DP-300 Implement a secure environment Practice Test 6 — 15 Questions

Question 1

Your company uses Azure SQL Database with Microsoft Entra ID authentication. You need to ensure that only users with specific Azure AD roles can access the database. What should you configure?

Accepted Answer

Create contained database users mapped to Azure AD identities and grant appropriate permissions.. Azure SQL Database supports contained database users mapped to Microsoft Entra ID identities, which allows you to grant granular permissions (e.g., db_datareader, db_owner) to specific Microsoft Entra ID users or groups. This ensures that only those with the appropriate Microsoft Entra ID roles (via group membership or direct assignment) can access the database, without relying on SQL Server logins or firewall rules.

Answer

Configure an Azure SQL Database firewall rule to allow only Azure AD IP addresses.

Answer

Assign the SQL Server Contributor role to Azure AD users.

Answer

Create SQL authenticated users with strong passwords.

Question 2

Your Azure SQL Managed Instance stores sensitive financial data. You must prevent unauthorized access from Azure services and ensure that only specific virtual networks can connect. You also need to audit all failed login attempts. Which combination of configurations should you implement?

Accepted Answer

Create a private endpoint, set 'Public network access' to 'Deny', and enable Azure SQL Auditing with a log analytics workspace.. Creating a private endpoint for Azure SQL Managed Instance ensures that traffic to the instance traverses the Microsoft backbone network and is only accessible from within the specified virtual network. Setting 'Public network access' to 'Deny' explicitly blocks all public internet traffic, including traffic from other Azure services that do not originate from the approved VNet. Enabling Azure SQL Auditing with a Log Analytics workspace captures all failed login attempts, meeting the audit requirement. This combination directly addresses the need to prevent unauthorized access from Azure services and enforce VNet-only connectivity while auditing failed logins.

Answer

Enable Microsoft Defender for SQL and set up anomaly detection alerts.

Answer

Enable SQL vulnerability assessment and configure email notifications.

Answer

Configure VNet service endpoints and set the firewall to allow only your VNet.

Question 3

Refer to the exhibit. You are reviewing the firewall rule JSON for an Azure SQL Server. What does this rule allow?

Accepted Answer

No traffic; this rule blocks all incoming connections.. This rule is a firewall rule with start IP address '0.0.0.0' and end IP address '0.0.0.0', which in Azure SQL Server firewall configuration explicitly blocks all incoming traffic. The IP range 0.0.0.0 to 0.0.0.0 is a special reserved range that denies any connection attempts, regardless of source IP. This is the default behavior when no other allow rules exist, effectively creating a deny-all rule.

Answer

All traffic from any IP address.

Answer

Traffic from IP address 0.0.0.0.

Answer

Traffic from Azure services.

Question 4

Refer to the exhibit. You are reviewing the audit settings for an Azure SQL Database. What will this configuration do?

Accepted Answer

Audit logs are written to Azure Monitor (Log Analytics).. The exhibit shows that the audit destination is set to 'Log Analytics' (Azure Monitor), which means audit logs will be sent to a Log Analytics workspace. This configuration does not require a storage endpoint because Log Analytics is the designated target. Option B correctly identifies that audit logs are written to Azure Monitor (Log Analytics).

Answer

Auditing is disabled because no storage endpoint is provided.

Answer

Only failed authentication attempts are audited.

Answer

Audit logs are written to an Azure Storage account.

Question 5

You have an Azure SQL Database that contains sensitive customer data. You need to classify the data and receive recommendations for protecting it. You also need to detect and alert on suspicious access patterns. Which two Azure services should you enable? (Choose two.)

Accepted Answer

Microsoft Defender for SQL. Microsoft Defender for SQL (C) is correct because it provides Advanced Threat Protection for Azure SQL Database, detecting anomalous and suspicious access patterns (such as SQL injection attempts, access from unusual locations, or brute-force attacks) and raising security alerts in Microsoft Defender for Cloud. Microsoft Purview Data Map (D) is correct because it performs automated data discovery and classification of sensitive data across Azure SQL Database, labeling columns with sensitivity classifications and surfacing recommendations for protecting that data. Microsoft Sentinel (A) is a SIEM/SOAR platform for correlating and investigating security events across many sources, but it does not itself classify SQL data or generate data-protection recommendations. Azure Information Protection (B) is a client-side labeling and protection tool for documents and emails, not for classifying data inside Azure SQL Database. Azure Policy (E) enforces governance rules and compliance at the resource/control-plane level, but it does not classify data or detect suspicious data-plane access patterns.

Answer

Microsoft Sentinel

Answer

Azure Information Protection

Answer

Azure Policy

Question 6

You are configuring Azure SQL Database firewall rules. Which THREE actions require the 'Allow Azure services and resources to access this server' setting to be enabled? (Choose three.)

Accepted Answer

Azure Data Factory using a self-hosted integration runtime.. Options A, D, and E are correct because they all involve Azure-hosted resources that need to reach Azure SQL Database through its public endpoint, which is exactly what the 'Allow Azure services and resources to access this server' setting permits. A (Azure Data Factory using a self-hosted integration runtime) is correct because the self-hosted IR runs outside Azure but the Data Factory service itself is an Azure resource that must be allowed through the server's firewall. D (Azure Logic App) is correct because Logic Apps is a multi-tenant Azure service whose outbound IPs are not guaranteed static, so enabling the setting is the supported way to grant access. E (Azure App Service) is correct for the same reason: App Service is an Azure PaaS service that can be allowed via this setting rather than by adding individual outbound IP addresses. Option B is not correct because an on-premises application with a static public IP should be allowed by creating a specific server-level firewall rule for that IP address. Option C is not correct because a private endpoint bypasses the public firewall entirely and uses a private IP within the virtual network, so the 'Allow Azure services' setting is irrelevant.

Answer

An on-premises application with a static public IP.

Answer

A virtual machine using a private endpoint.

Question 7

You need to ensure that all queries accessing a specific column containing credit card numbers are encrypted both at rest and in transit between the application and Azure SQL Database. Which THREE technologies should you implement? (Choose three.)

Accepted Answer

Enforce TLS 1.2 or higher for client connections. Option A is correct because enforcing TLS 1.2 or higher encrypts data in transit between the application and Azure SQL Database, protecting the credit card column while it travels over the network. Option B is correct because Always Encrypted encrypts the specific column at rest (and in memory) using a column encryption key stored in Azure Key Vault, ensuring only the client application can decrypt the credit card numbers. Option C is correct because Transparent Data Encryption (TDE) encrypts the database, backups, and log files at rest at the page level, satisfying the at-rest encryption requirement for the data store. Option D is not correct because Row-Level Security only restricts which rows a user can access and does not encrypt data. Option E is not correct because Dynamic Data Masking merely obscures data in query results and does not provide encryption at rest or in transit.

Answer

Row-Level Security

Answer

Dynamic Data Masking

Question 8

You have an Azure SQL Database that needs to be accessed by an application with a static public IP address. You want to allow only that IP address to connect. What should you configure?

Accepted Answer

Create a server-level firewall rule with the application's IP.. A server-level firewall rule explicitly allows inbound connections from a specific client IP address to the Azure SQL Database logical server. Since the application has a static public IP, configuring a server-level firewall rule with that IP is the simplest and most direct method to restrict access to only that address, while still using the public endpoint.

Answer

Create a virtual network rule for the database.

Answer

Create a private endpoint for the database.

Answer

Create a database-level firewall rule with the application's IP.

Question 9

You are the database administrator for a large e-commerce company. The company has an Azure SQL Database named SalesDB that stores sensitive customer data including credit card numbers and personal details. The security team has mandated the following requirements:

1. All customer credit card numbers must be encrypted at rest and in transit between the application and the database. The encryption keys must be stored in a hardware security module (HSM) managed by the company.
2. All access to the database must be authenticated using Microsoft Entra ID, and multi-factor authentication (MFA) must be enforced for all administrative users.
3. Any attempts to access the database from unusual geographic locations must be detected and automatically blocked for 24 hours.
4. All schema changes must be audited, and the audit logs must be sent to a central Log Analytics workspace for analysis.

Currently, the database uses SQL authentication, no encryption, and no auditing. You need to implement the required security controls with minimal downtime. What should you do?

Accepted Answer

Enable Always Encrypted for the credit card columns using Azure Key Vault Managed HSM for column master keys. Switch to Microsoft Entra ID authentication and configure Conditional Access policy to require MFA for administrators. Enable Microsoft Defender for SQL with anomaly detection and automatic blocking. Enable Azure SQL Auditing with Log Analytics destination.. It directly addresses all mandated requirements: Always Encrypted with Azure Key Vault Managed HSM ensures credit card numbers are encrypted at rest and in transit with customer-managed HSM keys; switching to Microsoft Entra ID authentication with a Conditional Access policy enforces MFA for administrators; Microsoft Defender for SQL provides anomaly detection that can automatically block access from unusual geographic locations for 24 hours; and Azure SQL Auditing configured to send logs to Log Analytics meets the central audit requirement. This combination provides the required security controls with minimal downtime as Always Encrypted can be enabled online.

Answer

Enable Always Encrypted for the credit card columns with keys stored in Azure Key Vault. Keep SQL authentication but require users to use MFA via a VPN. Enable TDE for at-rest encryption.

Answer

Enable Transparent Data Encryption (TDE) with a customer-managed key in Azure Key Vault. Configure Azure SQL Auditing to send logs to Log Analytics. Enable Microsoft Defender for SQL.

Answer

Use Dynamic Data Masking to mask credit card numbers. Enable TDE and use Azure SQL Auditing with a storage account. Enable Microsoft Defender for SQL.

Question 10

Your company uses Azure SQL Managed Instance and requires that all connections from client applications use Microsoft Entra authentication with multi-factor authentication (MFA). You configure Azure SQL Managed Instance to support Microsoft Entra authentication and create a contained database user for the application. However, when the application attempts to connect, it receives error '18456, state 10' indicating that the login is not recognized. What is the most likely cause?

Accepted Answer

The application is using a SQL login instead of a Microsoft Entra token or integrated authentication.. Error 18456, state 10 specifically indicates that the login was not recognized by SQL Server. Since the application is configured to use a contained database user with Microsoft Entra authentication, the most likely cause is that the application is attempting to connect using a SQL login (username/password) rather than presenting a Microsoft Entra access token or using integrated authentication. Contained database users require authentication through the Microsoft Entra ID token flow, not SQL Server authentication.

Answer

The contained database user is not mapped to a server-level login.

Answer

The client IP address is not allowed by the server-level firewall rule.

Answer

The server principal (server admin) is not a Microsoft Entra account.

Question 11

You are the database administrator for a healthcare organization that uses Azure SQL Database. You need to implement column-level encryption for sensitive patient data (e.g., Social Security numbers) using Always Encrypted. The application connecting to the database is a .NET application running on Azure Virtual Machines. The application should be able to perform parameterized queries on encrypted columns without revealing the plaintext to the database. Which configuration is essential for this setup?

Accepted Answer

Use Always Encrypted with secure enclaves and configure the enclave attestation URL.. The scenario requires the application to perform parameterized queries on encrypted columns without revealing plaintext to the database. Always Encrypted with secure enclaves allows rich computations (e.g., equality, pattern matching) on encrypted data inside a hardware-based enclave, and the enclave attestation URL is essential to verify the enclave's integrity. Without the enclave, Always Encrypted only supports equality comparisons and cannot handle parameterized queries that require operations like LIKE or range checks on encrypted columns.

Answer

Store the column master key in Azure Key Vault and configure the application to retrieve it.

Answer

Implement dynamic data masking on the columns containing Social Security numbers.

Answer

Enable Transparent Data Encryption (TDE) on the database.

Question 12

You are reviewing an Azure SQL Database audit policy configuration. The policy is set to audit successful and failed database authentication events. You notice that audit logs are being written to both Azure Blob Storage and Azure Monitor. However, you are concerned about security of the storage account access key in the policy. What is the recommended approach to securely reference the storage account?

Accepted Answer

Configure the server's system-assigned managed identity and grant it access to the storage account.. Using a system-assigned managed identity for the Azure SQL Database logical server eliminates the need to store a storage account access key in the audit policy configuration. Managed identities provide a secure, Microsoft Entra ID-backed identity that can be granted specific permissions (e.g., Storage Blob Data Contributor) on the storage account, ensuring that access is controlled via RBAC rather than a static key. This approach aligns with security best practices by removing the risk of key exposure or rotation failures.

Answer

Remove the storageAccountAccessKey property and rely on the storage endpoint.

Answer

Use a different storage account with a key that expires daily.

Answer

Disable the Azure Monitor destination and only use Blob Storage.

Question 13

Your company has an Azure SQL Database that stores financial data. You need to implement auditing to track all data modifications (INSERT, UPDATE, DELETE) and schema changes (DDL). Which audit action group should you configure?

Accepted Answer

SCHEMA_OBJECT_CHANGE_GROUP and DATABASE_OBJECT_CHANGE_GROUP. To track all data modifications (INSERT, UPDATE, DELETE) and schema changes (DDL) in Azure SQL Database, you need to audit both data changes and schema changes. The SCHEMA_OBJECT_CHANGE_GROUP captures DDL changes like CREATE, ALTER, DROP on schema objects, while DATABASE_OBJECT_CHANGE_GROUP captures DML changes on database objects (tables, views). Together, they cover the required tracking. Option A is correct because these two action groups specifically target the stated requirements.

Answer

DATABASE_OBJECT_PERMISSION_CHANGE_GROUP and SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP

Answer

DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP and SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP

Answer

SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP and FAILED_DATABASE_AUTHENTICATION_GROUP

Question 14

Your organization uses Azure SQL Database and wants to implement a defense-in-depth strategy. You have already enabled Transparent Data Encryption (TDE) and firewall rules. You need to add an additional layer of security that protects against unauthorized access to the physical storage files (e.g., if someone gains access to the storage account). What should you enable?

Accepted Answer

Infrastructure encryption (double encryption) using platform-managed keys. Infrastructure encryption (double encryption) using platform-managed keys adds a second layer of encryption at the storage infrastructure level, below the TDE layer. This protects data at rest even if the physical storage files (e.g., Azure Storage blobs) are accessed directly, because the storage infrastructure itself is encrypted with a separate, platform-managed key. This fulfills the defense-in-depth requirement for protecting against unauthorized access to physical storage.

Answer

Dynamic Data Masking

Answer

Microsoft Defender for SQL

Answer

Always Encrypted with secure enclaves

Question 15

You are responsible for securing Azure SQL Managed Instance. You need to ensure that only encrypted connections are allowed and that all client connections use the latest TLS protocol. Which TWO configurations should you implement?

Accepted Answer

Set the 'Minimal TLS Version' to 1.2.. Option A is correct because setting the 'Minimal TLS Version' to 1.2 on Azure SQL Managed Instance enforces that clients negotiate at least TLS 1.2, which is the latest supported TLS protocol and blocks older, insecure versions like TLS 1.0 and 1.1. Option D is correct because enabling 'Force SSL' (the Proxy/Redirect connection policy's enforced encryption setting) rejects any unencrypted client connection, ensuring that only encrypted connections are allowed to the managed instance. Option B is incorrect because firewall rules restrict source IP addresses, not whether connections are encrypted or which TLS version is used. Option C is incorrect because Microsoft Defender for SQL provides threat detection and vulnerability assessment, not connection encryption enforcement. Option E is incorrect because Transparent Data Encryption encrypts data at rest (database, log, and backup files), not data in transit between clients and the instance.

Answer

Configure a firewall rule to allow only specific IP addresses.

Answer

Enable Microsoft Defender for SQL.

Answer

Enable Transparent Data Encryption (TDE).