while leaving the data unmasked for users with elevated permissions (e.g., db_owner or the UNMASK permission). This is achieved by defining masking rules on specific columns, such as email or phone number, without altering the underlying stored data.

Answer

Always Encrypted

Answer

Transparent Data Encryption (TDE)

Answer

Row-Level Security

Question 2

Your company uses Azure SQL Database with Microsoft Entra ID (formerly Azure AD) authentication. You need to grant a group of external consultants access to a specific database with read-only permissions. The consultants are from a partner organization that uses their own Microsoft Entra ID tenant. What should you do?

Accepted Answer

Invite the consultants as guest users in your Microsoft Entra ID tenant using B2B collaboration, then create a contained database user for each guest user. Option A is correct because external consultants from a different Microsoft Entra ID tenant must first be invited as guest users via B2B collaboration to your tenant. Once they are guest users, you can create contained database users in Azure SQL Database mapped to their guest user identities (e.g., their UPN in your tenant) and grant them read-only permissions (e.g., db_datareader role). This approach respects the isolation of the partner's tenant while enabling access through your tenant's identity.

Answer

Create a contained database user mapped to the consultants' Microsoft Entra ID user principal names (UPNs)

Answer

Configure Azure SQL Database to trust the partner's Microsoft Entra ID tenant

Answer

Create a SQL Server authentication login and user for the consultants

Question 3

You run the Azure CLI command shown in the exhibit for an Azure SQL Database named SalesDB. The output shows that the security alert policy is disabled. You need to enable Microsoft Defender for SQL, including vulnerability assessments, for this database. What should you do?

Accepted Answer

Run 'az sql server update --name sql-sales --resource-group rg-sales --enable-defender-for-sql true'.. Option C is correct because enabling Microsoft Defender for SQL, including vulnerability assessments, is a server-level configuration in Azure SQL. The command 'az sql server update --enable-defender-for-sql true' activates Defender for SQL on the server, which automatically applies to all databases on that server, including SalesDB. The exhibit shows a database-level security alert policy is disabled, but the required feature is enabled at the server scope, not per-database.

Answer

Run 'az sql db update --name SalesDB --resource-group rg-sales --server sql-sales --enable-defender-for-sql true'.

Answer

Run 'az sql db threat-policy update --name SalesDB --resource-group rg-sales --server sql-sales --state Enabled'.

Answer

Configure a server firewall rule to allow Azure services.

Question 4

You need to ensure that all queries accessing a specific column containing credit card numbers are encrypted both at rest and in transit between the application and Azure SQL Database. Which THREE technologies should you implement? (Choose three.)

Accepted Answer

Enforce TLS 1.2 or higher for client connections. Option A is correct because enforcing TLS 1.2 or higher for client connections encrypts data in transit between the application and Azure SQL Database. TLS ensures that all queries and their results, including the credit card column, are protected from interception during network transmission.

Answer

Row-Level Security

Answer

Dynamic Data Masking

Question 5

You are configuring Azure SQL Database for a financial application that must meet PCI DSS compliance. The database contains credit card numbers stored in a column encrypted with Always Encrypted. You need to ensure that database administrators cannot view the plaintext credit card numbers while allowing application users with the proper credentials to access them. What should you implement?

Accepted Answer

Use Always Encrypted with secure enclaves and store the column master key in Azure Key Vault with access granted only to the application. Always Encrypted with secure enclaves ensures that credit card numbers are encrypted at all times, including during computation, and that the column master key is stored in Azure Key Vault with access granted only to the application. This prevents database administrators (DBAs) from viewing plaintext data because they never have access to the column master key, while authorized application users can decrypt the data via the client driver. This meets PCI DSS requirements for protecting cardholder data at rest and in use.

Answer

Use column-level encryption with a certificate stored in the database

Answer

Enable Transparent Data Encryption (TDE)

Answer

Implement Dynamic Data Masking (DDM)

Question 6

Your company uses Azure SQL Database with Microsoft Entra ID authentication. You need to ensure that only users from a specific Microsoft Entra ID tenant can access the database. What should you configure?

Accepted Answer

Create a server-level firewall rule with IP range '0.0.0.0' and then use Microsoft Entra ID authentication with a conditional access policy.. Option C is correct because to restrict access to a specific Microsoft Entra ID tenant, you must first set the server-level firewall to allow all Azure IPs (0.0.0.0) so that Azure SQL Database can accept connections from any Azure resource, and then enforce tenant-level restrictions using a conditional access policy. This combination ensures that only users from the specified tenant can authenticate, while the firewall rule handles network-level access from Azure services.

Answer

Enable Azure AD conditional access policy to restrict sign-ins to the specific tenant.

Answer

Set the server firewall to allow only the tenant's IP range.

Answer

Configure a network security group (NSG) to block all traffic except from the tenant's IP range.

Question 7

You are configuring Azure SQL Database firewall rules. Which THREE actions require the 'Allow Azure services and resources to access this server' setting to be enabled? (Choose three.)

Accepted Answer

Azure Data Factory using a self-hosted integration runtime.. Option A is correct because the 'Allow Azure services and resources to access this server' firewall setting permits connections from any Azure service that does not have a fixed public IP or a private endpoint. Azure Data Factory using a self-hosted integration runtime (IR) runs on-premises or on a VM, but the IR itself initiates outbound connections to Azure SQL Database from a dynamic Azure IP range. Without this setting enabled, the connection is blocked because the self-hosted IR's source IP is not a static, whitelisted address.

Answer

An on-premises application with a static public IP.

Answer

A virtual machine using a private endpoint.

Question 8

You need to audit schema changes on an Azure SQL Database. Specifically, you must capture details of any DDL statements executed by any user. The audit logs must be stored in a Log Analytics workspace for analysis. What should you configure?

Accepted Answer

Configure server-level auditing with a Log Analytics workspace destination. Option C is correct because Azure SQL Database server-level auditing with a Log Analytics workspace destination captures all DDL statements executed by any user and stores them in a Log Analytics workspace for analysis. This meets the requirement to audit schema changes and store logs in Log Analytics, as server-level auditing captures events for all databases on the server, including DDL operations, and supports Log Analytics as a destination.

Answer

Create DDL triggers that write to a table

Answer

Configure database-level auditing with blob storage destination

Answer

Create an extended events session to capture DDL events

Question 9

Refer to the exhibit. You are reviewing a script that is executed as part of a data migration to Azure SQL Database. The script attempts to insert a row with a specific OrderID into an Orders table that has an identity column. The script runs successfully in a test environment but fails in production with an error. The production environment has the same schema. What is the most likely cause?

Accepted Answer

The user running the script does not have ALTER permission on the table. The script uses SET IDENTITY_INSERT ON to allow explicit insertion into an identity column. In Azure SQL Database, this requires ALTER permission on the table, not just INSERT. The test environment likely granted the user ALTER, but production did not, causing the failure despite identical schema.

Answer

The table in production does not have an identity column

Answer

A different session is already using SET IDENTITY_INSERT ON for the same table

Answer

The identity column in production has a different seed value

Question 10

Your company is migrating on-premises SQL Server databases to Azure SQL Managed Instance. You need to ensure that database backups are encrypted at rest using customer-managed keys stored in Azure Key Vault. You also need to allow the backup service to access the keys. What should you configure?

Accepted Answer

Enable Transparent Data Encryption (TDE) with customer-managed keys and grant the managed instance's system-assigned managed identity 'get', 'wrapKey', and 'unwrapKey' permissions on the key vault.. Option C is correct because Transparent Data Encryption (TDE) with customer-managed keys (CMK) in Azure SQL Managed Instance encrypts database backups at rest. To allow the Azure backup service to access the key for backup encryption, the managed instance's system-assigned managed identity must be granted 'get', 'wrapKey', and 'unwrapKey' permissions on the Azure Key Vault where the CMK is stored. This ensures that backups are encrypted using the customer-controlled key, meeting the requirement for encryption at rest with customer-managed keys.

Answer

Use Always Encrypted with column master key stored in Azure Key Vault.

Answer

Configure Azure Backup for SQL Server in Azure VM and use Backup Center to manage encryption.

Answer

Configure server-level firewall rules to allow Azure services to access the server.

Question 11

Your company uses Azure SQL Database and needs to comply with GDPR. You must implement data classification and protection. Which TWO actions should you take? (Choose two.)

Accepted Answer

Configure sensitivity labels using Microsoft Purview Information Protection.. Option A is correct because Microsoft Purview Information Protection provides sensitivity labels that can be applied to columns in Azure SQL Database to classify and protect personal data, meeting GDPR requirements. These labels enforce encryption, access restrictions, and visual markings, integrating with Azure SQL's data classification capabilities.

Answer

Implement Always Encrypted for all columns containing personal data.

Answer

Install the Azure Information Protection client on all client machines.

Answer

Enable Microsoft Defender XDR for the database server.

Question 12

Your company uses Azure SQL Database and wants to implement row-level security (RLS) to restrict access to customer data based on the user's Microsoft Entra ID group membership. Which TWO actions are required?

Accepted Answer

Create a security policy that uses a predicate function.. Row-level security (RLS) in Azure SQL Database restricts data access at the row level by using a security policy that invokes a predicate function. The predicate function defines the logic for filtering rows, such as checking the caller's Microsoft Entra ID group membership via IS_MEMBER(). Therefore, creating both the predicate function (Option E) and the security policy that uses it (Option C) are required steps.

Answer

Create a column master key for the secured columns.

Answer

Grant the user the db_securityadmin server role.

Answer

Apply a dynamic data masking rule to hide sensitive columns.

Question 13

You are reviewing an ARM template for Azure SQL Database. The exhibit shows a resource definition for Transparent Data Encryption (TDE). You need to ensure that the database uses customer-managed keys (CMK) stored in Azure Key Vault instead of service-managed keys. What additional configuration is required?

Accepted Answer

Add a resource of type 'Microsoft.Sql/servers/encryptionProtector' and reference the key vault key.. Option A is correct because to use CMK, you must configure an Azure Key Vault and set the database's encryption protector to the key. Option B is wrong because TDE is already enabled; CMK requires a specific protector. Option C is wrong because the encryption protector is set at the server level, not database. Option D is wrong because Always Encrypted is a different feature.

Answer

Modify the database resource to include a 'keyVaultUri' property.

Answer

Enable Always Encrypted on the database.

Answer

Set the TDE state to 'Disabled' and then re-enable with a customer key.

Question 14

You are responsible for securing Azure SQL Managed Instance. You need to ensure that only encrypted connections are allowed and that all client connections use the latest TLS protocol. Which TWO configurations should you implement?

Accepted Answer

Set the 'Minimal TLS Version' to 1.2.. Options A and C are correct. Enforcing TLS 1.2 ensures only encrypted connections using that protocol are accepted. Setting 'Force SSL' to 'Enabled' (or 'On') ensures all connections use encryption. Option B is incorrect because TDE encrypts data at rest, not in transit. Option D is incorrect because firewall rules control network access, not encryption. Option E is incorrect because Microsoft Defender for SQL provides threat detection.

Answer

Configure a firewall rule to allow only specific IP addresses.

Answer

Enable Microsoft Defender for SQL.

Answer

Enable Transparent Data Encryption (TDE).

Question 15

You are configuring Azure SQL Database auditing. You need to ensure that all database-level authentication failures are logged. Which TWO audit action groups should you include?

Accepted Answer

SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP. Option A is correct because the SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP audit action group captures all successful authentication attempts at the database level. Option B is correct because the FAILED_DATABASE_AUTHENTICATION_GROUP audit action group captures all failed authentication attempts at the database level. Together, these two groups ensure that every database-level authentication event—both successes and failures—is logged, which is required to meet the requirement of logging all database-level authentication failures.

Answer

DATABASE_OBJECT_PERMISSION_CHANGE_GROUP

Answer

DATABASE_OBJECT_CHANGE_GROUP

Answer

SCHEMA_OBJECT_CHANGE_GROUP