DP-300 Implement a secure environment Practice Test 6 — 15 Questions

Question 1

You are a database administrator for an Azure SQL Managed Instance. You need to ensure that all connections to the instance use encrypted connections. What should you configure?

Accepted Answer

Set the 'Force Encryption' option to Yes on the server properties.. Setting 'Force Encryption' to Yes on the Azure SQL Managed Instance server properties enforces the use of TLS (Transport Layer Security) for all client connections. This configuration ensures that any client attempting to connect without encryption will be rejected, thereby meeting the requirement that all connections use encrypted connections. The setting is applied at the instance level and overrides client-side encryption preferences.

Answer

Enable Transparent Data Encryption (TDE).

Answer

Enable Always Encrypted for sensitive columns.

Answer

Configure a firewall rule to allow only specific IP addresses.

Question 2

Which TWO actions should you take to implement a secure environment for Azure SQL Database that meets the principle of least privilege?

Accepted Answer

Assign database roles instead of individual permissions.. Assigning database roles instead of individual permissions (Option A) aligns with the principle of least privilege by grouping necessary permissions into predefined roles, reducing the risk of over-privileging and simplifying permission management. Contained database users with Azure AD authentication (Option C) eliminate the dependency on server-level logins, allowing authentication at the database level and enabling fine-grained access control without granting server-wide privileges.

Answer

Enable all database features for maximum functionality.

Answer

Use server-level logins for all users.

Answer

Grant the db_owner role to all application users.

Question 3

Which TWO of the following are required to enable Microsoft Defender for SQL for Azure SQL Database?

Accepted Answer

Configure a Log Analytics workspace.. Microsoft Defender for SQL requires a Log Analytics workspace to store security alerts and vulnerability assessment data. Option E is correct because Microsoft Defender for SQL must be enabled at the subscription level via Microsoft Defender for Cloud, which provides the security center integration. Options B, C, and D are not required for enabling Defender for SQL: Azure SQL Database auditing is separate, SQL Server Agent is not needed, and Azure Key Vault is for encryption key management, not a prerequisite for Defender for SQL.

Answer

Enable Azure SQL Database auditing.

Answer

Enable SQL Server Agent.

Answer

Configure an Azure Key Vault for storing encryption keys.

Question 4

You have an Azure SQL Database that stores sensitive customer data. You need to ensure that the data is encrypted at rest using a customer-managed key stored in Azure Key Vault. What should you configure?

Accepted Answer

Enable Transparent Data Encryption (TDE) with a customer-managed key from Azure Key Vault.. Transparent Data Encryption (TDE) with a customer-managed key stored in Azure Key Vault encrypts the database at rest, using a key that you control and rotate independently. This meets the requirement for encryption at rest with a customer-managed key, as TDE performs real-time I/O encryption and decryption of the data and log files without requiring application changes.

Answer

Configure dynamic data masking (DDM).

Answer

Implement row-level security (RLS) to restrict access.

Answer

Enable Always Encrypted for the sensitive columns.

Question 5

You are a database administrator for Azure SQL Managed Instance. You need to configure a custom time zone for the instance because the application uses a specific time zone. What should you do?

Accepted Answer

Use ALTER INSTANCE SET TIMEZONE to set the desired time zone.. Azure SQL Managed Instance runs on top of a Windows operating system, and the time zone for the entire instance is controlled at the host level. The `ALTER INSTANCE SET TIMEZONE` command is the correct T-SQL method to change the time zone for the instance, which then applies to all databases within that instance. This command allows you to set a custom time zone that the application requires, without needing to deploy a separate VM or configure each database individually.

Answer

Deploy a virtual machine running SQL Server instead.

Answer

Set the time zone for each database using ALTER DATABASE.

Answer

Configure the time zone in the Azure portal under the instance settings.

Question 6

You need to ensure that only specific Azure services can access your Azure SQL Database server. You want to allow traffic from Azure services but block all other traffic. What should you configure?

Accepted Answer

Set the firewall rule 'Allow Azure Services and resources to access this server' to ON and remove all other IP rules.. Setting the 'Allow Azure Services and resources to access this server' firewall rule to ON enables a special rule that permits traffic from all Azure datacenter IP ranges, while removing all other IP rules ensures no other external traffic can reach the server. This configuration meets the requirement to allow only Azure services and block all other traffic, as the Azure services rule is a blanket allow for Azure-originated connections without needing specific IP addresses.

Answer

Set the firewall rule 'Allow Azure Services and resources to access this server' to OFF and add a rule for 0.0.0.0.

Answer

Set firewall rules to deny all IP addresses.

Answer

Set the firewall rule 'Allow Azure Services and resources to access this server' to ON and add a rule for 0.0.0.0.

Question 7

Which THREE of the following are best practices for managing keys in Azure Key Vault for use with Azure SQL Database TDE?

Accepted Answer

Enable soft-delete and purge protection on the Key Vault.. Enabling soft-delete and purge protection on the Key Vault is a best practice because soft-delete retains deleted keys for a configurable retention period (default 90 days), allowing recovery if a key is accidentally deleted. Purge protection prevents permanent deletion of keys even after the soft-delete retention period expires, which is critical for TDE because if the key is permanently lost, the encrypted database becomes inaccessible. Together, these features ensure that the TDE protector key is never irrevocably lost, maintaining database recoverability and compliance.

Answer

Store the Key Vault in the same resource group as the SQL server.

Answer

Disable Key Vault auditing to reduce costs.

Question 8

Your company plans to use Azure SQL Managed Instance for a mission-critical application. You need to ensure that all connections to the database are encrypted and that the server's identity is verified. Which configuration should you enforce?

Accepted Answer

Set 'Force Encryption' = ON and 'Trust Server Certificate' = OFF. Setting 'Force Encryption' = ON ensures that all connections to Azure SQL Managed Instance use TLS encryption, while setting 'Trust Server Certificate' = OFF forces the client to validate the server's certificate against a trusted certificate authority (CA). This combination guarantees both data-in-transit encryption and server identity verification, meeting the requirement for a mission-critical application.

Answer

Set 'Force Encryption' = OFF and 'Trust Server Certificate' = OFF

Answer

Set 'Force Encryption' = ON and 'Trust Server Certificate' = ON

Answer

Set 'Force Encryption' = OFF and 'Trust Server Certificate' = ON

Question 9

Which TWO actions are required to enable Microsoft Entra ID authentication for Azure SQL Database?

Accepted Answer

Set an Microsoft Entra ID administrator for the logical server. Setting a Microsoft Entra ID administrator for the logical server (Option A) is required because it establishes the Entra ID tenant as an identity provider for the Azure SQL Database logical server, enabling token-based authentication. Creating a contained database user mapped to an Entra ID identity (Option D) is required because Azure SQL Database uses contained database users for authentication, where the user is authenticated directly against the database without requiring a login in the master database. These two actions together allow Entra ID users to authenticate to the database using their cloud identities.

Answer

Create a login in the master database for each Entra ID user

Answer

Assign a system-assigned managed identity to the logical server

Answer

Enable 'contained database authentication' on the server

Question 10

Refer to the exhibit. You are deploying an Azure SQL Database audit policy using an ARM template. What is the MOST significant security concern with the configuration shown?

Accepted Answer

The storage account access key is exposed in the template. The ARM template exposes the storage account access key in plaintext as a parameter value. This is a critical security concern because anyone with access to the template (e.g., in source control or deployment logs) can retrieve the key and gain unrestricted access to the storage account, including reading, modifying, or deleting audit logs. Azure SQL Database audit policies should use managed identities or Azure AD authentication to avoid embedding secrets.

Answer

Enabling Azure Monitor target could allow unauthorized access to logs

Answer

Retention of 90 days may be too short for compliance

Answer

Including successful authentication events may expose sensitive login activity

Question 11

You are implementing a new Azure SQL Database and need to ensure that connections from client applications are encrypted using TLS 1.2 or higher. Which server-level firewall rule setting should you configure?

Accepted Answer

Set minimal TLS version to 1.2. The 'Minimal TLS version' server-level firewall rule setting enforces the minimum TLS version for encrypted connections to Azure SQL Database. By setting this to 1.2, the server will reject any connection attempts using TLS 1.0 or 1.1, ensuring all client applications use TLS 1.2 or higher. This setting is configured in the Azure portal under the 'Networking' blade of the SQL server resource.

Answer

Deny public network access

Answer

Enable contained database authentication

Answer

Allow Azure Services and resources to access this server

Question 12

Your organization has a regulatory requirement to audit all data modifications in an Azure SQL Database. You enable Azure SQL Database auditing and configure it to send logs to a Log Analytics workspace. However, you notice that DELETE operations on a specific table are not being audited. What is the most likely cause?

Accepted Answer

The audit action group does not include 'DATABASE_OPERATION_GROUP'. Azure SQL Database auditing uses audit action groups to define which operations are logged. By default, the audit policy includes 'SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP', 'FAILED_DATABASE_AUTHENTICATION_GROUP', and 'BATCH_COMPLETED_GROUP', but 'DATABASE_OPERATION_GROUP' is required to capture DDL and DML operations like DELETE. If this group is not explicitly added to the audit specification, DELETE operations on specific tables will not be recorded, even though general auditing is enabled.

Answer

The diagnostic settings for the database are misconfigured

Answer

Audit logs are being written to a storage account instead of Log Analytics

Answer

The table has been configured to ignore auditing for read operations

Question 13

Which THREE security features are available in Azure SQL Database to protect data at rest?

Accepted Answer

Transparent Data Encryption (TDE) with customer-managed keys. Transparent Data Encryption (TDE) with customer-managed keys (Option A) protects data at rest by encrypting the database files and backups using a key stored in Azure Key Vault, giving the customer full control over key rotation and revocation. TDE with service-managed keys (Option C) also encrypts data at rest but uses a key managed by Azure, which is simpler but offers less control. Always Encrypted with secure enclaves (Option E) protects sensitive data at rest by encrypting columns with keys that are never revealed to the database engine, and the secure enclave allows computations on encrypted data, ensuring data remains encrypted even during processing.

Answer

Dynamic Data Masking

Answer

Row-Level Security

Question 14

Refer to the exhibit. You are configuring a backup retention policy for an Azure SQL Database via ARM template. You need to ensure that point-in-time restore (PITR) is available for the maximum supported period. What is the issue with the current configuration?

Accepted Answer

The retentionDays value exceeds the maximum supported retention period. The exhibit shows retentionDays set to 40 days, but the maximum supported retention period for point-in-time restore (PITR) in Azure SQL Database is 35 days. Therefore, the configuration is invalid because it exceeds the maximum. Option A is incorrect because the minimum retention is 7 days, so 40 days is above the minimum. Option C is incorrect: diffBackupIntervalInHours of 12 is a supported value (12 or 24). Option D is incorrect because geo-redundant storage is not required for PITR; it is a separate backup option.

Answer

The retentionDays value is set below the minimum requirement

Answer

The diffBackupIntervalInHours value is not a supported value

Answer

The backup policy does not specify a geo-redundant storage option

Question 15

Your company uses Azure SQL Database and needs to restrict access to a specific column containing credit card numbers. Only users with the 'CreditCardViewer' role should see the full number; others should see only the last four digits. Which feature should you implement?

Accepted Answer

Dynamic Data Masking. Dynamic Data Masking (DDM) is the correct choice because it allows you to obfuscate sensitive data in query results without changing the underlying database. You can define a mask on the credit card column that shows only the last four digits to users without the 'CreditCardViewer' role, while users with that role can be granted the UNMASK permission to see the full value.

Answer

Always Encrypted

Answer

Row-Level Security

Answer

Column-level security with GRANT