DP-300 Implement a secure environment Practice Test 7 — 15 Questions

Question 1

Refer to the exhibit. You are configuring an Azure SQL Database security alert policy. What is the most significant misconfiguration?

Accepted Answer

The retentionDays is set to 0, which is not supported. The most significant misconfiguration is setting `retentionDays` to 0 because Azure SQL Database security alert policies require a retention period between 1 and 365 days. A value of 0 is invalid and will cause the policy to fail validation or be rejected, meaning the alert policy cannot be created or updated. This directly prevents the security alerts from being configured at all, making it a critical blocking issue.

Answer

Some alerts are disabled, which could leave the database vulnerable

Answer

Emailing account admins may not be sufficient for notification

Answer

Multiple email addresses are specified, which may cause duplicate notifications

Question 2

Your company is migrating an on-premises SQL Server database to Azure SQL Managed Instance. You need to ensure that the database is protected by Microsoft Defender for Cloud (formerly Azure Security Center) with advanced threat protection. What should you enable?

Accepted Answer

Enable Microsoft Defender for Cloud on the subscription or resource. Microsoft Defender for Cloud provides advanced threat protection for Azure SQL Managed Instance at the subscription or resource level. Enabling it on the subscription or the specific resource activates threat detection capabilities, including alerts for SQL injection, brute-force attacks, and anomalous access patterns, without requiring additional services.

Answer

Deploy Microsoft Sentinel and connect the SQL Managed Instance

Answer

Configure Microsoft Purview Data Map

Answer

Enable Azure SQL Database auditing

Question 3

Which THREE are valid methods to authenticate to Azure SQL Database using Microsoft Entra ID?

Accepted Answer

Microsoft Entra ID password authentication. Microsoft Entra ID password authentication allows users to authenticate to Azure SQL Database using their Entra ID credentials directly, without requiring Windows domain join or integrated authentication. This method uses the Entra ID access token flow, where the user provides their username and password to obtain a token from the Microsoft Entra ID endpoint, which is then used to connect to the database. It is a straightforward, cloud-native authentication method supported for contained database users mapped to Entra ID identities.

Answer

User-assigned managed identity without a contained database user

Answer

Azure CLI authentication

Question 4

Refer to the exhibit. You are deploying an Azure SQL Database with Transparent Data Encryption (TDE) enabled via ARM template. The database will contain highly sensitive data, and your security policy requires that the encryption key be managed by your organization using Azure Key Vault. What additional configuration is needed?

Accepted Answer

Set the 'keyVaultUri', 'keyName', and 'keyVersion' properties to reference the key in Key Vault. When deploying Azure SQL Database with TDE and customer-managed keys (CMK) via ARM template, you must explicitly specify the 'keyVaultUri', 'keyName', and 'keyVersion' properties under the 'encryptionProtector' resource to link the database to the specific key in Azure Key Vault. Without these properties, the template would only enable TDE with a service-managed key, not the required customer-managed key.

Answer

No additional configuration is needed; the template already enables TDE with customer-managed keys

Answer

Deploy a separate key rotation policy in the ARM template

Answer

Enable 'autoRotationEnabled' property

Question 5

You are responsible for an Azure SQL Database that stores customer personally identifiable information (PII). You need to ensure that users with the 'CustomerService' role can see only the last four digits of Social Security numbers. Which feature should you use?

Accepted Answer

Dynamic Data Masking with a partial mask function. Dynamic Data Masking (DDM) with a partial mask function is the correct choice because it allows you to obfuscate sensitive data at query time without altering the underlying storage. For a Social Security number, you can apply a mask like 'partial(0, "XXX-XX-", 4)' to expose only the last four digits to users in the 'CustomerService' role, while the full value remains intact in the database.

Answer

Row-Level Security

Answer

Column-level security with DENY permission on the column

Answer

Always Encrypted with deterministic encryption

Question 6

Your organization uses Azure SQL Database with Microsoft Entra ID authentication. You need to ensure that a specific user can only read data from the Sales schema. The user should not be able to modify any data. What should you do?

Accepted Answer

Create a contained user mapped to the Microsoft Entra identity, then grant SELECT on the Sales schema to the user, and deny SELECT on all other schemas.. It creates a contained database user mapped to the Microsoft Entra identity, then explicitly grants SELECT on the Sales schema. This ensures the user can read data only from that schema. Denying SELECT on all other schemas removes any implicit permissions (such as those from the public role) and enforces the least-privilege principle. This approach is schema-level permission control, which is more granular than fixed database roles.

Answer

Create a contained user mapped to the Microsoft Entra identity and add the user to the db_datareader role.

Answer

Create a contained user mapped to the Microsoft Entra identity and add the user to the db_denydatawriter role.

Answer

Create a contained user mapped to the Microsoft Entra identity and add the user to the db_datareader role, then deny SELECT on all schemas except Sales.

Question 7

You are the database administrator for a company that uses Azure SQL Managed Instance. The security team has detected unusual query activity from a specific client IP address. You need to immediately block all connections from that IP address while maintaining connectivity for all other users. Which solution should you implement?

Accepted Answer

Add a firewall rule at the managed instance level that denies the specific IP address.. Azure SQL Managed Instance supports instance-level firewall rules that can explicitly deny a specific client IP address while allowing all other traffic. Unlike Azure SQL Database, which uses server-level firewall rules, Managed Instance firewall rules are configured directly on the instance and can include both allow and deny entries, enabling granular access control without affecting other users.

Answer

Create a private endpoint for the managed instance and disable public network access.

Answer

Add a server-level firewall rule at the logical server level to deny the IP address.

Answer

Modify the network security group (NSG) associated with the managed instance's subnet to deny the IP address.

Question 8

Your company is migrating on-premises SQL Server databases to Azure SQL Database. As part of security compliance, you must ensure that all data at rest is encrypted using customer-managed keys stored in Azure Key Vault. Which Azure SQL Database feature should you enable?

Accepted Answer

Transparent Data Encryption with customer-managed keys in Azure Key Vault. Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault is the correct feature because it encrypts SQL Server, Azure SQL Database, and Azure Synapse data files at rest using a customer-controlled key stored in Azure Key Vault. This meets the compliance requirement for encrypting all data at rest with customer-managed keys, as TDE performs real-time I/O encryption and decryption of the database, backups, and transaction log files without requiring application changes.

Answer

Dynamic Data Masking

Answer

Always Encrypted

Answer

Row-Level Security

Question 9

Your company uses Azure SQL Database and requires that all connections use Azure Active Directory (now Microsoft Entra ID) authentication. You need to ensure that no SQL authentication logins exist in the database. What should you do?

Accepted Answer

Query sys.sql_logins to identify any SQL authentication logins and drop them.. The only way to ensure no SQL authentication logins exist in an Azure SQL Database is to query the `sys.sql_logins` system catalog view to identify any SQL-authenticated logins and then drop them. Azure SQL Database does not support a server-level property like `DisableSqlAuthentication` to block SQL authentication; instead, you must explicitly remove SQL logins to enforce exclusive use of Microsoft Entra ID authentication.

Answer

Set the server property 'DisableSqlAuthentication' to true.

Answer

Set the database property 'contained database authentication' to 0.

Answer

Use the Azure portal to set the firewall rule to block SQL authentication.

Question 10

You need to audit all failed login attempts to an Azure SQL Database. Which feature should you enable?

Accepted Answer

Azure SQL Auditing. Azure SQL Auditing is the correct feature because it tracks database events, including failed login attempts, and writes them to an audit log in an Azure Storage account, Log Analytics workspace, or Event Hubs. This allows you to review and analyze authentication failures for security and compliance purposes. The audit logs capture the exact timestamp, source IP address, and the specific error message for each failed login, such as 'Login failed for user'.

Answer

Azure SQL Advanced Threat Protection

Answer

Azure SQL Database Vulnerability Assessment

Answer

Dynamic Data Masking

Question 11

Your company has an Azure SQL Database that contains sensitive financial data. You need to ensure that database administrators cannot view the actual data while still being able to perform administrative tasks such as backups and index maintenance. Which feature should you implement?

Accepted Answer

Always Encrypted with column master key stored in Azure Key Vault. Always Encrypted with the column master key stored in Azure Key Vault ensures that sensitive data is encrypted at the client side and the encryption keys are never exposed to the database engine. This means database administrators (DBAs) can perform administrative tasks like backups and index maintenance on the encrypted columns without ever being able to view the plaintext data, because the SQL Server instance only sees ciphertext.

Answer

Row-Level Security

Answer

Dynamic Data Masking

Answer

Transparent Data Encryption

Question 12

You have an Azure SQL Database that uses a firewall rule allowing access from a specific range of IP addresses. A developer reports that they cannot connect from a new IP address that falls outside the allowed range. You need to temporarily allow the developer's IP address for 24 hours without affecting existing rules. What should you do?

Accepted Answer

Add a new firewall rule at the server level that allows the developer's IP address.. Azure SQL Database firewall rules are configured at the server level (the logical server) to control inbound access. Adding a new server-level firewall rule for the developer's specific IP address allows temporary access without modifying or removing the existing range-based rule. This approach is the standard method for granting time-limited access to a single IP while preserving all other firewall configurations.

Answer

Configure a point-to-site VPN connection for the developer.

Answer

Update the existing firewall rule to include the developer's IP address.

Answer

Modify the database-level firewall rule to include the developer's IP.

Question 13

Your organization uses Azure SQL Database and wants to automatically detect and alert on potential SQL injection attacks. Which Azure service should you enable?

Accepted Answer

Microsoft Defender for SQL. Microsoft Defender for SQL (option C) is the correct answer because it provides advanced SQL security capabilities, including a dedicated SQL injection detection engine that analyzes database activity patterns and alerts on suspicious queries. Unlike other options, Defender for SQL specifically monitors for SQL injection attempts by evaluating query anomalies and known attack signatures, making it the appropriate service for automatic detection and alerting.

Answer

Azure SQL Database Vulnerability Assessment

Answer

Azure SQL Auditing

Answer

Microsoft Sentinel

Question 14

Which TWO actions are valid for implementing column-level encryption in Azure SQL Database using Always Encrypted? (Choose two.)

Accepted Answer

Use randomized encryption for columns that will not be searched.. Always Encrypted supports two encryption types: deterministic and randomized. Randomized encryption is valid for columns that will not be searched because it encrypts the same plaintext into different ciphertexts each time, preventing pattern-based attacks. This makes it suitable for sensitive data like credit card numbers or personal identifiers that only need to be decrypted for use, not queried with equality predicates.

Answer

Store the column encryption key in the database.

Answer

Use a hash of the column value for encryption.

Answer

Encrypt an entire row by specifying a row-level encryption key.

Question 15

Which THREE actions are required to configure Microsoft Entra ID authentication for an Azure SQL Database? (Choose three.)

Accepted Answer

Set a Microsoft Entra ID administrator for the Azure SQL Database server.. Setting a Microsoft Entra ID administrator for the Azure SQL Database server is a mandatory step to enable Entra ID authentication at the server level. This action configures the server to accept authentication tokens from the specified Entra ID tenant and allows the creation of contained database users mapped to Entra identities.

Answer

Configure a firewall rule to allow connections from the Microsoft Entra ID service.

Answer

Ensure that SQL authentication is enabled as a fallback.