DP-300 Practice Test 19 — 15 Questions

Question 1

Refer to the exhibit. You are deploying an Azure SQL Database audit policy using an ARM template. What is the MOST significant security concern with the configuration shown?

Accepted Answer

The storage account access key is exposed in the template. The ARM template exposes the storage account access key in plaintext as a parameter value. This is a critical security concern because anyone with access to the template (e.g., in source control or deployment logs) can retrieve the key and gain unrestricted access to the storage account, including reading, modifying, or deleting audit logs. Azure SQL Database audit policies should use managed identities or Azure AD authentication to avoid embedding secrets.

Answer

Enabling Azure Monitor target could allow unauthorized access to logs

Answer

Retention of 90 days may be too short for compliance

Answer

Including successful authentication events may expose sensitive login activity

Question 2

Which THREE of the following are valid options for migrating an on-premises SQL Server database to Azure SQL Database?

Accepted Answer

Use the Data Migration Assistant (DMA) to assess and migrate.. The Data Migration Assistant (DMA) is a Microsoft tool specifically designed to assess on-premises SQL Server databases for compatibility issues and then perform a seamless migration of schema and data to Azure SQL Database. DMA handles both assessment and migration in a single workflow, making it a valid and recommended option for migrating to Azure SQL Database.

Answer

Use SQL Server Integration Services (SSIS) to migrate schema and data.

Answer

Use the Azure portal's 'Import database' wizard directly from on-premises.

Question 3

You are a database administrator for Azure SQL Managed Instance. You need to configure a custom time zone for the instance because the application uses a specific time zone. What should you do?

Accepted Answer

Use ALTER INSTANCE SET TIMEZONE to set the desired time zone.. Azure SQL Managed Instance runs on top of a Windows operating system, and the time zone for the entire instance is controlled at the host level. The `ALTER INSTANCE SET TIMEZONE` command is the correct T-SQL method to change the time zone for the instance, which then applies to all databases within that instance. This command allows you to set a custom time zone that the application requires, without needing to deploy a separate VM or configure each database individually.

Answer

Deploy a virtual machine running SQL Server instead.

Answer

Set the time zone for each database using ALTER DATABASE.

Answer

Configure the time zone in the Azure portal under the instance settings.

Question 4

Your company is migrating an on-premises SQL Server 2016 database to Azure SQL Managed Instance. The database uses SQL Server Agent jobs, Database Mail, and Service Broker. The database is 500 GB. You need to minimize downtime during migration. Which migration approach should you use?

Accepted Answer

Use Azure Database Migration Service with online migration. Azure Database Migration Service (DMS) with online migration mode uses continuous data synchronization via change tracking or log shipping to minimize downtime. This approach supports SQL Server Agent jobs, Database Mail, and Service Broker, which are preserved during migration to Azure SQL Managed Instance. The online mode allows the source database to remain operational until the final cutover, reducing downtime to seconds.

Answer

Set up transactional replication from on-premises to Azure SQL Managed Instance

Answer

Export the database as a BACPAC file and import to Azure SQL Managed Instance

Answer

Back up the database to URL and restore to Azure SQL Managed Instance

Question 5

Match each Azure SQL Database security feature to its purpose.

Accepted Answer

Transparent Data Encryption (TDE): Encrypts data at rest. TDE protects data at rest by encrypting the database files. Always Encrypted protects data in use by encrypting on the client side. Dynamic Data Masking hides sensitive data in query results from unauthorized users. Common confusions involve mixing up TDE and Always Encrypted.

Answer

Transparent Data Encryption (TDE): Encrypts data in use on client side

Answer

Always Encrypted: Encrypts data at rest

Question 6

You are configuring Azure SQL Database for a new e-commerce application that must support high read throughput for product catalog queries. The application uses Entity Framework Core and requires that read-only queries be offloaded to a secondary replica to reduce load on the primary. Which feature should you enable?

Accepted Answer

Enable read scale-out and configure the application to use read-only intent.. Read scale-out in Azure SQL Database allows you to offload read-only workloads to a readable secondary replica by setting the application connection string's `ApplicationIntent=ReadOnly`. This reduces load on the primary replica, which is essential for high read throughput in an e-commerce catalog scenario. Entity Framework Core can use this by specifying `ReadOnly` in the connection string or via a custom interceptor.

Answer

Enable Query Performance Insights and create indexes for frequent queries.

Answer

Configure Active Geo-Replication with a readable secondary in a different region.

Answer

Enable automatic tuning to force parameterization of queries.

Question 7

You are reviewing the ARM template snippet for an Azure SQL Database failover group. The primary server is in East US. The secondary is in West Europe. The readWriteEndpoint has automatic failover with a grace period of 60 minutes. The readOnlyEndpoint is disabled. After a complete outage in East US, what will happen?

Accepted Answer

The failover group will wait 60 minutes, then automatically fail over to West Europe.. With automatic failover policy and a grace period, the system will wait for 60 minutes before automatically failing over to West Europe. The read-only endpoint is disabled, so no read-only routing is available. Option A is incorrect because the grace period is 60 minutes, not zero. Option C is incorrect because automatic failover is enabled. Option D is incorrect because the failover will happen within 60 minutes, not immediately.

Answer

The failover group will not fail over automatically because the grace period is too long.

Answer

The failover group will immediately fail over to West Europe.

Answer

The failover group requires manual failover because readOnlyEndpoint is disabled.

Question 8

You are a database administrator for a healthcare organization. You need to deploy a new Azure SQL Database that stores protected health information (PHI). The database must be encrypted at rest using a customer-managed key in Azure Key Vault. Additionally, you need to ensure that backups are also encrypted with the same key. Which configuration should you use?

Accepted Answer

Enable Transparent Data Encryption (TDE) using a customer-managed key from Azure Key Vault. Transparent Data Encryption (TDE) with a customer-managed key from Azure Key Vault is the correct choice because it encrypts the database at rest, including data files and log files, using a key that you control and manage in Azure Key Vault. This meets the requirement for encrypting protected health information (PHI) at rest with a customer-managed key, and TDE automatically ensures that backups are encrypted with the same database encryption key (DEK), which is protected by the customer-managed key.

Answer

Use column-level encryption with a certificate

Answer

Enable Transparent Data Encryption with a service-managed key

Answer

Enable Always Encrypted with keys stored in Azure Key Vault

Question 9

Match each Azure SQL Database backup type to its description.

Accepted Answer

Full backup: Contains all data in the database.. These are the three types of backups used for point-in-time restore in Azure SQL Database.

Answer

Full backup: Contains only changes since the last full backup.

Answer

Differential backup: Contains all committed transactions since the last full backup.

Question 10

You are configuring an Azure SQL Database for a financial application that requires high availability and disaster recovery across regions. The database is in the Premium service tier. Which TWO configurations should you implement to meet these requirements? (Choose TWO.)

Accepted Answer

Create a failover group that includes the primary and secondary.. A failover group in Azure SQL Database provides automated, coordinated failover of multiple databases across regions, ensuring high availability and disaster recovery with a defined replication policy and a readable secondary endpoint. Option D is correct because active geo-replication allows you to create up to four readable secondary databases in different Azure regions, enabling manual or automatic failover for cross-region disaster recovery, which is essential for a financial application requiring regional resilience.

Answer

Enable automatic tuning for the database.

Answer

Enable zone redundancy within the primary region.

Answer

Enable Transparent Data Encryption (TDE).

Question 11

Which THREE actions should you take when planning to implement Azure SQL Database with Microsoft Defender for SQL and Microsoft Sentinel integration?

Accepted Answer

Configure Microsoft Sentinel data connectors for Azure SQL Database. Microsoft Sentinel requires a data connector to ingest Azure SQL Database security events. The 'Azure SQL Database' data connector in Sentinel must be configured to pull diagnostic logs and alerts from the SQL resource into the Log Analytics workspace used by Sentinel, enabling advanced threat detection and incident response.

Answer

Enable Advanced Threat Protection for each database individually

Answer

Create a diagnostic setting to stream metrics to Event Hub

Question 12

You are examining the configuration of an Azure SQL Database in the Business Critical tier. The exhibit shows the database properties. What is the maximum number of readable replicas available for read-only queries?

Accepted Answer

3. In the Business Critical tier of Azure SQL Database, there is a fixed set of four replicas: one primary and three secondary replicas. All secondary replicas are readable and can serve read-only queries. Therefore, the maximum number of readable replicas available for read-only queries is 3. Option C (4) is incorrect because it would include the primary replica, which is not typically used for read-only queries unless read-scale is enabled, but even then the maximum readable replicas (including primary) is 4, but the question asks specifically for 'readable replicas available for read-only queries', which are the secondaries. The highAvailabilityReplicaCount property shown in the exhibit is not configurable for the Business Critical tier; it is only applicable to the Hyperscale tier. In Business Critical, the replica count is fixed at 4 total, with 3 readable secondaries.

Answer

1

Answer

4

Answer

5

Question 13

Refer to the exhibit. You are reviewing the JSON configuration for an elastic job. The job is expected to run every week on Sunday at midnight UTC. However, the job is not executing as scheduled. What is the most likely cause?

Accepted Answer

The interval and frequency properties are conflicting; interval should be removed for weekly frequency.. The job configuration includes both an 'interval' property (e.g., 'PT1H' for every hour) and a 'frequency' property set to 'Weekly'. In Azure Elastic Jobs, when 'frequency' is specified, the 'interval' property is ignored or causes a conflict because the schedule is defined by the cron-like recurrence pattern. Removing the 'interval' property resolves the conflict and allows the weekly schedule to execute correctly.

Answer

The retention policy is set too low, causing the job to be pruned before execution.

Answer

The startTime is in the past; the job should have a future start time.

Answer

The job definition is missing the 'scheduleType' property.

Question 14

Drag and drop the steps to configure an Azure SQL Managed Instance link for disaster recovery in the correct order.

Accepted Answer

Create a secondary managed instance, then create the link, then configure the secondary as readable, then monitor replication, then initiate failover when needed.. The link requires a secondary instance first, then establishing the link, configuring as readable, monitoring, and failing over when needed.

Answer

Create the link, then create a secondary managed instance, then configure as readable, then monitor, then failover.

Answer

Create a secondary managed instance, then create the link, then monitor, then failover, then configure as readable.

Answer

Create a secondary managed instance, then configure as readable, then create the link, then monitor, then failover.

Question 15

You are planning to migrate a large number of on-premises SQL Server databases to Azure SQL Managed Instance. The migration must be automated and support schema and data validation. Which TWO tools or services should you consider using? (Choose TWO.)

Accepted Answer

Azure Database Migration Service. Azure Database Migration Service (DMS) is the correct choice because it is a fully managed service designed to automate the migration of on-premises SQL Server databases to Azure SQL Managed Instance with minimal downtime. It supports both schema and data validation through built-in assessment, data integrity checks, and cutover capabilities, making it ideal for large-scale automated migrations.

Answer

Azure SQL Migration tool

Answer

SQL Server Management Studio (SSMS)

Answer

BACPAC export and import