DP-300 Implement a secure environment Practice Test 14 — 15 Questions

Question 1

You manage an Azure SQL Database that is accessed by several applications. You need to implement the principle of least privilege for database access. Which three actions should you take? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create contained database users instead of server-level logins.. Contained database users are authenticated directly within the database, independent of the server-level logins. This aligns with the principle of least privilege by avoiding the need for server-level permissions, which would grant broader access across the server. In Azure SQL Database, contained users are the recommended approach for database-level access control, as they limit the blast radius of a compromised credential to a single database.

Answer

Add users to the db_datareader role.

Answer

Configure firewall rules to restrict IP addresses.

Question 2

You are configuring security for an Azure SQL Database that will be used by a web application. The application uses a connection string with SQL authentication. You need to protect the database from SQL injection attacks. Which two measures should you implement? (Choose two.)

Accepted Answer

Use parameterized queries in the application.. Parameterized queries ensure that user input is treated as data, not executable code, by separating SQL logic from input values. This prevents attackers from injecting malicious SQL statements into the query string, which is the primary defense against SQL injection attacks.

Answer

Enable Transparent Data Encryption (TDE).

Answer

Configure Dynamic Data Masking (DDM).

Answer

Enable Always Encrypted on sensitive columns.

Question 3

Your company uses Azure SQL Database with Microsoft Entra ID (formerly Azure AD) authentication. You need to grant a group of external consultants access to a specific database with read-only permissions. The consultants are from a partner organization that uses their own Microsoft Entra ID tenant. What should you do?

Accepted Answer

Invite the consultants as guest users in your Microsoft Entra ID tenant using B2B collaboration, then create a contained database user for each guest user. External consultants from a different Microsoft Entra ID tenant must first be invited as guest users via B2B collaboration to your tenant. Once they are guest users, you can create contained database users in Azure SQL Database mapped to their guest user identities (e.g., their UPN in your tenant) and grant them read-only permissions (e.g., db_datareader role). This approach respects the isolation of the partner's tenant while enabling access through your tenant's identity.

Answer

Create a contained database user mapped to the consultants' Microsoft Entra ID user principal names (UPNs)

Answer

Configure Azure SQL Database to trust the partner's Microsoft Entra ID tenant

Answer

Create a SQL Server authentication login and user for the consultants

Question 4

You are troubleshooting a connectivity issue: an application running on an Azure virtual machine (VM) cannot connect to an Azure SQL Database. The VM is in the same region as the SQL Database. The VM can ping other resources, but the SQL connection fails. The SQL Database has a firewall rule allowing the VM's private IP address. What is the most likely cause?

Accepted Answer

The firewall rule uses the VM's private IP address, but Azure SQL Database sees the VM's public IP address. When an Azure VM connects to Azure SQL Database, the source IP address seen by the SQL firewall is the VM's public outbound IP address due to Source Network Address Translation (SNAT) performed by Azure. Even if the VM is in the same region, traffic to Azure SQL Database egresses through the VM's public IP, not its private IP. Therefore, a firewall rule allowing the private IP will not match, causing the connection to fail.

Answer

The SQL Database has the public endpoint disabled

Answer

The SQL Database firewall is configured at the database level, not the server level

Answer

The VM does not have an outbound security rule allowing traffic to Azure SQL Database

Question 5

You need to ensure that all connections to an Azure SQL Database use encryption. The application uses the JDBC driver. What should you configure in the connection string?

Accepted Answer

Add 'encrypt=true' and 'trustServerCertificate=false'. For JDBC connections to Azure SQL Database, setting 'encrypt=true' enforces TLS encryption for data in transit, and 'trustServerCertificate=false' ensures that the server's TLS certificate is validated against the trusted certificate authority (CA) chain, preventing man-in-the-middle attacks. This is the recommended configuration for secure connections to Azure SQL Database.

Answer

Add 'hostNameInCertificate=*.database.windows.net'

Answer

Add 'encrypt=false' and 'trustServerCertificate=true'

Answer

Add 'useEncryption=true' and 'validateServerCertificate=true'

Question 6

You need to audit schema changes on an Azure SQL Database. Specifically, you must capture details of any DDL statements executed by any user. The audit logs must be stored in a Log Analytics workspace for analysis. What should you configure?

Accepted Answer

Configure server-level auditing with a Log Analytics workspace destination. Azure SQL Database server-level auditing with a Log Analytics workspace destination captures all DDL statements executed by any user and stores them in a Log Analytics workspace for analysis. This meets the requirement to audit schema changes and store logs in Log Analytics, as server-level auditing captures events for all databases on the server, including DDL operations, and supports Log Analytics as a destination.

Answer

Create DDL triggers that write to a table

Answer

Configure database-level auditing with blob storage destination

Answer

Create an extended events session to capture DDL events

Question 7

Refer to the exhibit. You are reviewing an Azure Resource Manager template for deploying an Azure SQL Database server. The template sets publicNetworkAccess to Disabled, minimalTlsVersion to 1.2, and azureAdOnlyAuthentication to true. However, the deployment fails with an error. What is the most likely cause?

Accepted Answer

When azureAdOnlyAuthentication is true, the administratorLogin and administratorLoginPassword properties must not be specified. When azureAdOnlyAuthentication is set to true in an Azure SQL Database ARM template, the administratorLogin and administratorLoginPassword properties must be omitted because Microsoft Entra ID authentication replaces SQL authentication as the sole identity provider. Including these properties causes a validation conflict, as the deployment expects no SQL admin credentials when Microsoft Entra ID-only authentication is enabled.

Answer

minimalTlsVersion 1.2 is not supported in Azure SQL Database

Answer

publicNetworkAccess Disabled requires a private endpoint to be defined in the same template

Answer

The password does not meet complexity requirements

Question 8

Refer to the exhibit. You are configuring Azure SQL Database Transparent Data Encryption (TDE) with customer-managed keys (CMK) stored in Azure Key Vault. The deployment uses a user-assigned managed identity. However, after deployment, the TDE status shows 'Inaccessible'. What is the most likely cause?

Accepted Answer

The managed identity lacks 'Get', 'Wrap Key', and 'Unwrap Key' permissions on the Key Vault key. When using customer-managed keys (CMK) for TDE in Azure SQL Database, the managed identity assigned to the logical server must have 'Get', 'Wrap Key', and 'Unwrap Key' permissions on the key in Azure Key Vault. Without these specific permissions, the SQL Database service cannot retrieve or use the key to encrypt or decrypt the database encryption key, resulting in an 'Inaccessible' TDE status.

Answer

The key specified in the URI does not exist

Answer

The user-assigned managed identity is not assigned to the SQL Database server

Answer

The Key Vault firewall is enabled and does not allow Azure services

Question 9

Which of the following are valid methods to authenticate to Azure SQL Database using Microsoft Entra ID? (Select all that apply.)

Accepted Answer

Microsoft Entra ID managed identity. Microsoft Entra ID offers several authentication methods for Azure SQL Database. Managed identity (A) and integrated authentication (C) are directly supported without additional token acquisition steps. Certificate-based authentication (D) and password authentication (E) require an intermediate application or client library to obtain an Entra ID token, and are not considered direct authentication methods for Azure SQL Database. AD FS tokens (B) are not directly accepted; Entra ID must issue the token after authentication.

Answer

Active Directory Federation Services (AD FS) token

Answer

Microsoft Entra ID certificate-based authentication

Answer

Microsoft Entra ID password authentication

Question 10

Which TWO of the following are required steps to configure Azure SQL Database to use a customer-managed key (CMK) for Transparent Data Encryption (TDE) with Azure Key Vault? (Choose two.)

Accepted Answer

Set the TDE protector to the Key Vault key via the Azure portal or T-SQL. Setting the TDE protector to the Key Vault key is the step that actually enables customer-managed key (CMK) encryption for Azure SQL Database. This can be done via the Azure portal, PowerShell, Azure CLI, or T-SQL (using ALTER DATABASE SCOPED CONFIGURATION SET TDE_PROTECTOR). Without this step, the database continues to use a service-managed key.

Answer

Create a user-assigned managed identity for the SQL Database server

Answer

Store the encryption key in the SQL Database server's hardware security module (HSM)

Answer

Ensure the SQL Database server is inside the same virtual network as the Key Vault

Question 11

Your company is migrating on-premises SQL Server databases to Azure SQL Managed Instance. You need to ensure that database backups are encrypted at rest using customer-managed keys stored in Azure Key Vault. You also need to allow the backup service to access the keys. What should you configure?

Accepted Answer

Enable Transparent Data Encryption (TDE) with customer-managed keys and grant the managed instance's system-assigned managed identity 'get', 'wrapKey', and 'unwrapKey' permissions on the key vault.. Transparent Data Encryption (TDE) with customer-managed keys (CMK) in Azure SQL Managed Instance encrypts database backups at rest. To allow the Azure backup service to access the key for backup encryption, the managed instance's system-assigned managed identity must be granted 'get', 'wrapKey', and 'unwrapKey' permissions on the Azure Key Vault where the CMK is stored. This ensures that backups are encrypted using the customer-controlled key, meeting the requirement for encryption at rest with customer-managed keys.

Answer

Use Always Encrypted with column master key stored in Azure Key Vault.

Answer

Configure Azure Backup for SQL Server in Azure VM and use Backup Center to manage encryption.

Answer

Configure server-level firewall rules to allow Azure services to access the server.

Question 12

You are the database administrator for a healthcare organization that uses Azure SQL Database. You need to implement column-level encryption for a column containing patient Social Security numbers (SSNs). The SSNs must be encrypted at rest and in transit, and only authorized client applications should be able to decrypt them. Which technology should you use?

Accepted Answer

Always Encrypted with column master key stored in Azure Key Vault.. Always Encrypted is the correct choice because it ensures that sensitive data, such as SSNs, is encrypted both at rest and in transit, and the encryption keys are stored client-side (e.g., in Azure Key Vault). This design ensures that only authorized client applications with access to the column master key can decrypt the data, preventing even database administrators or cloud operators from viewing the plaintext values.

Answer

Row-level security (RLS) to restrict access based on user role.

Answer

Dynamic data masking (DDM) to mask SSNs for unauthorized users.

Answer

Transparent Data Encryption (TDE) with customer-managed keys.

Question 13

Your organization has a policy that all Azure SQL Database connections must use Microsoft Entra authentication. You need to ensure that application developers cannot accidentally use SQL authentication. What should you do?

Accepted Answer

Enable 'Azure AD-only authentication' on the logical server.. Enabling 'Microsoft Entra ID-only authentication' on the logical server explicitly blocks all SQL authentication connections, including those from contained database users. This setting enforces that only Microsoft Entra ID (formerly Azure AD) principals can authenticate, directly aligning with the policy to prevent accidental use of SQL authentication.

Answer

Configure server-level firewall rules to block all IP addresses except Azure services.

Answer

Disable SQL authentication for all contained database users.

Answer

Create a database-level trigger to reject connections using SQL authentication.

Question 14

You manage an Azure SQL Database that is accessed by several applications. You need to implement the principle of least privilege for database access. Which three actions should you take? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a private endpoint for Azure SQL Database in the same virtual network as the application VMs.. Creating a private endpoint for Azure SQL Database places the database service on a private IP address within the same virtual network as the application VMs. This ensures that all traffic between the VMs and the database stays entirely within the Microsoft Azure backbone network, never traversing the public internet, while also providing encryption in transit via TLS by default.

Answer

Use TLS 1.2 for all connections to the database.

Answer

Configure server-level firewall rules to allow only the application VM IP addresses.

Answer

Enable forced tunneling on the application VMs to route all traffic through the on-premises network.

Question 15

Your organization requires that all changes to sensitive data in an Azure SQL Database be logged for compliance. You need to capture who changed what data and when, and store the logs in a Log Analytics workspace for analysis. What should you configure?

Accepted Answer

Configure server-level auditing to send logs to a Log Analytics workspace.. Server-level auditing in Azure SQL Database can be configured to send audit logs directly to a Log Analytics workspace, capturing detailed information about data changes including who made the change, what was changed, and when. This meets the compliance requirement for logging sensitive data changes and enables analysis using Log Analytics queries.

Answer

Enable change tracking on the database.

Answer

Enable Microsoft Defender for Cloud on the server.

Answer

Enable Transparent Data Encryption (TDE) with customer-managed keys.