DP-300 Practice Test 25 — 15 Questions

Question 1

You have an Azure SQL Database that contains sensitive customer data. You need to classify the data and receive recommendations for protecting it. You also need to detect and alert on suspicious access patterns. Which two Azure services should you enable? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Defender for SQL. Microsoft Defender for SQL (Option C) provides vulnerability assessment, data discovery and classification, and advanced threat protection for Azure SQL Database. It can classify sensitive columns, recommend protection measures, and detect suspicious access patterns such as SQL injection or brute-force attacks, generating alerts for immediate response.

Answer

Microsoft Sentinel

Answer

Azure Information Protection

Answer

Azure Policy

Question 2

You are designing a security strategy for Azure SQL Database. You need to ensure that database access is secured using Microsoft Entra ID (formerly Azure Active Directory) authentication. Which THREE actions should you take? (Choose THREE.)

Accepted Answer

Create a Microsoft Entra ID administrator for the Azure SQL logical server.. Creating a Microsoft Entra ID administrator for the Azure SQL logical server is required to enable Entra ID authentication at the server level. This administrator is a user or group from Entra ID that has permissions to manage all databases on the server, including creating contained database users mapped to Entra ID principals. Without this step, Entra ID authentication cannot be configured for the server or its databases.

Answer

Disable SQL Server authentication after migrating to Entra ID.

Answer

Enable Transparent Data Encryption (TDE).

Question 3

You are configuring Azure SQL Database firewall rules. Which THREE actions require the 'Allow Azure services and resources to access this server' setting to be enabled? (Choose three.)

Accepted Answer

Azure Data Factory using a self-hosted integration runtime.. The 'Allow Azure services and resources to access this server' firewall setting permits connections from any Azure service that does not have a fixed public IP or a private endpoint. Azure Data Factory using a self-hosted integration runtime (IR) runs on-premises or on a VM, but the IR itself initiates outbound connections to Azure SQL Database from a dynamic Azure IP range. Without this setting enabled, the connection is blocked because the self-hosted IR's source IP is not a static, whitelisted address.

Answer

An on-premises application with a static public IP.

Answer

A virtual machine using a private endpoint.

Question 4

Refer to the exhibit. You are reviewing an Azure Resource Manager template for deploying an Azure SQL Database server. The template sets publicNetworkAccess to Disabled, minimalTlsVersion to 1.2, and azureAdOnlyAuthentication to true. However, the deployment fails with an error. What is the most likely cause?

Accepted Answer

When azureAdOnlyAuthentication is true, the administratorLogin and administratorLoginPassword properties must not be specified. When azureAdOnlyAuthentication is set to true in an Azure SQL Database ARM template, the administratorLogin and administratorLoginPassword properties must be omitted because Azure AD authentication replaces SQL authentication as the sole identity provider. Including these properties causes a validation conflict, as the deployment expects no SQL admin credentials when Azure AD-only authentication is enabled.

Answer

minimalTlsVersion 1.2 is not supported in Azure SQL Database

Answer

publicNetworkAccess Disabled requires a private endpoint to be defined in the same template

Answer

The password does not meet complexity requirements

Question 5

Match each Azure SQL Database error code to its meaning.

Accepted Answer

4060: Cannot open database requested by the login. Login failed.. Common Azure SQL Database error codes: 4060 (database not accessible), 18456 (login failure), 40197 (transient error), 40501 (throttling). Distractors swap the definitions between 4060 and 18456.

Answer

4060: Login failed for user 'username'.

Answer

18456: Cannot open database requested by the login.

Question 6

Which TWO of the following are valid options for migrating an on-premises SQL Server database to Azure SQL Database with minimal downtime?

Accepted Answer

Configure transactional replication between on-premises SQL Server and Azure SQL Database.. Transactional replication allows continuous synchronization of changes from the on-premises SQL Server publisher to the Azure SQL Database subscriber, enabling migration with minimal downtime by cutting over only after data is in sync. This is a supported hybrid scenario for Azure SQL Database.

Answer

Use BULK INSERT to export data from on-premises and import to Azure SQL Database.

Answer

Use SQL Server backup to URL and restore to Azure SQL Database.

Answer

Use the Generate Scripts wizard in SQL Server Management Studio.

Question 7

Your company is adopting Microsoft Defender XDR for enhanced security. You need to enable Microsoft Defender for SQL for your Azure SQL Database to receive security alerts and vulnerability assessments. What is the first step you must take?

Accepted Answer

Enable Microsoft Defender for SQL on the Azure SQL logical server.. Microsoft Defender for SQL must be enabled at the logical server level before any security alerts or vulnerability assessments can be applied to the Azure SQL Database. This server-level enablement activates the Defender for SQL features (including vulnerability assessment and threat detection) for all databases under that server, making it the prerequisite step.

Answer

Configure Microsoft Intune to manage access.

Answer

Run a vulnerability assessment scan from the Azure portal.

Answer

Configure Microsoft Purview to scan the database.

Question 8

You are deploying Azure SQL Database for a new application. You need to ensure that connections from Azure services use a private IP address and do not traverse the public internet. What should you configure?

Accepted Answer

Use Azure Private Link for Azure SQL Database. Azure Private Link creates a private endpoint in a virtual network, mapping the Azure SQL Database logical server to a private IP address within that VNet. Traffic from Azure services (e.g., VMs, App Service) to the database uses Microsoft's backbone network via the private endpoint, never traversing the public internet. This meets the requirement for private, non-internet-routed connectivity.

Answer

Enable Virtual Network service endpoints for Azure SQL Database

Answer

Configure the Azure SQL Database firewall to allow Azure services

Answer

Deploy Azure SQL Database inside a virtual network

Question 9

You run the KQL query shown in the exhibit. The query returns a list of query IDs. What is the purpose of this query?

Accepted Answer

Identify the top 10 queries by average duration.. The KQL query in the exhibit uses `summarize` with `avg(duration)` and then `top 10 by avg_duration`, which explicitly calculates the average duration per query_id and returns the top 10 queries with the highest average duration. This directly matches the purpose of identifying the top 10 queries by average duration.

Answer

Identify queries consuming the most CPU.

Answer

Identify queries with the highest total wait time.

Answer

Identify queries with the highest execution count.

Question 10

You need to ensure that only specific Azure services can access your Azure SQL Database server. You want to allow traffic from Azure services but block all other traffic. What should you configure?

Accepted Answer

Set the firewall rule 'Allow Azure Services and resources to access this server' to ON and remove all other IP rules.. Setting the 'Allow Azure Services and resources to access this server' firewall rule to ON enables a special rule that permits traffic from all Azure datacenter IP ranges, while removing all other IP rules ensures no other external traffic can reach the server. This configuration meets the requirement to allow only Azure services and block all other traffic, as the Azure services rule is a blanket allow for Azure-originated connections without needing specific IP addresses.

Answer

Set the firewall rule 'Allow Azure Services and resources to access this server' to OFF and add a rule for 0.0.0.0.

Answer

Set firewall rules to deny all IP addresses.

Answer

Set the firewall rule 'Allow Azure Services and resources to access this server' to ON and add a rule for 0.0.0.0.

Question 11

You manage a mission-critical Azure SQL Database in the East US region. The database uses the Business Critical service tier with zone-redundant high availability enabled. You need to ensure that if an entire Azure region fails, the database can be failed over to a secondary region with minimal data loss. What should you implement?

Accepted Answer

Enable active geo-replication to a secondary server in a paired region.. Active geo-replication provides near-real-time asynchronous replication to a secondary region, and with Business Critical, you can configure a readable secondary that can be failed over manually or automatically with minimal data loss. Option A is wrong because failover groups are built on top of geo-replication but do not guarantee minimal data loss by themselves; they rely on the replication mode. Option B is wrong because auto-failover groups include geo-replication but the question asks for the specific feature to implement. Option D is wrong because zone redundancy protects against zonal failures within a region, not regional failures.

Answer

Enable auto-failover groups with read-write failover policy.

Answer

Configure a failover group with the secondary in a different Azure region.

Answer

Deploy zone-redundant configuration in East US 2.

Question 12

Your company has an Azure SQL Database that contains sensitive financial data. You need to ensure that database administrators cannot view the actual data while still being able to perform administrative tasks such as backups and index maintenance. Which feature should you implement?

Accepted Answer

Always Encrypted with column master key stored in Azure Key Vault. Always Encrypted with the column master key stored in Azure Key Vault ensures that sensitive data is encrypted at the client side and the encryption keys are never exposed to the database engine. This means database administrators (DBAs) can perform administrative tasks like backups and index maintenance on the encrypted columns without ever being able to view the plaintext data, because the SQL Server instance only sees ciphertext.

Answer

Row-Level Security

Answer

Dynamic Data Masking

Answer

Transparent Data Encryption

Question 13

You are configuring Azure SQL Database firewall rules. You need to allow a range of IP addresses (192.168.1.0 to 192.168.1.255) to connect to the database. Which firewall rule should you create?

Accepted Answer

Start IP: 192.168.1.0, End IP: 192.168.1.255. Azure SQL Database firewall rules require a contiguous range of IP addresses defined by a start and end IP. The range 192.168.1.0 to 192.168.1.255 exactly covers the specified /24 subnet, allowing all hosts in that block to connect. This is the standard method for permitting a subnet in Azure SQL firewall configuration.

Answer

Start IP: 192.168.0.0, End IP: 192.168.2.255

Answer

Start IP: 192.168.1.255, End IP: 192.168.1.0

Answer

Start IP: 192.168.1.0, End IP: 192.168.1.0

Question 14

Which TWO actions should you take to secure Azure SQL Database against SQL injection attacks?

Accepted Answer

Use parameterized queries in application code. Parameterized queries (Option D) and stored procedures with parameters (Option E) are both effective defenses against SQL injection because they separate SQL code from user input. When using parameterized queries, the database engine treats input as data only, never as executable code, which prevents attackers from injecting malicious SQL statements. This is a fundamental secure coding practice recommended by Microsoft for Azure SQL Database.

Answer

Enable Transparent Data Encryption

Answer

Enable auditing for all database operations

Answer

Configure firewall rules to allow only trusted IP addresses

Question 15

Your Azure SQL Database is protected by a failover group. You need to ensure that during a failover to the secondary region, only authenticated applications can connect. What should you configure?

Accepted Answer

Use the failover group listener endpoint with Microsoft Entra ID authentication.. The failover group listener endpoint provides a DNS name that automatically points to the current primary region. By configuring Microsoft Entra ID authentication on the logical server, you ensure that only authenticated applications (using Microsoft Entra tokens) can connect, even after a failover. This eliminates reliance on SQL authentication passwords, which could be compromised or misconfigured across regions.

Answer

Set up a private endpoint for each region and update connection strings manually.

Answer

Deploy an Always On availability group listener.

Answer

Configure geo-replication and use the secondary server's public endpoint.