DP-300 Practice Test 18 — 15 Questions

Question 1

Your organization has a compliance requirement to automatically classify and protect sensitive data in Azure SQL Database. You need to configure Microsoft Purview to scan and classify the database. Which THREE actions are required?

Accepted Answer

Run a scan to discover and classify sensitive data.. Option A is correct because running a scan is the primary action that discovers and classifies sensitive data in Azure SQL Database using Microsoft Purview. The scan applies the classification rules from the scan rule set to identify patterns like credit card numbers or social security numbers, and then labels the data accordingly for compliance.

Answer

Create a Microsoft Entra ID application and grant it access to the database.

Answer

Enable Microsoft Defender for SQL to automatically classify data.

Question 2

Your company wants to implement transparent data encryption (TDE) for an Azure SQL Database using a customer-managed key stored in Azure Key Vault. Which TWO prerequisites must be met? (Choose two.)

Accepted Answer

The Azure SQL Server must have a system-assigned managed identity.. Option A is correct because Azure SQL Database uses the server's system-assigned managed identity to authenticate to Azure Key Vault when accessing the customer-managed key for TDE. Without this identity, the SQL Server cannot prove its identity to Key Vault to retrieve the key. Option B is correct because the Key Vault must have an access policy that grants the SQL Server's managed identity the 'get', 'wrapKey', and 'unwrapKey' permissions, which are required for TDE operations.

Answer

The database must contain a column master key.

Answer

The Key Vault must be in a different region than the SQL Server.

Answer

The database must be taken offline during key configuration.

Question 3

Your organization uses Azure SQL Database and wants to implement a defense-in-depth strategy. You have already enabled Transparent Data Encryption (TDE) and firewall rules. You need to add an additional layer of security that protects against unauthorized access to the physical storage files (e.g., if someone gains access to the storage account). What should you enable?

Accepted Answer

Infrastructure encryption (double encryption) using platform-managed keys. Infrastructure encryption (double encryption) using platform-managed keys adds a second layer of encryption at the storage infrastructure level, below the TDE layer. This protects data at rest even if the physical storage files (e.g., Azure Storage blobs) are accessed directly, because the storage infrastructure itself is encrypted with a separate, platform-managed key. This fulfills the defense-in-depth requirement for protecting against unauthorized access to physical storage.

Answer

Dynamic Data Masking

Answer

Microsoft Defender for SQL

Answer

Always Encrypted with secure enclaves

Question 4

You are the database administrator for a large e-commerce company. The company has an Azure SQL Database named SalesDB that stores sensitive customer data including credit card numbers and personal details. The security team has mandated the following requirements:

1. All customer credit card numbers must be encrypted at rest and in transit between the application and the database. The encryption keys must be stored in a hardware security module (HSM) managed by the company.
2. All access to the database must be authenticated using Microsoft Entra ID, and multi-factor authentication (MFA) must be enforced for all administrative users.
3. Any attempts to access the database from unusual geographic locations must be detected and automatically blocked for 24 hours.
4. All schema changes must be audited, and the audit logs must be sent to a central Log Analytics workspace for analysis.

Currently, the database uses SQL authentication, no encryption, and no auditing. You need to implement the required security controls with minimal downtime. What should you do?

Accepted Answer

Enable Always Encrypted for the credit card columns using Azure Key Vault Managed HSM for column master keys. Switch to Microsoft Entra ID authentication and configure Conditional Access policy to require MFA for administrators. Enable Microsoft Defender for SQL with anomaly detection and automatic blocking. Enable Azure SQL Auditing with Log Analytics destination.. Option D is correct because it directly addresses all mandated requirements: Always Encrypted with Azure Key Vault Managed HSM ensures credit card numbers are encrypted at rest and in transit with customer-managed HSM keys; switching to Microsoft Entra ID authentication with a Conditional Access policy enforces MFA for administrators; Microsoft Defender for SQL provides anomaly detection that can automatically block access from unusual geographic locations for 24 hours; and Azure SQL Auditing configured to send logs to Log Analytics meets the central audit requirement. This combination provides the required security controls with minimal downtime as Always Encrypted can be enabled online.

Answer

Enable Always Encrypted for the credit card columns with keys stored in Azure Key Vault. Keep SQL authentication but require users to use MFA via a VPN. Enable TDE for at-rest encryption.

Answer

Enable Transparent Data Encryption (TDE) with a customer-managed key in Azure Key Vault. Configure Azure SQL Auditing to send logs to Log Analytics. Enable Microsoft Defender for SQL.

Answer

Use Dynamic Data Masking to mask credit card numbers. Enable TDE and use Azure SQL Auditing with a storage account. Enable Microsoft Defender for SQL.

Question 5

Your company is using Azure SQL Database with Microsoft Entra ID authentication. A developer needs to connect to the database using a service principal. What should you provide to the developer?

Accepted Answer

The service principal's client ID and client secret, and the connection string with 'Authentication=Active Directory Service Principal'.. Option B is correct because to connect to Azure SQL Database using a service principal with Microsoft Entra ID authentication, the developer needs the service principal's client ID and client secret (or certificate) for authentication, and the connection string must include 'Authentication=Active Directory Service Principal' to specify the authentication method. This combination allows the application to obtain an access token from Microsoft Entra ID via the OAuth 2.0 client credentials grant flow, which is then used to authenticate to the database.

Answer

The connection string with 'Authentication=Active Directory Service Principal' and the service principal's object ID.

Answer

The service principal's username and password.

Answer

The service principal's managed identity endpoint.

Question 6

You are the database administrator for a healthcare organization that uses Azure SQL Database. You need to implement column-level encryption for sensitive patient data (e.g., Social Security numbers) using Always Encrypted. The application connecting to the database is a .NET application running on Azure Virtual Machines. The application should be able to perform parameterized queries on encrypted columns without revealing the plaintext to the database. Which configuration is essential for this setup?

Accepted Answer

Use Always Encrypted with secure enclaves and configure the enclave attestation URL.. Option D is correct because Always Encrypted with secure enclaves (using Intel SGX) allows rich computations on encrypted data within the enclave. Option A is incorrect because column master key stored in Azure Key Vault is standard, but the enclave is needed for computations. Option B is incorrect because Transparent Data Encryption encrypts data at rest, not in use. Option C is incorrect because dynamic data masking only obfuscates data from certain users, but the database can still see the plaintext.

Answer

Store the column master key in Azure Key Vault and configure the application to retrieve it.

Answer

Implement dynamic data masking on the columns containing Social Security numbers.

Answer

Enable Transparent Data Encryption (TDE) on the database.

Question 7

You are a database administrator for a manufacturing company that uses Azure SQL Database. The company has a requirement to encrypt sensitive data in transit between the application and the database. Additionally, the company wants to ensure that database administrators (DBAs) cannot view the sensitive data. Which TWO features should you implement?

Accepted Answer

Configure the server to enforce TLS 1.2 by setting the 'Minimal TLS Version' property. Options A and E are correct. Option A enforces TLS 1.2 for data in transit. Option E uses Always Encrypted with a column master key stored in Azure Key Vault, which prevents DBAs from accessing the encryption keys and thus the sensitive data. Option B is wrong because TDE encrypts data at rest but does not protect data in transit or from DBAs. Option C is wrong because dynamic data masking can be bypassed by DBAs with elevated permissions. Option D is wrong because row-level security does not encrypt data.

Answer

Implement row-level security (RLS) to filter rows

Answer

Enable transparent data encryption (TDE) on the database

Answer

Implement dynamic data masking on sensitive columns

Question 8

Your company has an Azure SQL Database that stores financial data. You need to implement auditing to track all data modifications (INSERT, UPDATE, DELETE) and schema changes (DDL). Which audit action group should you configure?

Accepted Answer

SCHEMA_OBJECT_CHANGE_GROUP and DATABASE_OBJECT_CHANGE_GROUP. Option C is correct because DATABASE_OBJECT_CHANGE_GROUP captures DML changes on all database objects, and SCHEMA_OBJECT_CHANGE_GROUP captures DDL changes. Option A is incorrect because it only contains DDL actions. Option B is incorrect because it only contains security-related actions. Option D is incorrect because it only contains DML actions on specific objects.

Answer

DATABASE_OBJECT_PERMISSION_CHANGE_GROUP and SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP

Answer

DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP and SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP

Answer

SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP and FAILED_DATABASE_AUTHENTICATION_GROUP

Question 9

You are configuring authentication for Azure SQL Database. Which TWO of the following are supported authentication methods?

Accepted Answer

Microsoft Entra ID authentication with a service principal.. Options B and D are correct. Microsoft Entra ID (formerly Azure AD) authentication is supported, including service principals. SQL authentication with username/password is also supported. Option A is wrong because Windows authentication is not supported for Azure SQL Database (only for SQL Server on VMs or on-premises). Option C is wrong because certificate-based authentication is not directly supported for SQL logins; it can be used with Always Encrypted but not for authentication. Option E is wrong because OAuth tokens are used with Microsoft Entra ID but not as a standalone method.

Answer

Windows authentication using Kerberos.

Answer

OAuth 2.0 token authentication.

Answer

Certificate-based authentication for SQL logins.

Question 10

You are a database administrator for a bank that uses Azure SQL Database to store transaction data. The compliance team requires that you implement a solution to encrypt data at rest and in transit. Additionally, the solution must allow the database to be restored to any point in time within the last 35 days. Which TWO actions should you take?

Accepted Answer

Enable transparent data encryption (TDE) on the database. Options A and B are correct. Option A enables transparent data encryption (TDE) for data at rest. Option B configures point-in-time restore (PITR) for the required retention of 35 days. Option C is wrong because Always Encrypted encrypts data in transit between client and server, but the question requires data in transit between the database and client, which is typically handled by TLS (enforced by the server). Option D is wrong because dynamic data masking does not encrypt data. Option E is wrong because Microsoft Defender for SQL provides threat detection, not encryption or backup.

Answer

Enable Microsoft Defender for SQL

Answer

Implement dynamic data masking on sensitive columns

Answer

Enable Always Encrypted for all columns containing sensitive data

Question 11

You are configuring Azure SQL Database for a multi-tenant application. Each tenant's data is stored in a separate database. You need to ensure that a tenant admin can only manage their own database and not other databases on the same logical server. What is the best approach?

Accepted Answer

Create a contained database user with db_owner role in each tenant's database and use Microsoft Entra authentication.. Option A is correct because creating a contained database user in each database with appropriate permissions limits the user to that database. Option B is incorrect because server-level login with db_owner on all databases gives cross-database access. Option C is incorrect because a server-level firewall rule does not control permissions. Option D is incorrect because database-level firewall rule controls network access, not permissions.

Answer

Use a server-level firewall rule to restrict access to the tenant's IP.

Answer

Create a server-level login and assign it as db_owner on all databases.

Answer

Create a database-level firewall rule for each tenant database.

Question 12

You have a new Azure SQL Database. You need to ensure that all connections use TLS 1.2 or higher. What should you configure?

Accepted Answer

Set the 'minimal TLS version' to 1.2 in the server's properties in the Azure portal.. Option B is correct because Azure SQL Database has a server-level setting to enforce minimum TLS version. Option A is wrong because there is no database-level TLS setting. Option C is wrong because the firewall does not control encryption protocols. Option D is wrong because auditing is unrelated.

Answer

Set the 'minimal TLS version' to 1.2 in the database's properties.

Answer

Add a firewall rule to deny connections using TLS 1.0 or 1.1.

Answer

Enable the 'Force encryption' option in the connection string and require TLS 1.2.

Question 13

You are a junior DBA at a startup that uses Azure SQL Database for its SaaS application. The application uses a single database and the development team frequently makes schema changes. You need to implement security measures to:

1. Ensure that all connections from the application use TLS encryption.
2. Prevent unauthorized access from the internet.
3. Allow your office IP range (203.0.113.0/24) to connect for management.
4. Enable auditing of all schema changes.
5. Encrypt the database at rest using Azure-managed keys.

You have already enabled Transparent Data Encryption (TDE) with service-managed keys. What should you do next to meet the remaining requirements?

Accepted Answer

Set the minimal TLS version to 1.2. Add a firewall rule for the office IP range and remove the default 'Allow Azure services' rule. Enable auditing with SCHEMA_OBJECT_CHANGE_GROUP.. Option C is correct because it addresses all remaining requirements: (1) Set minimal TLS version to 1.2; (2) Add firewall rule for office IP only; (3) Enable auditing with SCHEMA_OBJECT_CHANGE_GROUP; (4) TDE already enabled. Option A is incorrect because it does not include firewall restrictions. Option B is incorrect because it does not enforce TLS. Option D is incorrect because it does not include auditing.

Answer

Set the minimal TLS version to 1.2. Enable auditing with SCHEMA_OBJECT_CHANGE_GROUP.

Answer

Add a firewall rule for the office IP range. Enable auditing with SCHEMA_OBJECT_CHANGE_GROUP.

Answer

Add a firewall rule for the office IP range. Remove the default 'Allow Azure services' rule.

Question 14

You are designing a secure environment for Azure SQL Database. Which TWO of the following are recommended practices for network security?

Accepted Answer

Use Azure Private Link to connect to the database from a virtual network.. Options A and C are correct. Azure Private Link ensures traffic never traverses the public internet. Disabling public network access at the server level blocks all internet traffic. Option B is wrong because allowing all Azure services is a broad rule that may be insecure. Option D is wrong because VNet service endpoints are legacy and less secure than Private Link. Option E is wrong because firewall rules with large IP ranges are less secure.

Answer

Enable the 'Allow Azure services and resources to access this server' firewall setting.

Answer

Use VNet service endpoints instead of Private Link to reduce costs.

Answer

Add firewall rules that allow all IP addresses from your organization's IP range.

Question 15

Your Azure SQL Database is configured with a failover group across two regions. You need to ensure that client connections automatically redirect to the secondary region during a regional outage, without changing the connection string. What should you implement?

Accepted Answer

Configure the failover group with a listener endpoint and use that in the connection string.. Option B is correct because the failover group listener provides a read-write listener endpoint that automatically redirects to the new primary after failover. Option A is wrong because private endpoints do not provide automatic redirection. Option C is wrong because read scale-out is for read-only traffic. Option D is wrong because traffic manager works at DNS level but adds complexity; failover group listener is the built-in solution.

Answer

Enable read scale-out and configure application retry logic.

Answer

Deploy Azure Traffic Manager in front of the SQL Database and configure failover routing.

Answer

Use private endpoints in both regions and configure DNS with a CNAME record.