DP-300 Implement a secure environment Practice Test 18 — 15 Questions

Question 1

A developer at your company needs to run ad hoc queries against an Azure SQL Database from a workstation on the corporate network. Security policy forbids storing credentials in the application and forbids any inbound public network access to the database. The workstation already has a Microsoft Entra ID-joined identity. What should you configure to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a contained database user mapped to the Microsoft Entra identity and connect through a private endpoint using Microsoft Entra authentication. Meeting both constraints requires an authentication method that needs no stored secret and a network path that avoids the public endpoint. A contained database user mapped to a Microsoft Entra identity lets the developer sign in with directory credentials, and a private endpoint routes traffic over the private network. Password-based logins and firewall rules that keep the public endpoint reachable fail the policy.

Answer

Enable the Allow Azure services and resources to access this server firewall rule and connect over the public endpoint

Answer

Create a SQL login with a strong password and store the password in the connection string on the workstation

Answer

Issue the developer a shared SQL login and restrict it with an IP-based firewall rule for the corporate egress address

Question 2

You are configuring security for an Azure SQL Database. The security policy requires that all connections to the database must be encrypted and that the encryption keys must be managed by your organization. You need to implement Transparent Data Encryption (TDE) with a customer-managed key (CMK) stored in Azure Key Vault. What should you do first?

Accepted Answer

Create an Azure Key Vault and grant the Azure SQL logical server's managed identity the get, wrapKey, and unwrapKey permissions on the key.. For TDE with customer-managed keys in Azure SQL Database, the first step is to set up Azure Key Vault and grant the logical server's managed identity the required permissions to access the key. This enables the server to use the key for encryption. Once this is done, you can configure TDE to use the customer-managed key. The other options either do not meet the key management requirement or are not applicable.

Answer

Configure a firewall rule to allow connections from your organization's IP addresses.

Answer

Create a database master key (DMK) in the master database of the Azure SQL logical server.

Answer

Enable TDE on the database using the default service-managed key.

Question 3

You manage an Azure SQL Database. A security review finds that an application service principal is connecting with a SQL login that has db_owner membership, and that the login's password has not changed in two years. You must reduce the standing privilege and eliminate the long-lived password while keeping the application working. What should you do?

Accepted Answer

Create a contained database user mapped to the service principal's Microsoft Entra identity, grant it only the required permissions, and remove the SQL login. Replacing the password-based SQL login with a contained database user mapped to the service principal removes the long-lived secret and lets you grant only the permissions the application actually needs. Rotating a password or renaming the role leaves both problems intact, and merely enabling directory authentication without removing the login does not close the insecure path.

Answer

Rotate the SQL login password and move it into Azure Key Vault, leaving db_owner membership unchanged

Answer

Enable Microsoft Entra authentication on the server and keep the SQL login as a fallback for the application

Answer

Add the service principal to a custom database role with db_owner and enforce a password policy on the login

Question 4

You are the database administrator for a company that uses Azure SQL Database. The company has a policy that database administrators must not have access to sensitive data in a specific table named EmployeeSalaries. You need to implement a solution that allows DBAs to manage the database but prevents them from viewing or modifying data in the EmployeeSalaries table. What should you implement?

Accepted Answer

Always Encrypted with column encryption keys stored in Azure Key Vault, and restrict DBA access to the keys.. Always Encrypted is designed to protect sensitive data from high-privileged users like DBAs by ensuring that encryption and decryption occur on the client side. The database engine never sees the plaintext data or the encryption keys. By storing the column encryption keys in Azure Key Vault and not granting DBAs access to the keys, DBAs cannot view or modify the data, even with sysadmin privileges. This meets the policy requirement.

Answer

Dynamic Data Masking (DDM) on the sensitive columns.

Answer

Transparent Data Encryption (TDE) with a customer-managed key.

Answer

Row-Level Security (RLS) with a filter predicate that excludes DBAs.

Question 5

You manage an Azure SQL Database named HRDB. The security team requires that all data in transit between the application and HRDB be encrypted, and that the database reject any connections using TLS versions below 1.2. You need to enforce this requirement with the least administrative effort. What should you do?

Accepted Answer

Set the 'Minimum TLS version' to 1.2 on the Azure SQL logical server.. The logical server's minimum TLS version setting enforces the required protocol for all connections to databases on that server. This is a server-level configuration that requires no application code changes and ensures clients using TLS 1.0 or 1.1 are rejected. TDE, firewall rules, and Always Encrypted address different security concerns and do not control the TLS version negotiated.

Answer

Configure a firewall rule to allow only the application's IP address.

Answer

Enable Always Encrypted on sensitive columns in HRDB.

Answer

Enable Transparent Data Encryption (TDE) on HRDB.

Question 6

You are the database administrator for a company that uses Azure SQL Database. The security team requires that all data at rest be encrypted with a customer-managed key (CMK) stored in Azure Key Vault, rather than the default service-managed key. You need to implement this requirement with the least administrative overhead. What should you do?

Accepted Answer

Enable Transparent Data Encryption (TDE) with a customer-managed key by configuring the Azure SQL logical server to use a key from Azure Key Vault.. TDE with a customer-managed key at the logical server level is the correct approach because it applies to all databases on the server and uses Azure Key Vault for key storage, satisfying the security team's requirement for customer-managed keys. The other options either do not provide full database encryption, require per-column configuration, or apply to services outside Azure SQL Database.

Answer

Create a database master key (DMK) in each user database and encrypt it with a password.

Answer

Enable Always Encrypted with a column master key stored in Azure Key Vault for all columns in every table.

Answer

Configure Azure Storage Service Encryption (SSE) with a customer-managed key on the storage account that hosts the database files.

Question 7

You are the database administrator for an Azure SQL Database that contains several tables with columns that store personally identifiable information (PII). The security team requires that these columns be identified and labeled as 'Confidential' in the database. You need to implement a solution that automatically classifies these columns based on their names and data patterns. What should you use?

Accepted Answer

SQL Data Discovery and Classification.. SQL Data Discovery and Classification is the built-in feature in Azure SQL Database that scans for potentially sensitive columns, such as those containing PII, and allows you to apply classification labels like 'Confidential'. It uses pattern matching and column names to provide recommendations, which can be reviewed and applied. This directly meets the requirement to identify and label PII columns.

Answer

Always Encrypted.

Answer

Transparent Data Encryption (TDE).

Answer

Dynamic Data Masking (DDM).

Question 8

Your Azure SQL Database is accessed by three separate applications. You must ensure that each application can connect only from its own set of IP addresses, that the addresses are managed centrally without editing each database, and that no application can reach the database over the public internet from any other address. What should you implement?

Accepted Answer

Create server-level firewall rules, one per application, containing that application's IP ranges. Server-level firewall rules are evaluated for the logical server and apply to all its databases, so they centralize address management while letting you define a distinct rule per application. Database-level rules scatter the configuration, the Azure services toggle admits too much, and service endpoints constrain to virtual network subnets rather than per-application address ranges.

Answer

Enable the Allow Azure services and resources to access this server rule and rely on database permissions per application

Answer

Create a database-level firewall rule in each database for the corresponding application's addresses

Answer

Configure a virtual network service endpoint and a network security group that permits the three application subnets

Question 9

You are configuring security for an Azure SQL Database. The security team requires that all administrative actions on the server and databases are logged to an Azure Storage account, and that the logs are retained for 90 days. You need to configure auditing to meet these requirements with minimal effort. What should you do?

Accepted Answer

Enable auditing at the server level and set the retention period to 90 days, targeting an Azure Storage account.. Server-level auditing with a 90-day retention targeting an Azure Storage account audits all databases on the server and meets the retention requirement. Database-level auditing would require per-database configuration, and using Log Analytics does not match the storage account requirement. Unlimited retention does not meet the 90-day specification.

Answer

Enable auditing at the server level and set the retention period to 0 (unlimited), targeting an Azure Storage account.

Answer

Enable auditing at the server level and target an Azure Log Analytics workspace with a 90-day retention.

Answer

Enable auditing at the database level for each database and set the retention period to 90 days, targeting an Azure Storage account.

Question 10

You administer an Azure SQL Database named HRDB. The security team requires that all data at rest be encrypted with a customer-managed key stored in Azure Key Vault, and that the key be automatically rotated every 90 days. You create the Key Vault and grant the logical server's managed identity the necessary permissions. What should you do next to meet the requirement?

Accepted Answer

Configure TDE on the logical server to use a customer-managed key from Azure Key Vault and enable auto-rotation.. The requirement is for encryption at rest using a customer-managed key in Azure Key Vault with automatic rotation. TDE with a customer-managed key (BYOK) is the Azure SQL feature that provides this. Configuring TDE to use a Key Vault key and enabling auto-rotation ensures the key is rotated every 90 days without manual intervention, satisfying the security team's policy.

Answer

Enable Transparent Data Encryption (TDE) with a service-managed key on the logical server.

Answer

Enable Dynamic Data Masking on all sensitive columns.

Answer

Enable Always Encrypted on all columns containing sensitive data.

Question 11

You are the database administrator for an Azure SQL Database that hosts a multi-tenant SaaS application. Each tenant has its own database user mapped to a Microsoft Entra ID group. The security team requires that every tenant user can see only rows belonging to their own tenant, and that no tenant can infer the existence of other tenants' data through error messages or row counts. You need to implement row-level filtering that enforces this requirement with the least administrative effort. What should you do?

Accepted Answer

Create a security policy that uses a predicate function comparing the tenant ID column to the result of DATABASE_PRINCIPAL_ID().. Row-level security in Azure SQL Database uses a security policy with an inline table-valued predicate function. When the predicate compares the tenant column to the current database principal, the engine transparently filters rows for every query, including aggregates, preventing cross-tenant visibility without application changes. Views, masking, and impersonation each leave gaps or add maintenance overhead that the scenario rules out.

Answer

Create a view for each tenant that filters rows by tenant ID, and grant tenants access only to their view.

Answer

Configure a database-scoped credential and use EXECUTE AS USER in every stored procedure that queries tenant data.

Answer

Enable Dynamic Data Masking on the tenant ID column so tenants cannot see values belonging to other tenants.

Question 12

You are the DBA for an Azure SQL Database that stores sensitive financial data. The security team requires that all user activity on the database be audited, and audit logs must be retained for 90 days. You need to configure auditing with minimal effort. What should you do?

Accepted Answer

Enable Azure SQL Database auditing and configure it to write logs to an Azure Storage account with a retention period of 90 days.. Enabling Azure SQL Database auditing and directing logs to Azure Storage with a 90-day retention period is the correct approach because it is a built-in feature that captures all user activity and meets the retention requirement with minimal configuration. The other options either are not supported in Azure SQL Database, require more manual effort, or do not provide the required audit scope.

Answer

Use SQL Server Extended Events to capture all statements and store the files in Azure Blob Storage.

Answer

Enable Azure Monitor diagnostic settings on the database and send logs to a Log Analytics workspace with 90-day retention.

Answer

Create a SQL Server Audit specification on the database and write to the Windows Application log.

Question 13

You are the DBA for an Azure SQL Database named OrdersDB. The security team requires that you implement row-level security (RLS) to ensure that sales representatives can only view orders for their own region. You need to create a security policy that filters rows based on the sales representative's region. Which two actions should you perform? (Choose two.)

Accepted Answer

Create an inline table-valued function that returns 1 when the sales representative's region matches the row's region.. Row-level security in Azure SQL Database requires a predicate function that defines the filtering logic and a security policy that applies that function to the table. The inline table-valued function returns 1 when the row should be visible to the user, and the security policy adds a FILTER PREDICATE using that function. Together, they enforce that sales representatives only see orders for their region. Other actions do not implement RLS.

Answer

Grant SELECT permission on the Orders table to all sales representatives.

Answer

Create a database role for each region and add sales representatives to the appropriate role.

Answer

Enable Auditing on the Orders table to track access.

Question 14

You have an Azure SQL Database server named sqlsrv1. Several application teams connect using SQL logins. The security team mandates that all authentication use Microsoft Entra ID and that multifactor authentication be enforceable. You need to configure the server so that Entra ID authentication is available to database users. What should you do first?

Accepted Answer

Assign a Microsoft Entra ID admin to the Azure SQL logical server.. Assigning a Microsoft Entra ID administrator to the logical server activates directory authentication for the server. Only after that can you create contained database users mapped to Entra identities and rely on Conditional Access to enforce multifactor authentication. The other choices address encryption, network filtering, or dependent steps that require the directory admin to exist first.

Answer

Enable Transparent Data Encryption on each database.

Answer

Create contained database users for each application in every database.

Answer

Configure a firewall rule to allow the corporate network range.

Question 15

You are the Azure SQL Database administrator for a financial services company. The compliance team requires that all data in transit between the application tier and Azure SQL Database be encrypted, and that the server enforce a minimum TLS version of 1.2. The application servers run Windows Server 2019 and use the Microsoft.Data.SqlClient provider. You need to configure the server so that only TLS 1.2 connections are accepted. What should you do?

Accepted Answer

Set the Minimum TLS version to 1.2 on the Azure SQL logical server's networking settings.. Azure SQL Database encrypts connections by default, but the minimum TLS version accepted by the gateway is controlled by the logical server's Minimum TLS version setting. Raising it to 1.2 causes the gateway to refuse any connection that negotiates a lower version, which is exactly what the compliance requirement demands. Firewall rules, private endpoints, and TDE address different concerns.

Answer

Configure a private endpoint for the Azure SQL Database and disable public network access.

Answer

Enable Transparent Data Encryption (TDE) on the database with a customer-managed key.

Answer

Add a firewall rule that allows only the application servers' IP addresses.