DP-300 Implement a secure environment Practice Test 7 — 15 Questions

Question 1

You are the database administrator for a company that uses Azure SQL Managed Instance. The security team has detected unusual query activity from a specific client IP address. You need to immediately block all connections from that IP address while maintaining connectivity for all other users. Which solution should you implement?

Accepted Answer

Add a firewall rule at the managed instance level that denies the specific IP address.. Option C is correct because Azure SQL Managed Instance supports instance-level firewall rules that can explicitly deny a specific client IP address while allowing all other traffic. Unlike Azure SQL Database, which uses server-level firewall rules, Managed Instance firewall rules are configured directly on the instance and can include both allow and deny entries, enabling granular access control without affecting other users.

Answer

Create a private endpoint for the managed instance and disable public network access.

Answer

Add a server-level firewall rule at the logical server level to deny the IP address.

Answer

Modify the network security group (NSG) associated with the managed instance's subnet to deny the IP address.

Question 2

Your company is migrating on-premises SQL Server databases to Azure SQL Database. As part of security compliance, you must ensure that all data at rest is encrypted using customer-managed keys stored in Azure Key Vault. Which Azure SQL Database feature should you enable?

Accepted Answer

Transparent Data Encryption with customer-managed keys in Azure Key Vault. Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault is the correct feature because it encrypts SQL Server, Azure SQL Database, and Azure Synapse data files at rest using a customer-controlled key stored in Azure Key Vault. This meets the compliance requirement for encrypting all data at rest with customer-managed keys, as TDE performs real-time I/O encryption and decryption of the database, backups, and transaction log files without requiring application changes.

Answer

Dynamic Data Masking

Answer

Always Encrypted

Answer

Row-Level Security

Question 3

You attempt to create a new Azure SQL Database server with public network access enabled. What will happen?

Accepted Answer

The creation will be denied because the policy prohibits public network access.. Azure Policy can enforce rules that restrict or deny the creation of Azure resources that do not meet specific compliance requirements. If a policy is in place that prohibits public network access for Azure SQL Database servers, the creation request will be denied at the Azure Resource Manager level before the server is provisioned. This is a common security control to enforce a private endpoint or deny public connectivity.

Answer

The server will be created, but an audit log will be generated.

Answer

The server will be created successfully with public network access enabled.

Answer

The server will be created, but the databases will be denied creation.

Question 4

Your company uses Azure SQL Database and requires that all connections use Azure Active Directory (now Microsoft Entra ID) authentication. You need to ensure that no SQL authentication logins exist in the database. What should you do?

Accepted Answer

Query sys.sql_logins to identify any SQL authentication logins and drop them.. Option D is correct because the only way to ensure no SQL authentication logins exist in an Azure SQL Database is to query the `sys.sql_logins` system catalog view to identify any SQL-authenticated logins and then drop them. Azure SQL Database does not support a server-level property like `DisableSqlAuthentication` to block SQL authentication; instead, you must explicitly remove SQL logins to enforce exclusive use of Microsoft Entra ID authentication.

Answer

Set the server property 'DisableSqlAuthentication' to true.

Answer

Set the database property 'contained database authentication' to 0.

Answer

Use the Azure portal to set the firewall rule to block SQL authentication.

Question 5

You need to audit all failed login attempts to an Azure SQL Database. Which feature should you enable?

Accepted Answer

Azure SQL Auditing. Azure SQL Auditing is the correct feature because it tracks database events, including failed login attempts, and writes them to an audit log in an Azure Storage account, Log Analytics workspace, or Event Hubs. This allows you to review and analyze authentication failures for security and compliance purposes. The audit logs capture the exact timestamp, source IP address, and the specific error message for each failed login, such as 'Login failed for user'.

Answer

Azure SQL Advanced Threat Protection

Answer

Azure SQL Database Vulnerability Assessment

Answer

Dynamic Data Masking

Question 6

Your company has an Azure SQL Database that contains sensitive financial data. You need to ensure that database administrators cannot view the actual data while still being able to perform administrative tasks such as backups and index maintenance. Which feature should you implement?

Accepted Answer

Always Encrypted with column master key stored in Azure Key Vault. Always Encrypted with the column master key stored in Azure Key Vault ensures that sensitive data is encrypted at the client side and the encryption keys are never exposed to the database engine. This means database administrators (DBAs) can perform administrative tasks like backups and index maintenance on the encrypted columns without ever being able to view the plaintext data, because the SQL Server instance only sees ciphertext.

Answer

Row-Level Security

Answer

Dynamic Data Masking

Answer

Transparent Data Encryption

Question 7

You have an Azure SQL Database that uses a firewall rule allowing access from a specific range of IP addresses. A developer reports that they cannot connect from a new IP address that falls outside the allowed range. You need to temporarily allow the developer's IP address for 24 hours without affecting existing rules. What should you do?

Accepted Answer

Add a new firewall rule at the server level that allows the developer's IP address.. Option C is correct because adding a new firewall rule for the specific IP address allows access without modifying existing rules. Option A is wrong because updating the existing range would change access for other IPs. Option B is wrong because modifying the server-level firewall rules is the correct approach but you should add, not modify. Option D is wrong because VPN is overkill and not a temporary solution.

Answer

Configure a point-to-site VPN connection for the developer.

Answer

Update the existing firewall rule to include the developer's IP address.

Answer

Modify the database-level firewall rule to include the developer's IP.

Question 8

Your organization uses Azure SQL Database and wants to automatically detect and alert on potential SQL injection attacks. Which Azure service should you enable?

Accepted Answer

Microsoft Defender for SQL. Microsoft Defender for SQL (option C) is the correct answer because it provides advanced SQL security capabilities, including a dedicated SQL injection detection engine that analyzes database activity patterns and alerts on suspicious queries. Unlike other options, Defender for SQL specifically monitors for SQL injection attempts by evaluating query anomalies and known attack signatures, making it the appropriate service for automatic detection and alerting.

Answer

Azure SQL Database Vulnerability Assessment

Answer

Azure SQL Auditing

Answer

Microsoft Sentinel

Question 9

Which TWO actions are valid for implementing column-level encryption in Azure SQL Database using Always Encrypted? (Choose two.)

Accepted Answer

Use randomized encryption for columns that will not be searched.. Always Encrypted supports two encryption types: deterministic and randomized. Randomized encryption is valid for columns that will not be searched because it encrypts the same plaintext into different ciphertexts each time, preventing pattern-based attacks. This makes it suitable for sensitive data like credit card numbers or personal identifiers that only need to be decrypted for use, not queried with equality predicates.

Answer

Store the column encryption key in the database.

Answer

Use a hash of the column value for encryption.

Answer

Encrypt an entire row by specifying a row-level encryption key.

Question 10

Which THREE actions are required to configure Microsoft Entra ID authentication for an Azure SQL Database? (Choose three.)

Accepted Answer

Set a Microsoft Entra ID administrator for the Azure SQL Database server.. Option B is correct because setting a Microsoft Entra ID administrator for the Azure SQL Database server is a mandatory step to enable Entra ID authentication at the server level. This action configures the server to accept authentication tokens from the specified Entra ID tenant and allows the creation of contained database users mapped to Entra identities.

Answer

Configure a firewall rule to allow connections from the Microsoft Entra ID service.

Answer

Ensure that SQL authentication is enabled as a fallback.

Question 11

Which TWO are valid methods for auditing Azure SQL Database activity? (Choose two.)

Accepted Answer

Azure Storage account. Option C is correct because Azure SQL Database auditing can write audit logs directly to an Azure Storage account, which is a supported destination for storing audit records in blob format. Option D is correct because audit logs can also be sent to a Log Analytics workspace, enabling integration with Azure Monitor for advanced querying and alerting on audit data.

Answer

Azure Event Grid

Answer

Azure Monitor Metrics

Answer

On-premises file share

Question 12

Which THREE are best practices for securing Azure SQL Database? (Choose three.)

Accepted Answer

Use Microsoft Entra ID authentication instead of SQL authentication.. Option A is correct because Microsoft Entra ID (formerly Azure AD) authentication provides centralized identity management, supports conditional access policies, and eliminates the need to manage SQL logins and passwords. It also enables features like multifactor authentication (MFA) and integration with Azure RBAC, which significantly reduces the risk of credential theft compared to SQL authentication.

Answer

Enable public network access to allow flexible connectivity.

Answer

Grant db_owner role to developers for ease of management.

Question 13

What will be the result of this command?

Accepted Answer

The database will log all successful and failed authentication attempts to the storage account for 90 days.. The command configures SQL Database auditing to send audit logs to an Azure Storage account. By default, when auditing is enabled with the AUDIT_SPECIFICATION set to AUDIT_ALL (or the default audit action group), both successful and failed authentication attempts are logged. The RETENTION_DAYS parameter set to 90 ensures logs are retained for 90 days before being automatically deleted. Option A correctly describes this behavior.

Answer

The database will log only failed authentication attempts to the storage account for 90 days.

Answer

The command will fail because the StorageAccountResourceId parameter is incorrect.

Answer

The command will enable auditing for the server rather than the database.

Question 14

What does this query return?

Accepted Answer

Failed login attempts to the database, including client IP and application name.. The query returns failed login attempts to the database, including client IP and application name. This is because the query filters for events where `action_id` = 'LGIF' (login failed) and `state` = 'ABORT' (indicating the login was aborted), and selects the `client_ip` and `application_name` columns from the `sys.dm_exec_sessions` DMV joined with `sys.dm_exec_connections` to capture client connection details. The `state` = 'ABORT' specifically identifies failed attempts, not successful logins or server-level events.

Answer

All security audit events for the database.

Answer

Failed login events at the server level.

Answer

Successful login events with client IP and application name.

Question 15

Your company has an Azure SQL Database that stores sensitive customer data. You need to ensure that data is encrypted at rest and in transit. The database is currently using Transparent Data Encryption (TDE) with service-managed keys. Compliance requirements now mandate that you use customer-managed keys stored in Azure Key Vault. Additionally, all connections must use encrypted connections. What should you do?

Accepted Answer

Configure the Azure SQL Server to use a customer-managed key from Azure Key Vault for TDE and set 'Encrypted connection' to 'Required' on the server.. Option B is correct because it directly addresses both requirements: using a customer-managed key from Azure Key Vault for TDE (which replaces the service-managed key) and enforcing encrypted connections by setting 'Encrypted connection' to 'Required' on the Azure SQL Server. This configuration ensures data at rest is encrypted with a key you control, and all client connections must use TLS encryption, meeting compliance mandates without requiring a new database or data migration.

Answer

Create a new Azure SQL Database with TDE enabled using a customer-managed key from Key Vault. Migrate data using SQL Server Management Studio (SSMS) with 'Encrypt connection' enabled.

Answer

Enable Transparent Data Encryption (TDE) with service-managed keys and set 'Minimum TLS version' to 1.2.

Answer

Implement Always Encrypted with keys stored in Azure Key Vault and set 'Encrypted connection' to 'Required' on the server.