DP-300 Implement a secure environment Practice Test 11 — 15 Questions

Question 1

You are responsible for securing an Azure SQL Database. You need to implement data masking for a column that contains credit card numbers, ensuring that users with the db_datareader role see a masked version. However, users with the db_owner role should see the unmasked data. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply Dynamic Data Masking (DDM) to the credit card column.. Dynamic Data Masking (DDM) is the correct choice because it allows you to obfuscate sensitive data in query results for non-privileged users (like db_datareader) while permitting users with elevated permissions (like db_owner) to see the unmasked data. DDM is applied at the column level and does not modify the underlying data; it simply masks the output based on the user's permissions. The db_owner role is exempt from masking by default, meeting the requirement exactly.

Answer

Implement Row-Level Security (RLS) to filter rows based on user role.

Answer

Implement Always Encrypted with deterministic encryption.

Answer

Enable Transparent Data Encryption (TDE).

Question 2

Your Azure SQL Database is protected by a failover group. You need to ensure that during a failover to the secondary region, only authenticated applications can connect. What should you configure?

Accepted Answer

Use the failover group listener endpoint with Microsoft Entra ID authentication.. The failover group listener endpoint provides a DNS name that automatically points to the current primary region. By configuring Microsoft Entra ID authentication on the logical server, you ensure that only authenticated applications (using Microsoft Entra tokens) can connect, even after a failover. This eliminates reliance on SQL authentication passwords, which could be compromised or misconfigured across regions.

Answer

Set up a private endpoint for each region and update connection strings manually.

Answer

Deploy an Always On availability group listener.

Answer

Configure geo-replication and use the secondary server's public endpoint.

Question 3

You are reviewing an ARM template for Azure SQL Database. The exhibit shows a resource definition for Transparent Data Encryption (TDE). You need to ensure that the database uses customer-managed keys (CMK) stored in Azure Key Vault instead of service-managed keys. What additional configuration is required?

Accepted Answer

Add a resource of type 'Microsoft.Sql/servers/encryptionProtector' and reference the key vault key.. To use customer-managed keys (CMK) for Transparent Data Encryption (TDE) in Azure SQL Database, you must configure an encryption protector that points to the key in Azure Key Vault. This is done by adding a resource of type 'Microsoft.Sql/servers/encryptionProtector' to the ARM template, which sets the server-level encryption protector to use the specified key vault key. Option D correctly identifies this required resource, as TDE with CMK is managed at the server level, not directly on the database resource.

Answer

Modify the database resource to include a 'keyVaultUri' property.

Answer

Enable Always Encrypted on the database.

Answer

Set the TDE state to 'Disabled' and then re-enable with a customer key.

Question 4

You are reviewing a PowerShell script that configures auditing for an Azure SQL Database. The script sets an audit rule with the specified parameters. After running the script, you notice that SELECT operations are not being audited. What is the most likely cause?

Accepted Answer

The AuditActionGroup specified does not capture SELECT operations.. The script likely specifies an AuditActionGroup that does not include the group responsible for capturing SELECT operations. In Azure SQL Database auditing, SELECT operations are captured by the SUCCESSFUL_SCHEMA_OBJECT_ACCESS_GROUP or similar action groups. If the configured AuditActionGroup omits this group, SELECT statements will not be logged, even though other operations may be audited correctly.

Answer

The retention days are set too low, causing logs to be overwritten.

Answer

The storage endpoint is incorrectly formatted.

Answer

The storage account access key is invalid.

Question 5

You run the Azure CLI command shown in the exhibit for an Azure SQL Database named SalesDB. The output shows that the security alert policy is disabled. You need to enable Microsoft Defender for SQL, including vulnerability assessments, for this database. What should you do?

Accepted Answer

Run 'az sql server update --name sql-sales --resource-group rg-sales --enable-defender-for-sql true'.. Enabling Microsoft Defender for SQL, including vulnerability assessments, is a server-level configuration in Azure SQL. The command 'az sql server update --enable-defender-for-sql true' activates Defender for SQL on the server, which automatically applies to all databases on that server, including SalesDB. The exhibit shows a database-level security alert policy is disabled, but the required feature is enabled at the server scope, not per-database.

Answer

Run 'az sql db update --name SalesDB --resource-group rg-sales --server sql-sales --enable-defender-for-sql true'.

Answer

Run 'az sql db threat-policy update --name SalesDB --resource-group rg-sales --server sql-sales --state Enabled'.

Answer

Configure a server firewall rule to allow Azure services.

Question 6

Your company uses Azure SQL Database and wants to implement row-level security (RLS) to restrict access to customer data based on the user's Microsoft Entra ID group membership. Which TWO actions are required?

Accepted Answer

Create a security policy that uses a predicate function.. Row-level security (RLS) in Azure SQL Database restricts data access at the row level by using a security policy that invokes a predicate function. The predicate function defines the logic for filtering rows, such as checking the caller's Microsoft Entra ID group membership via IS_MEMBER(). Therefore, creating both the predicate function (Option E) and the security policy that uses it (Option C) are required steps.

Answer

Create a column master key for the secured columns.

Answer

Grant the user the db_securityadmin server role.

Answer

Apply a dynamic data masking rule to hide sensitive columns.

Question 7

Your Azure SQL Database is accessed by multiple applications. You need to ensure that all connections use Transport Layer Security (TLS) 1.2 or higher. Which TWO configurations should you verify or enable?

Accepted Answer

Configure client applications to use TLS 1.2 in their connection strings.. Client applications must explicitly request TLS 1.2 in their connection strings (e.g., by adding 'Encrypt=True;TrustServerCertificate=False;' and specifying the minimum TLS version in the underlying driver configuration). Without this, the client may negotiate a lower TLS version, even if the server supports higher versions. Option D is correct because setting the server's 'minimalTlsVersion' property to '1.2' enforces that the Azure SQL Database server rejects any connection attempt using TLS 1.0 or 1.1, ensuring only TLS 1.2+ connections are accepted at the server level.

Answer

Create a network security group rule to block non-TLS traffic.

Answer

Set 'DenyPublicNetworkAccess' to 'Yes' on the server.

Answer

Enable 'ForceEncryption' on the SQL Server instance.

Question 8

Your organization has a compliance requirement to automatically classify and protect sensitive data in Azure SQL Database. You need to configure Microsoft Purview to scan and classify the database. Which THREE actions are required?

Accepted Answer

Run a scan to discover and classify sensitive data.. Running a scan is the primary action that discovers and classifies sensitive data in Azure SQL Database using Microsoft Purview. The scan applies the classification rules from the scan rule set to identify patterns like credit card numbers or social security numbers, and then labels the data accordingly for compliance.

Answer

Create a Microsoft Entra ID application and grant it access to the database.

Answer

Enable Microsoft Defender for SQL to automatically classify data.

Question 9

You are configuring a new Azure SQL Database for a multi-tenant SaaS application. You need to ensure that each tenant can only access their own rows. Which THREE features can be used to achieve this?

Accepted Answer

Row-Level Security (RLS) with a predicate function.. Row-Level Security (RLS) allows you to control access to rows in a database table based on the characteristics of the user executing a query. By creating a security policy with a predicate function that filters rows by tenant ID (e.g., using SESSION_CONTEXT or USER_NAME()), you can ensure each tenant only sees their own data without changing the application's query logic.

Answer

Always Encrypted with deterministic encryption.

Answer

Dynamic Data Masking for the tenant ID column.

Question 10

Your Azure SQL Database uses Always Encrypted to protect sensitive columns. You need to allow a reporting application to query encrypted columns without having access to the column encryption key. What should you configure?

Accepted Answer

Enable Always Encrypted with secure enclaves (Intel SGX) and create an enclave-enabled key.. Enabling Always Encrypted with secure enclaves (Intel SGX) allows the reporting application to perform computations on encrypted columns (e.g., equality, pattern matching) without ever exposing the column encryption key to the application. The enclave decrypts the data inside a trusted execution environment, so the application only sees the results of queries, not the raw encryption keys. This meets the requirement of querying encrypted columns without key access.

Answer

Rotate the column master key to a hardware security module (HSM).

Answer

Remove the Always Encrypted configuration from the columns.

Answer

Provide the application with the column master key and column encryption key.

Question 11

You are reviewing the encryption protector for an Azure SQL Server as shown in the exhibit. The server hosts multiple databases. You need to ensure that the databases are encrypted using the customer-managed key from Azure Key Vault. However, you find that the databases are not using this key. What is the most likely reason?

Accepted Answer

The databases still have the service-managed key as protector and need to be updated.. The exhibit shows that the server's encryption protector is set to a customer-managed key from Azure Key Vault, but this setting only applies to newly created databases. Existing databases retain their original encryption protector, which is typically the service-managed key. To enforce the customer-managed key on existing databases, you must manually update each database's encryption protector using the ALTER DATABASE ENCRYPTION KEY statement or through the Azure portal. Option C correctly identifies that the databases still have the service-managed key as protector and need to be updated.

Answer

The key version '123456' is incorrect.

Answer

The key vault is in a different subscription and not accessible.

Answer

The 'serverKeyName' property is not set correctly.

Question 12

Your company uses Azure SQL Database with Microsoft Entra ID authentication. You need to ensure that only users with specific Azure AD roles can access the database. What should you configure?

Accepted Answer

Create contained database users mapped to Azure AD identities and grant appropriate permissions.. Azure SQL Database supports contained database users mapped to Azure AD identities, which allows you to grant granular permissions (e.g., db_datareader, db_owner) to specific Azure AD users or groups. This ensures that only those with the appropriate Azure AD roles (via group membership or direct assignment) can access the database, without relying on SQL Server logins or firewall rules.

Answer

Configure an Azure SQL Database firewall rule to allow only Azure AD IP addresses.

Answer

Assign the SQL Server Contributor role to Azure AD users.

Answer

Create SQL authenticated users with strong passwords.

Question 13

Your Azure SQL Managed Instance stores sensitive financial data. You must prevent unauthorized access from Azure services and ensure that only specific virtual networks can connect. You also need to audit all failed login attempts. Which combination of configurations should you implement?

Accepted Answer

Create a private endpoint, set 'Public network access' to 'Deny', and enable Azure SQL Auditing with a log analytics workspace.. Creating a private endpoint for Azure SQL Managed Instance ensures that traffic to the instance traverses the Microsoft backbone network and is only accessible from within the specified virtual network. Setting 'Public network access' to 'Deny' explicitly blocks all public internet traffic, including traffic from other Azure services that do not originate from the approved VNet. Enabling Azure SQL Auditing with a Log Analytics workspace captures all failed login attempts, meeting the audit requirement. This combination directly addresses the need to prevent unauthorized access from Azure services and enforce VNet-only connectivity while auditing failed logins.

Answer

Enable Microsoft Defender for SQL and set up anomaly detection alerts.

Answer

Enable SQL vulnerability assessment and configure email notifications.

Answer

Configure VNet service endpoints and set the firewall to allow only your VNet.

Question 14

You need to audit all schema changes in an Azure SQL Database and store the audit logs in a storage account for long-term retention. What should you enable?

Accepted Answer

Azure SQL Auditing with storage account destination.. Azure SQL Auditing with a storage account destination is the correct choice because it tracks database events, including schema changes (DDL operations), and writes audit logs to Azure Blob Storage for long-term retention. This meets the requirement to audit all schema changes and store logs durably, as storage accounts provide configurable retention policies.

Answer

Advanced Threat Protection with email alerts.

Answer

Query Store with 'Data Flush Interval' set to 1 minute.

Answer

SQL Vulnerability Assessment with recurring scans.

Question 15

Refer to the exhibit. You are reviewing the firewall rule JSON for an Azure SQL Server. What does this rule allow?

Accepted Answer

No traffic; this rule blocks all incoming connections.. This rule is a firewall rule with start IP address '0.0.0.0' and end IP address '0.0.0.0', which in Azure SQL Server firewall configuration explicitly blocks all incoming traffic. The IP range 0.0.0.0 to 0.0.0.0 is a special reserved range that denies any connection attempts, regardless of source IP. This is the default behavior when no other allow rules exist, effectively creating a deny-all rule.

Answer

All traffic from any IP address.

Answer

Traffic from IP address 0.0.0.0.

Answer

Traffic from Azure services.