DP-300 Implement a secure environment Practice Test 16 — 15 Questions

Question 1

You are configuring Azure SQL Database for a multi-tenant application. Each tenant's data is stored in a separate database. You need to ensure that a tenant admin can only manage their own database and not other databases on the same logical server. What is the best approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a contained database user with db_owner role in each tenant's database and use Microsoft Entra authentication.. Creating a contained database user with the db_owner role in each tenant's database, using Microsoft Entra authentication, ensures that the tenant admin can only manage their own database. Contained database users are scoped to the individual database, not the logical server, so they cannot access other databases on the same server. This aligns with the principle of least privilege for multi-tenant isolation.

Answer

Use a server-level firewall rule to restrict access to the tenant's IP.

Answer

Create a server-level login and assign it as db_owner on all databases.

Answer

Create a database-level firewall rule for each tenant database.

Question 2

You need to configure Azure SQL Database to allow connections only from Azure services and from a specific on-premises IP range. Which firewall rule configuration should you apply at the server level?

Accepted Answer

Set 'Allow Azure Services and resources to access this server' to ON and add a firewall rule for the on-premises IP range.. Enabling 'Allow Azure Services and resources to access this server' permits connections from all Azure services (including those from other subscriptions) by adding a special firewall rule that allows Azure IP ranges. Adding a separate firewall rule for the specific on-premises IP range then restricts non-Azure external traffic to only that range. This combination meets the requirement to allow only Azure services and the specified on-premises range.

Answer

Create a private endpoint for the server.

Answer

Create a virtual network service endpoint and add a VNet firewall rule.

Answer

Set 'Allow Azure Services and resources to access this server' to OFF and add a firewall rule for the on-premises IP range.

Question 3

You are configuring Microsoft Defender for SQL for an Azure SQL Database. You want to receive email notifications when a suspicious activity is detected. What should you configure?

Accepted Answer

In the Microsoft Defender for SQL settings, enable 'Email notifications to admins and subscription owners'.. Microsoft Defender for SQL includes a dedicated 'Email notifications to admins and subscription owners' setting under its threat detection policy. When enabled, this sends email alerts to Azure subscription owners and administrators whenever Defender detects suspicious activities such as SQL injection, brute-force attacks, or anomalous access patterns. This is the direct, built-in mechanism for email-based alerting on threat detections.

Answer

Configure a vulnerability assessment recurring scan and email the report.

Answer

Create an Azure Monitor alert rule for the 'SQL database threat detection' metric.

Answer

Enable SQL auditing and stream logs to a Log Analytics workspace.

Question 4

You need to audit all schema changes (DDL) on an Azure SQL Database for compliance. The audit logs must be retained for 7 years. What should you do?

Accepted Answer

Enable auditing on the database, log to a storage account, and set the retention policy to 7 years.. Azure SQL Database auditing can be configured at the database level to log all database events, including DDL changes, to a storage account. The retention policy can be set to 7 years directly in the audit settings, ensuring compliance with long-term retention requirements. This is the native, supported method for auditing schema changes on Azure SQL Database.

Answer

Create an extended events session to capture DDL events and save to a file.

Answer

Enable change tracking on the database and query the change tracking tables.

Answer

Enable SQL Server Audit at the server level and specify a file destination.

Question 5

Your Azure SQL Database contains sensitive customer data. You need to implement column-level encryption so that only authorized users can read specific columns. The encryption must be managed by the application, not the database. What should you use?

Accepted Answer

Implement Always Encrypted with column master key stored in Azure Key Vault.. Always Encrypted is the correct choice because it ensures that sensitive data is encrypted at the column level and that the encryption keys are never revealed to the database engine. By storing the column master key in Azure Key Vault and using client-side encryption, the application manages the encryption and decryption process, so only authorized users with access to the key can read the plaintext data. This meets the requirement that encryption be managed by the application, not the database.

Answer

Use dynamic data masking to obfuscate the sensitive columns for unauthorized users.

Answer

Use Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault.

Answer

Create a row-level security policy to restrict access to the sensitive rows.

Question 6

You have a new Azure SQL Database. You need to ensure that all connections use TLS 1.2 or higher. What should you configure?

Accepted Answer

Set the 'minimal TLS version' to 1.2 in the server's properties in the Azure portal.. To enforce TLS 1.2 or higher for all connections to an Azure SQL Database, you must configure the 'minimal TLS version' setting at the server level in the Azure portal. This setting applies to all databases hosted on that logical server, ensuring that any client attempting to connect with a TLS version lower than 1.2 is rejected. The server-level property directly controls the TLS protocol version accepted during the SSL/TLS handshake, overriding any client-side or database-level settings.

Answer

Set the 'minimal TLS version' to 1.2 in the database's properties.

Answer

Add a firewall rule to deny connections using TLS 1.0 or 1.1.

Answer

Enable the 'Force encryption' option in the connection string and require TLS 1.2.

Question 7

Your company is using Azure SQL Database with Microsoft Entra ID authentication. A developer needs to connect to the database using a service principal. What should you provide to the developer?

Accepted Answer

The service principal's client ID and client secret, and the connection string with 'Authentication=Active Directory Service Principal'.. To connect to Azure SQL Database using a service principal with Microsoft Entra ID authentication, the developer needs the service principal's client ID and client secret (or certificate) for authentication, and the connection string must include 'Authentication=Active Directory Service Principal' to specify the authentication method. This combination allows the application to obtain an access token from Microsoft Entra ID via the OAuth 2.0 client credentials grant flow, which is then used to authenticate to the database.

Answer

The connection string with 'Authentication=Active Directory Service Principal' and the service principal's object ID.

Answer

The service principal's username and password.

Answer

The service principal's managed identity endpoint.

Question 8

You are designing a secure environment for Azure SQL Database. Which TWO of the following are recommended practices for network security?

Accepted Answer

Use Azure Private Link to connect to the database from a virtual network.. Option C is correct because Azure Private Link (Private Endpoint) provides a private IP address for the Azure SQL logical server inside your VNet, so traffic between the VNet and the database travels over the Microsoft backbone and never exposes the database to the public internet. Option D is correct because disabling public network access on the SQL server ensures the database accepts connections only through approved private paths (such as Private Endpoints) or explicitly permitted exceptions, eliminating the broad public endpoint attack surface. Option A is not recommended because 'Allow Azure services and resources to access this server' creates a firewall exception that permits traffic from any Azure service, which is overly permissive and not a targeted network security control. Option B is not recommended because VNet service endpoints still route traffic to the database's public endpoint and are generally considered less secure than Private Link, so cost should not drive that choice for a secure design. Option E is not recommended because allowing an entire organization IP range is a broad, IP-based rule that is weaker than private connectivity and can be bypassed if those addresses are compromised or spoofed.

Answer

Enable the 'Allow Azure services and resources to access this server' firewall setting.

Answer

Use VNet service endpoints instead of Private Link to reduce costs.

Answer

Add firewall rules that allow all IP addresses from your organization's IP range.

Question 9

You need to protect Azure SQL Database from SQL injection attacks. Which THREE of the following measures should you implement?

Accepted Answer

Enable Microsoft Defender for SQL to detect and alert on SQL injection.. Option A is correct because Microsoft Defender for SQL provides advanced threat protection that specifically detects anomalous and potentially harmful activities such as SQL injection attempts against Azure SQL Database, generating alerts and recommendations. Option B is correct because parameterized queries and stored procedures ensure that user input is treated as data rather than executable SQL code, which is the fundamental application-level defense against SQL injection. Option D is correct because an Azure Web Application Firewall (WAF), for example on Application Gateway or Front Door, inspects HTTP/HTTPS traffic and blocks common injection patterns before they reach the application and database. Option C is not correct because dynamic data masking only obscures sensitive data in query results for unauthorized users; it does not prevent or detect SQL injection. Option E is not correct because Transparent Data Encryption protects data at rest by encrypting database files, but it does not stop SQL injection, which exploits the application's query logic rather than the storage layer.

Answer

Implement dynamic data masking to hide sensitive data from unauthorized users.

Answer

Enable Transparent Data Encryption (TDE) to encrypt the database at rest.

Question 10

You are configuring authentication for Azure SQL Database. Which TWO of the following are supported authentication methods?

Accepted Answer

Microsoft Entra ID authentication with a service principal.. Option B is correct because Azure SQL Database natively integrates with Microsoft Entra ID (formerly Azure AD), and service principals (app registrations) can be granted access and authenticate via Entra ID tokens, which is a fully supported authentication method. Option D is correct because SQL authentication using a login name and password is a core, supported authentication method for Azure SQL Database (created via CREATE LOGIN or the portal). Option A is not supported because Azure SQL Database does not use Windows/Kerberos authentication; Kerberos-based Windows authentication applies to on-premises SQL Server or Azure SQL Managed Instance with AD integration, not Azure SQL Database. Option C is not a distinct supported method because OAuth 2.0 tokens are the underlying mechanism used by Entra ID authentication, not a separately configurable authentication method for SQL logins. Option E is not supported because Azure SQL Database does not support certificate-based authentication for SQL logins; certificate authentication applies to SQL Server on-premises or Azure SQL Managed Instance.

Answer

Windows authentication using Kerberos.

Answer

OAuth 2.0 token authentication.

Answer

Certificate-based authentication for SQL logins.

Question 11

You are a database administrator for a healthcare company. You have an Azure SQL Database that stores patient records. The database is currently accessible from the public internet via firewall rules. You need to implement a secure environment that meets the following requirements:
- All traffic to the database must be private and not traverse the internet.
- The database must be accessible from an Azure Virtual Machine in a specific VNet.
- The solution must minimize management overhead and cost.
- You need to ensure that the database can be failed over to a secondary region in case of an outage.

What should you do?

Accepted Answer

Create a private endpoint in the VNet, disable public network access, and configure a failover group with a private endpoint in the secondary region.. Creating a private endpoint in the VNet ensures that traffic to the Azure SQL Database uses a private IP address within the VNet, never traversing the internet. Disabling public network access enforces this. A failover group with a private endpoint in the secondary region provides cross-region failover while maintaining private connectivity. This solution minimizes management overhead and cost by using managed services.

Answer

Restrict firewall rules to only the VM's public IP and enable active geo-replication.

Answer

Configure a point-to-site VPN from the VM to the database and set up geo-replication.

Answer

Create a VNet service endpoint and a failover group. Keep public access enabled for failover.

Question 12

You are setting up a new Azure SQL Database for a development team. The database will contain test data that mimics production but with some sensitive fields obfuscated. You need to ensure that developers can query the database without seeing the actual sensitive data. The developers will use Microsoft Entra ID authentication. You have the following requirements:
- The sensitive data should be automatically masked in query results for all developers except the database administrator.
- The masking should be applied without modifying the application code.
- The solution should be easy to manage and not require changes to the data model.

What should you implement?

Accepted Answer

Configure dynamic data masking on the sensitive columns, and add the database administrator to the unmask permission.. Dynamic Data Masking (DDM) can be configured on sensitive columns to automatically mask data in query results without modifying application code or the data model. The database administrator can be added to the unmask permission to see the actual data. Option A is incorrect because creating views would require changes to the data model and application queries. Option C is incorrect because Always Encrypted requires application code changes to handle encryption/decryption. Option D is incorrect because Row-Level Security filters rows based on predicates, not columns, and does not mask data.

Answer

Create views that exclude sensitive columns and grant developers access to the views instead of the base tables.

Answer

Implement Always Encrypted with column encryption, and grant the developers access to the encryption keys.

Answer

Create a row-level security policy that denies access to sensitive rows for developers.

Question 13

Your company has an Azure SQL Database that is accessed by multiple applications. You need to implement a security solution that meets the following requirements:
- Each application must have its own database user with specific permissions.
- All authentication must use Microsoft Entra ID.
- You need to be able to rotate credentials for each application without impacting other applications.
- The solution must support automatic credential rotation for service principals.

What should you do?

Accepted Answer

Create a Microsoft Entra ID service principal for each application, store the client secret in Azure Key Vault, and create a contained database user mapped to each service principal.. Creating a separate Microsoft Entra ID service principal per application, storing each client secret in Key Vault, and mapping each to a contained database user gives per-application identity, Entra-only authentication, independent credential rotation, and Key Vault's automatic rotation support. Contained users live in the database, so no server-level login is needed and permissions are scoped per app.

Answer

Use managed identities for each Azure resource and assign permissions to the database.

Answer

Create a single Microsoft Entra ID service principal for all applications and assign different database roles.

Answer

Create SQL logins and users for each application with strong passwords, and configure password rotation policies.

Question 14

You are a database administrator for a company that stores sensitive customer data in Azure SQL Database. The security team requires that all access to the database be authenticated using Microsoft Entra ID and that no SQL authentication logins exist. You need to verify that SQL authentication is disabled. What should you do?

Accepted Answer

In the Azure portal, navigate to the SQL server's 'Microsoft Entra ID' blade and enable 'Azure AD-only authentication'. Enabling 'Microsoft Entra ID-only authentication' in the SQL server's Microsoft Entra ID blade disables SQL authentication entirely, ensuring that only Microsoft Entra ID principals can authenticate. This directly meets the security requirement to eliminate SQL authentication logins, as it prevents any connection attempt using SQL login credentials, even if they exist in the system catalog.

Answer

Set the 'Deny public network access' property to 'Yes'

Answer

Configure a server-level firewall rule to block all IP addresses

Answer

Query sys.sql_logins to check for any SQL authenticated logins

Question 15

You are a database administrator for a financial services company. You have deployed an Azure SQL Database and configured auditing using the JSON policy shown in the exhibit. After a security incident, you need to review all successful and failed login attempts to the database. However, you notice that login events are not being captured in the audit logs. What is the most likely reason?

Accepted Answer

The audit actions and groups do not include login events. The JSON policy shown in the exhibit defines audit actions and groups, but it does not include the `SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP` or `FAILED_DATABASE_AUTHENTICATION_GROUP` action groups. These groups are required to capture both successful and failed login attempts (authentication events) in Azure SQL Database. Without them, login events are not recorded in the audit logs, regardless of other settings.

Answer

The audit logs are being sent to Azure Monitor instead of blob storage

Answer

The retention days are set too high, causing logs to be truncated

Answer

Auditing is disabled at the server level