DP-300 Implement a secure environment Practice Test 4 — 15 Questions

Question 1

Your organization uses Azure SQL Database with Microsoft Entra ID authentication. You need to ensure that a specific user can only read data from the Sales schema. The user should not be able to modify any data. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a contained user mapped to the Microsoft Entra identity, then grant SELECT on the Sales schema to the user, and deny SELECT on all other schemas.. It creates a contained database user mapped to the Microsoft Entra identity, then explicitly grants SELECT on the Sales schema. This ensures the user can read data only from that schema. Denying SELECT on all other schemas removes any implicit permissions (such as those from the public role) and enforces the least-privilege principle. This approach is schema-level permission control, which is more granular than fixed database roles.

Answer

Create a contained user mapped to the Microsoft Entra identity and add the user to the db_datareader role.

Answer

Create a contained user mapped to the Microsoft Entra identity and add the user to the db_denydatawriter role.

Answer

Create a contained user mapped to the Microsoft Entra identity and add the user to the db_datareader role, then deny SELECT on all schemas except Sales.

Question 2

You are the database administrator for a company that uses Azure SQL Managed Instance. The security team has detected unusual query activity from a specific client IP address. You need to immediately block all connections from that IP address while maintaining connectivity for all other users. Which solution should you implement?

Accepted Answer

Add a firewall rule at the managed instance level that denies the specific IP address.. Azure SQL Managed Instance supports instance-level firewall rules that can explicitly deny a specific client IP address while allowing all other traffic. Unlike Azure SQL Database, which uses server-level firewall rules, Managed Instance firewall rules are configured directly on the instance and can include both allow and deny entries, enabling granular access control without affecting other users.

Answer

Create a private endpoint for the managed instance and disable public network access.

Answer

Add a server-level firewall rule at the logical server level to deny the IP address.

Answer

Modify the network security group (NSG) associated with the managed instance's subnet to deny the IP address.

Question 3

Your company is migrating on-premises SQL Server databases to Azure SQL Database. As part of security compliance, you must ensure that all data at rest is encrypted using customer-managed keys stored in Azure Key Vault. Which Azure SQL Database feature should you enable?

Accepted Answer

Transparent Data Encryption with customer-managed keys in Azure Key Vault. Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault is the correct feature because it encrypts SQL Server, Azure SQL Database, and Azure Synapse data files at rest using a customer-controlled key stored in Azure Key Vault. This meets the compliance requirement for encrypting all data at rest with customer-managed keys, as TDE performs real-time I/O encryption and decryption of the database, backups, and transaction log files without requiring application changes.

Answer

Dynamic Data Masking

Answer

Always Encrypted

Answer

Row-Level Security

Question 4

You attempt to create a new Azure SQL Database server with public network access enabled. What will happen?

Accepted Answer

The creation will be denied because the policy prohibits public network access.. In this scenario, it is assumed that an Azure Policy is in place that prohibits public network access for Azure SQL Database servers. Azure Policy enforces rules at the Azure Resource Manager level. Therefore, when you attempt to create a server with public network access enabled, the policy evaluation occurs before provisioning, and the creation request is denied. This prevents the server from being created at all.

Answer

The server will be created, but an audit log will be generated.

Answer

The server will be created successfully with public network access enabled.

Answer

The server will be created, but the databases will be denied creation.

Question 5

Your company uses Azure SQL Database and requires that all connections use Azure Active Directory (now Microsoft Entra ID) authentication. You need to ensure that no SQL authentication logins exist in the database. What should you do?

Accepted Answer

Query sys.sql_logins to identify any SQL authentication logins and drop them.. The only way to ensure no SQL authentication logins exist in an Azure SQL Database is to query the `sys.sql_logins` system catalog view to identify any SQL-authenticated logins and then drop them. Azure SQL Database does not support a server-level property like `DisableSqlAuthentication` to block SQL authentication; instead, you must explicitly remove SQL logins to enforce exclusive use of Microsoft Entra ID authentication.

Answer

Set the server property 'DisableSqlAuthentication' to true.

Answer

Set the database property 'contained database authentication' to 0.

Answer

Use the Azure portal to set the firewall rule to block SQL authentication.

Question 6

What will be the result of this command?

Accepted Answer

The database will log all successful and failed authentication attempts to the storage account for 90 days.. The command enables auditing on the database. When auditing is enabled, by default both successful and failed authentication attempts are logged. The retention period is set to 90 days. Therefore, all authentication attempts are logged and retained for 90 days.

Answer

The database will log only failed authentication attempts to the storage account for 90 days.

Answer

The command will fail because the StorageAccountResourceId parameter is incorrect.

Answer

The command will enable auditing for the server rather than the database.

Question 7

Your company uses Azure SQL Database with Elastic Jobs to run maintenance scripts. You need to ensure that the Elastic Job agent can connect to the target databases securely. The agent runs in an Azure virtual network and uses a managed identity. The target databases are in a different Azure region and have public endpoint disabled. What is the most secure way to connect the Elastic Job agent to the target databases?

Accepted Answer

Configure a private endpoint for each target database and grant the Elastic Job agent's managed identity access to the databases via a contained database user.. It combines Azure Private Link (private endpoint) for network-level isolation with managed identity for authentication, eliminating exposure to the public internet and removing the need for passwords. The Elastic Job agent's managed identity is mapped to a contained database user in each target database, enabling secure, passwordless connections even across regions when public endpoints are disabled.

Answer

Use virtual network service endpoints to allow the agent's subnet to connect to the target databases.

Answer

Add the agent's public IP address to the target database firewall rules.

Answer

Create a SQL authentication login for the Elastic Job agent and use that in the job credentials.

Question 8

You have an Azure SQL Managed Instance that needs to be accessed from an on-premises application. The connection must be encrypted and the on-premises network uses an ExpressRoute circuit. You need to configure the managed instance to only accept connections from the on-premises network. What should you do?

Accepted Answer

Connect the on-premises network to the managed instance's virtual network using ExpressRoute and configure network security group (NSG) rules to restrict inbound traffic to the on-premises subnet.. Azure SQL Managed Instance is deployed into a virtual network, and the most secure way to allow only on-premises traffic is to extend the on-premises network into that VNet via ExpressRoute (private peering) and then use Network Security Group (NSG) rules to restrict inbound connections to only the on-premises subnet. This ensures the connection remains private, encrypted (via the ExpressRoute circuit), and does not expose a public endpoint.

Answer

Enable a public endpoint and restrict access using a firewall rule.

Answer

Configure a server-level firewall rule to allow the on-premises IP range.

Answer

Create a private endpoint for the managed instance and configure DNS.

Question 9

You have an Azure SQL Database that stores personally identifiable information (PII). You need to classify and label the sensitive columns using Microsoft Purview. Additionally, you want to automatically mask these columns for a specific application user. Which two actions should you take? (Choose two.)

Accepted Answer

Apply Dynamic Data Masking (DDM) rules to mask the classified columns for the application user.. Option D is correct because Microsoft Purview Data Map is the component that scans Azure SQL Database and applies built-in or custom classification rules to identify and label PII columns, which is exactly the classification and labeling requirement. Option A is correct because Dynamic Data Masking (DDM) is the Azure SQL Database feature that masks column data at query time for specified users via CREATE MASKING RULE / GRANT UNMASK, so the application user sees masked values while other privileged users see the real data. Option B is not correct because Always Encrypted protects data at rest and in transit by encrypting columns client-side, but it does not mask data for a specific application user and requires client driver and key changes. Option C is not correct because Microsoft Sentinel is a SIEM/SOAR monitoring and analytics service, not a classification or masking mechanism. Option E is not correct because Transparent Data Encryption (TDE) encrypts the entire database, backups, and logs at rest, but it is transparent to all users and provides no column-level classification or user-specific masking.

Answer

Enable Always Encrypted on the classified columns.

Answer

Configure Microsoft Sentinel to monitor access to classified columns.

Answer

Enable Transparent Data Encryption (TDE) on the database.

Question 10

You are configuring Azure SQL Database for a financial application that must meet PCI DSS compliance. The database contains credit card numbers stored in a column encrypted with Always Encrypted. You need to ensure that database administrators cannot view the plaintext credit card numbers while allowing application users with the proper credentials to access them. What should you implement?

Accepted Answer

Use Always Encrypted with secure enclaves and store the column master key in Azure Key Vault with access granted only to the application. Always Encrypted with secure enclaves ensures that credit card numbers are encrypted at all times, including during computation, and that the column master key is stored in Azure Key Vault with access granted only to the application. This prevents database administrators (DBAs) from viewing plaintext data because they never have access to the column master key, while authorized application users can decrypt the data via the client driver. This meets PCI DSS requirements for protecting cardholder data at rest and in use.

Answer

Use column-level encryption with a certificate stored in the database

Answer

Enable Transparent Data Encryption (TDE)

Answer

Implement Dynamic Data Masking (DDM)

Question 11

You are the database administrator for a SaaS company that uses Azure SQL Database. The company has a new requirement to audit all SELECT operations on a specific table containing sensitive customer data. You enable auditing on the server and configure a storage account for audit logs. However, after 24 hours, you notice that no SELECT operations are captured in the audit logs. You verify that the table is being accessed frequently. What is the most likely cause?

Accepted Answer

The audit policy is not configured to capture SELECT operations; only UPDATE, INSERT, and DELETE are captured. The default server-level audit policy in Azure SQL Database captures only data manipulation language (DML) operations like UPDATE, INSERT, and DELETE, not SELECT queries. To audit SELECT operations, you must explicitly configure a database-level audit action group such as DATABASE_OBJECT_ACCESS_GROUP or SCHEMA_OBJECT_ACCESS_GROUP, or use a custom audit action like SELECT on the specific table. Without this configuration, SELECT operations are not recorded in the audit logs, even if server auditing is enabled and the storage account is properly configured.

Answer

The storage account key was rotated and the audit configuration is using an expired key

Answer

The client application is using a connection string that bypasses the server firewall

Answer

The storage account is in a different region than the SQL Database server

Question 12

Your Azure SQL Managed Instance stores sensitive healthcare data. You need to restrict access to the database from public networks while allowing a specific on-premises application to connect. The on-premises network has a static public IP address. What is the most secure way to configure connectivity?

Accepted Answer

Enable the public endpoint and create a firewall rule allowing only the on-premises static IP address. Enabling the public endpoint with a firewall rule that restricts access to only the on-premises static IP address is the most secure way to allow a specific external application to connect while blocking all other public traffic. This approach leverages Azure SQL Managed Instance's built-in public endpoint firewall, which evaluates source IP addresses against configured rules before allowing connections, ensuring that only the trusted on-premises application can reach the sensitive healthcare data.

Answer

Enable the public endpoint without any firewall rules

Answer

Configure a service endpoint on the VNet where the Managed Instance is deployed

Answer

Disable the public endpoint and configure a point-to-site VPN for the on-premises application

Question 13

Your company uses Azure SQL Database with Microsoft Defender for Cloud. You receive an alert indicating a potential SQL injection attack. The alert shows that the attack originated from the IP address of your company's VPN gateway. You have verified that no legitimate users are using the VPN at that time. What should you do to immediately stop the attack while preserving legitimate access?

Accepted Answer

Remove the firewall rule that allows the VPN gateway IP address. The attack is originating from the VPN gateway's IP address, and the firewall rule allowing that IP is the only entry point for the attacker. By removing that specific firewall rule, you immediately block the malicious traffic while preserving legitimate access through other firewall rules (e.g., for on-premises or other VPN ranges). This directly stops the SQL injection attack at the network layer without affecting other users or services.

Answer

Disable the public endpoint on the SQL Database

Answer

Change the SQL Database server admin password

Answer

Add the attacker's IP address to a block list in Microsoft Defender for Cloud

Question 14

You are implementing row-level security (RLS) in Azure SQL Database to enforce data isolation for multiple tenants. Each tenant has a TenantID. The RLS predicate function uses the SESSION_CONTEXT variable set by the application. You need to ensure that users cannot bypass the RLS by setting arbitrary SESSION_CONTEXT values. What should you do?

Accepted Answer

Create a stored procedure that sets the SESSION_CONTEXT and grant the application only execute permission on that procedure; revoke SET permission from users. By creating a stored procedure that sets the SESSION_CONTEXT and granting the application only EXECUTE permission on that procedure while revoking SET permission from users, you prevent users from arbitrarily setting SESSION_CONTEXT values. This enforces that only the trusted application code can set the context used by the RLS predicate, ensuring tenants cannot impersonate other tenants.

Answer

Use dynamic data masking to hide the TenantID column

Answer

Encrypt the SESSION_CONTEXT values using Always Encrypted

Answer

Use a firewall rule to restrict access to the database to only the application IP addresses

Question 15

Refer to the exhibit. You are reviewing a script that is executed as part of a data migration to Azure SQL Database. The script attempts to insert a row with a specific OrderID into an Orders table that has an identity column. The script runs successfully in a test environment but fails in production with an error. The production environment has the same schema. What is the most likely cause?

Accepted Answer

The user running the script does not have ALTER permission on the table. The script uses SET IDENTITY_INSERT ON to allow explicit insertion into an identity column. In Azure SQL Database, this requires ALTER permission on the table, not just INSERT. The test environment likely granted the user ALTER, but production did not, causing the failure despite identical schema.

Answer

The table in production does not have an identity column

Answer

A different session is already using SET IDENTITY_INSERT ON for the same table

Answer

The identity column in production has a different seed value