DP-300 Implement a secure environment Practice Test 13 — 15 Questions

Question 1

You need to configure Azure SQL Database to allow connections only from Azure services and from a specific on-premises IP range. Which firewall rule configuration should you apply at the server level?

Accepted Answer

Set 'Allow Azure Services and resources to access this server' to ON and add a firewall rule for the on-premises IP range.. Option C is correct because enabling 'Allow Azure Services and resources to access this server' permits connections from all Azure services (including those from other subscriptions) by adding a special firewall rule that allows Azure IP ranges. Adding a separate firewall rule for the specific on-premises IP range then restricts non-Azure external traffic to only that range. This combination meets the requirement to allow only Azure services and the specified on-premises range.

Answer

Create a private endpoint for the server.

Answer

Create a virtual network service endpoint and add a VNet firewall rule.

Answer

Set 'Allow Azure Services and resources to access this server' to OFF and add a firewall rule for the on-premises IP range.

Question 2

You are responsible for securing Azure SQL Managed Instance. You need to ensure that only encrypted connections are allowed and that all client connections use the latest TLS protocol. Which TWO configurations should you implement?

Accepted Answer

Set the 'Minimal TLS Version' to 1.2.. Options A and C are correct. Enforcing TLS 1.2 ensures only encrypted connections using that protocol are accepted. Setting 'Force SSL' to 'Enabled' (or 'On') ensures all connections use encryption. Option B is incorrect because TDE encrypts data at rest, not in transit. Option D is incorrect because firewall rules control network access, not encryption. Option E is incorrect because Microsoft Defender for SQL provides threat detection.

Answer

Configure a firewall rule to allow only specific IP addresses.

Answer

Enable Microsoft Defender for SQL.

Answer

Enable Transparent Data Encryption (TDE).

Question 3

You are deploying Azure SQL Database and need to comply with regulatory requirements that mandate separation of duties for database administration. Specifically, the security team should manage access policies, and the database administrators should manage the data. Which THREE features should you use to implement this?

Accepted Answer

Dynamic Data Masking to hide sensitive data from non-privileged users.. Dynamic Data Masking (C) is correct because it allows database administrators to manage data while hiding sensitive information from non-privileged users, supporting separation of duties by preventing security team members from viewing actual data. Azure RBAC (D) is correct because it enables distinct role assignments (e.g., SQL Security Manager vs. SQL DB Contributor) to separate who manages access policies from who manages data. Database-level roles (E) are correct because they provide granular permissions within the database, such as db_securityadmin for managing security policies and db_owner for full data management, enforcing separation at the database level.

Answer

Firewall rules to restrict administrative access to specific IP addresses.

Answer

Transparent Data Encryption (TDE) with customer-managed keys.

Question 4

You are configuring Azure SQL Database auditing. You need to ensure that all database-level authentication failures are logged. Which TWO audit action groups should you include?

Accepted Answer

SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP. Option A is correct because the SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP audit action group captures all successful authentication attempts at the database level. Option B is correct because the FAILED_DATABASE_AUTHENTICATION_GROUP audit action group captures all failed authentication attempts at the database level. Together, these two groups ensure that every database-level authentication event—both successes and failures—is logged, which is required to meet the requirement of logging all database-level authentication failures.

Answer

DATABASE_OBJECT_PERMISSION_CHANGE_GROUP

Answer

DATABASE_OBJECT_CHANGE_GROUP

Answer

SCHEMA_OBJECT_CHANGE_GROUP

Question 5

You are a database administrator for a financial services company that uses Azure SQL Database for a critical trading application. The application connects using a service principal (Microsoft Entra application) and executes stored procedures. You need to implement the following security requirements:

1. All connections must use Microsoft Entra authentication with MFA enforced for the service principal.
2. The application should only be able to execute specific stored procedures (usp_Trade, usp_GetQuote) and no other operations.
3. All data at rest must be encrypted using customer-managed keys stored in Azure Key Vault.
4. Auditing must capture all failed login attempts and all changes to the database schema.
5. The database must be protected against SQL injection attacks from the application layer.

You have already configured Microsoft Entra authentication and enabled TDE with customer-managed key in Azure Key Vault. Which additional steps should you take to meet all remaining requirements?

Accepted Answer

Create a database role with EXECUTE permission on the required stored procedures and assign it to the service principal. Configure a Conditional Access policy that requires MFA for the service principal. Enable audit for FAILED_DATABASE_AUTHENTICATION_GROUP and SCHEMA_OBJECT_CHANGE_GROUP. Ensure the application uses parameterized queries.. Option D is correct because it addresses all remaining requirements: (1) Conditional Access policy enforces MFA for the service principal; (2) EXECUTE permission on specific stored procedures limits operations; (3) Audit action groups for failed logins and schema changes; (4) Parameterized queries prevent SQL injection. Option A is incorrect because dynamic data masking does not prevent SQL injection. Option B is incorrect because row-level security does not prevent SQL injection. Option C is incorrect because Always Encrypted does not prevent SQL injection and does not enforce MFA.

Answer

Create a database role that only has EXECUTE permission on the required stored procedures. Configure dynamic data masking on sensitive columns. Enable audit for FAILED_DATABASE_AUTHENTICATION_GROUP and SCHEMA_OBJECT_CHANGE_GROUP.

Answer

Create a contained database user for the service principal with EXECUTE permission. Enable Always Encrypted for sensitive columns. Configure audit for FAILED_DATABASE_AUTHENTICATION_GROUP only.

Answer

Create a database role with EXECUTE on the stored procedures. Implement row-level security to restrict data access. Use Microsoft Defender for SQL to detect SQL injection attempts.

Question 6

You are the DBA for a company that uses Azure SQL Managed Instance to host multiple databases for different departments. The security team has mandated that:

- All connections to the managed instance must be encrypted using TLS 1.2 or higher.
- SQL Server authentication must be disabled; only Microsoft Entra authentication is allowed.
- A dedicated audit log must be created for each database to track all DDL changes and all failed login attempts.
- The audit logs must be stored in a central Azure Storage account with 180-day retention.
- Database administrators (DBAs) should not be able to view or modify the audit logs.

You have already set the minimal TLS version to 1.2 and disabled SQL Server authentication. What should you do next to meet the remaining requirements?

Accepted Answer

Enable database-level auditing on each database with audit action groups SCHEMA_OBJECT_CHANGE_GROUP and FAILED_DATABASE_AUTHENTICATION_GROUP. Configure the audit log destination to be a central Azure Storage account. Set retention to 180 days. Grant the DBAs 'Storage Blob Data Reader' role on the storage account but not 'Contributor' or 'Owner'.. Option C is correct because database-level auditing with the specified action groups (SCHEMA_OBJECT_CHANGE_GROUP for DDL changes and FAILED_DATABASE_AUTHENTICATION_GROUP for failed logins) meets the requirement to track DDL changes and failed login attempts per database. Configuring the audit log destination to a central Azure Storage account with 180-day retention satisfies the storage and retention requirement. Granting DBAs only the 'Storage Blob Data Reader' role prevents them from viewing or modifying the audit logs, as they cannot delete or overwrite blobs, while still allowing read access if needed.

Answer

Create a SQL Server Agent job on the managed instance that captures DDL changes and failed logins into a table. Grant DBAs access to the table.

Answer

Enable server-level auditing with the same action groups and send logs to a central storage account. Use Azure RBAC to deny DBAs access to the storage account.

Answer

Use Azure SQL Auditing with Azure Monitor Log Analytics workspace. Configure the workspace with 180-day retention. Grant DBAs 'Log Analytics Reader' role.

Question 7

You are a junior DBA at a startup that uses Azure SQL Database for its SaaS application. The application uses a single database and the development team frequently makes schema changes. You need to implement security measures to:

1. Ensure that all connections from the application use TLS encryption.
2. Prevent unauthorized access from the internet.
3. Allow your office IP range (203.0.113.0/24) to connect for management.
4. Enable auditing of all schema changes.
5. Encrypt the database at rest using Azure-managed keys.

You have already enabled Transparent Data Encryption (TDE) with service-managed keys. What should you do next to meet the remaining requirements?

Accepted Answer

Set the minimal TLS version to 1.2. Add a firewall rule for the office IP range and remove the default 'Allow Azure services' rule. Enable auditing with SCHEMA_OBJECT_CHANGE_GROUP.. Option C is correct because it addresses all remaining requirements: (1) Set minimal TLS version to 1.2; (2) Add firewall rule for office IP only; (3) Enable auditing with SCHEMA_OBJECT_CHANGE_GROUP; (4) TDE already enabled. Option A is incorrect because it does not include firewall restrictions. Option B is incorrect because it does not enforce TLS. Option D is incorrect because it does not include auditing.

Answer

Set the minimal TLS version to 1.2. Enable auditing with SCHEMA_OBJECT_CHANGE_GROUP.

Answer

Add a firewall rule for the office IP range. Enable auditing with SCHEMA_OBJECT_CHANGE_GROUP.

Answer

Add a firewall rule for the office IP range. Remove the default 'Allow Azure services' rule.

Question 8

Your company uses Azure SQL Database for a customer-facing application. You need to ensure that only the application can access the database, and that access is restricted to specific IP ranges. The application runs on Azure App Service with a dynamic outbound IP address. What should you do?

Accepted Answer

Add a firewall rule for the App Service's outbound IP address range.. Option D is correct because the application runs on Azure App Service with a dynamic outbound IP address, and the requirement is to restrict access to specific IP ranges. By adding a firewall rule for the App Service's outbound IP address range (which can be found in the App Service properties or via the `WEBSITE_OUTBOUND_IP_ADDRESSES` app setting), you allow the application to connect to Azure SQL Database while blocking other traffic. This approach directly addresses the dynamic IP challenge without requiring VNet integration or private endpoints.

Answer

Configure a VNet integration for the App Service and set the SQL firewall to allow the VNet subnet.

Answer

Migrate the database to Azure SQL Managed Instance and use a service endpoint.

Answer

Create a private endpoint for the SQL Database and connect App Service to it via VNet peering.

Question 9

You are configuring Microsoft Defender for SQL for an Azure SQL Database. You want to receive email notifications when a suspicious activity is detected. What should you configure?

Accepted Answer

In the Microsoft Defender for SQL settings, enable 'Email notifications to admins and subscription owners'.. Option C is correct because Microsoft Defender for SQL includes a dedicated 'Email notifications to admins and subscription owners' setting under its threat detection policy. When enabled, this sends email alerts to Azure subscription owners and administrators whenever Defender detects suspicious activities such as SQL injection, brute-force attacks, or anomalous access patterns. This is the direct, built-in mechanism for email-based alerting on threat detections.

Answer

Configure a vulnerability assessment recurring scan and email the report.

Answer

Create an Azure Monitor alert rule for the 'SQL database threat detection' metric.

Answer

Enable SQL auditing and stream logs to a Log Analytics workspace.

Question 10

Your Azure SQL Database is configured with a failover group across two regions. You need to ensure that client connections automatically redirect to the secondary region during a regional outage, without changing the connection string. What should you implement?

Accepted Answer

Configure the failover group with a listener endpoint and use that in the connection string.. Option B is correct because the failover group listener provides a read-write listener endpoint that automatically redirects to the new primary after failover. Option A is wrong because private endpoints do not provide automatic redirection. Option C is wrong because read scale-out is for read-only traffic. Option D is wrong because traffic manager works at DNS level but adds complexity; failover group listener is the built-in solution.

Answer

Enable read scale-out and configure application retry logic.

Answer

Deploy Azure Traffic Manager in front of the SQL Database and configure failover routing.

Answer

Use private endpoints in both regions and configure DNS with a CNAME record.

Question 11

You need to audit all schema changes (DDL) on an Azure SQL Database for compliance. The audit logs must be retained for 7 years. What should you do?

Accepted Answer

Enable auditing on the database, log to a storage account, and set the retention policy to 7 years.. Option B is correct because Azure SQL Database auditing can be configured to log DDL events and store them in a storage account with long-term retention. Option A is wrong because server-level audit policy requires SQL Server on-premises or VM. Option C is wrong because extended events are more for performance troubleshooting. Option D is wrong because change tracking is for data changes, not schema changes.

Answer

Create an extended events session to capture DDL events and save to a file.

Answer

Enable change tracking on the database and query the change tracking tables.

Answer

Enable SQL Server Audit at the server level and specify a file destination.

Question 12

Your Azure SQL Database contains sensitive customer data. You need to implement column-level encryption so that only authorized users can read specific columns. The encryption must be managed by the application, not the database. What should you use?

Accepted Answer

Implement Always Encrypted with column master key stored in Azure Key Vault.. Always Encrypted is the correct choice because it ensures that sensitive data is encrypted at the column level and that the encryption keys are never revealed to the database engine. By storing the column master key in Azure Key Vault and using client-side encryption, the application manages the encryption and decryption process, so only authorized users with access to the key can read the plaintext data. This meets the requirement that encryption be managed by the application, not the database.

Answer

Use dynamic data masking to obfuscate the sensitive columns for unauthorized users.

Answer

Use Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault.

Answer

Create a row-level security policy to restrict access to the sensitive rows.

Question 13

You have a new Azure SQL Database. You need to ensure that all connections use TLS 1.2 or higher. What should you configure?

Accepted Answer

Set the 'minimal TLS version' to 1.2 in the server's properties in the Azure portal.. Option B is correct because Azure SQL Database has a server-level setting to enforce minimum TLS version. Option A is wrong because there is no database-level TLS setting. Option C is wrong because the firewall does not control encryption protocols. Option D is wrong because auditing is unrelated.

Answer

Set the 'minimal TLS version' to 1.2 in the database's properties.

Answer

Add a firewall rule to deny connections using TLS 1.0 or 1.1.

Answer

Enable the 'Force encryption' option in the connection string and require TLS 1.2.

Question 14

Your company is using Azure SQL Database with Microsoft Entra ID authentication. A developer needs to connect to the database using a service principal. What should you provide to the developer?

Accepted Answer

The service principal's client ID and client secret, and the connection string with 'Authentication=Active Directory Service Principal'.. Option B is correct because to connect to Azure SQL Database using a service principal with Microsoft Entra ID authentication, the developer needs the service principal's client ID and client secret (or certificate) for authentication, and the connection string must include 'Authentication=Active Directory Service Principal' to specify the authentication method. This combination allows the application to obtain an access token from Microsoft Entra ID via the OAuth 2.0 client credentials grant flow, which is then used to authenticate to the database.

Answer

The connection string with 'Authentication=Active Directory Service Principal' and the service principal's object ID.

Answer

The service principal's username and password.

Answer

The service principal's managed identity endpoint.

Question 15

You are designing a secure environment for Azure SQL Database. Which TWO of the following are recommended practices for network security?

Accepted Answer

Use Azure Private Link to connect to the database from a virtual network.. Options A and C are correct. Azure Private Link ensures traffic never traverses the public internet. Disabling public network access at the server level blocks all internet traffic. Option B is wrong because allowing all Azure services is a broad rule that may be insecure. Option D is wrong because VNet service endpoints are legacy and less secure than Private Link. Option E is wrong because firewall rules with large IP ranges are less secure.

Answer

Enable the 'Allow Azure services and resources to access this server' firewall setting.

Answer

Use VNet service endpoints instead of Private Link to reduce costs.

Answer

Add firewall rules that allow all IP addresses from your organization's IP range.