DP-300 Implement a secure environment Practice Test 8 — 15 Questions

Question 1

You are the database administrator for a company that uses Azure SQL Managed Instance. You need to allow a specific application to connect to the database using a service principal. The application authenticates with Microsoft Entra ID. What should you configure?

Accepted Answer

Create a contained database user mapped to the Microsoft Entra service principal.. A contained database user mapped to a Microsoft Entra ID service principal allows the application to authenticate directly to the database using its Microsoft Entra identity, without requiring a SQL Server login. This is the correct approach because Azure SQL Managed Instance supports Microsoft Entra authentication for service principals, enabling token-based authentication from applications that authenticate with Microsoft Entra ID.

Answer

Enable Always Encrypted and configure column master key with the service principal.

Answer

Add a server-level firewall rule with the application's IP address.

Answer

Create a SQL authentication login and user for the application.

Question 2

Your company uses Azure SQL Database with Elastic Jobs to run maintenance scripts. You need to ensure that the Elastic Job agent can connect to the target databases securely. The agent runs in an Azure virtual network and uses a managed identity. The target databases are in a different Azure region and have public endpoint disabled. What is the most secure way to connect the Elastic Job agent to the target databases?

Accepted Answer

Configure a private endpoint for each target database and grant the Elastic Job agent's managed identity access to the databases via a contained database user.. Option B is correct because it combines Azure Private Link (private endpoint) for network-level isolation with managed identity for authentication, eliminating exposure to the public internet and removing the need for passwords. The Elastic Job agent's managed identity is mapped to a contained database user in each target database, enabling secure, passwordless connections even across regions when public endpoints are disabled.

Answer

Use virtual network service endpoints to allow the agent's subnet to connect to the target databases.

Answer

Add the agent's public IP address to the target database firewall rules.

Answer

Create a SQL authentication login for the Elastic Job agent and use that in the job credentials.

Question 3

You are responsible for security compliance of Azure SQL databases. You need to audit all successful and failed login attempts and store the audit logs in a Log Analytics workspace for analysis. You also want to detect potential brute-force attacks. What should you implement?

Accepted Answer

Enable Azure SQL Auditing for the server, configure the audit log destination to Log Analytics, and enable Microsoft Sentinel for threat detection.. Option C is correct because Azure SQL Auditing captures both successful and failed login attempts (audit logs) and can be configured to send them directly to a Log Analytics workspace for centralized analysis. Microsoft Sentinel, when enabled, provides built-in analytics rules to detect brute-force attacks by correlating failed login patterns across time and IP addresses, fulfilling the threat detection requirement.

Answer

Configure Azure Policy to enforce auditing on all SQL databases in the subscription.

Answer

Enable SQL Vulnerability Assessment and schedule recurring scans.

Answer

Enable Advanced Threat Protection (ATP) for Azure SQL Database.

Question 4

Your organization uses Azure SQL Database and wants to restrict access to only specific Azure services and on-premises IP addresses. The database has a public endpoint. Which two security features should you configure?

Accepted Answer

Enable 'Allow Azure services and resources to access this server' in the firewall settings.. Option A is correct because enabling 'Allow Azure services and resources to access this server' in the Azure SQL Database firewall settings permits traffic from all Azure datacenters, effectively allowing other Azure services (e.g., Azure App Service, Azure Functions) to connect to the database. Option C is correct because configuring firewall rules to allow specific on-premises IP ranges restricts inbound traffic to only those IP addresses, meeting the requirement to allow on-premises access while blocking others.

Answer

Enable Always Encrypted with secure enclaves.

Answer

Create a virtual network service endpoint for SQL.

Answer

Configure a private endpoint for the database.

Question 5

You have an Azure SQL Managed Instance that needs to be accessed from an on-premises application. The connection must be encrypted and the on-premises network uses an ExpressRoute circuit. You need to configure the managed instance to only accept connections from the on-premises network. What should you do?

Accepted Answer

Connect the on-premises network to the managed instance's virtual network using ExpressRoute and configure network security group (NSG) rules to restrict inbound traffic to the on-premises subnet.. Option C is correct because Azure SQL Managed Instance is deployed into a virtual network, and the most secure way to allow only on-premises traffic is to extend the on-premises network into that VNet via ExpressRoute (private peering) and then use Network Security Group (NSG) rules to restrict inbound connections to only the on-premises subnet. This ensures the connection remains private, encrypted (via the ExpressRoute circuit), and does not expose a public endpoint.

Answer

Enable a public endpoint and restrict access using a firewall rule.

Answer

Configure a server-level firewall rule to allow the on-premises IP range.

Answer

Create a private endpoint for the managed instance and configure DNS.

Question 6

Your company uses Azure SQL Database and needs to protect sensitive columns (e.g., credit card numbers) from being accessed by unauthorized users. You implement Always Encrypted. However, some queries that perform pattern matching on the encrypted column are failing because the column cannot be searched. What should you do to allow pattern matching while maintaining security?

Accepted Answer

Enable Always Encrypted with secure enclaves and use a column master key that supports enclave computations.. Always Encrypted with secure enclaves allows computations, including pattern matching (LIKE, equality, comparisons), on encrypted columns by using a trusted execution environment (e.g., Intel SGX). The column master key must support enclave computations (enclave-enabled key) to permit the SQL Server engine to offload operations to the enclave. This preserves encryption at rest and in transit while enabling rich query patterns.

Answer

Implement row-level security (RLS) to filter rows based on user identity.

Answer

Change the encryption type from randomized to deterministic encryption.

Answer

Use Dynamic Data Masking (DDM) to mask the column for unauthorized users instead of encryption.

Question 7

You are deploying Azure SQL Database for a multi-tenant application. Each tenant's data must be isolated. You need to ensure that tenants cannot access each other's data even if there is a SQL injection vulnerability. Which security feature should you implement?

Accepted Answer

Implement row-level security (RLS) with a security policy that filters rows by tenant ID.. Row-level security (RLS) is the correct choice because it enforces data isolation at the database engine level by filtering rows based on a tenant ID predicate. Even if a SQL injection vulnerability allows an attacker to execute arbitrary queries, RLS ensures that only rows belonging to the attacker's tenant are returned, preventing cross-tenant data access. This is a defense-in-depth measure that works regardless of application-layer flaws.

Answer

Use Always Encrypted to encrypt sensitive columns.

Answer

Configure Azure SQL Database auditing to monitor cross-tenant access.

Answer

Enable Transparent Data Encryption (TDE) on the database.

Question 8

Your company uses Azure SQL Database and wants to automatically detect and alert on potential SQL injection attacks. Which Azure service should you enable?

Accepted Answer

Microsoft Defender for Cloud (formerly Azure Security Center) with Advanced Threat Protection for Azure SQL Database. Microsoft Defender for Cloud with Advanced Threat Protection for Azure SQL Database is the correct choice because it specifically detects anomalous activities indicating SQL injection attempts, such as unusual SQL queries or patterns, and triggers security alerts. Azure SQL Auditing only logs database events for compliance and forensic analysis, not real-time threat detection. SQL Vulnerability Assessment identifies configuration weaknesses but does not monitor for active attacks. Azure Policy enforces compliance rules but lacks intrusion detection capabilities.

Answer

Azure SQL Auditing

Answer

SQL Vulnerability Assessment

Answer

Azure Policy

Question 9

You have an Azure SQL Database that stores personally identifiable information (PII). You need to classify and label the sensitive columns using Microsoft Purview. Additionally, you want to automatically mask these columns for a specific application user. Which two actions should you take? (Choose two.)

Accepted Answer

Apply Dynamic Data Masking (DDM) rules to mask the classified columns for the application user.. Option A is correct because Dynamic Data Masking (DDM) can be applied to classified columns to obfuscate sensitive data for a specific application user without altering the underlying data. DDM rules are defined at the column level and can be configured to mask data for designated users while allowing full access to others, meeting the requirement to automatically mask PII for the application user.

Answer

Enable Always Encrypted on the classified columns.

Answer

Configure Microsoft Sentinel to monitor access to classified columns.

Answer

Enable Transparent Data Encryption (TDE) on the database.

Question 10

You manage an Azure SQL Database that is accessed by several applications. You need to implement the principle of least privilege for database access. Which three actions should you take? (Choose three.)

Accepted Answer

Create contained database users instead of server-level logins.. Contained database users are authenticated directly within the database, independent of the server-level logins. This aligns with the principle of least privilege by avoiding the need for server-level permissions, which would grant broader access across the server. In Azure SQL Database, contained users are the recommended approach for database-level access control, as they limit the blast radius of a compromised credential to a single database.

Answer

Add users to the db_datareader role.

Answer

Configure firewall rules to restrict IP addresses.

Question 11

You are configuring security for an Azure SQL Database that will be used by a web application. The application uses a connection string with SQL authentication. You need to protect the database from SQL injection attacks. Which two measures should you implement? (Choose two.)

Accepted Answer

Use parameterized queries in the application.. Parameterized queries ensure that user input is treated as data, not executable code, by separating SQL logic from input values. This prevents attackers from injecting malicious SQL statements into the query string, which is the primary defense against SQL injection attacks.

Answer

Enable Transparent Data Encryption (TDE).

Answer

Configure Dynamic Data Masking (DDM).

Answer

Enable Always Encrypted on sensitive columns.

Question 12

You are configuring Azure SQL Database for a financial application that must meet PCI DSS compliance. The database contains credit card numbers stored in a column encrypted with Always Encrypted. You need to ensure that database administrators cannot view the plaintext credit card numbers while allowing application users with the proper credentials to access them. What should you implement?

Accepted Answer

Use Always Encrypted with secure enclaves and store the column master key in Azure Key Vault with access granted only to the application. Always Encrypted with secure enclaves ensures that credit card numbers are encrypted at all times, including during computation, and that the column master key is stored in Azure Key Vault with access granted only to the application. This prevents database administrators (DBAs) from viewing plaintext data because they never have access to the column master key, while authorized application users can decrypt the data via the client driver. This meets PCI DSS requirements for protecting cardholder data at rest and in use.

Answer

Use column-level encryption with a certificate stored in the database

Answer

Enable Transparent Data Encryption (TDE)

Answer

Implement Dynamic Data Masking (DDM)

Question 13

You are the database administrator for a SaaS company that uses Azure SQL Database. The company has a new requirement to audit all SELECT operations on a specific table containing sensitive customer data. You enable auditing on the server and configure a storage account for audit logs. However, after 24 hours, you notice that no SELECT operations are captured in the audit logs. You verify that the table is being accessed frequently. What is the most likely cause?

Accepted Answer

The audit policy is not configured to capture SELECT operations; only UPDATE, INSERT, and DELETE are captured. Option B is correct because the default server-level audit policy in Azure SQL Database captures only data manipulation language (DML) operations like UPDATE, INSERT, and DELETE, not SELECT queries. To audit SELECT operations, you must explicitly configure a database-level audit action group such as DATABASE_OBJECT_ACCESS_GROUP or SCHEMA_OBJECT_ACCESS_GROUP, or use a custom audit action like SELECT on the specific table. Without this configuration, SELECT operations are not recorded in the audit logs, even if server auditing is enabled and the storage account is properly configured.

Answer

The storage account key was rotated and the audit configuration is using an expired key

Answer

The client application is using a connection string that bypasses the server firewall

Answer

The storage account is in a different region than the SQL Database server

Question 14

Your Azure SQL Managed Instance stores sensitive healthcare data. You need to restrict access to the database from public networks while allowing a specific on-premises application to connect. The on-premises network has a static public IP address. What is the most secure way to configure connectivity?

Accepted Answer

Enable the public endpoint and create a firewall rule allowing only the on-premises static IP address. Enabling the public endpoint with a firewall rule that restricts access to only the on-premises static IP address is the most secure way to allow a specific external application to connect while blocking all other public traffic. This approach leverages Azure SQL Managed Instance's built-in public endpoint firewall, which evaluates source IP addresses against configured rules before allowing connections, ensuring that only the trusted on-premises application can reach the sensitive healthcare data.

Answer

Enable the public endpoint without any firewall rules

Answer

Configure a service endpoint on the VNet where the Managed Instance is deployed

Answer

Disable the public endpoint and configure a point-to-site VPN for the on-premises application

Question 15

Your company uses Azure SQL Database with Microsoft Entra ID (formerly Azure AD) authentication. You need to grant a group of external consultants access to a specific database with read-only permissions. The consultants are from a partner organization that uses their own Microsoft Entra ID tenant. What should you do?

Accepted Answer

Invite the consultants as guest users in your Microsoft Entra ID tenant using B2B collaboration, then create a contained database user for each guest user. Option A is correct because external consultants from a different Microsoft Entra ID tenant must first be invited as guest users via B2B collaboration to your tenant. Once they are guest users, you can create contained database users in Azure SQL Database mapped to their guest user identities (e.g., their UPN in your tenant) and grant them read-only permissions (e.g., db_datareader role). This approach respects the isolation of the partner's tenant while enabling access through your tenant's identity.

Answer

Create a contained database user mapped to the consultants' Microsoft Entra ID user principal names (UPNs)

Answer

Configure Azure SQL Database to trust the partner's Microsoft Entra ID tenant

Answer

Create a SQL Server authentication login and user for the consultants