DP-300 Implement a secure environment Practice Test 2 — 15 Questions

Question 1

You are the database administrator for a company that uses Azure SQL Database. The company has a strict security policy requiring that all database connections be encrypted using TLS 1.2 or higher and that the server certificate be validated to prevent man-in-the-middle attacks. Additionally, the company wants to ensure that only applications running on Azure virtual machines (VMs) in a specific virtual network (VNet) can access the database. The VMs use a subnet named 'AppSubnet'. You have configured the following: 
1. The server 'Allow Azure Services' setting is OFF. 
2. A virtual network rule is added for 'AppSubnet' with the service endpoint for Microsoft.Sql enabled. 
3. The server firewall has no other rules. 
4. The 'Minimum TLS version' is set to 1.2. 
5. All client applications are configured to use 'Encrypt=True' and 'TrustServerCertificate=False' in their connection strings.

After deployment, you discover that connections from the VMs are failing with error: 'The certificate chain was issued by an authority that is not trusted'. What is the most likely cause of this issue?

Accepted Answer

The VMs do not have the necessary root CA certificates installed to validate the Azure SQL Database server certificate.. The error 'The certificate chain was issued by an authority that is not trusted' indicates that the client cannot validate the Azure SQL Database server certificate. With 'TrustServerCertificate=False', the client must trust the server's certificate chain, which requires the root CA certificates (e.g., Baltimore CyberTrust Root) to be installed in the VM's trusted root store. Since the VMs are in Azure, they typically have these certificates, but custom images or hardened VMs may lack them, causing the validation failure.

Answer

The client applications are using an older version of .NET that does not support TLS 1.2.

Answer

The virtual network rule is missing the service endpoint for Microsoft.Sql on the subnet.

Answer

The server firewall is blocking traffic from the VNet because 'Allow Azure Services' is OFF.

Question 2

You are designing a secure architecture for Azure SQL Managed Instance. You need to ensure that all connections to the instance are encrypted and that the instance can only be accessed from a specific virtual network. Which TWO configurations should you implement?

Accepted Answer

Configure the managed instance with the 'Force encryption' property set to Enabled.. Option C is correct because setting the 'Force encryption' property to Enabled on Azure SQL Managed Instance enforces TLS encryption for all client connections, ensuring data in transit is encrypted. Option E is correct because Azure SQL Managed Instance must be deployed inside a delegated subnet within an Azure virtual network, which inherently restricts access to that specific VNet and its connected networks. Option A is incorrect because service endpoints are used for PaaS services like Azure SQL Database or Storage, not for SQL Managed Instance, which requires native VNet integration via a delegated subnet. Option B is incorrect because a managed instance cannot be deployed outside a virtual network; VNet deployment is mandatory. Option D is incorrect because private endpoints are used to access PaaS services privately, but SQL Managed Instance already resides in a VNet and does not use private endpoints for its own connectivity.

Answer

Configure a service endpoint on the subnet of the managed instance.

Answer

Deploy the managed instance outside a virtual network.

Answer

Attach a private endpoint to the managed instance.

Question 3

You are the database administrator for a company that uses Azure SQL Database. The company has a strict security policy requiring that all database connections be encrypted and that the server's firewall only allows connections from a list of approved IP addresses. You have configured the server-level firewall rules accordingly and enabled the 'Force encryption' setting on the server. However, after deployment, you notice that an application running on an Azure virtual machine is able to connect to the database even though its public IP address is not in the approved list. The virtual machine is in the same region as the database. What is the most likely cause?

Accepted Answer

The 'Allow Azure services and resources to access this server' setting is enabled, which allows all Azure IPs to connect.. The 'Allow Azure services and resources to access this server' setting, when enabled, adds a firewall rule that permits connections from all Azure IP addresses, including those not in the approved list. This overrides the specific IP-based firewall rules, allowing the Azure VM (even with a public IP not on the approved list) to connect. The setting is designed to allow Azure services like Azure App Service or Azure VMs to bypass IP restrictions, which violates the strict security policy in this scenario.

Answer

The virtual machine is using a private IP address that is automatically allowed.

Answer

The virtual machine is using a service endpoint that bypasses the firewall.

Answer

The 'Force encryption' setting is misconfigured; it should be disabled to allow non-encrypted connections.

Question 4

Refer to the exhibit. The exhibit shows an Azure role assignment with a condition. When user@contoso.com tries to read data from the database 'proddb', what will be the effect of this condition?

Accepted Answer

The user will be denied the ability to read data from the database.. The condition in the Azure role assignment explicitly denies read access to the database 'proddb' for user@contoso.com. In Azure RBAC, a deny assignment overrides any allow assignments, so even if the user has other roles granting read permissions, this condition will block all data read operations on that specific database. Therefore, the user will be denied the ability to read data from the database.

Answer

The user will be allowed to read all data from the database.

Answer

The user will be able to read the database metadata but not the data.

Answer

The user will be able to assign the role to others.

Question 5

Match each Azure SQL Database pricing tier to its key feature.

Accepted Answer

Basic: Low-cost, lightweight workloads with minimal compute and memory resources.. These tiers define the compute and memory resources available for Azure SQL Database.

Answer

Basic: Balanced compute and memory resources for most enterprise workloads with scalable storage.

Answer

Standard: High memory-to-core ratio for memory-intensive workloads like analytics.

Question 6

Match each Azure SQL Database migration tool to its description.

Accepted Answer

Azure Database Migration Service: A fully managed service designed for online migrations to Azure SQL Database with minimal downtime.. Correct matches: A - Azure Database Migration Service (online/offline migration), B - Data Migration Assistant (assessment), C - SSMA (cross-platform migration), D - Azure Migrate (central hub). Common confusion: mixing up the migration service with offline-only tools or ignoring the assessment step.

Answer

Azure Database Migration Service: A tool that only performs offline migrations and requires significant downtime.

Answer

Data Migration Assistant: A service that automatically migrates databases with no assessment step.

Question 7

Your company uses Azure SQL Managed Instance. You need to configure a server-level firewall rule to allow access from a specific Azure service, but you want to minimize the attack surface. What is the best practice?

Accepted Answer

Set the firewall rule to allow Azure services and resources to access this server.. Enabling the 'Allow Azure services and resources to access this server' firewall rule is the best practice for Azure SQL Managed Instance when you need to allow access from a specific Azure service while minimizing the attack surface. This setting uses a special firewall rule that permits connections from any Azure service (including those within the same region) without exposing the server to all public IP addresses, as it relies on Azure's internal network boundaries and does not open the server to the entire internet. It is more secure than allowing all IPs (0.0.0.0/0) because it restricts access to only Azure-originated traffic, and it is simpler than manually specifying IP ranges, which can change dynamically.

Answer

Set the firewall rule to allow all IP addresses (0.0.0.0/0).

Answer

Disable public endpoint and use private endpoint.

Answer

Create a firewall rule with the specific IP range of the Azure service.

Question 8

You are configuring Microsoft Defender for SQL for Azure SQL Database. You need to ensure that alerts are sent to the security operations team via email and also integrated with Microsoft Sentinel. What should you configure?

Accepted Answer

In Microsoft Sentinel, connect the Azure SQL Database data source using the built-in connector.. Microsoft Sentinel provides a built-in connector for Azure SQL Database that ingests security alerts from Microsoft Defender for SQL, satisfying the Sentinel integration requirement. The email notification requirement is addressed separately by configuring alert rules within Defender for SQL to send emails to the security operations team. Option A enables the Sentinel integration, while email notifications are a complementary configuration within Defender for SQL, not part of Option A itself.

Answer

Use Azure Logic Apps to forward Defender for SQL alerts to Sentinel.

Answer

Configure a diagnostic setting on the SQL server to stream logs to a Log Analytics workspace used by Sentinel.

Answer

Configure the alert rule in Defender for SQL to send email to the security team.

Question 9

You need to audit all successful and failed login attempts to an Azure SQL Database. Which feature should you enable?

Accepted Answer

Azure SQL Auditing. Azure SQL Auditing is the correct feature because it tracks database events, including both successful and failed login attempts, and writes them to an audit log in your Azure Storage account, Log Analytics workspace, or Event Hubs. This meets the requirement to audit all authentication events for security and compliance purposes.

Answer

Transparent Data Encryption (TDE)

Answer

SQL Vulnerability Assessment

Answer

Diagnostic settings

Question 10

Your organization needs to comply with a regulation that requires data to be encrypted at rest using a customer-managed key stored in Azure Key Vault. You have an Azure SQL Database. What should you configure?

Accepted Answer

Enable Transparent Data Encryption (TDE) and use a customer-managed key in Azure Key Vault as the TDE protector.. Transparent Data Encryption (TDE) with a customer-managed key in Azure Key Vault meets the requirement for data at rest encryption using a customer-controlled key. TDE encrypts the database files (data and log files) at rest, and by using a customer-managed key as the TDE protector, you retain control over key rotation and revocation, satisfying regulatory compliance.

Answer

Use Azure Policy to enforce encryption at rest.

Answer

Enable Always Encrypted and store the column master key in Azure Key Vault.

Answer

Configure Azure Storage Service Encryption for the database files.

Question 11

You are a database administrator for an Azure SQL Database. You need to allow a user to restore a database from a backup to a new database, but the user should not have permission to delete the original database. What is the minimum permission required?

Accepted Answer

CREATE DATABASE permission on the logical server. The minimum permission required to restore a database from a backup to a new database in Azure SQL Database is the CREATE DATABASE permission on the logical server. This is because restoring a backup to a new database is essentially creating a new database, and the user does not need any additional permissions on the original database to perform this action. The db_backupoperator and db_owner roles grant excessive permissions on the original database, while the SQL Server Contributor role is an Azure RBAC role that provides broader management capabilities beyond what is needed.

Answer

db_backupoperator database role

Answer

db_owner database role

Answer

SQL Server Contributor role

Question 12

Which THREE features can help protect Azure SQL Database from data exfiltration?

Accepted Answer

Microsoft Defender for SQL. Microsoft Defender for SQL (A) is correct because it provides advanced threat protection and vulnerability assessment, detecting anomalous access patterns and suspicious exfiltration attempts against Azure SQL Database. Always Encrypted (B) is correct because it encrypts sensitive columns client-side so that even database administrators or compromised services cannot read plaintext data, directly limiting what data can be exfiltrated. Azure Policy with a deny effect for public network access (E) is correct because it enforces that the logical server cannot be reached over the public internet, restricting exfiltration paths to private endpoints or approved networks. Azure SQL Database Ledger (C) is not a preventive exfiltration control; it provides tamper-evident cryptographic verification of data integrity, not protection against data being read and removed. Dynamic Data Masking (D) is not correct because it only obfuscates data in query results for non-privileged users and is easily bypassed by users with unmask permissions, so it does not prevent exfiltration.

Answer

Azure SQL Database Ledger

Answer

Dynamic Data Masking

Question 13

You are configuring a new Azure SQL Database. The company policy requires that all connections use Microsoft Entra authentication and that no SQL authentication accounts exist. What should you do to prevent creation of SQL authenticated logins?

Accepted Answer

Set the 'DisallowSqlAuthentication' property to 'True' on the logical server.. Setting the 'DisallowSqlAuthentication' property to 'True' on the logical server enforces that only Microsoft Entra authentication can be used to connect to the Azure SQL Database. This property prevents the creation of any SQL authenticated logins, including the SQL admin account, and ensures compliance with the policy that no SQL authentication accounts exist.

Answer

Set the 'public_network_access' to 'Disabled'.

Answer

Remove the SQL admin login after creating the database.

Answer

Create an Azure Policy to audit SQL authentication usage.

Question 14

Your Azure SQL Managed Instance is configured to allow connections only from a specific virtual network. You need to ensure that clients from on-premises can connect using a point-to-site VPN. What additional configuration is required?

Accepted Answer

Configure a point-to-site VPN connection on the virtual network gateway and ensure the gateway subnet is in the same VNet as the managed instance.. A point-to-site VPN connection on the virtual network gateway allows individual on-premises clients to securely connect to the Azure VNet over SSTP or IKEv2. Since the managed instance is deployed inside a subnet of that VNet and its endpoint is restricted to the VNet, the VPN tunnel provides the necessary network path for on-premises clients to reach the instance without exposing it to the public internet.

Answer

Configure a private endpoint for the managed instance.

Answer

Deploy Azure Bastion in the same VNet.

Answer

Add the on-premises public IP address to the managed instance firewall rules.

Question 15

You have an Azure SQL Database with Always Encrypted enabled for sensitive columns. You need to grant a developer the ability to encrypt data using a column master key stored in Azure Key Vault. What permissions must be assigned to the developer's Microsoft Entra identity in the key vault?

Accepted Answer

Get, Wrap Key, and Unwrap Key.. To encrypt data with Always Encrypted, the client driver must retrieve the column encryption key (which is stored encrypted) and unwrap it using the column master key. It may also need to wrap newly generated column encryption keys during key rotation or initial setup. Therefore, the developer's Microsoft Entra identity requires Get, Unwrap Key, and Wrap Key permissions on the column master key in Azure Key Vault. Option B correctly includes all three.

Answer

Get, Decrypt, and Unwrap Key.

Answer

Get and Decrypt.

Answer

Get, Sign, and Verify.