DP-300 Implement a secure environment Practice Test 4 — 15 Questions

Question 1

Drag and drop the steps to configure a failover group for an Azure SQL Database in the correct order.

Accepted Answer

Step 1: Create a secondary Azure SQL Database server; Step 2: Create a failover group; Step 3: Add databases to the failover group; Step 4: Configure the failover policy; Step 5: Test failover.. Failover groups require a secondary server, then creating the group, adding databases, configuring policy, and testing.

Answer

Step 2: Create a failover group; Step 1: Create a secondary Azure SQL Database server; Step 3: Add databases to the failover group; Step 4: Configure the failover policy; Step 5: Test failover.

Answer

Step 1: Create a secondary Azure SQL Database server; Step 2: Create a failover group; Step 4: Configure the failover policy; Step 3: Add databases to the failover group; Step 5: Test failover.

Answer

Step 1: Create a secondary Azure SQL Database server; Step 3: Add databases to the failover group; Step 2: Create a failover group; Step 4: Configure the failover policy; Step 5: Test failover.

Question 2

Match each Azure SQL Database pricing tier to its key feature.

Accepted Answer

Basic: Low-cost, lightweight workloads with minimal compute and memory resources.. These tiers define the compute and memory resources available for Azure SQL Database.

Answer

Basic: Balanced compute and memory resources for most enterprise workloads with scalable storage.

Answer

Standard: High memory-to-core ratio for memory-intensive workloads like analytics.

Question 3

Match each Azure SQL Database migration tool to its description.

Accepted Answer

Azure Database Migration Service: A fully managed service designed for online migrations to Azure SQL Database with minimal downtime.. Correct matches: A - Azure Database Migration Service (online/offline migration), B - Data Migration Assistant (assessment), C - SSMA (cross-platform migration), D - Azure Migrate (central hub). Common confusion: mixing up the migration service with offline-only tools or ignoring the assessment step.

Answer

Azure Database Migration Service: A tool that only performs offline migrations and requires significant downtime.

Answer

Data Migration Assistant: A service that automatically migrates databases with no assessment step.

Question 4

You need to ensure that all users accessing Azure SQL Database from outside the corporate network are required to use multi-factor authentication (MFA). What should you configure?

Accepted Answer

Configure a Conditional Access policy in Microsoft Entra ID.. Conditional Access policies in Microsoft Entra ID (formerly Azure AD) allow you to enforce MFA based on network location, device state, or risk level. By configuring a policy that targets the Azure SQL Database application and requires MFA for all access from outside the corporate network, you meet the requirement without altering the database or server configuration.

Answer

Enable Azure RBAC for the SQL server.

Answer

Create an Azure Policy to require MFA.

Answer

Turn on Transparent Data Encryption (TDE).

Question 5

You are the database administrator for a company that uses Azure SQL Database. You need to implement a security solution that automatically detects and alerts on suspicious activities, such as SQL injection attempts. Which feature should you enable?

Accepted Answer

Microsoft Defender for SQL. Microsoft Defender for SQL (formerly Azure Security Center's Advanced Threat Protection) is the correct feature because it continuously monitors database traffic for anomalous activities, including SQL injection, brute-force attacks, and privilege escalation. When suspicious behavior is detected, it generates a security alert that can be viewed in the Azure portal or integrated with Azure Sentinel for automated response. This is the only option among the choices that provides proactive threat detection and alerting for suspicious activities.

Answer

Azure SQL Auditing

Answer

SQL Vulnerability Assessment

Answer

Transparent Data Encryption (TDE)

Question 6

Your company uses Azure SQL Managed Instance. You need to configure a server-level firewall rule to allow access from a specific Azure service, but you want to minimize the attack surface. What is the best practice?

Accepted Answer

Set the firewall rule to allow Azure services and resources to access this server.. Enabling the 'Allow Azure services and resources to access this server' firewall rule is the best practice for Azure SQL Managed Instance when you need to allow access from a specific Azure service while minimizing the attack surface. This setting uses a special firewall rule that permits connections from any Azure service (including those within the same region) without exposing the server to all public IP addresses, as it relies on Azure's internal network boundaries and does not open the server to the entire internet. It is more secure than allowing all IPs (0.0.0.0/0) because it restricts access to only Azure-originated traffic, and it is simpler than manually specifying IP ranges, which can change dynamically.

Answer

Set the firewall rule to allow all IP addresses (0.0.0.0/0).

Answer

Disable public endpoint and use private endpoint.

Answer

Create a firewall rule with the specific IP range of the Azure service.

Question 7

You need to encrypt sensitive columns in an Azure SQL Database table so that data is encrypted at rest and in transit between the application and database. Which feature should you use?

Accepted Answer

Always Encrypted. Always Encrypted is the correct choice because it encrypts sensitive data both at rest in the database and in transit between the application and the database. It ensures that encryption keys are never revealed to the database engine, so data remains encrypted throughout the entire data path, including during query execution. This meets the requirement for encryption at rest and in transit.

Answer

Row-Level Security

Answer

Transparent Data Encryption (TDE)

Answer

Dynamic Data Masking

Question 8

You are configuring Microsoft Defender for SQL for Azure SQL Database. You need to ensure that alerts are sent to the security operations team via email and also integrated with Microsoft Sentinel. What should you configure?

Accepted Answer

In Microsoft Sentinel, connect the Azure SQL Database data source using the built-in connector.. Microsoft Sentinel provides a built-in connector for Azure SQL Database that ingests security alerts from Microsoft Defender for SQL, satisfying the Sentinel integration requirement. The email notification requirement is addressed separately by configuring alert rules within Defender for SQL to send emails to the security operations team. Option A enables the Sentinel integration, while email notifications are a complementary configuration within Defender for SQL, not part of Option A itself.

Answer

Use Azure Logic Apps to forward Defender for SQL alerts to Sentinel.

Answer

Configure a diagnostic setting on the SQL server to stream logs to a Log Analytics workspace used by Sentinel.

Answer

Configure the alert rule in Defender for SQL to send email to the security team.

Question 9

Your company uses Azure SQL Database with a server-level Microsoft Entra ID admin. You need to implement a solution where database-level roles are automatically assigned based on the user's group membership in Microsoft Entra ID. What should you use?

Accepted Answer

Create database users from Microsoft Entra ID groups and grant roles to those users.. Azure SQL Database supports creating database users mapped to Microsoft Entra ID (formerly Azure AD) groups. By creating a user for the Entra ID group and then granting database roles to that group user, all members of the group automatically inherit the assigned permissions. This directly satisfies the requirement for role assignment based on group membership without custom scripting or triggers.

Answer

Use Azure RBAC to assign roles to the Entra ID groups.

Answer

Configure a SQL Server Agent job to update database roles based on group membership.

Answer

Create a DDL trigger that assigns roles when users log in.

Question 10

You need to audit all successful and failed login attempts to an Azure SQL Database. Which feature should you enable?

Accepted Answer

Azure SQL Auditing. Azure SQL Auditing is the correct feature because it tracks database events, including both successful and failed login attempts, and writes them to an audit log in your Azure Storage account, Log Analytics workspace, or Event Hubs. This meets the requirement to audit all authentication events for security and compliance purposes.

Answer

Transparent Data Encryption (TDE)

Answer

SQL Vulnerability Assessment

Answer

Diagnostic settings

Question 11

Your organization needs to comply with a regulation that requires data to be encrypted at rest using a customer-managed key stored in Azure Key Vault. You have an Azure SQL Database. What should you configure?

Accepted Answer

Enable Transparent Data Encryption (TDE) and use a customer-managed key in Azure Key Vault as the TDE protector.. Transparent Data Encryption (TDE) with a customer-managed key in Azure Key Vault meets the requirement for data at rest encryption using a customer-controlled key. TDE encrypts the database files (data and log files) at rest, and by using a customer-managed key as the TDE protector, you retain control over key rotation and revocation, satisfying regulatory compliance.

Answer

Use Azure Policy to enforce encryption at rest.

Answer

Enable Always Encrypted and store the column master key in Azure Key Vault.

Answer

Configure Azure Storage Service Encryption for the database files.

Question 12

You are a database administrator for an Azure SQL Database. You need to allow a user to restore a database from a backup to a new database, but the user should not have permission to delete the original database. What is the minimum permission required?

Accepted Answer

CREATE DATABASE permission on the logical server. The minimum permission required to restore a database from a backup to a new database in Azure SQL Database is the CREATE DATABASE permission on the logical server. This is because restoring a backup to a new database is essentially creating a new database, and the user does not need any additional permissions on the original database to perform this action. The db_backupoperator and db_owner roles grant excessive permissions on the original database, while the SQL Server Contributor role is an Azure RBAC role that provides broader management capabilities beyond what is needed.

Answer

db_backupoperator database role

Answer

db_owner database role

Answer

SQL Server Contributor role

Question 13

Which TWO actions are required to enable Microsoft Entra ID authentication for an Azure SQL Database?

Accepted Answer

Set an Microsoft Entra ID admin for the Azure SQL Server.. To enable Entra ID authentication, you must set an Entra ID admin for the SQL server and create contained database users mapped to Entra ID identities. Enabling Azure AD (Entra ID) integration is automatic. Assigning Azure RBAC roles is for management plane, not database authentication. The SQL Server authentication mode is always enabled.

Answer

Enable SQL Server authentication only.

Answer

Assign the SQL Server Contributor role to the Entra ID users.

Answer

Enable Azure AD integration on the SQL server.

Question 14

Which THREE features can help protect Azure SQL Database from data exfiltration?

Accepted Answer

Microsoft Defender for SQL. Microsoft Defender for SQL detects anomalous activities that may indicate data exfiltration attempts. Azure Policy with deny effect for public network access blocks external connectivity, preventing unauthorized data transfer. Always Encrypted ensures that sensitive data remains encrypted even when accessed by unauthorized users, so if data is exfiltrated, it is unusable without the encryption keys. Together, these three features protect Azure SQL Database from data exfiltration.

Answer

Azure SQL Database Ledger

Answer

Dynamic Data Masking

Question 15

Which TWO are valid methods to connect to an Azure SQL Database without exposing a public endpoint?

Accepted Answer

Use a service endpoint. A service endpoint extends your virtual network private address space and the identity of your VNet to Azure SQL Database over a direct connection on the Azure backbone network. This allows you to secure your logical SQL server to accept traffic only from a specific subnet, eliminating the need for a public endpoint while still using the public endpoint's DNS name internally.

Answer

Use Always Encrypted

Answer

Use a public endpoint with a firewall rule

Answer

Use a site-to-site VPN gateway and connect to public endpoint