DP-300 Implement a secure environment Practice Test 5 — 15 Questions

Question 1

Refer to the exhibit. You are reviewing an ARM template for an Azure SQL Database. The template configures backup retention. What is the effect of this configuration?

Accepted Answer

Point-in-time restore (PITR) backups are retained for 7 days, and differential backups occur every 12 hours.. The ARM template configures the backup retention settings for Azure SQL Database. By default, Azure SQL Database automatically performs full backups every week, differential backups every 12 hours, and transaction log backups every 5–10 minutes. The configuration shown sets the point-in-time restore (PITR) retention period to 7 days, meaning you can restore the database to any point within the last 7 days. Differential backups occur every 12 hours to support efficient PITR, but the retention setting directly controls how far back you can perform a point-in-time restore.

Answer

Full backups are taken every 12 hours and retained for 7 days.

Answer

Long-term retention (LTR) is set to 7 days.

Answer

Transaction log backups are taken every 12 hours.

Question 2

Refer to the exhibit. You are troubleshooting an Azure SQL Database auditing configuration. The exhibit shows the blob auditing policy. The storage account access key is null, and the subscription ID is all zeros. What is the most likely issue?

Accepted Answer

Auditing will fail because the storage account access key is null.. The exhibit shows that the storage account access key is null, which means Azure SQL Database cannot authenticate to the storage account using the access key. Without a valid access key or a configured managed identity, blob auditing will fail because the database cannot write audit logs to the specified storage container. Option C is correct because a null access key directly prevents auditing from functioning when no alternative authentication method is configured.

Answer

Auditing will fall back to Log Analytics workspace.

Answer

Auditing will work because managed identity is used.

Answer

Auditing will write to the storage account using the system-assigned managed identity.

Question 3

Refer to the exhibit. You run these commands in an Azure SQL Database. What is the result?

Accepted Answer

A Microsoft Entra ID user is created and granted read access to the database.. The commands create a user in an Azure SQL Database mapped to a Microsoft Entra ID (formerly Azure AD) identity. The CREATE USER statement with FROM EXTERNAL PROVIDER creates a user that corresponds to an Entra ID user or group. The ALTER ROLE statement then adds this user to the db_datareader database role, granting read access to all tables and views. Therefore, option D correctly describes the outcome: a Microsoft Entra ID user is created and granted read access.

Answer

The user is created but not granted any permissions.

Answer

The commands fail because Entra ID users cannot be created in Azure SQL Database.

Answer

A SQL Server authentication user is created and granted read access.

Question 4

You are configuring a new Azure SQL Database. The company policy requires that all connections use Microsoft Entra authentication and that no SQL authentication accounts exist. What should you do to prevent creation of SQL authenticated logins?

Accepted Answer

Set the 'DisallowSqlAuthentication' property to 'True' on the logical server.. Setting the 'DisallowSqlAuthentication' property to 'True' on the logical server enforces that only Microsoft Entra authentication can be used to connect to the Azure SQL Database. This property prevents the creation of any SQL authenticated logins, including the SQL admin account, and ensures compliance with the policy that no SQL authentication accounts exist.

Answer

Set the 'public_network_access' to 'Disabled'.

Answer

Remove the SQL admin login after creating the database.

Answer

Create an Azure Policy to audit SQL authentication usage.

Question 5

Your Azure SQL Managed Instance is configured to allow connections only from a specific virtual network. You need to ensure that clients from on-premises can connect using a point-to-site VPN. What additional configuration is required?

Accepted Answer

Configure a point-to-site VPN connection on the virtual network gateway and ensure the gateway subnet is in the same VNet as the managed instance.. A point-to-site VPN connection on the virtual network gateway allows individual on-premises clients to securely connect to the Azure VNet over SSTP or IKEv2. Since the managed instance is deployed inside a subnet of that VNet and its endpoint is restricted to the VNet, the VPN tunnel provides the necessary network path for on-premises clients to reach the instance without exposing it to the public internet.

Answer

Configure a private endpoint for the managed instance.

Answer

Deploy Azure Bastion in the same VNet.

Answer

Add the on-premises public IP address to the managed instance firewall rules.

Question 6

You need to audit all successful and failed login attempts on an Azure SQL Database. Which feature should you enable?

Accepted Answer

SQL Server Audit with a server-level audit specification that includes SUCCESSFUL_LOGIN_GROUP and FAILED_LOGIN_GROUP.. SQL Server Audit is the correct feature because it allows you to capture both successful and failed login attempts at the server level by defining a server audit specification that includes the SUCCESSFUL_LOGIN_GROUP and FAILED_LOGIN_GROUP audit action groups. These groups specifically log authentication events, which is exactly what is needed to audit all login attempts. Microsoft Defender for SQL, Vulnerability Assessment, and regulatory compliance dashboards do not provide granular login event auditing.

Answer

Microsoft Defender for SQL threat detection.

Answer

SQL Vulnerability Assessment.

Answer

Enable Microsoft Defender for Cloud's regulatory compliance dashboard.

Question 7

You have an Azure SQL Database with Always Encrypted enabled for sensitive columns. You need to grant a developer the ability to encrypt data using a column master key stored in Azure Key Vault. What permissions must be assigned to the developer's Microsoft Entra identity in the key vault?

Accepted Answer

Get, Wrap Key, and Unwrap Key.. To encrypt data with Always Encrypted, the client driver must retrieve the column encryption key (which is stored encrypted) and unwrap it using the column master key. It may also need to wrap newly generated column encryption keys during key rotation or initial setup. Therefore, the developer's Microsoft Entra identity requires Get, Unwrap Key, and Wrap Key permissions on the column master key in Azure Key Vault. Option B correctly includes all three.

Answer

Get, Decrypt, and Unwrap Key.

Answer

Get and Decrypt.

Answer

Get, Sign, and Verify.

Question 8

You are designing a security strategy for Azure SQL Managed Instance. The compliance team requires that all database backups be encrypted at rest using a customer-managed key. Which feature should you enable?

Accepted Answer

Transparent Data Encryption (TDE) with a customer-managed key stored in Azure Key Vault.. Transparent Data Encryption (TDE) with a customer-managed key stored in Azure Key Vault is the correct feature because it encrypts the database at rest, including all backup files, using a key that the customer controls. This satisfies the compliance requirement for customer-managed key encryption of backups, as TDE automatically encrypts backups when the database is encrypted.

Answer

Always Encrypted with a column master key in Azure Key Vault.

Answer

Transparent Data Encryption (TDE) with a service-managed key.

Answer

Row-Level Security (RLS) with a custom authorization function.

Question 9

You have an Azure SQL Database that is accessed by a web application. The application uses a service principal (Microsoft Entra application) to connect. You need to rotate the client secret for the service principal without downtime. What should you do?

Accepted Answer

Store the client secret in Azure Key Vault, configure the application to retrieve the secret from Key Vault, and implement a secret rotation policy.. It enables zero-downtime secret rotation by decoupling the application from a single secret value. By storing the client secret in Azure Key Vault and configuring the application to retrieve it dynamically, you can rotate the secret in Key Vault without changing the application's configuration or restarting it. The application always fetches the latest version of the secret, so rotation is transparent and does not interrupt connectivity.

Answer

Create a new client secret, update the application configuration, and then delete the old secret.

Answer

Switch to using a client certificate instead of a client secret.

Answer

Use a system-assigned managed identity for the web application.

Question 10

Your company has a strict policy that all Azure SQL Databases must have Microsoft Defender for SQL enabled. You need to enforce this policy across all subscriptions using a scalable, automated approach. What should you do?

Accepted Answer

Create an Azure Policy initiative that includes the 'Configure Microsoft Defender for SQL to be enabled' policy and assign it to the root management group.. Azure Policy provides a scalable, automated, and continuous enforcement mechanism across all subscriptions. By creating an initiative that includes the 'Configure Microsoft Defender for SQL to be enabled' policy and assigning it to the root management group, you ensure that any new or existing subscription inherits the policy, and non-compliant resources are automatically remediated or flagged. This approach aligns with the requirement for a strict, company-wide policy without manual intervention.

Answer

Use Azure Blueprints to deploy a predefined ARM template that enables Defender for SQL.

Answer

Create a script that runs periodically to check and enable Defender for SQL on all databases.

Answer

Assign the 'SQL Security Manager' role to a central team to manually enable Defender for SQL.

Question 11

Which TWO of the following are valid methods to secure data in transit for Azure SQL Database?

Accepted Answer

Configure the server to enforce TLS 1.2 by setting minimal TLS version.. Azure SQL Database allows you to enforce a minimum TLS version, such as TLS 1.2, which ensures that all client connections use at least that protocol version. This directly secures data in transit by preventing downgrade attacks and blocking older, less secure TLS versions like TLS 1.0 or 1.1.

Answer

Enable Always Encrypted on sensitive columns.

Answer

Deploy Azure Firewall in front of the database.

Answer

Apply a Network Security Group (NSG) to the subnet.

Question 12

Which THREE of the following are required to configure Microsoft Entra authentication for an Azure SQL Managed Instance?

Accepted Answer

Enable the managed instance system-assigned managed identity.. Enabling the system-assigned managed identity for Azure SQL Managed Instance is required because Microsoft Entra authentication relies on this identity to authenticate the instance itself against Microsoft Entra ID. Without a managed identity, the instance cannot securely obtain tokens or perform directory lookups needed for authentication and authorization.

Answer

Ensure the managed instance is deployed in a different virtual network from the clients.

Answer

Configure the managed instance to allow public network access.

Question 13

You need to ensure that an Azure SQL Database uses Microsoft Entra-only authentication. You have configured the server to disallow SQL authentication. What additional step is required to prevent users from creating SQL logins?

Accepted Answer

Revoke the 'CREATE LOGIN' permission from all users except the Entra admin.. Disallowing SQL authentication at the server level prevents users from authenticating with SQL logins, but it does not revoke the ability to create new SQL logins. Users with the 'loginmanager' fixed server role or the 'CREATE LOGIN' permission can still create SQL logins, which would exist in the master database even though they cannot be used for authentication. To fully enforce Microsoft Entra-only authentication, you must explicitly revoke the 'CREATE LOGIN' permission from all users except the Entra admin, ensuring no new SQL logins can be created.

Answer

Remove the 'loginmanager' fixed server role from all users.

Answer

Enable auditing to detect login creation attempts and alert the security team.

Answer

No further action needed; disallowing SQL authentication prevents any SQL login creation.

Question 14

You are deploying an Azure SQL Database that will contain highly sensitive personal data. The security policy requires that the data be encrypted at rest, in transit, and in use. Additionally, the encryption keys must be stored in a hardware security module (HSM) and be customer-managed. Which combination of features should you implement?

Accepted Answer

TDE with a customer-managed key in Azure Key Vault (HSM-backed), enforce TLS 1.2, and Always Encrypted with a column master key in Azure Key Vault (HSM-backed).. It satisfies all requirements: encryption at rest via TDE with a customer-managed key stored in an HSM-backed Key Vault, encryption in transit by enforcing TLS 1.2, and encryption in use via Always Encrypted with the column master key also stored in an HSM-backed Key Vault. This ensures that all three states of data are encrypted and that keys are both customer-managed and hardware-protected.

Answer

TDE with a service-managed key, enforce TLS 1.2, and Always Encrypted with a column master key in Key Vault.

Answer

TDE with a customer-managed key in Key Vault, enforce TLS 1.2, and use Dynamic Data Masking.

Answer

TDE with a customer-managed key in Key Vault, enforce TLS 1.2, and Always Encrypted with a column master key stored in Windows Certificate Store.

Question 15

Your company uses Azure SQL Database with Azure Active Directory (now Microsoft Entra ID) authentication. A new security policy requires that all database users must be authenticated via Microsoft Entra ID only. You need to disable SQL authentication for an Azure SQL Database logical server. What should you do?

Accepted Answer

Set the 'Azure AD-only authentication' property to Enabled for the logical server.. Enabling the 'Azure AD-only authentication' property at the logical server level explicitly blocks all SQL authentication attempts, forcing every database user to authenticate via Microsoft Entra ID. This property is a server-level toggle that overrides any existing SQL logins or contained database users, ensuring compliance with the policy without needing to manually remove logins.

Answer

Remove the Azure AD administrator for the server.

Answer

Remove all SQL logins from the master database.

Answer

Set the 'Azure AD-only authentication' property to Enabled for each database.