DP-300 Implement a secure environment Practice Test 5 — 15 Questions

Question 1

Which THREE of the following are features that help protect against data exfiltration in Azure SQL Database? (Choose three.)

Accepted Answer

Always Encrypted. Always Encrypted is correct because it encrypts sensitive data at the client-side, ensuring that the encryption keys are never revealed to the database engine. This prevents even database administrators or attackers with access to the server from reading the plaintext data, directly protecting against data exfiltration.

Answer

Dynamic Data Masking (DDM)

Answer

Transparent Data Encryption (TDE)

Question 2

Your organization uses Azure SQL Database with Azure SQL Managed Instance for a multi-tenant SaaS application. You need to ensure that each tenant's data is isolated and that a compromised tenant cannot access other tenants' data. What is the most secure approach?

Accepted Answer

Deploy a separate database per tenant, configure server-level firewall rules per tenant IP, and use Microsoft Entra authentication with application roles.. Deploying a separate database per tenant provides the strongest isolation boundary at the storage and compute layer. Combining server-level firewall rules that restrict access to each tenant's IP range and using Microsoft Entra authentication with application roles ensures that even if one tenant's credentials are compromised, the attacker cannot access another tenant's database. This multi-layered approach (network + authentication + authorization) is the most secure for multi-tenant isolation in Azure SQL Managed Instance.

Answer

Use dynamic data masking to obfuscate tenant IDs in query results.

Answer

Implement row-level security (RLS) with a tenant ID filter on all tables.

Answer

Use column-level encryption with Azure Key Vault for sensitive columns.

Question 3

You have an Azure SQL Database that stores financial data. You need to audit all SELECT operations on the 'Transactions' table and store the audit logs in an Azure Storage account. What should you use?

Accepted Answer

Configure server-level auditing to log to an Azure Storage account.. Azure SQL Database supports server-level auditing that can write audit logs directly to an Azure Storage account. This meets the requirement to audit SELECT operations on the 'Transactions' table and store logs in Azure Storage. Server-level auditing captures all database events, including SELECT statements, and can be configured to target a storage container.

Answer

Enable Microsoft Defender for Cloud on the server and review security insights.

Answer

Create a server audit using SQL Server Audit and specify a file destination.

Answer

Enable diagnostic settings for the database and send to a Log Analytics workspace.

Question 4

You are designing a secure Azure SQL Database environment for a financial services application. You need to meet the following requirements: - All network traffic to the database must be private and not traverse the public internet. - Only specific Azure resources in a virtual network should be able to connect. - The solution must minimize administrative overhead. Which TWO configurations should you implement? (Choose two.)

Accepted Answer

Configure the server firewall to deny all public network access.. Option E is correct because a private endpoint assigns a private IP address from the virtual network to Azure SQL Database via Azure Private Link, ensuring all traffic stays on the Microsoft backbone and never traverses the public internet, while also restricting access to only resources that can reach that private IP. Option D is correct because setting the server firewall to deny public network access disables connectivity over the public endpoint, which is required to guarantee that no traffic uses the public internet once the private endpoint is in place. Together, the private endpoint plus denying public access satisfy the private-only and limited-resource-access requirements with minimal administrative overhead, since Private Link handles routing without managing VPN gateways or complex firewall rules. Option A is not appropriate because Azure Bastion provides secure RDP/SSH access to virtual machines, not to Azure SQL Database. Option B is wrong because allowing all Azure services opens the server to public Azure traffic, violating the private-only requirement. Option C is insufficient by itself because service endpoints still route traffic over the Azure backbone but the SQL Database endpoint remains public-facing, and they do not provide the private IP isolation that Private Link does.

Answer

Deploy Azure Bastion in the virtual network for secure connectivity.

Answer

Add a firewall rule to allow all Azure services to access the server.

Answer

Enable service endpoints for Azure SQL Database on the virtual network subnets.

Question 5

You are deploying a new Azure SQL Database that will store Personally Identifiable Information (PII). You need to ensure that the data is encrypted at rest and that access to encryption keys is logged. Which THREE actions should you take? (Choose three.)

Accepted Answer

Grant the managed identity of the database access to the key vault with 'get', 'wrapKey', and 'unwrapKey' permissions.. Option D is correct because Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault encrypts the database, backups, and logs at rest while giving you control over the key, which is required to ensure encryption at rest for PII. Option B is correct because for TDE with customer-managed keys, the Azure SQL logical server's managed identity must be granted 'get', 'wrapKey', and 'unwrapKey' permissions on the key vault key so the database can access and use the key for encryption and decryption. Option E is correct because enabling auditing on Azure Key Vault logs key operations (such as get, wrapKey, and unwrapKey), which satisfies the requirement to log access to encryption keys. Option A is not correct because Always Encrypted protects data in use and in transit at the client side, but it does not by itself provide encryption at rest for the whole database, and it is not the mechanism that logs key vault access. Option C is not correct because service-managed keys do not give you control over the keys and do not satisfy the requirement to log access to the encryption keys in your key vault.

Answer

Use Always Encrypted to encrypt all PII columns.

Answer

Configure TDE with service-managed keys.

Question 6

Your company uses Azure SQL Database with Microsoft Entra ID authentication. You need to ensure that only users from a specific Microsoft Entra ID tenant can access the database. What should you configure?

Accepted Answer

Create a server-level firewall rule with IP range '0.0.0.0' and then use Microsoft Entra ID authentication with a conditional access policy.. To restrict access to a specific Microsoft Entra ID tenant, you must first set the server-level firewall to allow all Azure IPs (0.0.0.0) so that Azure SQL Database can accept connections from any Azure resource, and then enforce tenant-level restrictions using a conditional access policy. This combination ensures that only users from the specified tenant can authenticate, while the firewall rule handles network-level access from Azure services.

Answer

Enable Azure AD conditional access policy to restrict sign-ins to the specific tenant.

Answer

Set the server firewall to allow only the tenant's IP range.

Answer

Configure a network security group (NSG) to block all traffic except from the tenant's IP range.

Question 7

You are designing a secure environment for Azure SQL Managed Instance. You need to ensure that all connections from client applications use a private endpoint, and no public endpoint is accessible. What should you configure?

Accepted Answer

Set the public endpoint to 'Disabled' and configure a private endpoint in the same virtual network with a private DNS zone.. Azure SQL Managed Instance requires the public endpoint to be explicitly disabled to ensure no public traffic can reach it. By configuring a private endpoint within the same virtual network and linking it to a private DNS zone, client applications resolve the managed instance's fully qualified domain name (FQDN) to the private IP address, enforcing all connections through the private endpoint and eliminating public endpoint accessibility.

Answer

Set the public endpoint to 'Enabled' and create a firewall rule with a deny-all rule.

Answer

Enable the public endpoint and use a VNet service tag in a firewall rule.

Answer

Use a VNet service endpoint for Azure SQL Managed Instance and configure a network security group.

Question 8

Your team uses Azure SQL Database and wants to use Microsoft Entra ID authentication. You need to create a contained database user mapped to a Microsoft Entra ID application (service principal). Which T-SQL command should you use?

Accepted Answer

CREATE USER [app-name] FROM EXTERNAL PROVIDER;. `CREATE USER [app-name] FROM EXTERNAL PROVIDER` creates a contained database user mapped to a Microsoft Entra ID identity (user, group, or application) directly in the database, without requiring a server-level login. This is the required syntax for authenticating a service principal (application) in Azure SQL Database using Microsoft Entra ID authentication.

Answer

CREATE USER [app-name] FROM LOGIN [app-name];

Answer

CREATE LOGIN [app-name] FROM EXTERNAL PROVIDER;

Answer

CREATE USER [app-name] WITH PASSWORD = 'password';

Question 9

Your Azure SQL Database is protected by a failover group. You need to ensure that during a failover to the secondary region, only authenticated applications can connect. What should you configure?

Accepted Answer

Use the failover group listener endpoint with Microsoft Entra ID authentication.. The failover group listener endpoint provides a DNS name that automatically points to the current primary region. By configuring Microsoft Entra ID authentication on the logical server, you ensure that only authenticated applications (using Microsoft Entra tokens) can connect, even after a failover. This eliminates reliance on SQL authentication passwords, which could be compromised or misconfigured across regions.

Answer

Set up a private endpoint for each region and update connection strings manually.

Answer

Deploy an Always On availability group listener.

Answer

Configure geo-replication and use the secondary server's public endpoint.

Question 10

You run the Azure CLI command shown in the exhibit for an Azure SQL Database named SalesDB. The output shows that the security alert policy is disabled. You need to enable Microsoft Defender for SQL, including vulnerability assessments, for this database. What should you do?

Accepted Answer

Run 'az sql server update --name sql-sales --resource-group rg-sales --enable-defender-for-sql true'.. Enabling Microsoft Defender for SQL, including vulnerability assessments, is a server-level configuration in Azure SQL. The command 'az sql server update --enable-defender-for-sql true' activates Defender for SQL on the server, which automatically applies to all databases on that server, including SalesDB. The exhibit shows a database-level security alert policy is disabled, but the required feature is enabled at the server scope, not per-database.

Answer

Run 'az sql db update --name SalesDB --resource-group rg-sales --server sql-sales --enable-defender-for-sql true'.

Answer

Run 'az sql db threat-policy update --name SalesDB --resource-group rg-sales --server sql-sales --state Enabled'.

Answer

Configure a server firewall rule to allow Azure services.

Question 11

Your company uses Azure SQL Database and wants to implement row-level security (RLS) to restrict access to customer data based on the user's Microsoft Entra ID group membership. Which TWO actions are required?

Accepted Answer

Create a security policy that uses a predicate function.. Option C is correct because implementing RLS in Azure SQL Database requires creating a security policy with CREATE SECURITY POLICY that binds a predicate function to the target table, which is what actually enforces the row filtering. Option E is correct because the predicate function (typically an inline table-valued function) must contain the filtering logic that checks the user's Microsoft Entra ID group membership, for example via IS_MEMBER() or similar, to determine which rows the user can see. Option A is incorrect because a column master key is used for Always Encrypted to protect column encryption keys, not for row-level security. Option B is incorrect because db_securityadmin is a database role, not a server role, and RLS setup requires permissions such as ALTER on the schema/table and CREATE SECURITY POLICY, not that role. Option D is incorrect because dynamic data masking obscures column values in query results but does not filter rows based on user identity, which is the requirement here.

Answer

Create a column master key for the secured columns.

Answer

Grant the user the db_securityadmin server role.

Answer

Apply a dynamic data masking rule to hide sensitive columns.

Question 12

Your organization has a compliance requirement to automatically classify and protect sensitive data in Azure SQL Database. You need to configure Microsoft Purview to scan and classify the database. Which THREE actions are required?

Accepted Answer

Run a scan to discover and classify sensitive data.. Option C is correct because the Azure SQL Database must first be registered as a data source in Microsoft Purview before any scanning or classification can occur. Option B is correct because a scan rule set defines which classification rules (such as built-in or custom sensitive information types) are applied during the scan to identify sensitive data. Option A is correct because running the scan is the action that actually discovers and classifies sensitive data using the configured rule set. Option D is not required because Microsoft Purview uses its managed identity to authenticate to the data source, not a user-created Microsoft Entra ID application. Option E is not required because Microsoft Defender for SQL provides threat protection and vulnerability assessment, not Purview-based data classification.

Answer

Create a Microsoft Entra ID application and grant it access to the database.

Answer

Enable Microsoft Defender for SQL to automatically classify data.

Question 13

You are configuring a new Azure SQL Database for a multi-tenant SaaS application. You need to ensure that each tenant can only access their own rows. Which THREE features can be used to achieve this?

Accepted Answer

Row-Level Security (RLS) with a predicate function.. Row-Level Security (RLS) with a predicate function (B) is correct because it enforces tenant isolation at the database engine level: a security policy with an inline table-valued function using SESSION_CONTEXT() or USER_NAME() automatically filters rows so each tenant sees only their own data regardless of the query issued. Application logic that filters queries by tenant ID (C) is correct because adding a tenant-ID predicate to every query (typically parameterized and driven by the authenticated tenant context) restricts result sets to the current tenant, and this is a valid, commonly layered approach for multi-tenant isolation. A view that includes a WHERE clause filtering by tenant ID (E) is correct because exposing tenants only through such a view restricts the rows they can retrieve, and the view can reference the tenant identifier from SESSION_CONTEXT() or a mapped user to enforce the filter. Always Encrypted with deterministic encryption (A) is not correct because it protects data confidentiality at rest and in transit but does not restrict which rows a tenant can query. Dynamic Data Masking for the tenant ID column (D) is not correct because masking only obfuscates displayed values and does not prevent access to other tenants' rows.

Answer

Always Encrypted with deterministic encryption.

Answer

Dynamic Data Masking for the tenant ID column.

Question 14

Your Azure SQL Database uses Always Encrypted to protect sensitive columns. You need to allow a reporting application to query encrypted columns without having access to the column encryption key. What should you configure?

Accepted Answer

Enable Always Encrypted with secure enclaves (Intel SGX) and create an enclave-enabled key.. Enabling Always Encrypted with secure enclaves (Intel SGX) allows the reporting application to perform computations on encrypted columns (e.g., equality, pattern matching) without ever exposing the column encryption key to the application. The enclave decrypts the data inside a trusted execution environment, so the application only sees the results of queries, not the raw encryption keys. This meets the requirement of querying encrypted columns without key access.

Answer

Rotate the column master key to a hardware security module (HSM).

Answer

Remove the Always Encrypted configuration from the columns.

Answer

Provide the application with the column master key and column encryption key.

Question 15

You are reviewing the encryption protector for an Azure SQL Server as shown in the exhibit. The server hosts multiple databases. You need to ensure that the databases are encrypted using the customer-managed key from Azure Key Vault. However, you find that the databases are not using this key. What is the most likely reason?

Accepted Answer

The databases still have the service-managed key as protector and need to be updated.. The exhibit shows that the server's encryption protector is set to a customer-managed key from Azure Key Vault, but this setting only applies to newly created databases. Existing databases retain their original encryption protector, which is typically the service-managed key. To enforce the customer-managed key on existing databases, you must manually update each database's encryption protector using the ALTER DATABASE ENCRYPTION KEY statement or through the Azure portal. Option C correctly identifies that the databases still have the service-managed key as protector and need to be updated.

Answer

The key version '123456' is incorrect.

Answer

The key vault is in a different subscription and not accessible.

Answer

The 'serverKeyName' property is not set correctly.