DP-300 Practice Test 50 — 15 Questions

Question 1

Your company uses Azure SQL Database with active geo-replication for disaster recovery. The primary database is in the West Europe region. You need to perform a planned failover to the secondary in North Europe for a maintenance window. Which THREE actions should you take? (Choose three.)

Accepted Answer

After failover, verify that the new secondary (in West Europe) is configured as a readable secondary.. Options A, C, and D are correct. A planned failover ensures no data loss by synchronizing all transactions before switching. After failover, the new primary should have a readable secondary or geo-replication configured to maintain DR. Updating the connection string is necessary for applications. Option B is wrong because you want to avoid data loss. Option E is wrong because seeding is automatic.

Answer

Initiate a forced failover to ensure the fastest switchover.

Answer

Manually seed the new secondary database after failover.

Question 2

You are the database administrator for a global e-commerce company that runs its critical order processing system on Azure SQL Database. The database is currently deployed as a single database in the West US region using the Business Critical service tier (4 vCores, 320 GB storage). The application requires a Recovery Point Objective (RPO) of no more than 5 seconds and a Recovery Time Objective (RTO) of no more than 30 seconds in the event of a regional outage. The secondary region must be in East Asia. The solution must also handle planned failovers for maintenance without data loss. You need to configure high availability and disaster recovery to meet these requirements with the lowest possible latency for writes. What should you do?

Accepted Answer

Create a failover group with an active geo-replication secondary in East Asia. Set the failover policy to automatic with a grace period of 1 hour. Ensure the secondary is configured for synchronous commit.. Option B is correct because a failover group with active geo-replication and automatic failover policy meets the RPO of 5 seconds and RTO of 30 seconds, as the secondary is readable and synchronous commit is used for zero data loss. Option A is incorrect because geo-restore has an RPO of 1 hour and RTO of several hours. Option C is incorrect because auto-failover groups with read-scale failover are for readable secondaries but do not guarantee synchronous commit across regions. Option D is incorrect because zone redundancy provides HA within a region, not DR across regions.

Answer

Configure geo-restore of the database to the East Asia region. Enable auto-failover groups with manual failover.

Answer

Deploy the database as a zone-redundant configuration within West US. Use Azure Traffic Manager to redirect traffic to a secondary database in East Asia.

Answer

Configure auto-failover groups with read-scale failover. Deploy a readable secondary in East Asia using the Business Critical tier. Set the failover policy to automatic.

Question 3

You have an Azure SQL Database that stores financial data. You need to audit all SELECT operations on the 'Transactions' table and store the audit logs in an Azure Storage account. What should you use?

Accepted Answer

Configure server-level auditing to log to an Azure Storage account.. Option D is correct because Azure SQL Database supports server-level auditing that can write audit logs directly to an Azure Storage account. This meets the requirement to audit SELECT operations on the 'Transactions' table and store logs in Azure Storage. Server-level auditing captures all database events, including SELECT statements, and can be configured to target a storage container.

Answer

Enable Microsoft Defender for Cloud on the server and review security insights.

Answer

Create a server audit using SQL Server Audit and specify a file destination.

Answer

Enable diagnostic settings for the database and send to a Log Analytics workspace.

Question 4

You are a database administrator for an Azure SQL Database. You need to ensure that only specific client IP addresses can connect to the database, while all other traffic is blocked. You also need to allow Azure services to access the database. What should you configure?

Accepted Answer

Configure server-level firewall rules to allow the specific client IP addresses and enable the 'Allow Azure services and resources to access this server' setting.. Option D is correct because Azure SQL Database uses server-level firewall rules to control inbound access. By adding rules for specific client IP addresses and enabling the 'Allow Azure services and resources to access this server' setting, you restrict connections to only those IPs while permitting Azure internal services (e.g., Azure Logic Apps, Azure Functions) to connect. This setting leverages the Azure SQL firewall, which evaluates source IP addresses against the configured rules before allowing a connection.

Answer

Disable public network access and configure a service endpoint.

Answer

Configure a private endpoint and disable public network access.

Answer

Configure network security group (NSG) rules on the subnet where the Azure SQL Database is deployed.

Question 5

You are reviewing an Azure RBAC role assignment for an Azure SQL Database. The role assignment shown in the exhibit is intended to allow a user to read data from the database. However, the user reports they cannot connect to the database. What is the most likely reason?

Accepted Answer

The RBAC role does not grant data plane access; the user must be mapped to a database user and granted database-level permissions.. Azure RBAC roles control management plane operations (e.g., creating or deleting resources) but do not grant access to the data plane (e.g., reading or writing data in a database). To read data from an Azure SQL Database, the user must be mapped to a database user (via a contained database user or an Azure AD user) and granted database-level permissions such as db_datareader. The RBAC role assignment shown only provides the 'Microsoft.Sql/servers/databases/read' action, which allows reading database metadata (like tags or properties) but not connecting to the database or querying tables.

Answer

The principal is incorrectly specified; it should be a security group.

Answer

The scope is too broad; it should be at the server level.

Answer

The action 'Microsoft.Sql/servers/databases/read' is not valid; it should be 'Microsoft.Sql/servers/databases/dataReader'.

Question 6

You are reviewing a JSON representation of an Azure SQL Database firewall rule. What is the effect of this rule?

Accepted Answer

Allows all IP addresses from 10.0.0.0 to 10.0.0.255.. The JSON representation of the Azure SQL Database firewall rule with startIpAddress '10.0.0.0' and endIpAddress '10.0.0.255' defines a range that allows all IP addresses from 10.0.0.0 to 10.0.0.255 inclusive. Azure SQL Database firewall rules use inclusive IP range matching, so any client with an IP in that range is permitted to connect, provided the rule is enabled.

Answer

Blocks all IP addresses from 10.0.0.0 to 10.0.0.255.

Answer

Allows all IP addresses except 10.0.0.0 to 10.0.0.255.

Answer

Allows only the IP address 10.0.0.0.

Question 7

You are designing a secure architecture for Azure SQL Managed Instance. You need to ensure that all connections to the instance are encrypted and that the instance can only be accessed from a specific virtual network. Which TWO configurations should you implement?

Accepted Answer

Configure the managed instance with the 'Force encryption' property set to Enabled.. Option C is correct because setting the 'Force encryption' property to Enabled on Azure SQL Managed Instance ensures that all client connections are encrypted using TLS, enforcing encryption in transit. This is a critical security control to protect data from interception or tampering during transmission.

Answer

Configure a service endpoint on the subnet of the managed instance.

Answer

Deploy the managed instance outside a virtual network.

Answer

Attach a private endpoint to the managed instance.

Question 8

Your company has a strict policy that Azure SQL Database backups must be encrypted with customer-managed keys stored in Azure Key Vault. You configure TDE with AKV integration. After a key rotation, you find that long-running queries start failing with encryption errors. What is the most likely cause?

Accepted Answer

The previous key version was disabled or deleted in AKV.. When TDE is configured with Azure Key Vault (AKV) integration, the database uses the current key version from AKV to encrypt and decrypt data. If the previous key version is disabled or deleted during a key rotation, any long-running queries that still rely on that specific key version for decryption will fail with encryption errors. The database cannot automatically fall back to the new key version for in-flight operations that started before the rotation.

Answer

The service principal used for AKV access has expired.

Answer

The new key is in a different Azure region than the database.

Answer

The database is using service-managed TDE and cannot switch to customer-managed keys.

Question 9

Which TWO of the following are best practices for securing Azure SQL Database?

Accepted Answer

Enable firewall rules to restrict access to specific IP addresses.. Option D is correct because Azure SQL Database firewall rules allow you to restrict access to specific IP address ranges, which is a fundamental network security best practice. By limiting inbound traffic to only trusted IPs, you reduce the attack surface and prevent unauthorized connections from unknown sources. This is a first line of defense in a defense-in-depth strategy for securing Azure SQL Database.

Answer

Enable Auditing to block malicious queries.

Answer

Enable TDE to prevent SQL injection attacks.

Answer

Use SQL authentication with complex passwords.

Question 10

Match each Azure Database for PostgreSQL pricing tier to its key feature.

Question 11

You are configuring Azure SQL Database firewall rules. You need to allow a range of IP addresses (192.168.1.0 to 192.168.1.255) to connect to the database. Which firewall rule should you create?

Accepted Answer

Start IP: 192.168.1.0, End IP: 192.168.1.255. Option B is correct because Azure SQL Database firewall rules require a contiguous range of IP addresses defined by a start and end IP. The range 192.168.1.0 to 192.168.1.255 exactly covers the specified /24 subnet, allowing all hosts in that block to connect. This is the standard method for permitting a subnet in Azure SQL firewall configuration.

Answer

Start IP: 192.168.0.0, End IP: 192.168.2.255

Answer

Start IP: 192.168.1.255, End IP: 192.168.1.0

Answer

Start IP: 192.168.1.0, End IP: 192.168.1.0

Question 12

Your organization has an Azure SQL Database server. You need to ensure that only applications running on Azure virtual machines in a specific virtual network can connect to the database. Which THREE actions should you take?

Accepted Answer

Add a virtual network rule for the specific subnet of the VMs.. Option B is correct because adding a virtual network rule for the specific subnet of the VMs allows Azure SQL Database to accept traffic only from that subnet when a service endpoint is enabled. This restricts access to the database to only those applications running on Azure VMs within the specified virtual network, ensuring network-level isolation.

Answer

Add a service endpoint for Azure SQL Database to the virtual network.

Answer

Set the 'Allow Azure Services and resources to access this server' setting to ON.

Question 13

Your company uses Azure SQL Database. You need to ensure that all connections to the database use TLS 1.2 or higher. Currently, some client applications are connecting using TLS 1.0. What should you do?

Accepted Answer

Set the 'Minimum TLS version' property of the logical server to 1.2.. Option B is correct because setting the 'Minimum TLS version' property of the Azure SQL logical server to 1.2 enforces that all incoming connections must use TLS 1.2 or higher. This server-level setting overrides any client-side configuration, blocking connections that attempt to use TLS 1.0 or 1.1. It is the simplest and most effective way to enforce the minimum TLS version across all client applications without requiring changes to each client.

Answer

Configure the server firewall to block non-TLS traffic.

Answer

Set the 'tls_version' database parameter to 1.2 in the master database.

Answer

Update the client applications to only use TLS 1.2.

Question 14

You are troubleshooting a connection issue from Azure SQL Database to Azure Storage using a managed identity. The above credential was created. What is missing from this configuration?

Accepted Answer

The credential is missing the SECRET parameter.. The credential is missing the SECRET parameter because when using a managed identity to access Azure Storage from Azure SQL Database, the credential must specify the identity's client ID or object ID as the SECRET. Without this, the credential cannot authenticate to the storage account, causing the connection to fail. The SECRET parameter is required to map the managed identity to the credential for Azure AD authentication.

Answer

The credential should be a server-level credential.

Answer

The credential lacks a valid identity.

Answer

The credential needs to include the storage account name.

Question 15

Your company uses Azure SQL Database and needs to audit all data modifications (INSERT, UPDATE, DELETE) for compliance. You enable SQL Database auditing and configure a storage account for logs. However, you notice that some DELETE operations are not being audited. What could be the cause?

Accepted Answer

The audit is configured to capture only successful operations.. Option C is correct because Azure SQL Database auditing can be configured to capture only successful operations or only failed operations, or both. If the audit is set to capture only successful operations, DELETE operations that fail (e.g., due to permissions or constraint violations) will not be logged. The question states that some DELETE operations are missing, which aligns with a filter that excludes failed operations.

Answer

The diagnostic setting is configured incorrectly.

Answer

The storage account firewall is blocking the audit logs.

Answer

The database has Transparent Data Encryption (TDE) enabled.