DP-300 Implement a secure environment Practice Test 15 — 15 Questions

Question 1

Your company uses Azure SQL Database and needs to comply with GDPR. You must implement data classification and protection. Which TWO actions should you take? (Choose two.)

Accepted Answer

Configure sensitivity labels using Microsoft Purview Information Protection.. Microsoft Purview Information Protection provides sensitivity labels that can be applied to columns in Azure SQL Database to classify and protect personal data, meeting GDPR requirements. These labels enforce encryption, access restrictions, and visual markings, integrating with Azure SQL's data classification capabilities.

Answer

Implement Always Encrypted for all columns containing personal data.

Answer

Install the Azure Information Protection client on all client machines.

Answer

Enable Microsoft Defender XDR for the database server.

Question 2

Your organization uses Azure SQL Managed Instance and needs to implement a defense-in-depth strategy. Which THREE security controls should you implement? (Choose three.)

Accepted Answer

Enable advanced threat protection using Microsoft Defender for Cloud.. Option A is correct because enabling advanced threat protection via Microsoft Defender for Cloud provides detection and alerting for anomalous activities and potential vulnerabilities on Azure SQL Managed Instance, which is a core detective control in a defense-in-depth strategy. Option B is correct because server-level auditing captures database events and writes them to an audit log, providing the monitoring and traceability required for a layered security approach. Option D is correct because configuring network security groups (NSGs) on the subnet restricts inbound traffic to the managed instance, enforcing network-level segmentation and reducing the attack surface, which is a fundamental preventive control. Option C is not a security control; columnstore indexes are a performance optimization for analytical workloads and do not contribute to defense-in-depth. Option E is not the best fit because application roles manage permissions within a database but do not address the broader layered security controls expected in a defense-in-depth strategy for Azure SQL Managed Instance.

Answer

Create columnstore indexes on large tables to improve query performance.

Answer

Create application roles in each database to manage permissions.

Question 3

Your Azure SQL Database contains sensitive financial data. You need to audit all data modifications (INSERT, UPDATE, DELETE) and store the audit logs in a central Azure Storage account for compliance. What should you configure?

Accepted Answer

Enable auditing on the database and set the audit log destination to an Azure Storage account.. Azure SQL Database's built-in auditing feature can be configured to capture all data modifications (INSERT, UPDATE, DELETE) and write audit logs directly to an Azure Storage account. This meets the compliance requirement for centralized, durable storage of audit records without additional services or complex pipelines.

Answer

Configure diagnostic settings to stream query store data to an event hub.

Answer

Enable Microsoft Defender for SQL and configure security alerts to be sent to a storage account.

Answer

Enable SQL Vulnerability Assessment and export the results to a storage account.

Question 4

You are responsible for securing an Azure SQL Database. You need to implement data masking for a column that contains credit card numbers, ensuring that users with the db_datareader role see a masked version. However, users with the db_owner role should see the unmasked data. What should you configure?

Accepted Answer

Apply Dynamic Data Masking (DDM) to the credit card column.. Dynamic Data Masking (DDM) is the correct choice because it allows you to obfuscate sensitive data in query results for non-privileged users (like db_datareader) while permitting users with elevated permissions (like db_owner) to see the unmasked data. DDM is applied at the column level and does not modify the underlying data; it simply masks the output based on the user's permissions. The db_owner role is exempt from masking by default, meeting the requirement exactly.

Answer

Implement Row-Level Security (RLS) to filter rows based on user role.

Answer

Implement Always Encrypted with deterministic encryption.

Answer

Enable Transparent Data Encryption (TDE).

Question 5

You are reviewing an ARM template for Azure SQL Database. The exhibit shows a resource definition for Transparent Data Encryption (TDE). You need to ensure that the database uses customer-managed keys (CMK) stored in Azure Key Vault instead of service-managed keys. What additional configuration is required?

Accepted Answer

Add a resource of type 'Microsoft.Sql/servers/encryptionProtector' and reference the key vault key.. To use customer-managed keys (CMK) for Transparent Data Encryption (TDE) in Azure SQL Database, you must configure an encryption protector that points to the key in Azure Key Vault. This is done by adding a resource of type 'Microsoft.Sql/servers/encryptionProtector' to the ARM template, which sets the server-level encryption protector to use the specified key vault key. Option D correctly identifies this required resource, as TDE with CMK is managed at the server level, not directly on the database resource.

Answer

Modify the database resource to include a 'keyVaultUri' property.

Answer

Enable Always Encrypted on the database.

Answer

Set the TDE state to 'Disabled' and then re-enable with a customer key.

Question 6

You are reviewing a PowerShell script that configures auditing for an Azure SQL Database. The script sets an audit rule with the specified parameters. After running the script, you notice that SELECT operations are not being audited. What is the most likely cause?

Accepted Answer

The AuditActionGroup specified does not capture SELECT operations.. The script likely specifies an AuditActionGroup that does not include the group responsible for capturing SELECT operations. In Azure SQL Database auditing, SELECT operations are captured by the SUCCESSFUL_SCHEMA_OBJECT_ACCESS_GROUP or similar action groups. If the configured AuditActionGroup omits this group, SELECT statements will not be logged, even though other operations may be audited correctly.

Answer

The retention days are set too low, causing logs to be overwritten.

Answer

The storage endpoint is incorrectly formatted.

Answer

The storage account access key is invalid.

Question 7

Your Azure SQL Database is accessed by multiple applications. You need to ensure that all connections use Transport Layer Security (TLS) 1.2 or higher. Which TWO configurations should you verify or enable?

Accepted Answer

Configure client applications to use TLS 1.2 in their connection strings.. Option A is correct because client-side enforcement is required: applications must be configured to negotiate TLS 1.2 or higher (for example, via the connection string or the underlying driver/provider settings), otherwise a client may still attempt to negotiate an older protocol version. Option D is correct because Azure SQL Database (and Azure SQL Managed Instance) exposes a server-level 'minimalTlsVersion' property that, when set to '1.2', rejects connections that attempt to negotiate TLS versions lower than 1.2. Together, A and D ensure both the client and the server enforce TLS 1.2 or higher. Option B is not appropriate because a network security group rule cannot inspect or enforce TLS protocol versions; NSGs filter by IP, port, and protocol (TCP/UDP), not by TLS version. Option C is not relevant because 'DenyPublicNetworkAccess' only controls whether public endpoints are reachable, not the TLS version used. Option E is not applicable because 'ForceEncryption' is a SQL Server on-premises/VM configuration option (set via sp_configure or the protocol properties), not an Azure SQL Database server property.

Answer

Create a network security group rule to block non-TLS traffic.

Answer

Set 'DenyPublicNetworkAccess' to 'Yes' on the server.

Answer

Enable 'ForceEncryption' on the SQL Server instance.

Question 8

You need to audit all schema changes in an Azure SQL Database and store the audit logs in a storage account for long-term retention. What should you enable?

Accepted Answer

Azure SQL Auditing with storage account destination.. Azure SQL Auditing with a storage account destination is the correct choice because it tracks database events, including schema changes (DDL operations), and writes audit logs to Azure Blob Storage for long-term retention. This meets the requirement to audit all schema changes and store logs durably, as storage accounts provide configurable retention policies.

Answer

Advanced Threat Protection with email alerts.

Answer

Query Store with 'Data Flush Interval' set to 1 minute.

Answer

SQL Vulnerability Assessment with recurring scans.

Question 9

You have an Azure SQL Database that needs to be accessed by an application running on an Azure VM. The VM is in a different subscription. You want to minimize administrative overhead and ensure secure connectivity without exposing the database to the public internet. What should you do?

Accepted Answer

Create a private endpoint for the SQL Database in the VM's VNet.. A private endpoint assigns the Azure SQL Database a private IP address from the VM's VNet, enabling secure connectivity over the Microsoft backbone without exposing the database to the public internet. This minimizes administrative overhead as it does not require VPN gateways or complex routing, and it works across subscriptions by linking the private endpoint to the VM's VNet.

Answer

Set up a site-to-site VPN between the VM's VNet and the SQL Database's VNet.

Answer

Use a VNet service endpoint for Azure SQL Database in the VM's VNet.

Answer

Configure a firewall rule to allow the VM's public IP address.

Question 10

Your organization requires that all Azure SQL Database administrators use multi-factor authentication (MFA) when connecting. Which authentication method must be used?

Accepted Answer

Microsoft Entra ID authentication with Conditional Access policy. Microsoft Entra ID authentication combined with a Conditional Access policy is required to enforce multi-factor authentication (MFA) for Azure SQL Database administrators. Conditional Access policies can mandate MFA as a condition for authentication, which is not possible with SQL Server authentication, certificate-based authentication, or Windows authentication alone. This method integrates with Microsoft Entra ID (formerly Azure AD) to provide the necessary security controls.

Answer

SQL Server authentication

Answer

Certificate-based authentication

Answer

Windows authentication

Question 11

Your company wants to implement transparent data encryption (TDE) for an Azure SQL Database using a customer-managed key stored in Azure Key Vault. Which TWO prerequisites must be met? (Choose two.)

Accepted Answer

The Azure SQL Server must have a system-assigned managed identity.. Option A is correct because Azure SQL TDE with a customer-managed key (BYOK) requires the logical Azure SQL Server to have a managed identity (system-assigned or user-assigned) that can authenticate to Azure Key Vault; the system-assigned managed identity is the standard prerequisite for granting the server access to the key. Option B is correct because the Key Vault must grant that SQL Server identity the required key permissions — typically get, wrapKey, and unwrapKey — via an access policy (or Azure RBAC role assignment) so the server can wrap and unwrap the TDE protector key. Option C is not required: a column master key belongs to Always Encrypted, not TDE, which uses a database encryption key (DEK) protected by a server-level TDE protector. Option D is incorrect because the Key Vault and SQL Server can be in the same region; there is no requirement that they be in different regions. Option E is incorrect because TDE key configuration does not require taking the database offline; the operation is performed online without database downtime.

Answer

The database must contain a column master key.

Answer

The Key Vault must be in a different region than the SQL Server.

Answer

The database must be taken offline during key configuration.

Question 12

You need to prevent users from accidentally deleting an Azure SQL Database. What should you configure?

Accepted Answer

Apply a 'CanNotDelete' Azure Resource Lock on the resource group.. A 'CanNotDelete' Azure Resource Lock on the resource group prevents any user, including those with high-level permissions like Owner, from deleting the Azure SQL Database. This lock overrides all role-based access control (RBAC) permissions at the resource or resource group level, ensuring accidental deletion is blocked even if a user has delete permissions.

Answer

Revoke the db_ddladmin role from users.

Answer

Create an Azure Policy to deny SQL Database creation.

Answer

Set a deny rule in the SQL Database firewall.

Question 13

An Azure SQL Database contains personally identifiable information (PII). You need to mask the PII columns from non-administrative users while allowing administrators to see the actual data. Which feature should you use?

Accepted Answer

Dynamic Data Masking. Dynamic Data Masking (DDM) is the correct choice because it selectively obscures sensitive PII columns in query results for non-administrative users, while leaving the data unmasked for users with elevated permissions (e.g., db_owner or the UNMASK permission). This is achieved by defining masking rules on specific columns, such as email or phone number, without altering the underlying stored data.

Answer

Always Encrypted

Answer

Transparent Data Encryption (TDE)

Answer

Row-Level Security

Question 14

You are configuring Azure SQL Database firewall rules. You need to allow a team of developers to connect from their office IP range (192.168.1.0/24) to a specific database. The developers should not be able to access other databases on the same logical server. What should you do?

Accepted Answer

Add a database-level firewall rule for the IP range 192.168.1.0/24.. Database-level firewall rules in Azure SQL Database allow you to restrict access to a specific database on a logical server, rather than the entire server. By adding a rule for the IP range 192.168.1.0/24 at the database level, the developers can connect only to that database, and they will be blocked from accessing other databases on the same server. This is the correct approach because server-level rules would grant access to all databases, which violates the requirement.

Answer

Create a private endpoint for the database.

Answer

Add a server-level firewall rule for the IP range 192.168.1.0/24.

Answer

Configure a virtual network service endpoint for the server.

Question 15

You are the DBA for a company that uses Azure SQL Database. You need to ensure that only authorized users can view sensitive columns (e.g., salary) in the Employees table. You want to obfuscate the data for certain users but allow full access to HR managers. Which feature should you use?

Accepted Answer

Dynamic Data Masking. Dynamic Data Masking (DDM) is the correct choice because it obfuscates sensitive columns (e.g., salary) in query results for unauthorized users while allowing full visibility for authorized users like HR managers. DDM applies masking rules at the database level without modifying the underlying data, making it ideal for scenarios where you need to limit exposure of sensitive data to certain roles without changing the application code.

Answer

Always Encrypted

Answer

Row-Level Security (RLS)

Answer

Transparent Data Encryption (TDE)