DP-300 Implement a secure environment Practice Test 11 — 15 Questions

Question 1

You need to ensure that all users accessing Azure SQL Database from outside the corporate network are required to use multi-factor authentication (MFA). What should you configure?

Accepted Answer

Configure a Conditional Access policy in Microsoft Entra ID.. Conditional Access policies in Microsoft Entra ID (formerly Azure AD) allow you to enforce MFA based on network location, device state, or risk level. By configuring a policy that targets the Azure SQL Database application and requires MFA for all access from outside the corporate network, you meet the requirement without altering the database or server configuration.

Answer

Enable Azure RBAC for the SQL server.

Answer

Create an Azure Policy to require MFA.

Answer

Turn on Transparent Data Encryption (TDE).

Question 2

You are the database administrator for a company that uses Azure SQL Database. You need to implement a security solution that automatically detects and alerts on suspicious activities, such as SQL injection attempts. Which feature should you enable?

Accepted Answer

Microsoft Defender for SQL. Microsoft Defender for SQL (formerly Azure Security Center's Advanced Threat Protection) is the correct feature because it continuously monitors database traffic for anomalous activities, including SQL injection, brute-force attacks, and privilege escalation. When suspicious behavior is detected, it generates a security alert that can be viewed in the Azure portal or integrated with Azure Sentinel for automated response. This is the only option among the choices that provides proactive threat detection and alerting for suspicious activities.

Answer

Azure SQL Auditing

Answer

SQL Vulnerability Assessment

Answer

Transparent Data Encryption (TDE)

Question 3

You need to encrypt sensitive columns in an Azure SQL Database table so that data is encrypted at rest and in transit between the application and database. Which feature should you use?

Accepted Answer

Always Encrypted. Always Encrypted is the correct choice because it encrypts sensitive data both at rest in the database and in transit between the application and the database. It ensures that encryption keys are never revealed to the database engine, so data remains encrypted throughout the entire data path, including during query execution. This meets the requirement for encryption at rest and in transit.

Answer

Row-Level Security

Answer

Transparent Data Encryption (TDE)

Answer

Dynamic Data Masking

Question 4

Your company uses Azure SQL Database with a server-level Microsoft Entra ID admin. You need to implement a solution where database-level roles are automatically assigned based on the user's group membership in Microsoft Entra ID. What should you use?

Accepted Answer

Create database users from Microsoft Entra ID groups and grant roles to those users.. Azure SQL Database supports creating database users mapped to Microsoft Entra ID (formerly Azure AD) groups. By creating a user for the Entra ID group and then granting database roles to that group user, all members of the group automatically inherit the assigned permissions. This directly satisfies the requirement for role assignment based on group membership without custom scripting or triggers.

Answer

Use Azure RBAC to assign roles to the Entra ID groups.

Answer

Configure a SQL Server Agent job to update database roles based on group membership.

Answer

Create a DDL trigger that assigns roles when users log in.

Question 5

Which TWO actions are required to enable Microsoft Entra ID authentication for an Azure SQL Database?

Accepted Answer

Set an Microsoft Entra ID admin for the Azure SQL Server.. Option B is correct because enabling Microsoft Entra ID authentication for Azure SQL Database requires provisioning a Microsoft Entra ID administrator at the Azure SQL logical server level, which establishes the trust relationship between the server and the Entra ID tenant. Option C is correct because after the Entra ID admin is set, you must create contained database users in the target database that are mapped to Entra ID identities (for example, CREATE USER [user@domain.com] FROM EXTERNAL PROVIDER), since Entra principals authenticate at the database level via contained users rather than server-level logins. Option A is incorrect because enabling SQL Server authentication only is the opposite of what is needed and does not enable Entra ID authentication. Option D is incorrect because assigning the SQL Server Contributor RBAC role grants Azure management-plane permissions, not data-plane authentication rights inside the database. Option E is incorrect because there is no separate 'Microsoft Entra ID integration' toggle to enable on the SQL server; the Entra ID admin setting itself establishes the integration.

Answer

Enable SQL Server authentication only.

Answer

Assign the SQL Server Contributor role to the Entra ID users.

Answer

Enable Azure AD integration on the SQL server.

Question 6

Which TWO are valid methods to connect to an Azure SQL Database without exposing a public endpoint?

Accepted Answer

Use a service endpoint. A service endpoint extends your virtual network private address space and the identity of your VNet to Azure SQL Database over a direct connection on the Azure backbone network. This allows you to secure your logical SQL server to accept traffic only from a specific subnet, eliminating the need for a public endpoint while still using the public endpoint's DNS name internally.

Answer

Use Always Encrypted

Answer

Use a public endpoint with a firewall rule

Answer

Use a site-to-site VPN gateway and connect to public endpoint

Question 7

Refer to the exhibit. You are reviewing an ARM template for an Azure SQL Database. The template configures backup retention. What is the effect of this configuration?

Accepted Answer

Point-in-time restore (PITR) backups are retained for 7 days, and differential backups occur every 12 hours.. The ARM template configures the backup retention settings for Azure SQL Database. By default, Azure SQL Database automatically performs full backups every week, differential backups every 12 hours, and transaction log backups every 5–10 minutes. The configuration shown sets the point-in-time restore (PITR) retention period to 7 days, meaning you can restore the database to any point within the last 7 days. Differential backups occur every 12 hours to support efficient PITR, but the retention setting directly controls how far back you can perform a point-in-time restore.

Answer

Full backups are taken every 12 hours and retained for 7 days.

Answer

Long-term retention (LTR) is set to 7 days.

Answer

Transaction log backups are taken every 12 hours.

Question 8

Refer to the exhibit. You are troubleshooting an Azure SQL Database auditing configuration. The exhibit shows the blob auditing policy. The storage account access key is null, and the subscription ID is all zeros. What is the most likely issue?

Accepted Answer

Auditing will fail because the storage account access key is null.. The exhibit shows that the storage account access key is null, which means Azure SQL Database cannot authenticate to the storage account using the access key. Without a valid access key or a configured managed identity, blob auditing will fail because the database cannot write audit logs to the specified storage container. Option C is correct because a null access key directly prevents auditing from functioning when no alternative authentication method is configured.

Answer

Auditing will fall back to Log Analytics workspace.

Answer

Auditing will work because managed identity is used.

Answer

Auditing will write to the storage account using the system-assigned managed identity.

Question 9

Refer to the exhibit. You run these commands in an Azure SQL Database. What is the result?

Accepted Answer

A Microsoft Entra ID user is created and granted read access to the database.. The commands create a user in an Azure SQL Database mapped to a Microsoft Entra ID (formerly Azure AD) identity. The CREATE USER statement with FROM EXTERNAL PROVIDER creates a user that corresponds to an Entra ID user or group. The ALTER ROLE statement then adds this user to the db_datareader database role, granting read access to all tables and views. Therefore, option D correctly describes the outcome: a Microsoft Entra ID user is created and granted read access.

Answer

The user is created but not granted any permissions.

Answer

The commands fail because Entra ID users cannot be created in Azure SQL Database.

Answer

A SQL Server authentication user is created and granted read access.

Question 10

You need to audit all successful and failed login attempts on an Azure SQL Database. Which feature should you enable?

Accepted Answer

SQL Server Audit with a server-level audit specification that includes SUCCESSFUL_LOGIN_GROUP and FAILED_LOGIN_GROUP.. SQL Server Audit is the correct feature because it allows you to capture both successful and failed login attempts at the server level by defining a server audit specification that includes the SUCCESSFUL_LOGIN_GROUP and FAILED_LOGIN_GROUP audit action groups. These groups specifically log authentication events, which is exactly what is needed to audit all login attempts. Microsoft Defender for SQL, Vulnerability Assessment, and regulatory compliance dashboards do not provide granular login event auditing.

Answer

Microsoft Defender for SQL threat detection.

Answer

SQL Vulnerability Assessment.

Answer

Enable Microsoft Defender for Cloud's regulatory compliance dashboard.

Question 11

You are designing a security strategy for Azure SQL Managed Instance. The compliance team requires that all database backups be encrypted at rest using a customer-managed key. Which feature should you enable?

Accepted Answer

Transparent Data Encryption (TDE) with a customer-managed key stored in Azure Key Vault.. Transparent Data Encryption (TDE) with a customer-managed key stored in Azure Key Vault is the correct feature because it encrypts the database at rest, including all backup files, using a key that the customer controls. This satisfies the compliance requirement for customer-managed key encryption of backups, as TDE automatically encrypts backups when the database is encrypted.

Answer

Always Encrypted with a column master key in Azure Key Vault.

Answer

Transparent Data Encryption (TDE) with a service-managed key.

Answer

Row-Level Security (RLS) with a custom authorization function.

Question 12

Your company has a strict policy that all Azure SQL Databases must have Microsoft Defender for SQL enabled. You need to enforce this policy across all subscriptions using a scalable, automated approach. What should you do?

Accepted Answer

Create an Azure Policy initiative that includes the 'Configure Microsoft Defender for SQL to be enabled' policy and assign it to the root management group.. Azure Policy provides a scalable, automated, and continuous enforcement mechanism across all subscriptions. By creating an initiative that includes the 'Configure Microsoft Defender for SQL to be enabled' policy and assigning it to the root management group, you ensure that any new or existing subscription inherits the policy, and non-compliant resources are automatically remediated or flagged. This approach aligns with the requirement for a strict, company-wide policy without manual intervention.

Answer

Use Azure Blueprints to deploy a predefined ARM template that enables Defender for SQL.

Answer

Create a script that runs periodically to check and enable Defender for SQL on all databases.

Answer

Assign the 'SQL Security Manager' role to a central team to manually enable Defender for SQL.

Question 13

Which THREE of the following are required to configure Microsoft Entra authentication for an Azure SQL Managed Instance?

Accepted Answer

Enable the managed instance system-assigned managed identity.. Enabling the system-assigned managed identity for Azure SQL Managed Instance is required because Microsoft Entra authentication relies on this identity to authenticate the instance itself against Microsoft Entra ID. Without a managed identity, the instance cannot securely obtain tokens or perform directory lookups needed for authentication and authorization.

Answer

Ensure the managed instance is deployed in a different virtual network from the clients.

Answer

Configure the managed instance to allow public network access.

Question 14

Which TWO of the following are best practices for managing firewall rules for Azure SQL Database?

Accepted Answer

Use Azure Private Link to connect from Azure VNets instead of opening firewall rules to IP ranges.. Option C is correct because Azure Private Link (Private Endpoint) gives Azure SQL Database a private IP inside your VNet, so clients connect over the Microsoft backbone without any public IP firewall rules, which is the recommended way to restrict access from Azure VNets. Option D is correct because Azure Activity Logs record control-plane operations such as creating, updating, or deleting firewall rules, providing the audit trail needed to detect unauthorized or accidental rule changes. Options A and B are not best practices: IP-based rules for all clients, especially Azure services, expose the logical server to the public internet, and broad ranges like 0.0.0.0/0 defeat the purpose of a firewall. Option E is not recommended because the 'Allow Azure Services' rule (0.0.0.0) permits connections from any Azure tenant, not just your own resources, so it should be avoided in favor of Private Link or specific IP rules.

Answer

Use IP-based firewall rules for all client connections, including Azure services.

Answer

Create firewall rules with broad IP ranges (e.g., 0.0.0.0/0) to simplify management.

Answer

Enable the 'Allow Azure Services' firewall rule to allow connections from Azure services.

Question 15

You are deploying an Azure SQL Database that will contain highly sensitive personal data. The security policy requires that the data be encrypted at rest, in transit, and in use. Additionally, the encryption keys must be stored in a hardware security module (HSM) and be customer-managed. Which combination of features should you implement?

Accepted Answer

TDE with a customer-managed key in Azure Key Vault (HSM-backed), enforce TLS 1.2, and Always Encrypted with a column master key in Azure Key Vault (HSM-backed).. It satisfies all requirements: encryption at rest via TDE with a customer-managed key stored in an HSM-backed Key Vault, encryption in transit by enforcing TLS 1.2, and encryption in use via Always Encrypted with the column master key also stored in an HSM-backed Key Vault. This ensures that all three states of data are encrypted and that keys are both customer-managed and hardware-protected.

Answer

TDE with a service-managed key, enforce TLS 1.2, and Always Encrypted with a column master key in Key Vault.

Answer

TDE with a customer-managed key in Key Vault, enforce TLS 1.2, and use Dynamic Data Masking.

Answer

TDE with a customer-managed key in Key Vault, enforce TLS 1.2, and Always Encrypted with a column master key stored in Windows Certificate Store.