DP-300 Implement a secure environment Practice Test 10 — 15 Questions

Question 1

Your organization uses Azure SQL Database with Azure SQL Managed Instance for a multi-tenant SaaS application. You need to ensure that each tenant's data is isolated and that a compromised tenant cannot access other tenants' data. What is the most secure approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy a separate database per tenant, configure server-level firewall rules per tenant IP, and use Microsoft Entra authentication with application roles.. Deploying a separate database per tenant provides the strongest isolation boundary at the storage and compute layer. Combining server-level firewall rules that restrict access to each tenant's IP range and using Microsoft Entra authentication with application roles ensures that even if one tenant's credentials are compromised, the attacker cannot access another tenant's database. This multi-layered approach (network + authentication + authorization) is the most secure for multi-tenant isolation in Azure SQL Managed Instance.

Answer

Use dynamic data masking to obfuscate tenant IDs in query results.

Answer

Implement row-level security (RLS) with a tenant ID filter on all tables.

Answer

Use column-level encryption with Azure Key Vault for sensitive columns.

Question 2

Your company is migrating on-premises SQL Server databases to Azure SQL Managed Instance. You need to ensure that database backups are encrypted at rest using customer-managed keys stored in Azure Key Vault. You also need to allow the backup service to access the keys. What should you configure?

Accepted Answer

Enable Transparent Data Encryption (TDE) with customer-managed keys and grant the managed instance's system-assigned managed identity 'get', 'wrapKey', and 'unwrapKey' permissions on the key vault.. Transparent Data Encryption (TDE) with customer-managed keys (CMK) in Azure SQL Managed Instance encrypts database backups at rest. To allow the Azure backup service to access the key for backup encryption, the managed instance's system-assigned managed identity must be granted 'get', 'wrapKey', and 'unwrapKey' permissions on the Azure Key Vault where the CMK is stored. This ensures that backups are encrypted using the customer-controlled key, meeting the requirement for encryption at rest with customer-managed keys.

Answer

Use Always Encrypted with column master key stored in Azure Key Vault.

Answer

Configure Azure Backup for SQL Server in Azure VM and use Backup Center to manage encryption.

Answer

Configure server-level firewall rules to allow Azure services to access the server.

Question 3

You have an Azure SQL Database that stores financial data. You need to audit all SELECT operations on the 'Transactions' table and store the audit logs in an Azure Storage account. What should you use?

Accepted Answer

Configure server-level auditing to log to an Azure Storage account.. Azure SQL Database supports server-level auditing that can write audit logs directly to an Azure Storage account. This meets the requirement to audit SELECT operations on the 'Transactions' table and store logs in Azure Storage. Server-level auditing captures all database events, including SELECT statements, and can be configured to target a storage container.

Answer

Enable Microsoft Defender for Cloud on the server and review security insights.

Answer

Create a server audit using SQL Server Audit and specify a file destination.

Answer

Enable diagnostic settings for the database and send to a Log Analytics workspace.

Question 4

You are the database administrator for a healthcare organization that uses Azure SQL Database. You need to implement column-level encryption for a column containing patient Social Security numbers (SSNs). The SSNs must be encrypted at rest and in transit, and only authorized client applications should be able to decrypt them. Which technology should you use?

Accepted Answer

Always Encrypted with column master key stored in Azure Key Vault.. Always Encrypted is the correct choice because it ensures that sensitive data, such as SSNs, is encrypted both at rest and in transit, and the encryption keys are stored client-side (e.g., in Azure Key Vault). This design ensures that only authorized client applications with access to the column master key can decrypt the data, preventing even database administrators or cloud operators from viewing the plaintext values.

Answer

Row-level security (RLS) to restrict access based on user role.

Answer

Dynamic data masking (DDM) to mask SSNs for unauthorized users.

Answer

Transparent Data Encryption (TDE) with customer-managed keys.

Question 5

Your organization has a policy that all Azure SQL Database connections must use Microsoft Entra authentication. You need to ensure that application developers cannot accidentally use SQL authentication. What should you do?

Accepted Answer

Enable 'Azure AD-only authentication' on the logical server.. Enabling 'Azure AD-only authentication' on the logical server explicitly blocks all SQL authentication connections, including those from contained database users. This setting enforces that only Microsoft Entra ID (formerly Azure AD) principals can authenticate, directly aligning with the policy to prevent accidental use of SQL authentication.

Answer

Configure server-level firewall rules to block all IP addresses except Azure services.

Answer

Disable SQL authentication for all contained database users.

Answer

Create a database-level trigger to reject connections using SQL authentication.

Question 6

You manage an Azure SQL Database that is part of a business-critical application. You need to ensure that network traffic between the application hosted on Azure VMs and the database is encrypted and does not traverse the public internet. What should you configure?

Accepted Answer

Create a private endpoint for Azure SQL Database in the same virtual network as the application VMs.. Creating a private endpoint for Azure SQL Database places the database service on a private IP address within the same virtual network as the application VMs. This ensures that all traffic between the VMs and the database stays entirely within the Microsoft Azure backbone network, never traversing the public internet, while also providing encryption in transit via TLS by default.

Answer

Use TLS 1.2 for all connections to the database.

Answer

Configure server-level firewall rules to allow only the application VM IP addresses.

Answer

Enable forced tunneling on the application VMs to route all traffic through the on-premises network.

Question 7

Your organization requires that all changes to sensitive data in an Azure SQL Database be logged for compliance. You need to capture who changed what data and when, and store the logs in a Log Analytics workspace for analysis. What should you configure?

Accepted Answer

Configure server-level auditing to send logs to a Log Analytics workspace.. Server-level auditing in Azure SQL Database can be configured to send audit logs directly to a Log Analytics workspace, capturing detailed information about data changes including who made the change, what was changed, and when. This meets the compliance requirement for logging sensitive data changes and enables analysis using Log Analytics queries.

Answer

Enable change tracking on the database.

Answer

Enable Microsoft Defender for Cloud on the server.

Answer

Enable Transparent Data Encryption (TDE) with customer-managed keys.

Question 8

Your company uses Azure SQL Database and needs to comply with GDPR. You must implement data classification and protection. Which TWO actions should you take? (Choose two.)

Accepted Answer

Configure sensitivity labels using Microsoft Purview Information Protection.. Microsoft Purview Information Protection provides sensitivity labels that can be applied to columns in Azure SQL Database to classify and protect personal data, meeting GDPR requirements. These labels enforce encryption, access restrictions, and visual markings, integrating with Azure SQL's data classification capabilities.

Answer

Implement Always Encrypted for all columns containing personal data.

Answer

Install the Azure Information Protection client on all client machines.

Answer

Enable Microsoft Defender XDR for the database server.

Question 9

You are designing a secure Azure SQL Database environment for a financial services application. You need to meet the following requirements: - All network traffic to the database must be private and not traverse the public internet. - Only specific Azure resources in a virtual network should be able to connect. - The solution must minimize administrative overhead. Which TWO configurations should you implement? (Choose two.)

Accepted Answer

Configure the server firewall to deny all public network access.. Configuring the server firewall to deny all public network access ensures that no traffic can reach the database over the public internet, which is required for private connectivity. Option E is correct because creating a private endpoint for Azure SQL Database in the virtual network assigns a private IP address from the VNet, allowing traffic to stay entirely within the Microsoft backbone network and never traverse the public internet. Together, these two configurations enforce private-only access and meet the requirement for specific Azure resources in the VNet to connect.

Answer

Deploy Azure Bastion in the virtual network for secure connectivity.

Answer

Add a firewall rule to allow all Azure services to access the server.

Answer

Enable service endpoints for Azure SQL Database on the virtual network subnets.

Question 10

Your organization uses Azure SQL Managed Instance and needs to implement a defense-in-depth strategy. Which THREE security controls should you implement? (Choose three.)

Accepted Answer

Enable advanced threat protection using Microsoft Defender for Cloud.. Enabling advanced threat protection via Microsoft Defender for Cloud provides continuous monitoring for suspicious activities, such as SQL injection or brute-force attacks, and generates security alerts that integrate with Azure Sentinel or SIEM solutions. This is a critical layer in a defense-in-depth strategy, as it detects and responds to threats at the database level.

Answer

Create columnstore indexes on large tables to improve query performance.

Answer

Create application roles in each database to manage permissions.

Question 11

You are deploying a new Azure SQL Database that will store Personally Identifiable Information (PII). You need to ensure that the data is encrypted at rest and that access to encryption keys is logged. Which THREE actions should you take? (Choose three.)

Accepted Answer

Grant the managed identity of the database access to the key vault with 'get', 'wrapKey', and 'unwrapKey' permissions.. To use customer-managed TDE keys stored in Azure Key Vault, the Azure SQL Database's managed identity must be granted 'get', 'wrapKey', and 'unwrapKey' permissions. This allows the database to access the key for encryption and decryption operations while maintaining a secure, auditable key management chain.

Answer

Use Always Encrypted to encrypt all PII columns.

Answer

Configure TDE with service-managed keys.

Question 12

Your company uses Azure SQL Database with Microsoft Entra ID authentication. You need to ensure that only users from a specific Microsoft Entra ID tenant can access the database. What should you configure?

Accepted Answer

Create a server-level firewall rule with IP range '0.0.0.0' and then use Microsoft Entra ID authentication with a conditional access policy.. To restrict access to a specific Microsoft Entra ID tenant, you must first set the server-level firewall to allow all Azure IPs (0.0.0.0) so that Azure SQL Database can accept connections from any Azure resource, and then enforce tenant-level restrictions using a conditional access policy. This combination ensures that only users from the specified tenant can authenticate, while the firewall rule handles network-level access from Azure services.

Answer

Enable Azure AD conditional access policy to restrict sign-ins to the specific tenant.

Answer

Set the server firewall to allow only the tenant's IP range.

Answer

Configure a network security group (NSG) to block all traffic except from the tenant's IP range.

Question 13

You are designing a secure environment for Azure SQL Managed Instance. You need to ensure that all connections from client applications use a private endpoint, and no public endpoint is accessible. What should you configure?

Accepted Answer

Set the public endpoint to 'Disabled' and configure a private endpoint in the same virtual network with a private DNS zone.. Azure SQL Managed Instance requires the public endpoint to be explicitly disabled to ensure no public traffic can reach it. By configuring a private endpoint within the same virtual network and linking it to a private DNS zone, client applications resolve the managed instance's fully qualified domain name (FQDN) to the private IP address, enforcing all connections through the private endpoint and eliminating public endpoint accessibility.

Answer

Set the public endpoint to 'Enabled' and create a firewall rule with a deny-all rule.

Answer

Enable the public endpoint and use a VNet service tag in a firewall rule.

Answer

Use a VNet service endpoint for Azure SQL Managed Instance and configure a network security group.

Question 14

Your Azure SQL Database contains sensitive financial data. You need to audit all data modifications (INSERT, UPDATE, DELETE) and store the audit logs in a central Azure Storage account for compliance. What should you configure?

Accepted Answer

Enable auditing on the database and set the audit log destination to an Azure Storage account.. Azure SQL Database's built-in auditing feature can be configured to capture all data modifications (INSERT, UPDATE, DELETE) and write audit logs directly to an Azure Storage account. This meets the compliance requirement for centralized, durable storage of audit records without additional services or complex pipelines.

Answer

Configure diagnostic settings to stream query store data to an event hub.

Answer

Enable Microsoft Defender for SQL and configure security alerts to be sent to a storage account.

Answer

Enable SQL Vulnerability Assessment and export the results to a storage account.

Question 15

Your team uses Azure SQL Database and wants to use Microsoft Entra ID authentication. You need to create a contained database user mapped to a Microsoft Entra ID application (service principal). Which T-SQL command should you use?

Accepted Answer

CREATE USER [app-name] FROM EXTERNAL PROVIDER;. `CREATE USER [app-name] FROM EXTERNAL PROVIDER` creates a contained database user mapped to a Microsoft Entra ID identity (user, group, or application) directly in the database, without requiring a server-level login. This is the required syntax for authenticating a service principal (application) in Azure SQL Database using Microsoft Entra ID authentication.

Answer

CREATE USER [app-name] FROM LOGIN [app-name];

Answer

CREATE LOGIN [app-name] FROM EXTERNAL PROVIDER;

Answer

CREATE USER [app-name] WITH PASSWORD = 'password';