DP-300 Implement a secure environment Practice Test 10 — 15 Questions

Question 1

Your organization has a policy that all Azure SQL Database connections must use Microsoft Entra authentication. You need to ensure that application developers cannot accidentally use SQL authentication. What should you do?

Accepted Answer

Enable 'Azure AD-only authentication' on the logical server.. Option D is correct because enabling 'Azure AD-only authentication' on the logical server explicitly blocks all SQL authentication connections, including those from contained database users. This setting enforces that only Microsoft Entra ID (formerly Azure AD) principals can authenticate, directly aligning with the policy to prevent accidental use of SQL authentication.

Answer

Configure server-level firewall rules to block all IP addresses except Azure services.

Answer

Disable SQL authentication for all contained database users.

Answer

Create a database-level trigger to reject connections using SQL authentication.

Question 2

You manage an Azure SQL Database that is part of a business-critical application. You need to ensure that network traffic between the application hosted on Azure VMs and the database is encrypted and does not traverse the public internet. What should you configure?

Accepted Answer

Create a private endpoint for Azure SQL Database in the same virtual network as the application VMs.. Option D is correct because creating a private endpoint for Azure SQL Database places the database service on a private IP address within the same virtual network as the application VMs. This ensures that all traffic between the VMs and the database stays entirely within the Microsoft Azure backbone network, never traversing the public internet, while also providing encryption in transit via TLS by default.

Answer

Use TLS 1.2 for all connections to the database.

Answer

Configure server-level firewall rules to allow only the application VM IP addresses.

Answer

Enable forced tunneling on the application VMs to route all traffic through the on-premises network.

Question 3

Your organization requires that all changes to sensitive data in an Azure SQL Database be logged for compliance. You need to capture who changed what data and when, and store the logs in a Log Analytics workspace for analysis. What should you configure?

Accepted Answer

Configure server-level auditing to send logs to a Log Analytics workspace.. Server-level auditing in Azure SQL Database can be configured to send audit logs directly to a Log Analytics workspace, capturing detailed information about data changes including who made the change, what was changed, and when. This meets the compliance requirement for logging sensitive data changes and enables analysis using Log Analytics queries.

Answer

Enable change tracking on the database.

Answer

Enable Microsoft Defender for Cloud on the server.

Answer

Enable Transparent Data Encryption (TDE) with customer-managed keys.

Question 4

Your company uses Azure SQL Database and needs to comply with GDPR. You must implement data classification and protection. Which TWO actions should you take? (Choose two.)

Accepted Answer

Configure sensitivity labels using Microsoft Purview Information Protection.. Option A is correct because Microsoft Purview Information Protection provides sensitivity labels that can be applied to columns in Azure SQL Database to classify and protect personal data, meeting GDPR requirements. These labels enforce encryption, access restrictions, and visual markings, integrating with Azure SQL's data classification capabilities.

Answer

Implement Always Encrypted for all columns containing personal data.

Answer

Install the Azure Information Protection client on all client machines.

Answer

Enable Microsoft Defender XDR for the database server.

Question 5

You are designing a secure Azure SQL Database environment for a financial services application. You need to meet the following requirements: - All network traffic to the database must be private and not traverse the public internet. - Only specific Azure resources in a virtual network should be able to connect. - The solution must minimize administrative overhead. Which TWO configurations should you implement? (Choose two.)

Accepted Answer

Configure the server firewall to deny all public network access.. Options A and C are correct. Option A ensures private connectivity. Option C restricts access to specific subnets. Option B is incorrect because service endpoints also allow access from other services in the same VNet but do not provide a private IP; private endpoints are more secure. Option D is incorrect because enabling firewall rules for all Azure services opens access broadly. Option E is incorrect because Azure Bastion is for VM management, not database connectivity.

Answer

Deploy Azure Bastion in the virtual network for secure connectivity.

Answer

Add a firewall rule to allow all Azure services to access the server.

Answer

Enable service endpoints for Azure SQL Database on the virtual network subnets.

Question 6

Your organization uses Azure SQL Managed Instance and needs to implement a defense-in-depth strategy. Which THREE security controls should you implement? (Choose three.)

Accepted Answer

Enable advanced threat protection using Microsoft Defender for Cloud.. Option A is correct because enabling advanced threat protection via Microsoft Defender for Cloud provides continuous monitoring for suspicious activities, such as SQL injection or brute-force attacks, and generates security alerts that integrate with Azure Sentinel or SIEM solutions. This is a critical layer in a defense-in-depth strategy, as it detects and responds to threats at the database level.

Answer

Create columnstore indexes on large tables to improve query performance.

Answer

Create application roles in each database to manage permissions.

Question 7

You are deploying a new Azure SQL Database that will store Personally Identifiable Information (PII). You need to ensure that the data is encrypted at rest and that access to encryption keys is logged. Which THREE actions should you take? (Choose three.)

Accepted Answer

Grant the managed identity of the database access to the key vault with 'get', 'wrapKey', and 'unwrapKey' permissions.. Option B is correct because to use customer-managed TDE keys stored in Azure Key Vault, the Azure SQL Database's managed identity must be granted 'get', 'wrapKey', and 'unwrapKey' permissions. This allows the database to access the key for encryption and decryption operations while maintaining a secure, auditable key management chain.

Answer

Use Always Encrypted to encrypt all PII columns.

Answer

Configure TDE with service-managed keys.

Question 8

Your company uses Azure SQL Database with Microsoft Entra ID authentication. You need to ensure that only users from a specific Microsoft Entra ID tenant can access the database. What should you configure?

Accepted Answer

Create a server-level firewall rule with IP range '0.0.0.0' and then use Microsoft Entra ID authentication with a conditional access policy.. Option C is correct because to restrict access to a specific Microsoft Entra ID tenant, you must first set the server-level firewall to allow all Azure IPs (0.0.0.0) so that Azure SQL Database can accept connections from any Azure resource, and then enforce tenant-level restrictions using a conditional access policy. This combination ensures that only users from the specified tenant can authenticate, while the firewall rule handles network-level access from Azure services.

Answer

Enable Azure AD conditional access policy to restrict sign-ins to the specific tenant.

Answer

Set the server firewall to allow only the tenant's IP range.

Answer

Configure a network security group (NSG) to block all traffic except from the tenant's IP range.

Question 9

You are designing a secure environment for Azure SQL Managed Instance. You need to ensure that all connections from client applications use a private endpoint, and no public endpoint is accessible. What should you configure?

Accepted Answer

Set the public endpoint to 'Disabled' and configure a private endpoint in the same virtual network with a private DNS zone.. Option C is correct because Azure SQL Managed Instance requires the public endpoint to be explicitly disabled to ensure no public traffic can reach it. By configuring a private endpoint within the same virtual network and linking it to a private DNS zone, client applications resolve the managed instance's fully qualified domain name (FQDN) to the private IP address, enforcing all connections through the private endpoint and eliminating public endpoint accessibility.

Answer

Set the public endpoint to 'Enabled' and create a firewall rule with a deny-all rule.

Answer

Enable the public endpoint and use a VNet service tag in a firewall rule.

Answer

Use a VNet service endpoint for Azure SQL Managed Instance and configure a network security group.

Question 10

Your Azure SQL Database contains sensitive financial data. You need to audit all data modifications (INSERT, UPDATE, DELETE) and store the audit logs in a central Azure Storage account for compliance. What should you configure?

Accepted Answer

Enable auditing on the database and set the audit log destination to an Azure Storage account.. Option A is correct because Azure SQL Database's built-in auditing feature can be configured to capture all data modifications (INSERT, UPDATE, DELETE) and write audit logs directly to an Azure Storage account. This meets the compliance requirement for centralized, durable storage of audit records without additional services or complex pipelines.

Answer

Configure diagnostic settings to stream query store data to an event hub.

Answer

Enable Microsoft Defender for SQL and configure security alerts to be sent to a storage account.

Answer

Enable SQL Vulnerability Assessment and export the results to a storage account.

Question 11

Your team uses Azure SQL Database and wants to use Microsoft Entra ID authentication. You need to create a contained database user mapped to a Microsoft Entra ID application (service principal). Which T-SQL command should you use?

Accepted Answer

CREATE USER [app-name] FROM EXTERNAL PROVIDER;. Option D is correct because `CREATE USER [app-name] FROM EXTERNAL PROVIDER` creates a contained database user mapped to a Microsoft Entra ID identity (user, group, or application) directly in the database, without requiring a server-level login. This is the required syntax for authenticating a service principal (application) in Azure SQL Database using Microsoft Entra ID authentication.

Answer

CREATE USER [app-name] FROM LOGIN [app-name];

Answer

CREATE LOGIN [app-name] FROM EXTERNAL PROVIDER;

Answer

CREATE USER [app-name] WITH PASSWORD = 'password';

Question 12

You are responsible for securing an Azure SQL Database. You need to implement data masking for a column that contains credit card numbers, ensuring that users with the db_datareader role see a masked version. However, users with the db_owner role should see the unmasked data. What should you configure?

Accepted Answer

Apply Dynamic Data Masking (DDM) to the credit card column.. Dynamic Data Masking (DDM) is the correct choice because it allows you to obfuscate sensitive data in query results for non-privileged users (like db_datareader) while permitting users with elevated permissions (like db_owner) to see the unmasked data. DDM is applied at the column level and does not modify the underlying data; it simply masks the output based on the user's permissions. The db_owner role is exempt from masking by default, meeting the requirement exactly.

Answer

Implement Row-Level Security (RLS) to filter rows based on user role.

Answer

Implement Always Encrypted with deterministic encryption.

Answer

Enable Transparent Data Encryption (TDE).

Question 13

Your Azure SQL Database is protected by a failover group. You need to ensure that during a failover to the secondary region, only authenticated applications can connect. What should you configure?

Accepted Answer

Use the failover group listener endpoint with Microsoft Entra ID authentication.. The failover group listener endpoint provides a DNS name that automatically points to the current primary region. By configuring Microsoft Entra ID authentication on the logical server, you ensure that only authenticated applications (using Microsoft Entra tokens) can connect, even after a failover. This eliminates reliance on SQL authentication passwords, which could be compromised or misconfigured across regions.

Answer

Set up a private endpoint for each region and update connection strings manually.

Answer

Deploy an Always On availability group listener.

Answer

Configure geo-replication and use the secondary server's public endpoint.

Question 14

You are reviewing an ARM template for Azure SQL Database. The exhibit shows a resource definition for Transparent Data Encryption (TDE). You need to ensure that the database uses customer-managed keys (CMK) stored in Azure Key Vault instead of service-managed keys. What additional configuration is required?

Accepted Answer

Add a resource of type 'Microsoft.Sql/servers/encryptionProtector' and reference the key vault key.. Option A is correct because to use CMK, you must configure an Azure Key Vault and set the database's encryption protector to the key. Option B is wrong because TDE is already enabled; CMK requires a specific protector. Option C is wrong because the encryption protector is set at the server level, not database. Option D is wrong because Always Encrypted is a different feature.

Answer

Modify the database resource to include a 'keyVaultUri' property.

Answer

Enable Always Encrypted on the database.

Answer

Set the TDE state to 'Disabled' and then re-enable with a customer key.

Question 15

You are reviewing a PowerShell script that configures auditing for an Azure SQL Database. The script sets an audit rule with the specified parameters. After running the script, you notice that SELECT operations are not being audited. What is the most likely cause?

Accepted Answer

The AuditActionGroup specified does not capture SELECT operations.. The script likely specifies an AuditActionGroup that does not include the group responsible for capturing SELECT operations. In Azure SQL Database auditing, SELECT operations are captured by the SUCCESSFUL_SCHEMA_OBJECT_ACCESS_GROUP or similar action groups. If the configured AuditActionGroup omits this group, SELECT statements will not be logged, even though other operations may be audited correctly.

Answer

The retention days are set too low, causing logs to be overwritten.

Answer

The storage endpoint is incorrectly formatted.

Answer

The storage account access key is invalid.