DP-300 Implement a secure environment — Timed 20 Questions

Question 1

You are configuring Azure SQL Database firewall rules for a new application. The application runs on Azure VMs in the same region. To minimize latency and security risk, which approach should you use?

Accepted Answer

Configure a virtual network service endpoint and a virtual network firewall rule.. Option B is correct because using a virtual network service endpoint and a virtual network firewall rule allows Azure SQL Database to accept traffic only from the specific subnet hosting the application VMs, without exposing the database to the public internet. This minimizes latency by keeping traffic within the Azure backbone network and reduces the security risk by eliminating broad IP-based rules.

Answer

Add a firewall rule allowing all Azure IP addresses.

Answer

Add a firewall rule for each VM's public IP address.

Answer

Add a firewall rule allowing all Azure services to access the database.

Question 2

You need to audit all successful and failed login attempts to an Azure SQL Database. Which feature should you enable?

Accepted Answer

Azure SQL Auditing. Azure SQL Auditing is the correct feature because it tracks database events, including both successful and failed login attempts, and writes them to an audit log in your Azure Storage account, Log Analytics workspace, or Event Hubs. This allows you to monitor and review authentication activity for compliance and security analysis. Other features like Advanced Threat Protection, TDE, and Vulnerability Assessment do not capture login event logs.

Answer

Advanced Threat Protection

Answer

Transparent Data Encryption (TDE)

Answer

SQL Vulnerability Assessment

Question 3

Your company has a strict policy that Azure SQL Database backups must be encrypted with customer-managed keys stored in Azure Key Vault. You configure TDE with AKV integration. After a key rotation, you find that long-running queries start failing with encryption errors. What is the most likely cause?

Accepted Answer

The previous key version was disabled or deleted in AKV.. When TDE is configured with Azure Key Vault (AKV) integration, the database uses the current key version from AKV to encrypt and decrypt data. If the previous key version is disabled or deleted during a key rotation, any long-running queries that still rely on that specific key version for decryption will fail with encryption errors. The database cannot automatically fall back to the new key version for in-flight operations that started before the rotation.

Answer

The service principal used for AKV access has expired.

Answer

The new key is in a different Azure region than the database.

Answer

The database is using service-managed TDE and cannot switch to customer-managed keys.

Question 4

You are designing a secure environment for Azure SQL Database. Which authentication method provides the strongest security and supports multi-factor authentication?

Accepted Answer

Azure Active Directory authentication. Azure Active Directory (Azure AD) authentication is the recommended method for Azure SQL Database because it supports multi-factor authentication (MFA), conditional access policies, and identity-driven security. It eliminates the need for password management and leverages Azure AD's built-in security features, providing the strongest security posture for cloud-native environments.

Answer

Certificate-based authentication

Answer

SQL authentication with strong passwords

Answer

Windows authentication

Question 5

Your Azure SQL Database is configured with Advanced Threat Protection (ATP). You receive an alert about a SQL injection attack. After investigation, you confirm the attack was blocked. However, you need to ensure that future similar attacks are automatically prevented without manual intervention. What should you configure?

Accepted Answer

Configure the firewall to automatically block the attacker's IP address.. Option D is correct because configuring the Azure SQL Database firewall to automatically block the attacker's IP address provides a proactive, automated defense against future SQL injection attempts from the same source. Advanced Threat Protection (ATP) can be integrated with Azure Logic Apps or other automation to trigger a firewall rule update that denies traffic from the offending IP, thereby preventing manual intervention. This directly addresses the requirement for automatic prevention of similar attacks.

Answer

Enable Transparent Data Encryption (TDE).

Answer

Run SQL Vulnerability Assessment weekly.

Answer

Enable Azure SQL Auditing to log all queries.

Question 6

A developer reports that they cannot connect to an Azure SQL Database using Azure AD authentication. The developer is a member of an Azure AD group that has been granted db_datareader role in the database. The connection string uses Active Directory Password authentication. What is the most likely issue?

Accepted Answer

The Azure AD group has not been created as a database user.. The most likely issue is that the Azure AD group has not been created as a database user in the SQL Database. Even though the group has been granted the db_datareader role at the Azure AD level, Azure SQL Database requires that the group be explicitly mapped to a database user via the CREATE USER [group name] FROM EXTERNAL PROVIDER statement. Without this mapping, the group's membership does not translate into database-level permissions, and the developer's authentication will fail.

Answer

The server firewall is blocking the connection.

Answer

The developer's IP address is not allowed.

Answer

Multi-factor authentication is required but not configured.

Question 7

You need to ensure that all connections to an Azure SQL Database are encrypted. Which setting should you enforce?

Accepted Answer

Set 'Force encryption' to 'Yes' on the server.. Option B is correct because setting 'Force encryption' to 'Yes' on the Azure SQL Database server enforces TLS encryption for all client connections. This setting ensures that any client connecting to the database must use an encrypted connection, rejecting any unencrypted attempts. It is the direct mechanism to mandate encryption in transit, as opposed to encryption at rest or auditing.

Answer

Configure firewall rules to allow only specific IP addresses.

Answer

Enable Transparent Data Encryption (TDE).

Answer

Enable SQL Auditing.

Question 8

You are deploying an Azure SQL Database that will store sensitive customer data. Compliance requirements dictate that the data must be encrypted at rest using a customer-managed key that is rotated every 90 days. You configure TDE with Azure Key Vault. What additional step is critical to ensure data remains accessible after key rotation?

Accepted Answer

Ensure the previous key version remains enabled in Azure Key Vault.. When using TDE with Azure Key Vault and customer-managed keys, the database is encrypted using a Data Encryption Key (DEK) that is protected by the key in Key Vault. Key rotation creates a new key version, but the DEK remains encrypted with the previous key version. To decrypt the DEK and access the data after rotation, the previous key version must remain enabled in Key Vault. If it is disabled or deleted, the database becomes inaccessible.

Answer

Store the key in a different region for disaster recovery.

Answer

Use a premium tier of Azure Key Vault.

Answer

Re-encrypt the database with the new key immediately after rotation.

Question 9

Which TWO of the following are best practices for securing Azure SQL Database?

Accepted Answer

Enable firewall rules to restrict access to specific IP addresses.. Option D is correct because Azure SQL Database firewall rules allow you to restrict access to specific IP address ranges, which is a fundamental network security best practice. By limiting inbound traffic to only trusted IPs, you reduce the attack surface and prevent unauthorized connections from unknown sources. This is a first line of defense in a defense-in-depth strategy for securing Azure SQL Database.

Answer

Enable Auditing to block malicious queries.

Answer

Enable TDE to prevent SQL injection attacks.

Answer

Use SQL authentication with complex passwords.

Question 10

Which THREE of the following are required to configure Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault for Azure SQL Database?

Accepted Answer

The key encryption key must be stored in Azure Key Vault.. Option A is correct because Transparent Data Encryption (TDE) with customer-managed keys requires the key encryption key (KEK) to be stored in Azure Key Vault. This KEK is used to protect the database encryption key (DEK), which is stored in the database boot record. Without the KEK in Key Vault, the customer-managed key scenario cannot be implemented, as Azure SQL Database must be able to access the key to perform encryption operations.

Answer

The Azure Key Vault must be in the same region as the database.

Answer

The SQL server must have an RBAC role assignment on the key vault.

Question 11

Which TWO of the following are valid methods to connect to Azure SQL Database securely?

Accepted Answer

Connect using Azure AD authentication with multi-factor authentication.. Option A is correct because Azure AD authentication with multi-factor authentication (MFA) provides strong identity-based security, eliminating password vulnerabilities and supporting conditional access policies. This method integrates with Azure SQL Database's built-in support for Azure AD tokens, ensuring that only authenticated users with MFA can connect, which meets the exam's focus on secure environment implementation.

Answer

Connect using a shared access key from Azure Storage.

Answer

Connect directly using the server's public IP address without encryption.

Answer

Connect using SQL authentication with a simple password.

Question 12

You are the database administrator for a healthcare company that uses Azure SQL Database to store patient records. The database is named PatientDB. The security team mandates that all database access must be audited, and any suspicious activity must be alerted in real-time. Additionally, compliance requires that all data at rest be encrypted using a customer-managed key stored in Azure Key Vault. You have configured the following:
- TDE with customer-managed key in AKV (key vault name: KV-Health, key name: PatientKey)
- Azure SQL Auditing enabled, writing logs to a storage account (StorageAcctLogs)
- Advanced Threat Protection (ATP) enabled with alerts sent to the security team's email
- Firewall rules allowing only the application server's public IP (203.0.113.50)

A week later, the security team reports that they received an ATP alert about a potential SQL injection attack from IP 198.51.100.25. However, when they check the audit logs, they find no entries from that IP. They also notice that the database remains accessible. The security team wants to know why the audit logs do not contain the suspicious IP even though ATP detected it. What is the most likely reason?

Accepted Answer

The firewall rule blocks connections from the attacker's IP, so no audit log entries are generated because the connection never reaches the database.. Option C is correct because Advanced Threat Protection (ATP) can detect suspicious activity at the network level before the connection is fully established, while Azure SQL Auditing only logs events after a connection is accepted and authenticated. Since the firewall rule blocks connections from IP 198.51.100.25, the attacker's IP never reaches the database engine, so no audit log entries are generated for that IP. ATP alerts can be triggered by network-level patterns (e.g., SQL injection signatures) even when the connection is denied by the firewall, explaining the discrepancy.

Answer

The storage account for audit logs is not accessible, so logs are not being written.

Answer

The firewall rule allowing only the application server's IP is misconfigured, allowing the attacker's IP.

Answer

The TDE configuration with customer-managed key is interfering with auditing.

Question 13

You manage an Azure SQL Database named SalesDB that is used by a sales application. The application connects using a SQL login named 'sales_user' with a password. Recently, the security team discovered that 'sales_user' has been compromised. They have reset the password in Azure SQL Database. However, the application continues to connect successfully using the old credentials. You suspect the application might be caching the password. The security team wants to immediately revoke access for the compromised login and ensure that only a new login with a complex password is used. You also want to minimize downtime. What should you do first?

Accepted Answer

Revoke the CONNECT permission from 'sales_user' using REVOKE CONNECT FROM sales_user; then create a new login and update the application connection string.. Option A is correct because immediately revoking the CONNECT permission from the compromised login 'sales_user' terminates any existing active sessions and prevents new connections using the old credentials, without deleting the login object. This allows you to create a new login with a complex password and update the application connection string with minimal downtime, as the database and other server-level objects remain intact.

Answer

Change the password again and ensure the application is restarted to clear the cache.

Answer

Enable auditing to monitor future logins and leave the login as is.

Answer

Drop the 'sales_user' login using DROP LOGIN sales_user; then create a new login and update the application.

Question 14

You are configuring Azure SQL Database firewall rules. You need to allow a range of IP addresses (192.168.1.0 to 192.168.1.255) to connect to the database. Which firewall rule should you create?

Accepted Answer

Start IP: 192.168.1.0, End IP: 192.168.1.255. Option B is correct because Azure SQL Database firewall rules require a contiguous range of IP addresses defined by a start and end IP. The range 192.168.1.0 to 192.168.1.255 exactly covers the specified /24 subnet, allowing all hosts in that block to connect. This is the standard method for permitting a subnet in Azure SQL firewall configuration.

Answer

Start IP: 192.168.0.0, End IP: 192.168.2.255

Answer

Start IP: 192.168.1.255, End IP: 192.168.1.0

Answer

Start IP: 192.168.1.0, End IP: 192.168.1.0

Question 15

Your company uses Azure SQL Database. You need to ensure that all connections to the database use TLS 1.2 or higher. Currently, some client applications are connecting using TLS 1.0. What should you do?

Accepted Answer

Set the 'Minimum TLS version' property of the logical server to 1.2.. Option B is correct because setting the 'Minimum TLS version' property of the Azure SQL logical server to 1.2 enforces that all incoming connections must use TLS 1.2 or higher. This server-level setting overrides any client-side configuration, blocking connections that attempt to use TLS 1.0 or 1.1. It is the simplest and most effective way to enforce the minimum TLS version across all client applications without requiring changes to each client.

Answer

Configure the server firewall to block non-TLS traffic.

Answer

Set the 'tls_version' database parameter to 1.2 in the master database.

Answer

Update the client applications to only use TLS 1.2.

Question 16

You are designing a secure environment for Azure SQL Managed Instance. The company requires that all database backups be encrypted using customer-managed keys stored in Azure Key Vault. Which combination of actions should you take?

Accepted Answer

Enable Transparent Data Encryption (TDE) with a customer-managed key in Azure Key Vault.. Option B is correct because Transparent Data Encryption (TDE) with customer-managed keys in Azure Key Vault allows you to encrypt the database backup files using a key that you control. When TDE is enabled and configured with a customer-managed key (CMK) stored in Azure Key Vault, Azure SQL Managed Instance automatically encrypts backups with the same TDE protector key, meeting the requirement for customer-managed backup encryption.

Answer

Configure Always Encrypted with keys stored in Key Vault.

Answer

Use Azure Storage Service Encryption to encrypt the backup files.

Answer

Enable backup encryption using a certificate stored in the managed instance.

Question 17

You need to configure authentication for Azure SQL Database. Which TWO options are supported?

Accepted Answer

Azure Active Directory authentication. Azure SQL Database supports Azure Active Directory (Azure AD) authentication, which allows you to centrally manage identities and access. This includes support for modern authentication protocols like OAuth 2.0 and integration with Azure AD, enabling features such as conditional access and managed identities.

Answer

Multi-factor authentication

Answer

Certificate-based authentication

Answer

Windows authentication

Question 18

Your organization has an Azure SQL Database server. You need to ensure that only applications running on Azure virtual machines in a specific virtual network can connect to the database. Which THREE actions should you take?

Accepted Answer

Add a virtual network rule for the specific subnet of the VMs.. Option B is correct because adding a virtual network rule for the specific subnet of the VMs allows Azure SQL Database to accept traffic only from that subnet when a service endpoint is enabled. This restricts access to the database to only those applications running on Azure VMs within the specified virtual network, ensuring network-level isolation.

Answer

Add a service endpoint for Azure SQL Database to the virtual network.

Answer

Set the 'Allow Azure Services and resources to access this server' setting to ON.

Question 19

You are reviewing a JSON representation of an Azure SQL Database firewall rule. What is the effect of this rule?

Accepted Answer

Allows all IP addresses from 10.0.0.0 to 10.0.0.255.. The JSON representation of the Azure SQL Database firewall rule with startIpAddress '10.0.0.0' and endIpAddress '10.0.0.255' defines a range that allows all IP addresses from 10.0.0.0 to 10.0.0.255 inclusive. Azure SQL Database firewall rules use inclusive IP range matching, so any client with an IP in that range is permitted to connect, provided the rule is enabled.

Answer

Blocks all IP addresses from 10.0.0.0 to 10.0.0.255.

Answer

Allows all IP addresses except 10.0.0.0 to 10.0.0.255.

Answer

Allows only the IP address 10.0.0.0.

Question 20

You are troubleshooting a connection issue from Azure SQL Database to Azure Storage using a managed identity. The above credential was created. What is missing from this configuration?

Accepted Answer

The credential is missing the SECRET parameter.. The credential is missing the SECRET parameter because when using a managed identity to access Azure Storage from Azure SQL Database, the credential must specify the identity's client ID or object ID as the SECRET. Without this, the credential cannot authenticate to the storage account, causing the connection to fail. The SECRET parameter is required to map the managed identity to the credential for Azure AD authentication.

Answer

The credential should be a server-level credential.

Answer

The credential lacks a valid identity.

Answer

The credential needs to include the storage account name.