DP-300 Implement a secure environment Practice Test 12 — 15 Questions

Question 1

You are configuring Azure SQL Database firewall rules. Which THREE actions require the 'Allow Azure services and resources to access this server' setting to be enabled? (Choose three.)

Accepted Answer

Azure Data Factory using a self-hosted integration runtime.. Option A is correct because the 'Allow Azure services and resources to access this server' firewall setting permits connections from any Azure service that does not have a fixed public IP or a private endpoint. Azure Data Factory using a self-hosted integration runtime (IR) runs on-premises or on a VM, but the IR itself initiates outbound connections to Azure SQL Database from a dynamic Azure IP range. Without this setting enabled, the connection is blocked because the self-hosted IR's source IP is not a static, whitelisted address.

Answer

An on-premises application with a static public IP.

Answer

A virtual machine using a private endpoint.

Question 2

Your company wants to implement transparent data encryption (TDE) for an Azure SQL Database using a customer-managed key stored in Azure Key Vault. Which TWO prerequisites must be met? (Choose two.)

Accepted Answer

The Azure SQL Server must have a system-assigned managed identity.. Option A is correct because Azure SQL Database uses the server's system-assigned managed identity to authenticate to Azure Key Vault when accessing the customer-managed key for TDE. Without this identity, the SQL Server cannot prove its identity to Key Vault to retrieve the key. Option B is correct because the Key Vault must have an access policy that grants the SQL Server's managed identity the 'get', 'wrapKey', and 'unwrapKey' permissions, which are required for TDE operations.

Answer

The database must contain a column master key.

Answer

The Key Vault must be in a different region than the SQL Server.

Answer

The database must be taken offline during key configuration.

Question 3

You need to ensure that all queries accessing a specific column containing credit card numbers are encrypted both at rest and in transit between the application and Azure SQL Database. Which THREE technologies should you implement? (Choose three.)

Accepted Answer

Enforce TLS 1.2 or higher for client connections. Option A is correct because enforcing TLS 1.2 or higher for client connections encrypts data in transit between the application and Azure SQL Database. TLS ensures that all queries and their results, including the credit card column, are protected from interception during network transmission.

Answer

Row-Level Security

Answer

Dynamic Data Masking

Question 4

You need to prevent users from accidentally deleting an Azure SQL Database. What should you configure?

Accepted Answer

Apply a 'CanNotDelete' Azure Resource Lock on the resource group.. A 'CanNotDelete' Azure Resource Lock on the resource group prevents any user, including those with high-level permissions like Owner, from deleting the Azure SQL Database. This lock overrides all role-based access control (RBAC) permissions at the resource or resource group level, ensuring accidental deletion is blocked even if a user has delete permissions.

Answer

Revoke the db_ddladmin role from users.

Answer

Create an Azure Policy to deny SQL Database creation.

Answer

Set a deny rule in the SQL Database firewall.

Question 5

An Azure SQL Database contains personally identifiable information (PII). You need to mask the PII columns from non-administrative users while allowing administrators to see the actual data. Which feature should you use?

Accepted Answer

Dynamic Data Masking. Dynamic Data Masking (DDM) is the correct choice because it selectively obscures sensitive PII columns in query results for non-administrative users, while leaving the data unmasked for users with elevated permissions (e.g., db_owner or the UNMASK permission). This is achieved by defining masking rules on specific columns, such as email or phone number, without altering the underlying stored data.

Answer

Always Encrypted

Answer

Transparent Data Encryption (TDE)

Answer

Row-Level Security

Question 6

You have an Azure SQL Database that needs to be accessed by an application with a static public IP address. You want to allow only that IP address to connect. What should you configure?

Accepted Answer

Create a server-level firewall rule with the application's IP.. Option C is correct because a server-level firewall rule explicitly allows inbound connections from a specific client IP address to the Azure SQL Database logical server. Since the application has a static public IP, configuring a server-level firewall rule with that IP is the simplest and most direct method to restrict access to only that address, while still using the public endpoint.

Answer

Create a virtual network rule for the database.

Answer

Create a private endpoint for the database.

Answer

Create a database-level firewall rule with the application's IP.

Question 7

You are the database administrator for a large e-commerce company. The company has an Azure SQL Database named SalesDB that stores sensitive customer data including credit card numbers and personal details. The security team has mandated the following requirements:

1. All customer credit card numbers must be encrypted at rest and in transit between the application and the database. The encryption keys must be stored in a hardware security module (HSM) managed by the company.
2. All access to the database must be authenticated using Microsoft Entra ID, and multi-factor authentication (MFA) must be enforced for all administrative users.
3. Any attempts to access the database from unusual geographic locations must be detected and automatically blocked for 24 hours.
4. All schema changes must be audited, and the audit logs must be sent to a central Log Analytics workspace for analysis.

Currently, the database uses SQL authentication, no encryption, and no auditing. You need to implement the required security controls with minimal downtime. What should you do?

Accepted Answer

Enable Always Encrypted for the credit card columns using Azure Key Vault Managed HSM for column master keys. Switch to Microsoft Entra ID authentication and configure Conditional Access policy to require MFA for administrators. Enable Microsoft Defender for SQL with anomaly detection and automatic blocking. Enable Azure SQL Auditing with Log Analytics destination.. Option D is correct because it directly addresses all mandated requirements: Always Encrypted with Azure Key Vault Managed HSM ensures credit card numbers are encrypted at rest and in transit with customer-managed HSM keys; switching to Microsoft Entra ID authentication with a Conditional Access policy enforces MFA for administrators; Microsoft Defender for SQL provides anomaly detection that can automatically block access from unusual geographic locations for 24 hours; and Azure SQL Auditing configured to send logs to Log Analytics meets the central audit requirement. This combination provides the required security controls with minimal downtime as Always Encrypted can be enabled online.

Answer

Enable Always Encrypted for the credit card columns with keys stored in Azure Key Vault. Keep SQL authentication but require users to use MFA via a VPN. Enable TDE for at-rest encryption.

Answer

Enable Transparent Data Encryption (TDE) with a customer-managed key in Azure Key Vault. Configure Azure SQL Auditing to send logs to Log Analytics. Enable Microsoft Defender for SQL.

Answer

Use Dynamic Data Masking to mask credit card numbers. Enable TDE and use Azure SQL Auditing with a storage account. Enable Microsoft Defender for SQL.

Question 8

Your company uses Azure SQL Managed Instance and requires that all connections from client applications use Microsoft Entra authentication with multi-factor authentication (MFA). You configure Azure SQL Managed Instance to support Microsoft Entra authentication and create a contained database user for the application. However, when the application attempts to connect, it receives error '18456, state 10' indicating that the login is not recognized. What is the most likely cause?

Accepted Answer

The application is using a SQL login instead of a Microsoft Entra token or integrated authentication.. Error 18456, state 10 specifically indicates that the login was not recognized by SQL Server. Since the application is configured to use a contained database user with Microsoft Entra authentication, the most likely cause is that the application is attempting to connect using a SQL login (username/password) rather than presenting a Microsoft Entra access token or using integrated authentication. Contained database users require authentication through the Microsoft Entra ID token flow, not SQL Server authentication.

Answer

The contained database user is not mapped to a server-level login.

Answer

The client IP address is not allowed by the server-level firewall rule.

Answer

The server principal (server admin) is not a Microsoft Entra account.

Question 9

You are the database administrator for a healthcare organization that uses Azure SQL Database. You need to implement column-level encryption for sensitive patient data (e.g., Social Security numbers) using Always Encrypted. The application connecting to the database is a .NET application running on Azure Virtual Machines. The application should be able to perform parameterized queries on encrypted columns without revealing the plaintext to the database. Which configuration is essential for this setup?

Accepted Answer

Use Always Encrypted with secure enclaves and configure the enclave attestation URL.. Option D is correct because Always Encrypted with secure enclaves (using Intel SGX) allows rich computations on encrypted data within the enclave. Option A is incorrect because column master key stored in Azure Key Vault is standard, but the enclave is needed for computations. Option B is incorrect because Transparent Data Encryption encrypts data at rest, not in use. Option C is incorrect because dynamic data masking only obfuscates data from certain users, but the database can still see the plaintext.

Answer

Store the column master key in Azure Key Vault and configure the application to retrieve it.

Answer

Implement dynamic data masking on the columns containing Social Security numbers.

Answer

Enable Transparent Data Encryption (TDE) on the database.

Question 10

You are configuring Azure SQL Database firewall rules. You need to allow a team of developers to connect from their office IP range (192.168.1.0/24) to a specific database. The developers should not be able to access other databases on the same logical server. What should you do?

Accepted Answer

Add a database-level firewall rule for the IP range 192.168.1.0/24.. Database-level firewall rules in Azure SQL Database allow you to restrict access to a specific database on a logical server, rather than the entire server. By adding a rule for the IP range 192.168.1.0/24 at the database level, the developers can connect only to that database, and they will be blocked from accessing other databases on the same server. This is the correct approach because server-level rules would grant access to all databases, which violates the requirement.

Answer

Create a private endpoint for the database.

Answer

Add a server-level firewall rule for the IP range 192.168.1.0/24.

Answer

Configure a virtual network service endpoint for the server.

Question 11

You are reviewing an Azure SQL Database audit policy configuration. The policy is set to audit successful and failed database authentication events. You notice that audit logs are being written to both Azure Blob Storage and Azure Monitor. However, you are concerned about security of the storage account access key in the policy. What is the recommended approach to securely reference the storage account?

Accepted Answer

Configure the server's system-assigned managed identity and grant it access to the storage account.. Option D is correct because using a system-assigned managed identity for the Azure SQL Database logical server eliminates the need to store a storage account access key in the audit policy configuration. Managed identities provide a secure, Azure AD-backed identity that can be granted specific permissions (e.g., Storage Blob Data Contributor) on the storage account, ensuring that access is controlled via RBAC rather than a static key. This approach aligns with security best practices by removing the risk of key exposure or rotation failures.

Answer

Remove the storageAccountAccessKey property and rely on the storage endpoint.

Answer

Use a different storage account with a key that expires daily.

Answer

Disable the Azure Monitor destination and only use Blob Storage.

Question 12

Your company has an Azure SQL Database that stores financial data. You need to implement auditing to track all data modifications (INSERT, UPDATE, DELETE) and schema changes (DDL). Which audit action group should you configure?

Accepted Answer

SCHEMA_OBJECT_CHANGE_GROUP and DATABASE_OBJECT_CHANGE_GROUP. Option C is correct because DATABASE_OBJECT_CHANGE_GROUP captures DML changes on all database objects, and SCHEMA_OBJECT_CHANGE_GROUP captures DDL changes. Option A is incorrect because it only contains DDL actions. Option B is incorrect because it only contains security-related actions. Option D is incorrect because it only contains DML actions on specific objects.

Answer

DATABASE_OBJECT_PERMISSION_CHANGE_GROUP and SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP

Answer

DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP and SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP

Answer

SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP and FAILED_DATABASE_AUTHENTICATION_GROUP

Question 13

You are the DBA for a company that uses Azure SQL Database. You need to ensure that only authorized users can view sensitive columns (e.g., salary) in the Employees table. You want to obfuscate the data for certain users but allow full access to HR managers. Which feature should you use?

Accepted Answer

Dynamic Data Masking. Dynamic Data Masking (DDM) is the correct choice because it obfuscates sensitive columns (e.g., salary) in query results for unauthorized users while allowing full visibility for authorized users like HR managers. DDM applies masking rules at the database level without modifying the underlying data, making it ideal for scenarios where you need to limit exposure of sensitive data to certain roles without changing the application code.

Answer

Always Encrypted

Answer

Row-Level Security (RLS)

Answer

Transparent Data Encryption (TDE)

Question 14

You are configuring Azure SQL Database for a multi-tenant application. Each tenant's data is stored in a separate database. You need to ensure that a tenant admin can only manage their own database and not other databases on the same logical server. What is the best approach?

Accepted Answer

Create a contained database user with db_owner role in each tenant's database and use Microsoft Entra authentication.. Option A is correct because creating a contained database user in each database with appropriate permissions limits the user to that database. Option B is incorrect because server-level login with db_owner on all databases gives cross-database access. Option C is incorrect because a server-level firewall rule does not control permissions. Option D is incorrect because database-level firewall rule controls network access, not permissions.

Answer

Use a server-level firewall rule to restrict access to the tenant's IP.

Answer

Create a server-level login and assign it as db_owner on all databases.

Answer

Create a database-level firewall rule for each tenant database.

Question 15

Your organization uses Azure SQL Database and wants to implement a defense-in-depth strategy. You have already enabled Transparent Data Encryption (TDE) and firewall rules. You need to add an additional layer of security that protects against unauthorized access to the physical storage files (e.g., if someone gains access to the storage account). What should you enable?

Accepted Answer

Infrastructure encryption (double encryption) using platform-managed keys. Infrastructure encryption (double encryption) using platform-managed keys adds a second layer of encryption at the storage infrastructure level, below the TDE layer. This protects data at rest even if the physical storage files (e.g., Azure Storage blobs) are accessed directly, because the storage infrastructure itself is encrypted with a separate, platform-managed key. This fulfills the defense-in-depth requirement for protecting against unauthorized access to physical storage.

Answer

Dynamic Data Masking

Answer

Microsoft Defender for SQL

Answer

Always Encrypted with secure enclaves