DP-300 Implement a secure environment Practice Test 3 — 15 Questions

Question 1

You have an Azure SQL Database that is accessed by a web application. The application uses a service principal (Microsoft Entra application) to connect. You need to rotate the client secret for the service principal without downtime. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Store the client secret in Azure Key Vault, configure the application to retrieve the secret from Key Vault, and implement a secret rotation policy.. It enables zero-downtime secret rotation by decoupling the application from a single secret value. By storing the client secret in Azure Key Vault and configuring the application to retrieve it dynamically, you can rotate the secret in Key Vault without changing the application's configuration or restarting it. The application always fetches the latest version of the secret, so rotation is transparent and does not interrupt connectivity.

Answer

Create a new client secret, update the application configuration, and then delete the old secret.

Answer

Switch to using a client certificate instead of a client secret.

Answer

Use a system-assigned managed identity for the web application.

Question 2

Which TWO of the following are valid methods to secure data in transit for Azure SQL Database?

Accepted Answer

Configure the server to enforce TLS 1.2 by setting minimal TLS version.. Azure SQL Database allows you to enforce a minimum TLS version, such as TLS 1.2, which ensures that all client connections use at least that protocol version. This directly secures data in transit by preventing downgrade attacks and blocking older, less secure TLS versions like TLS 1.0 or 1.1.

Answer

Enable Always Encrypted on sensitive columns.

Answer

Deploy Azure Firewall in front of the database.

Answer

Apply a Network Security Group (NSG) to the subnet.

Question 3

You need to ensure that an Azure SQL Database uses Microsoft Entra-only authentication. You have configured the server to disallow SQL authentication. What additional step is required to prevent users from creating SQL logins?

Accepted Answer

Revoke the 'CREATE LOGIN' permission from all users except the Entra admin.. Disallowing SQL authentication at the server level prevents users from authenticating with SQL logins, but it does not revoke the ability to create new SQL logins. Users with the 'loginmanager' fixed server role or the 'CREATE LOGIN' permission can still create SQL logins, which would exist in the master database even though they cannot be used for authentication. To fully enforce Microsoft Entra-only authentication, you must explicitly revoke the 'CREATE LOGIN' permission from all users except the Entra admin, ensuring no new SQL logins can be created.

Answer

Remove the 'loginmanager' fixed server role from all users.

Answer

Enable auditing to detect login creation attempts and alert the security team.

Answer

No further action needed; disallowing SQL authentication prevents any SQL login creation.

Question 4

Your company uses Azure SQL Database with Azure Active Directory (now Microsoft Entra ID) authentication. A new security policy requires that all database users must be authenticated via Microsoft Entra ID only. You need to disable SQL authentication for an Azure SQL Database logical server. What should you do?

Accepted Answer

Set the 'Azure AD-only authentication' property to Enabled for the logical server.. Enabling the 'Microsoft Entra ID-only authentication' property at the logical server level explicitly blocks all SQL authentication attempts, forcing every database user to authenticate via Microsoft Entra ID. This property is a server-level toggle that overrides any existing SQL logins or contained database users, ensuring compliance with the policy without needing to manually remove logins.

Answer

Remove the Azure AD administrator for the server.

Answer

Remove all SQL logins from the master database.

Answer

Set the 'Azure AD-only authentication' property to Enabled for each database.

Question 5

Which TWO of the following are required to enable Microsoft Defender for SQL for Azure SQL Database?

Accepted Answer

Configure a Log Analytics workspace.. Microsoft Defender for SQL requires a Log Analytics workspace to store security alerts and vulnerability assessment data. Option E is correct because Microsoft Defender for SQL must be enabled at the subscription level via Microsoft Defender for Cloud, which provides the security center integration. Options B, C, and D are not required for enabling Defender for SQL: Azure SQL Database auditing is separate, SQL Server Agent is not needed, and Azure Key Vault is for encryption key management, not a prerequisite for Defender for SQL.

Answer

Enable Azure SQL Database auditing.

Answer

Enable SQL Server Agent.

Answer

Configure an Azure Key Vault for storing encryption keys.

Question 6

Your organization uses Azure SQL Database with a geo-replication configuration. The primary server is in the East US region and the secondary is in West US. You need to ensure that if a regional outage occurs, failover can be initiated manually and the secondary database will have the same security settings as the primary. What should you configure?

Accepted Answer

Create an auto-failover group with read-write failover policy.. An auto-failover group in Azure SQL Database provides automatic and manual failover capabilities while ensuring that all databases in the group share the same secondary server and security settings. The read-write failover policy allows manual failover initiation, and because the failover group replicates at the server level, security configurations such as firewall rules, logins, and permissions are maintained on the secondary. This directly satisfies the requirement for manual failover with consistent security settings.

Answer

Configure active geo-replication between the databases and manually initiate failover if needed.

Answer

Use database copy to create a copy in the secondary region.

Answer

Use backup and restore to copy the database to the secondary region.

Question 7

You are a database administrator for Azure SQL Managed Instance. You need to configure a custom time zone for the instance because the application uses a specific time zone. What should you do?

Accepted Answer

Use ALTER INSTANCE SET TIMEZONE to set the desired time zone.. Azure SQL Managed Instance runs on top of a Windows operating system, and the time zone for the entire instance is controlled at the host level. The `ALTER INSTANCE SET TIMEZONE` command is the correct T-SQL method to change the time zone for the instance, which then applies to all databases within that instance. This command allows you to set a custom time zone that the application requires, without needing to deploy a separate VM or configure each database individually.

Answer

Deploy a virtual machine running SQL Server instead.

Answer

Set the time zone for each database using ALTER DATABASE.

Answer

Configure the time zone in the Azure portal under the instance settings.

Question 8

You are implementing a new Azure SQL Database and need to ensure that connections from client applications are encrypted using TLS 1.2 or higher. Which server-level firewall rule setting should you configure?

Accepted Answer

Set minimal TLS version to 1.2. The 'Minimal TLS version' server-level firewall rule setting enforces the minimum TLS version for encrypted connections to Azure SQL Database. By setting this to 1.2, the server will reject any connection attempts using TLS 1.0 or 1.1, ensuring all client applications use TLS 1.2 or higher. This setting is configured in the Azure portal under the 'Networking' blade of the SQL server resource.

Answer

Deny public network access

Answer

Enable contained database authentication

Answer

Allow Azure Services and resources to access this server

Question 9

Your organization has a regulatory requirement to audit all data modifications in an Azure SQL Database. You enable Azure SQL Database auditing and configure it to send logs to a Log Analytics workspace. However, you notice that DELETE operations on a specific table are not being audited. What is the most likely cause?

Accepted Answer

The audit action group does not include 'DATABASE_OPERATION_GROUP'. Azure SQL Database auditing uses audit action groups to define which operations are logged. By default, the audit policy includes 'SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP', 'FAILED_DATABASE_AUTHENTICATION_GROUP', and 'BATCH_COMPLETED_GROUP', but 'DATABASE_OPERATION_GROUP' is required to capture DDL and DML operations like DELETE. If this group is not explicitly added to the audit specification, DELETE operations on specific tables will not be recorded, even though general auditing is enabled.

Answer

The diagnostic settings for the database are misconfigured

Answer

Audit logs are being written to a storage account instead of Log Analytics

Answer

The table has been configured to ignore auditing for read operations

Question 10

Which THREE security features are available in Azure SQL Database to protect data at rest?

Accepted Answer

Transparent Data Encryption (TDE) with customer-managed keys. Transparent Data Encryption (TDE) with customer-managed keys (Option A) protects data at rest by encrypting the database files and backups using a key stored in Azure Key Vault, giving the customer full control over key rotation and revocation. TDE with service-managed keys (Option C) also encrypts data at rest but uses a key managed by Azure, which is simpler but offers less control. Always Encrypted with secure enclaves (Option E) protects sensitive data at rest by encrypting columns with keys that are never revealed to the database engine, and the secure enclave allows computations on encrypted data, ensuring data remains encrypted even during processing.

Answer

Dynamic Data Masking

Answer

Row-Level Security

Question 11

Refer to the exhibit. You are configuring a backup retention policy for an Azure SQL Database via ARM template. You need to ensure that point-in-time restore (PITR) is available for the maximum supported period. What is the issue with the current configuration?

Accepted Answer

The retentionDays value exceeds the maximum supported retention period. For Azure SQL Database, the maximum supported retention period for point-in-time restore (PITR) is 35 days. The ARM template in the exhibit sets retentionDays to a value greater than 35 (e.g., 40), which exceeds this limit. Therefore, the configuration is invalid because it requests a retention period beyond what Azure SQL Database supports for PITR.

Answer

The retentionDays value is set below the minimum requirement

Answer

The diffBackupIntervalInHours value is not a supported value

Answer

The backup policy does not specify a geo-redundant storage option

Question 12

You need to ensure that Azure SQL Database can only be accessed from a specific virtual network in Azure. Which configuration should you apply?

Accepted Answer

Configure a virtual network service endpoint and add a firewall rule for the VNet subnet. Configuring a virtual network service endpoint for Azure SQL Database and then adding a firewall rule for the specific VNet subnet restricts access to traffic originating from that subnet only. This ensures that the database is not reachable over the public internet, but only from the designated virtual network, meeting the requirement precisely.

Answer

Add the public IP address range of the VNet to the firewall rules

Answer

Create a private endpoint and disable public network access

Answer

Set 'Deny public network access' to Yes

Question 13

Refer to the exhibit. You are configuring an Azure SQL Database security alert policy. What is the most significant misconfiguration?

Accepted Answer

The retentionDays is set to 0, which is not supported. The most significant misconfiguration is setting `retentionDays` to 0 because Azure SQL Database security alert policies require a retention period between 1 and 365 days. A value of 0 is invalid and will cause the policy to fail validation or be rejected, meaning the alert policy cannot be created or updated. This directly prevents the security alerts from being configured at all, making it a critical blocking issue.

Answer

Some alerts are disabled, which could leave the database vulnerable

Answer

Emailing account admins may not be sufficient for notification

Answer

Multiple email addresses are specified, which may cause duplicate notifications

Question 14

Which THREE are valid methods to authenticate to Azure SQL Database using Microsoft Entra ID?

Accepted Answer

Microsoft Entra ID password authentication. Option B (Microsoft Entra ID password authentication) is correct because Azure SQL Database supports connecting with a Microsoft Entra ID user principal name and password, where the identity is created as a contained database user (CREATE USER ... FROM EXTERNAL PROVIDER) and authenticated directly against Entra ID. Option C (Integrated Windows authentication/Kerberos) is correct because Azure SQL Database supports Microsoft Entra ID integrated authentication, allowing domain-joined Windows clients to obtain a Kerberos ticket from Entra ID and present it to the database without sending a password. Option E (Service principal authentication) is correct because an Entra ID application registration with a client secret or certificate can be used as a service principal, granted access via a contained database user, and used to authenticate to Azure SQL Database. Option A is not valid because a user-assigned managed identity must be mapped to a contained database user (CREATE USER ... FROM EXTERNAL PROVIDER) before it can authenticate; without that contained user, authentication fails. Option D is not valid because Azure CLI authentication is merely a client tool that obtains a token from Entra ID — it is not itself an authentication method for Azure SQL Database, and the underlying method would still be an Entra ID user, service principal, or managed identity.

Answer

User-assigned managed identity without a contained database user

Answer

Azure CLI authentication

Question 15

You are responsible for an Azure SQL Database that stores customer personally identifiable information (PII). You need to ensure that users with the 'CustomerService' role can see only the last four digits of Social Security numbers. Which feature should you use?

Accepted Answer

Dynamic Data Masking with a partial mask function. Dynamic Data Masking (DDM) with a partial mask function is the correct choice because it allows you to obfuscate sensitive data at query time without altering the underlying storage. For a Social Security number, you can apply a mask like 'partial(0, "XXX-XX-", 4)' to expose only the last four digits to users in the 'CustomerService' role, while the full value remains intact in the database.

Answer

Row-Level Security

Answer

Column-level security with DENY permission on the column

Answer

Always Encrypted with deterministic encryption