DP-300 Implement a secure environment Practice Test 2 — 15 Questions

Question 1

Your Azure SQL Database is configured with Advanced Threat Protection (ATP). You receive an alert about a SQL injection attack. After investigation, you confirm the attack was blocked. However, you need to ensure that future similar attacks are automatically prevented without manual intervention. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the firewall to automatically block the attacker's IP address.. Configuring the Azure SQL Database firewall to automatically block the attacker's IP address provides a proactive, automated defense against future SQL injection attempts from the same source. Advanced Threat Protection (ATP) can be integrated with Azure Logic Apps or other automation to trigger a firewall rule update that denies traffic from the offending IP, thereby preventing manual intervention. This directly addresses the requirement for automatic prevention of similar attacks.

Answer

Enable Transparent Data Encryption (TDE).

Answer

Run SQL Vulnerability Assessment weekly.

Answer

Enable Azure SQL Auditing to log all queries.

Question 2

A developer reports that they cannot connect to an Azure SQL Database using Azure AD authentication. The developer is a member of an Azure AD group that has been granted db_datareader role in the database. The connection string uses Active Directory Password authentication. What is the most likely issue?

Accepted Answer

The Azure AD group has not been created as a database user.. The most likely issue is that the Azure AD group has not been created as a database user in the SQL Database. Even though the group has been granted the db_datareader role at the Azure AD level, Azure SQL Database requires that the group be explicitly mapped to a database user via the CREATE USER [group name] FROM EXTERNAL PROVIDER statement. Without this mapping, the group's membership does not translate into database-level permissions, and the developer's authentication will fail.

Answer

The server firewall is blocking the connection.

Answer

The developer's IP address is not allowed.

Answer

Multi-factor authentication is required but not configured.

Question 3

You need to ensure that all connections to an Azure SQL Database are encrypted. Which setting should you enforce?

Accepted Answer

Set 'Force encryption' to 'Yes' on the server.. Setting 'Force encryption' to 'Yes' on the Azure SQL Database server enforces TLS encryption for all client connections. This setting ensures that any client connecting to the database must use an encrypted connection, rejecting any unencrypted attempts. It is the direct mechanism to mandate encryption in transit, as opposed to encryption at rest or auditing.

Answer

Configure firewall rules to allow only specific IP addresses.

Answer

Enable Transparent Data Encryption (TDE).

Answer

Enable SQL Auditing.

Question 4

You are deploying an Azure SQL Database that will store sensitive customer data. Compliance requirements dictate that the data must be encrypted at rest using a customer-managed key that is rotated every 90 days. You configure TDE with Azure Key Vault. What additional step is critical to ensure data remains accessible after key rotation?

Accepted Answer

Ensure the previous key version remains enabled in Azure Key Vault.. When using TDE with Azure Key Vault and customer-managed keys, the database is encrypted using a Data Encryption Key (DEK) that is protected by the key in Key Vault. Key rotation creates a new key version, but the DEK remains encrypted with the previous key version. To decrypt the DEK and access the data after rotation, the previous key version must remain enabled in Key Vault. If it is disabled or deleted, the database becomes inaccessible.

Answer

Store the key in a different region for disaster recovery.

Answer

Use a premium tier of Azure Key Vault.

Answer

Re-encrypt the database with the new key immediately after rotation.

Question 5

Which TWO of the following are best practices for securing Azure SQL Database?

Accepted Answer

Enable firewall rules to restrict access to specific IP addresses.. Azure SQL Database firewall rules allow you to restrict access to specific IP address ranges, which is a fundamental network security best practice. By limiting inbound traffic to only trusted IPs, you reduce the attack surface and prevent unauthorized connections from unknown sources. This is a first line of defense in a defense-in-depth strategy for securing Azure SQL Database.

Answer

Enable Auditing to block malicious queries.

Answer

Enable TDE to prevent SQL injection attacks.

Answer

Use SQL authentication with complex passwords.

Question 6

Which THREE of the following are required to configure Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault for Azure SQL Database?

Accepted Answer

The key encryption key must be stored in Azure Key Vault.. Transparent Data Encryption (TDE) with customer-managed keys requires the key encryption key (KEK) to be stored in Azure Key Vault. This KEK is used to protect the database encryption key (DEK), which is stored in the database boot record. Without the KEK in Key Vault, the customer-managed key scenario cannot be implemented, as Azure SQL Database must be able to access the key to perform encryption operations.

Answer

The Azure Key Vault must be in the same region as the database.

Answer

The SQL server must have an RBAC role assignment on the key vault.

Question 7

Which TWO of the following are valid methods to connect to Azure SQL Database securely?

Accepted Answer

Connect using Azure AD authentication with multi-factor authentication.. Azure AD authentication with multi-factor authentication (MFA) provides strong identity-based security, eliminating password vulnerabilities and supporting conditional access policies. This method integrates with Azure SQL Database's built-in support for Azure AD tokens, ensuring that only authenticated users with MFA can connect, which meets the exam's focus on secure environment implementation.

Answer

Connect using a shared access key from Azure Storage.

Answer

Connect directly using the server's public IP address without encryption.

Answer

Connect using SQL authentication with a simple password.

Question 8

You are the database administrator for a healthcare company that uses Azure SQL Database to store patient records. The database is named PatientDB. The security team mandates that all database access must be audited, and any suspicious activity must be alerted in real-time. Additionally, compliance requires that all data at rest be encrypted using a customer-managed key stored in Azure Key Vault. You have configured the following:
- TDE with customer-managed key in AKV (key vault name: KV-Health, key name: PatientKey)
- Azure SQL Auditing enabled, writing logs to a storage account (StorageAcctLogs)
- Advanced Threat Protection (ATP) enabled with alerts sent to the security team's email
- Firewall rules allowing only the application server's public IP (203.0.113.50)

A week later, the security team reports that they received an ATP alert about a potential SQL injection attack from IP 198.51.100.25. However, when they check the audit logs, they find no entries from that IP. They also notice that the database remains accessible. The security team wants to know why the audit logs do not contain the suspicious IP even though ATP detected it. What is the most likely reason?

Accepted Answer

The firewall rule blocks connections from the attacker's IP, so no audit log entries are generated because the connection never reaches the database.. Advanced Threat Protection (ATP) can detect suspicious activity at the network level before the connection is fully established, while Azure SQL Auditing only logs events after a connection is accepted and authenticated. Since the firewall rule blocks connections from IP 198.51.100.25, the attacker's IP never reaches the database engine, so no audit log entries are generated for that IP. ATP alerts can be triggered by network-level patterns (e.g., SQL injection signatures) even when the connection is denied by the firewall, explaining the discrepancy.

Answer

The storage account for audit logs is not accessible, so logs are not being written.

Answer

The firewall rule allowing only the application server's IP is misconfigured, allowing the attacker's IP.

Answer

The TDE configuration with customer-managed key is interfering with auditing.

Question 9

You are configuring Azure SQL Database firewall rules. You need to allow a range of IP addresses (192.168.1.0 to 192.168.1.255) to connect to the database. Which firewall rule should you create?

Accepted Answer

Start IP: 192.168.1.0, End IP: 192.168.1.255. Azure SQL Database firewall rules require a contiguous range of IP addresses defined by a start and end IP. The range 192.168.1.0 to 192.168.1.255 exactly covers the specified /24 subnet, allowing all hosts in that block to connect. This is the standard method for permitting a subnet in Azure SQL firewall configuration.

Answer

Start IP: 192.168.0.0, End IP: 192.168.2.255

Answer

Start IP: 192.168.1.255, End IP: 192.168.1.0

Answer

Start IP: 192.168.1.0, End IP: 192.168.1.0

Question 10

Your company uses Azure SQL Database. You need to ensure that all connections to the database use TLS 1.2 or higher. Currently, some client applications are connecting using TLS 1.0. What should you do?

Accepted Answer

Set the 'Minimum TLS version' property of the logical server to 1.2.. Setting the 'Minimum TLS version' property of the Azure SQL logical server to 1.2 enforces that all incoming connections must use TLS 1.2 or higher. This server-level setting overrides any client-side configuration, blocking connections that attempt to use TLS 1.0 or 1.1. It is the simplest and most effective way to enforce the minimum TLS version across all client applications without requiring changes to each client.

Answer

Configure the server firewall to block non-TLS traffic.

Answer

Set the 'tls_version' database parameter to 1.2 in the master database.

Answer

Update the client applications to only use TLS 1.2.

Question 11

You are designing a secure environment for Azure SQL Managed Instance. The company requires that all database backups be encrypted using customer-managed keys stored in Azure Key Vault. Which combination of actions should you take?

Accepted Answer

Enable Transparent Data Encryption (TDE) with a customer-managed key in Azure Key Vault.. Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault allows you to encrypt the database backup files using a key that you control. When TDE is enabled and configured with a customer-managed key (CMK) stored in Azure Key Vault, Azure SQL Managed Instance automatically encrypts backups with the same TDE protector key, meeting the requirement for customer-managed backup encryption.

Answer

Configure Always Encrypted with keys stored in Key Vault.

Answer

Use Azure Storage Service Encryption to encrypt the backup files.

Answer

Enable backup encryption using a certificate stored in the managed instance.

Question 12

You need to configure authentication for Azure SQL Database. Which TWO options are supported?

Accepted Answer

Azure Active Directory authentication. Azure SQL Database supports Azure Active Directory (Azure AD) authentication, which allows you to centrally manage identities and access. This includes support for modern authentication protocols like OAuth 2.0 and integration with Azure AD, enabling features such as conditional access and managed identities.

Answer

Multi-factor authentication

Answer

Certificate-based authentication

Answer

Windows authentication

Question 13

Your organization has an Azure SQL Database server. You need to ensure that only applications running on Azure virtual machines in a specific virtual network can connect to the database. Which THREE actions should you take?

Accepted Answer

Add a virtual network rule for the specific subnet of the VMs.. Adding a virtual network rule for the specific subnet of the VMs allows Azure SQL Database to accept traffic only from that subnet when a service endpoint is enabled. This restricts access to the database to only those applications running on Azure VMs within the specified virtual network, ensuring network-level isolation.

Answer

Add a service endpoint for Azure SQL Database to the virtual network.

Answer

Set the 'Allow Azure Services and resources to access this server' setting to ON.

Question 14

You are reviewing a JSON representation of an Azure SQL Database firewall rule. What is the effect of this rule?

Accepted Answer

Allows all IP addresses from 10.0.0.0 to 10.0.0.255.. The JSON representation of the Azure SQL Database firewall rule with startIpAddress '10.0.0.0' and endIpAddress '10.0.0.255' defines a range that allows all IP addresses from 10.0.0.0 to 10.0.0.255 inclusive. Azure SQL Database firewall rules use inclusive IP range matching, so any client with an IP in that range is permitted to connect, provided the rule is enabled.

Answer

Blocks all IP addresses from 10.0.0.0 to 10.0.0.255.

Answer

Allows all IP addresses except 10.0.0.0 to 10.0.0.255.

Answer

Allows only the IP address 10.0.0.0.

Question 15

You are troubleshooting a connection issue from Azure SQL Database to Azure Storage using a managed identity. The above credential was created. What is missing from this configuration?

Accepted Answer

The credential is missing the SECRET parameter.. The credential is missing the SECRET parameter because when using a managed identity to access Azure Storage from Azure SQL Database, the credential must specify the identity's client ID or object ID as the SECRET. Without this, the credential cannot authenticate to the storage account, causing the connection to fail. The SECRET parameter is required to map the managed identity to the credential for Azure AD authentication.

Answer

The credential should be a server-level credential.

Answer

The credential lacks a valid identity.

Answer

The credential needs to include the storage account name.