DP-300 Implement a secure environment Practice Test 14 — 15 Questions

Question 1

You are designing a secure environment for Azure SQL Database. Which TWO of the following are recommended practices for network security?

Accepted Answer

Use Azure Private Link to connect to the database from a virtual network.. Options C and D are correct. Azure Private Link (C) ensures traffic between the virtual network and Azure SQL Database stays within the Microsoft backbone network, avoiding the public internet. Disabling public network access (D) at the server level blocks all internet traffic, enhancing security. Option A is incorrect because enabling 'Allow Azure services...' is a broad rule that permits traffic from any Azure service, which may be insecure. Option B is incorrect because VNet service endpoints are legacy and less secure compared to Private Link. Option E is incorrect because allowing a large IP range increases the attack surface.

Answer

Enable the 'Allow Azure services and resources to access this server' firewall setting.

Answer

Use VNet service endpoints instead of Private Link to reduce costs.

Answer

Add firewall rules that allow all IP addresses from your organization's IP range.

Question 2

You need to protect Azure SQL Database from SQL injection attacks. Which THREE of the following measures should you implement?

Accepted Answer

Enable Microsoft Defender for SQL to detect and alert on SQL injection.. Microsoft Defender for SQL provides advanced security capabilities, including vulnerability assessment and threat detection. It specifically monitors for anomalous activities that indicate a SQL injection attack, such as unusual login attempts or queries that match known injection patterns, and can alert administrators or trigger automated responses.

Answer

Implement dynamic data masking to hide sensitive data from unauthorized users.

Answer

Enable Transparent Data Encryption (TDE) to encrypt the database at rest.

Question 3

You are configuring authentication for Azure SQL Database. Which TWO of the following are supported authentication methods?

Accepted Answer

Microsoft Entra ID authentication with a service principal.. Microsoft Entra ID authentication with a service principal is supported in Azure SQL Database. A service principal is an identity created for use with applications, hosted services, and automated tools to access Azure resources, and it can authenticate to Azure SQL Database using Microsoft Entra ID (formerly Azure AD) tokens. This method enables secure, non-interactive authentication for applications and automation scenarios.

Answer

Windows authentication using Kerberos.

Answer

OAuth 2.0 token authentication.

Answer

Certificate-based authentication for SQL logins.

Question 4

You are a database administrator for a healthcare company. You have an Azure SQL Database that stores patient records. The database is currently accessible from the public internet via firewall rules. You need to implement a secure environment that meets the following requirements:
- All traffic to the database must be private and not traverse the internet.
- The database must be accessible from an Azure Virtual Machine in a specific VNet.
- The solution must minimize management overhead and cost.
- You need to ensure that the database can be failed over to a secondary region in case of an outage.

What should you do?

Accepted Answer

Create a private endpoint in the VNet, disable public network access, and configure a failover group with a private endpoint in the secondary region.. It meets all requirements: a private endpoint ensures all traffic to the database stays within the Microsoft backbone network and never traverses the internet. Disabling public network access enforces that no public traffic can reach the database, fulfilling the private traffic requirement. Configuring a failover group with a private endpoint in the secondary region provides geo-replication and automatic failover while maintaining private connectivity, with minimal management overhead and no additional cost for VPNs. Option A is incorrect because restricting the firewall to the VM's public IP still allows traffic over the public internet, violating the private traffic requirement. Option B is incorrect because a point-to-site VPN adds complexity and cost, and still uses a VPN connection that may traverse the internet, and does not provide the same seamless private connectivity as a private endpoint. Option D is incorrect because a VNet service endpoint does not make traffic private; it still uses the public endpoint of the database, and keeping public access enabled fails the requirement to disable public internet access.

Answer

Restrict firewall rules to only the VM's public IP and enable active geo-replication.

Answer

Configure a point-to-site VPN from the VM to the database and set up geo-replication.

Answer

Create a VNet service endpoint and a failover group. Keep public access enabled for failover.

Question 5

Your organization is migrating a legacy on-premises SQL Server database to Azure SQL Managed Instance. The database contains sensitive financial data. You need to implement column-level encryption so that even database administrators cannot view the plaintext data. The encryption keys must be stored in Azure Key Vault, and the application must be able to encrypt and decrypt data transparently. The application currently uses Entity Framework Core and runs on Azure App Service. You have the following requirements:
- Use a solution that provides the strongest security by ensuring the database never has access to the plaintext.
- Minimize changes to the application code.
- The application must be able to perform equality searches on encrypted columns.

What should you implement?

Accepted Answer

Use Always Encrypted with deterministic encryption and store column master key in Azure Key Vault.. Always Encrypted with deterministic encryption provides column-level encryption, stores the column master key in Azure Key Vault, and ensures the database never sees plaintext. The client-side driver in Entity Framework Core handles encryption transparently, and deterministic encryption allows equality searches. Option A is incorrect because randomized encryption does not support equality searches; secure enclaves could enable that but add complexity. Option B is incorrect because dynamic data masking does not encrypt data; it only hides it from unauthorized users at query time, and the database still has access to plaintext. Option C is incorrect because Transparent Data Encryption (TDE) encrypts the entire database at rest, not individual columns, and does not prevent the database from seeing plaintext during operations.

Answer

Use Always Encrypted with secure enclaves and randomized encryption.

Answer

Use dynamic data masking to hide the data from unauthorized users.

Answer

Use Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault.

Question 6

You are setting up a new Azure SQL Database for a development team. The database will contain test data that mimics production but with some sensitive fields obfuscated. You need to ensure that developers can query the database without seeing the actual sensitive data. The developers will use Microsoft Entra ID authentication. You have the following requirements:
- The sensitive data should be automatically masked in query results for all developers except the database administrator.
- The masking should be applied without modifying the application code.
- The solution should be easy to manage and not require changes to the data model.

What should you implement?

Accepted Answer

Configure dynamic data masking on the sensitive columns, and add the database administrator to the unmask permission.. Dynamic Data Masking (DDM) can be configured on sensitive columns to automatically mask data in query results without modifying application code or the data model. The database administrator can be added to the unmask permission to see the actual data. Option A is incorrect because creating views would require changes to the data model and application queries. Option C is incorrect because Always Encrypted requires application code changes to handle encryption/decryption. Option D is incorrect because Row-Level Security filters rows based on predicates, not columns, and does not mask data.

Answer

Create views that exclude sensitive columns and grant developers access to the views instead of the base tables.

Answer

Implement Always Encrypted with column encryption, and grant the developers access to the encryption keys.

Answer

Create a row-level security policy that denies access to sensitive rows for developers.

Question 7

Your company has an Azure SQL Database that is accessed by multiple applications. You need to implement a security solution that meets the following requirements:
- Each application must have its own database user with specific permissions.
- All authentication must use Microsoft Entra ID.
- You need to be able to rotate credentials for each application without impacting other applications.
- The solution must support automatic credential rotation for service principals.

What should you do?

Accepted Answer

Create a Microsoft Entra ID service principal for each application, store the client secret in Azure Key Vault, and create a contained database user mapped to each service principal.. It creates a separate Microsoft Entra ID service principal for each application, stores the client secret in Azure Key Vault for automatic rotation, and creates a contained database user mapped to each service principal. This meets all requirements: per-application users, Microsoft Entra ID authentication, independent credential rotation, and support for automatic rotation via Key Vault. Option A is incorrect because managed identities are tied to specific Azure resources (e.g., VMs, App Services) and cannot be used for all applications (e.g., on-premises). Additionally, they do not provide a separate credential that can be rotated independently for each application. Option B is incorrect because a single service principal would share the same identity across all applications, preventing individual permissions and making credential rotation affect all applications. Option C is incorrect because SQL logins do not use Microsoft Entra ID authentication.

Answer

Use managed identities for each Azure resource and assign permissions to the database.

Answer

Create a single Microsoft Entra ID service principal for all applications and assign different database roles.

Answer

Create SQL logins and users for each application with strong passwords, and configure password rotation policies.

Question 8

You are a database administrator for a company that stores sensitive customer data in Azure SQL Database. The security team requires that all access to the database be authenticated using Microsoft Entra ID and that no SQL authentication logins exist. You need to verify that SQL authentication is disabled. What should you do?

Accepted Answer

In the Azure portal, navigate to the SQL server's 'Microsoft Entra ID' blade and enable 'Azure AD-only authentication'. Enabling 'Azure AD-only authentication' in the SQL server's Microsoft Entra ID blade disables SQL authentication entirely, ensuring that only Microsoft Entra ID principals can authenticate. This directly meets the security requirement to eliminate SQL authentication logins, as it prevents any connection attempt using SQL login credentials, even if they exist in the system catalog.

Answer

Set the 'Deny public network access' property to 'Yes'

Answer

Configure a server-level firewall rule to block all IP addresses

Answer

Query sys.sql_logins to check for any SQL authenticated logins

Question 9

You are a database administrator for a healthcare organization that uses Azure SQL Database to store protected health information (PHI). The compliance team requires that you implement controls to prevent unauthorized access and detect potential data exfiltration. Which TWO actions should you take?

Accepted Answer

Implement dynamic data masking for columns containing PHI. Dynamic data masking (B) limits exposure of PHI by obfuscating sensitive data in query results to non-privileged users, directly preventing unauthorized viewing. Microsoft Defender for SQL (D) provides advanced threat detection and alerts for anomalous activities like SQL injection or data exfiltration attempts, meeting the detection requirement. Together, they address both prevention and detection of unauthorized access and data exfiltration.

Answer

Enable transparent data encryption (TDE) on the database

Answer

Enable change tracking on the database

Answer

Enable auditing on the database

Question 10

You are a database administrator for a financial services company. You have deployed an Azure SQL Database and configured auditing using the JSON policy shown in the exhibit. After a security incident, you need to review all successful and failed login attempts to the database. However, you notice that login events are not being captured in the audit logs. What is the most likely reason?

Accepted Answer

The audit actions and groups do not include login events. The JSON policy shown in the exhibit defines audit actions and groups, but it does not include the `SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP` or `FAILED_DATABASE_AUTHENTICATION_GROUP` action groups. These groups are required to capture both successful and failed login attempts (authentication events) in Azure SQL Database. Without them, login events are not recorded in the audit logs, regardless of other settings.

Answer

The audit logs are being sent to Azure Monitor instead of blob storage

Answer

The retention days are set too high, causing logs to be truncated

Answer

Auditing is disabled at the server level

Question 11

You are a database administrator for a multinational corporation that uses Azure SQL Managed Instance to host multiple databases for different business units. The security policy requires that all connections to the managed instance must use encrypted connections (TLS 1.2 or higher). Additionally, the company wants to minimize the attack surface by restricting network access. You need to configure the managed instance to enforce encrypted connections and block all public internet traffic. What should you do?

Accepted Answer

Set the 'Minimal TLS Version' property to 1.2 and set 'Public data endpoint' to 'Disabled'. Setting the 'Minimal TLS Version' property to 1.2 enforces that all connections use TLS 1.2 or higher, meeting the encryption requirement. Disabling the 'Public data endpoint' blocks all public internet traffic, ensuring that only traffic from within the virtual network can reach the managed instance. This combination directly satisfies both security policy goals without relying on additional components like private endpoints or firewall rules.

Answer

Enable a private endpoint and set the 'Minimal TLS Version' property to 1.0

Answer

Disable the public endpoint and enable a service endpoint for the virtual network

Answer

Configure a server-level firewall rule to allow only specific IP addresses and set the 'Minimal TLS Version' property to 1.2

Question 12

You are a database administrator for a startup that uses Azure SQL Database to run an e-commerce application. The application uses a service principal (Microsoft Entra ID application) to authenticate to the database. You need to grant the service principal the ability to read data from all tables in the 'sales' schema. Which THREE actions should you take?

Accepted Answer

Create a database user for the service principal using the CREATE USER statement with the FROM EXTERNAL PROVIDER option. A service principal (Microsoft Entra ID application) must have a corresponding database user created using the CREATE USER statement with the FROM EXTERNAL PROVIDER clause. This maps the external identity to a database principal, enabling authentication and authorization within Azure SQL Database.

Answer

Grant CONTROL permission on the database to the user

Answer

Add the user to the 'sales' database role

Question 13

You are a database administrator for a retail company that uses Azure SQL Database. The security team wants to prevent SQL injection attacks by ensuring that all application queries use parameterized statements. Which built-in Azure feature should you enable to help detect and alert on potential SQL injection attempts?

Accepted Answer

Enable Microsoft Defender for SQL. Microsoft Defender for SQL includes advanced threat detection capabilities that continuously monitor database activity for anomalous patterns, including SQL injection attempts. When enabled, it analyzes query execution patterns and can alert on suspicious queries that deviate from parameterized statement usage, directly addressing the security team's requirement to detect and alert on potential SQL injection attacks.

Answer

Enable auditing on the database

Answer

Enable data discovery and classification

Answer

Enable SQL vulnerability assessment

Question 14

You are a database administrator for a bank that uses Azure SQL Database to store transaction data. The compliance team requires that you implement a solution to encrypt data at rest and in transit. Additionally, the solution must allow the database to be restored to any point in time within the last 35 days. Which TWO actions should you take?

Accepted Answer

Enable transparent data encryption (TDE) on the database. Transparent Data Encryption (TDE) encrypts the database at rest, including backups and transaction log files, which satisfies the compliance requirement for data at rest. TDE is a built-in feature of Azure SQL Database that requires no application changes and is enabled at the database level.

Answer

Enable Microsoft Defender for SQL

Answer

Implement dynamic data masking on sensitive columns

Answer

Enable Always Encrypted for all columns containing sensitive data

Question 15

You are a database administrator for a technology company that uses Azure SQL Database to support a multi-tenant SaaS application. Each tenant has its own database. The security team requires that users from one tenant should never be able to access data from another tenant, even if a user's credentials are compromised. You need to implement a solution that enforces tenant isolation at the database level. The solution must be transparent to the application and must not require application code changes. What should you do?

Accepted Answer

Create a contained database user for each tenant in their respective database and ensure that cross-database queries are not allowed by configuring server-level firewall rules to block access between databases. Each tenant has its own database, and by creating contained database users specific to each tenant and preventing cross-database access through firewall rules or private endpoints, you enforce tenant isolation. Even if credentials are compromised, the attacker can only access the single tenant's database. Option A is incorrect because Always Encrypted protects data at rest and in transit but does not restrict which data a user can query; it does not prevent cross-tenant access. Option C is incorrect because elastic queries are designed to query across databases, which would allow cross-tenant access if not carefully restricted. Option D is incorrect because a linked server enables cross-database queries, increasing the risk of cross-tenant access.

Answer

Use Always Encrypted to encrypt each tenant's data with a separate column encryption key

Answer

Implement elastic queries to query across all tenant databases and use a view to filter by tenant ID

Answer

Create a linked server between all tenant databases and use a security policy to restrict access