DP-300 Implement a secure environment Practice Test 11 — 15 Questions

Question 1

You run the Azure CLI command shown in the exhibit for an Azure SQL Database named SalesDB. The output shows that the security alert policy is disabled. You need to enable Microsoft Defender for SQL, including vulnerability assessments, for this database. What should you do?

Accepted Answer

Run 'az sql server update --name sql-sales --resource-group rg-sales --enable-defender-for-sql true'.. Option C is correct because enabling Microsoft Defender for SQL, including vulnerability assessments, is a server-level configuration in Azure SQL. The command 'az sql server update --enable-defender-for-sql true' activates Defender for SQL on the server, which automatically applies to all databases on that server, including SalesDB. The exhibit shows a database-level security alert policy is disabled, but the required feature is enabled at the server scope, not per-database.

Answer

Run 'az sql db update --name SalesDB --resource-group rg-sales --server sql-sales --enable-defender-for-sql true'.

Answer

Run 'az sql db threat-policy update --name SalesDB --resource-group rg-sales --server sql-sales --state Enabled'.

Answer

Configure a server firewall rule to allow Azure services.

Question 2

Your company uses Azure SQL Database and wants to implement row-level security (RLS) to restrict access to customer data based on the user's Microsoft Entra ID group membership. Which TWO actions are required?

Accepted Answer

Create a security policy that uses a predicate function.. Row-level security (RLS) in Azure SQL Database restricts data access at the row level by using a security policy that invokes a predicate function. The predicate function defines the logic for filtering rows, such as checking the caller's Microsoft Entra ID group membership via IS_MEMBER(). Therefore, creating both the predicate function (Option E) and the security policy that uses it (Option C) are required steps.

Answer

Create a column master key for the secured columns.

Answer

Grant the user the db_securityadmin server role.

Answer

Apply a dynamic data masking rule to hide sensitive columns.

Question 3

Your Azure SQL Database is accessed by multiple applications. You need to ensure that all connections use Transport Layer Security (TLS) 1.2 or higher. Which TWO configurations should you verify or enable?

Accepted Answer

Configure client applications to use TLS 1.2 in their connection strings.. Option A is correct because client applications must explicitly request TLS 1.2 in their connection strings (e.g., by adding 'Encrypt=True;TrustServerCertificate=False;' and specifying the minimum TLS version in the underlying driver configuration). Without this, the client may negotiate a lower TLS version, even if the server supports higher versions. Option D is correct because setting the server's 'minimalTlsVersion' property to '1.2' enforces that the Azure SQL Database server rejects any connection attempt using TLS 1.0 or 1.1, ensuring only TLS 1.2+ connections are accepted at the server level.

Answer

Create a network security group rule to block non-TLS traffic.

Answer

Set 'DenyPublicNetworkAccess' to 'Yes' on the server.

Answer

Enable 'ForceEncryption' on the SQL Server instance.

Question 4

Your organization has a compliance requirement to automatically classify and protect sensitive data in Azure SQL Database. You need to configure Microsoft Purview to scan and classify the database. Which THREE actions are required?

Accepted Answer

Run a scan to discover and classify sensitive data.. Option A is correct because running a scan is the primary action that discovers and classifies sensitive data in Azure SQL Database using Microsoft Purview. The scan applies the classification rules from the scan rule set to identify patterns like credit card numbers or social security numbers, and then labels the data accordingly for compliance.

Answer

Create a Microsoft Entra ID application and grant it access to the database.

Answer

Enable Microsoft Defender for SQL to automatically classify data.

Question 5

You are configuring a new Azure SQL Database for a multi-tenant SaaS application. You need to ensure that each tenant can only access their own rows. Which THREE features can be used to achieve this?

Accepted Answer

Row-Level Security (RLS) with a predicate function.. Row-Level Security (RLS) allows you to control access to rows in a database table based on the characteristics of the user executing a query. By creating a security policy with a predicate function that filters rows by tenant ID (e.g., using SESSION_CONTEXT or USER_NAME()), you can ensure each tenant only sees their own data without changing the application's query logic.

Answer

Always Encrypted with deterministic encryption.

Answer

Dynamic Data Masking for the tenant ID column.

Question 6

Your Azure SQL Database uses Always Encrypted to protect sensitive columns. You need to allow a reporting application to query encrypted columns without having access to the column encryption key. What should you configure?

Accepted Answer

Enable Always Encrypted with secure enclaves (Intel SGX) and create an enclave-enabled key.. Option C is correct because enabling Always Encrypted with secure enclaves (Intel SGX) allows the reporting application to perform computations on encrypted columns (e.g., equality, pattern matching) without ever exposing the column encryption key to the application. The enclave decrypts the data inside a trusted execution environment, so the application only sees the results of queries, not the raw encryption keys. This meets the requirement of querying encrypted columns without key access.

Answer

Rotate the column master key to a hardware security module (HSM).

Answer

Remove the Always Encrypted configuration from the columns.

Answer

Provide the application with the column master key and column encryption key.

Question 7

You are reviewing the encryption protector for an Azure SQL Server as shown in the exhibit. The server hosts multiple databases. You need to ensure that the databases are encrypted using the customer-managed key from Azure Key Vault. However, you find that the databases are not using this key. What is the most likely reason?

Accepted Answer

The databases still have the service-managed key as protector and need to be updated.. The exhibit shows that the server's encryption protector is set to a customer-managed key from Azure Key Vault, but this setting only applies to newly created databases. Existing databases retain their original encryption protector, which is typically the service-managed key. To enforce the customer-managed key on existing databases, you must manually update each database's encryption protector using the ALTER DATABASE ENCRYPTION KEY statement or through the Azure portal. Option C correctly identifies that the databases still have the service-managed key as protector and need to be updated.

Answer

The key version '123456' is incorrect.

Answer

The key vault is in a different subscription and not accessible.

Answer

The 'serverKeyName' property is not set correctly.

Question 8

Your company uses Azure SQL Database with Microsoft Entra ID authentication. You need to ensure that only users with specific Azure AD roles can access the database. What should you configure?

Accepted Answer

Create contained database users mapped to Azure AD identities and grant appropriate permissions.. Option D is correct because Azure SQL Database supports contained database users mapped to Azure AD identities, which allows you to grant granular permissions (e.g., db_datareader, db_owner) to specific Azure AD users or groups. This ensures that only those with the appropriate Azure AD roles (via group membership or direct assignment) can access the database, without relying on SQL Server logins or firewall rules.

Answer

Configure an Azure SQL Database firewall rule to allow only Azure AD IP addresses.

Answer

Assign the SQL Server Contributor role to Azure AD users.

Answer

Create SQL authenticated users with strong passwords.

Question 9

Your Azure SQL Managed Instance stores sensitive financial data. You must prevent unauthorized access from Azure services and ensure that only specific virtual networks can connect. You also need to audit all failed login attempts. Which combination of configurations should you implement?

Accepted Answer

Create a private endpoint, set 'Public network access' to 'Deny', and enable Azure SQL Auditing with a log analytics workspace.. Option B is correct because creating a private endpoint for Azure SQL Managed Instance ensures that traffic to the instance traverses the Microsoft backbone network and is only accessible from within the specified virtual network. Setting 'Public network access' to 'Deny' explicitly blocks all public internet traffic, including traffic from other Azure services that do not originate from the approved VNet. Enabling Azure SQL Auditing with a Log Analytics workspace captures all failed login attempts, meeting the audit requirement. This combination directly addresses the need to prevent unauthorized access from Azure services and enforce VNet-only connectivity while auditing failed logins.

Answer

Enable Microsoft Defender for SQL and set up anomaly detection alerts.

Answer

Enable SQL vulnerability assessment and configure email notifications.

Answer

Configure VNet service endpoints and set the firewall to allow only your VNet.

Question 10

You need to audit all schema changes in an Azure SQL Database and store the audit logs in a storage account for long-term retention. What should you enable?

Accepted Answer

Azure SQL Auditing with storage account destination.. Azure SQL Auditing with a storage account destination is the correct choice because it tracks database events, including schema changes (DDL operations), and writes audit logs to Azure Blob Storage for long-term retention. This meets the requirement to audit all schema changes and store logs durably, as storage accounts provide configurable retention policies.

Answer

Advanced Threat Protection with email alerts.

Answer

Query Store with 'Data Flush Interval' set to 1 minute.

Answer

SQL Vulnerability Assessment with recurring scans.

Question 11

Refer to the exhibit. You are reviewing the firewall rule JSON for an Azure SQL Server. What does this rule allow?

Accepted Answer

No traffic; this rule blocks all incoming connections.. This rule is a firewall rule with start IP address '0.0.0.0' and end IP address '0.0.0.0', which in Azure SQL Server firewall configuration explicitly blocks all incoming traffic. The IP range 0.0.0.0 to 0.0.0.0 is a special reserved range that denies any connection attempts, regardless of source IP. This is the default behavior when no other allow rules exist, effectively creating a deny-all rule.

Answer

All traffic from any IP address.

Answer

Traffic from IP address 0.0.0.0.

Answer

Traffic from Azure services.

Question 12

You have an Azure SQL Database that needs to be accessed by an application running on an Azure VM. The VM is in a different subscription. You want to minimize administrative overhead and ensure secure connectivity without exposing the database to the public internet. What should you do?

Accepted Answer

Create a private endpoint for the SQL Database in the VM's VNet.. Option C is correct because a private endpoint assigns the Azure SQL Database a private IP address from the VM's VNet, enabling secure connectivity over the Microsoft backbone without exposing the database to the public internet. This minimizes administrative overhead as it does not require VPN gateways or complex routing, and it works across subscriptions by linking the private endpoint to the VM's VNet.

Answer

Set up a site-to-site VPN between the VM's VNet and the SQL Database's VNet.

Answer

Use a VNet service endpoint for Azure SQL Database in the VM's VNet.

Answer

Configure a firewall rule to allow the VM's public IP address.

Question 13

Your organization requires that all Azure SQL Database administrators use multi-factor authentication (MFA) when connecting. Which authentication method must be used?

Accepted Answer

Microsoft Entra ID authentication with Conditional Access policy. Microsoft Entra ID authentication combined with a Conditional Access policy is required to enforce multi-factor authentication (MFA) for Azure SQL Database administrators. Conditional Access policies can mandate MFA as a condition for authentication, which is not possible with SQL Server authentication, certificate-based authentication, or Windows authentication alone. This method integrates with Microsoft Entra ID (formerly Azure AD) to provide the necessary security controls.

Answer

SQL Server authentication

Answer

Certificate-based authentication

Answer

Windows authentication

Question 14

Refer to the exhibit. You are reviewing the audit settings for an Azure SQL Database. What will this configuration do?

Accepted Answer

Audit logs are written to Azure Monitor (Log Analytics).. The exhibit shows that the audit destination is set to 'Log Analytics' (Azure Monitor), which means audit logs will be sent to a Log Analytics workspace. This configuration does not require a storage endpoint because Log Analytics is the designated target. Option B correctly identifies that audit logs are written to Azure Monitor (Log Analytics).

Answer

Auditing is disabled because no storage endpoint is provided.

Answer

Only failed authentication attempts are audited.

Answer

Audit logs are written to an Azure Storage account.

Question 15

You have an Azure SQL Database that contains sensitive customer data. You need to classify the data and receive recommendations for protecting it. You also need to detect and alert on suspicious access patterns. Which two Azure services should you enable? (Choose two.)

Accepted Answer

Microsoft Defender for SQL. Microsoft Defender for SQL (Option C) provides vulnerability assessment, data discovery and classification, and advanced threat protection for Azure SQL Database. It can classify sensitive columns, recommend protection measures, and detect suspicious access patterns such as SQL injection or brute-force attacks, generating alerts for immediate response.

Answer

Microsoft Sentinel

Answer

Azure Information Protection

Answer

Azure Policy