DP-300 Implement a secure environment Practice Test 9 — 15 Questions

Question 1

You are troubleshooting a connectivity issue: an application running on an Azure virtual machine (VM) cannot connect to an Azure SQL Database. The VM is in the same region as the SQL Database. The VM can ping other resources, but the SQL connection fails. The SQL Database has a firewall rule allowing the VM's private IP address. What is the most likely cause?

Accepted Answer

The firewall rule uses the VM's private IP address, but Azure SQL Database sees the VM's public IP address. When an Azure VM connects to Azure SQL Database, the source IP address seen by the SQL firewall is the VM's public outbound IP address due to Source Network Address Translation (SNAT) performed by Azure. Even if the VM is in the same region, traffic to Azure SQL Database egresses through the VM's public IP, not its private IP. Therefore, a firewall rule allowing the private IP will not match, causing the connection to fail.

Answer

The SQL Database has the public endpoint disabled

Answer

The SQL Database firewall is configured at the database level, not the server level

Answer

The VM does not have an outbound security rule allowing traffic to Azure SQL Database

Question 2

You need to ensure that all connections to an Azure SQL Database use encryption. The application uses the JDBC driver. What should you configure in the connection string?

Accepted Answer

Add 'encrypt=true' and 'trustServerCertificate=false'. Option C is correct because for JDBC connections to Azure SQL Database, setting 'encrypt=true' enforces TLS encryption for data in transit, and 'trustServerCertificate=false' ensures that the server's TLS certificate is validated against the trusted certificate authority (CA) chain, preventing man-in-the-middle attacks. This is the recommended configuration for secure connections to Azure SQL Database.

Answer

Add 'hostNameInCertificate=*.database.windows.net'

Answer

Add 'encrypt=false' and 'trustServerCertificate=true'

Answer

Add 'useEncryption=true' and 'validateServerCertificate=true'

Question 3

Your company uses Azure SQL Database with Microsoft Defender for Cloud. You receive an alert indicating a potential SQL injection attack. The alert shows that the attack originated from the IP address of your company's VPN gateway. You have verified that no legitimate users are using the VPN at that time. What should you do to immediately stop the attack while preserving legitimate access?

Accepted Answer

Remove the firewall rule that allows the VPN gateway IP address. Option C is correct because the attack is originating from the VPN gateway's IP address, and the firewall rule allowing that IP is the only entry point for the attacker. By removing that specific firewall rule, you immediately block the malicious traffic while preserving legitimate access through other firewall rules (e.g., for on-premises or other VPN ranges). This directly stops the SQL injection attack at the network layer without affecting other users or services.

Answer

Disable the public endpoint on the SQL Database

Answer

Change the SQL Database server admin password

Answer

Add the attacker's IP address to a block list in Microsoft Defender for Cloud

Question 4

You are implementing row-level security (RLS) in Azure SQL Database to enforce data isolation for multiple tenants. Each tenant has a TenantID. The RLS predicate function uses the SESSION_CONTEXT variable set by the application. You need to ensure that users cannot bypass the RLS by setting arbitrary SESSION_CONTEXT values. What should you do?

Accepted Answer

Create a stored procedure that sets the SESSION_CONTEXT and grant the application only execute permission on that procedure; revoke SET permission from users. Option A is correct because by creating a stored procedure that sets the SESSION_CONTEXT and granting the application only EXECUTE permission on that procedure while revoking SET permission from users, you prevent users from arbitrarily setting SESSION_CONTEXT values. This enforces that only the trusted application code can set the context used by the RLS predicate, ensuring tenants cannot impersonate other tenants.

Answer

Use dynamic data masking to hide the TenantID column

Answer

Encrypt the SESSION_CONTEXT values using Always Encrypted

Answer

Use a firewall rule to restrict access to the database to only the application IP addresses

Question 5

You need to audit schema changes on an Azure SQL Database. Specifically, you must capture details of any DDL statements executed by any user. The audit logs must be stored in a Log Analytics workspace for analysis. What should you configure?

Accepted Answer

Configure server-level auditing with a Log Analytics workspace destination. Option C is correct because Azure SQL Database server-level auditing with a Log Analytics workspace destination captures all DDL statements executed by any user and stores them in a Log Analytics workspace for analysis. This meets the requirement to audit schema changes and store logs in Log Analytics, as server-level auditing captures events for all databases on the server, including DDL operations, and supports Log Analytics as a destination.

Answer

Create DDL triggers that write to a table

Answer

Configure database-level auditing with blob storage destination

Answer

Create an extended events session to capture DDL events

Question 6

Refer to the exhibit. You are reviewing an Azure Resource Manager template for deploying an Azure SQL Database server. The template sets publicNetworkAccess to Disabled, minimalTlsVersion to 1.2, and azureAdOnlyAuthentication to true. However, the deployment fails with an error. What is the most likely cause?

Accepted Answer

When azureAdOnlyAuthentication is true, the administratorLogin and administratorLoginPassword properties must not be specified. When azureAdOnlyAuthentication is set to true in an Azure SQL Database ARM template, the administratorLogin and administratorLoginPassword properties must be omitted because Azure AD authentication replaces SQL authentication as the sole identity provider. Including these properties causes a validation conflict, as the deployment expects no SQL admin credentials when Azure AD-only authentication is enabled.

Answer

minimalTlsVersion 1.2 is not supported in Azure SQL Database

Answer

publicNetworkAccess Disabled requires a private endpoint to be defined in the same template

Answer

The password does not meet complexity requirements

Question 7

Refer to the exhibit. You are configuring Azure SQL Database Transparent Data Encryption (TDE) with customer-managed keys (CMK) stored in Azure Key Vault. The deployment uses a user-assigned managed identity. However, after deployment, the TDE status shows 'Inaccessible'. What is the most likely cause?

Accepted Answer

The managed identity lacks 'Get', 'Wrap Key', and 'Unwrap Key' permissions on the Key Vault key. Option A is correct because the managed identity needs to have 'Get, Wrap Key, Unwrap Key' permissions on the Key Vault key. Without those, the SQL Database cannot access the key. Option B is wrong because Key Vault firewall rules could block access, but the most common issue is missing permissions. Option C is wrong because the key exists. Option D is wrong because the identity is assigned correctly.

Answer

The key specified in the URI does not exist

Answer

The user-assigned managed identity is not assigned to the SQL Database server

Answer

The Key Vault firewall is enabled and does not allow Azure services

Question 8

Refer to the exhibit. You are reviewing a script that is executed as part of a data migration to Azure SQL Database. The script attempts to insert a row with a specific OrderID into an Orders table that has an identity column. The script runs successfully in a test environment but fails in production with an error. The production environment has the same schema. What is the most likely cause?

Accepted Answer

The user running the script does not have ALTER permission on the table. The script uses SET IDENTITY_INSERT ON to allow explicit insertion into an identity column. In Azure SQL Database, this requires ALTER permission on the table, not just INSERT. The test environment likely granted the user ALTER, but production did not, causing the failure despite identical schema.

Answer

The table in production does not have an identity column

Answer

A different session is already using SET IDENTITY_INSERT ON for the same table

Answer

The identity column in production has a different seed value

Question 9

Which TWO of the following are valid methods to authenticate to Azure SQL Database using Microsoft Entra ID? (Choose two.)

Accepted Answer

Microsoft Entra ID managed identity. Option A is correct because Microsoft Entra ID managed identity allows Azure resources, such as a virtual machine or an App Service, to authenticate to Azure SQL Database without storing credentials. The managed identity is automatically managed by Azure and can be assigned to a resource, which then uses OAuth 2.0 token-based authentication to access the database. This method is secure and eliminates the need for manual credential rotation.

Answer

Active Directory Federation Services (AD FS) token

Answer

Microsoft Entra ID certificate-based authentication

Answer

Microsoft Entra ID password authentication

Question 10

Which THREE of the following are features that help protect against data exfiltration in Azure SQL Database? (Choose three.)

Accepted Answer

Always Encrypted. Always Encrypted is correct because it encrypts sensitive data at the client-side, ensuring that the encryption keys are never revealed to the database engine. This prevents even database administrators or attackers with access to the server from reading the plaintext data, directly protecting against data exfiltration.

Answer

Dynamic Data Masking (DDM)

Answer

Transparent Data Encryption (TDE)

Question 11

Which TWO of the following are required steps to configure Azure SQL Database to use a customer-managed key (CMK) for Transparent Data Encryption (TDE) with Azure Key Vault? (Choose two.)

Accepted Answer

Set the TDE protector to the Key Vault key via the Azure portal or T-SQL. Option B is correct because setting the TDE protector to the Key Vault key is the step that actually enables customer-managed key (CMK) encryption for Azure SQL Database. This can be done via the Azure portal, PowerShell, Azure CLI, or T-SQL (using ALTER DATABASE SCOPED CONFIGURATION SET TDE_PROTECTOR). Without this step, the database continues to use a service-managed key.

Answer

Create a user-assigned managed identity for the SQL Database server

Answer

Store the encryption key in the SQL Database server's hardware security module (HSM)

Answer

Ensure the SQL Database server is inside the same virtual network as the Key Vault

Question 12

Your organization uses Azure SQL Database with Azure SQL Managed Instance for a multi-tenant SaaS application. You need to ensure that each tenant's data is isolated and that a compromised tenant cannot access other tenants' data. What is the most secure approach?

Accepted Answer

Deploy a separate database per tenant, configure server-level firewall rules per tenant IP, and use Microsoft Entra authentication with application roles.. Option A is correct because deploying a separate database per tenant provides the strongest isolation boundary at the storage and compute layer. Combining server-level firewall rules that restrict access to each tenant's IP range and using Microsoft Entra authentication with application roles ensures that even if one tenant's credentials are compromised, the attacker cannot access another tenant's database. This multi-layered approach (network + authentication + authorization) is the most secure for multi-tenant isolation in Azure SQL Managed Instance.

Answer

Use dynamic data masking to obfuscate tenant IDs in query results.

Answer

Implement row-level security (RLS) with a tenant ID filter on all tables.

Answer

Use column-level encryption with Azure Key Vault for sensitive columns.

Question 13

Your company is migrating on-premises SQL Server databases to Azure SQL Managed Instance. You need to ensure that database backups are encrypted at rest using customer-managed keys stored in Azure Key Vault. You also need to allow the backup service to access the keys. What should you configure?

Accepted Answer

Enable Transparent Data Encryption (TDE) with customer-managed keys and grant the managed instance's system-assigned managed identity 'get', 'wrapKey', and 'unwrapKey' permissions on the key vault.. Option C is correct because Transparent Data Encryption (TDE) with customer-managed keys (CMK) in Azure SQL Managed Instance encrypts database backups at rest. To allow the Azure backup service to access the key for backup encryption, the managed instance's system-assigned managed identity must be granted 'get', 'wrapKey', and 'unwrapKey' permissions on the Azure Key Vault where the CMK is stored. This ensures that backups are encrypted using the customer-controlled key, meeting the requirement for encryption at rest with customer-managed keys.

Answer

Use Always Encrypted with column master key stored in Azure Key Vault.

Answer

Configure Azure Backup for SQL Server in Azure VM and use Backup Center to manage encryption.

Answer

Configure server-level firewall rules to allow Azure services to access the server.

Question 14

You have an Azure SQL Database that stores financial data. You need to audit all SELECT operations on the 'Transactions' table and store the audit logs in an Azure Storage account. What should you use?

Accepted Answer

Configure server-level auditing to log to an Azure Storage account.. Option D is correct because Azure SQL Database supports server-level auditing that can write audit logs directly to an Azure Storage account. This meets the requirement to audit SELECT operations on the 'Transactions' table and store logs in Azure Storage. Server-level auditing captures all database events, including SELECT statements, and can be configured to target a storage container.

Answer

Enable Microsoft Defender for Cloud on the server and review security insights.

Answer

Create a server audit using SQL Server Audit and specify a file destination.

Answer

Enable diagnostic settings for the database and send to a Log Analytics workspace.

Question 15

You are the database administrator for a healthcare organization that uses Azure SQL Database. You need to implement column-level encryption for a column containing patient Social Security numbers (SSNs). The SSNs must be encrypted at rest and in transit, and only authorized client applications should be able to decrypt them. Which technology should you use?

Accepted Answer

Always Encrypted with column master key stored in Azure Key Vault.. Always Encrypted is the correct choice because it ensures that sensitive data, such as SSNs, is encrypted both at rest and in transit, and the encryption keys are stored client-side (e.g., in Azure Key Vault). This design ensures that only authorized client applications with access to the column master key can decrypt the data, preventing even database administrators or cloud operators from viewing the plaintext values.

Answer

Row-level security (RLS) to restrict access based on user role.

Answer

Dynamic data masking (DDM) to mask SSNs for unauthorized users.

Answer

Transparent Data Encryption (TDE) with customer-managed keys.