Microsoft Azure Database Administrator Associate DP-300 DP-300 Questions 901–906 | Page 13/13

901

Multi-Selecteasy

You are configuring authentication for Azure SQL Database. Which TWO of the following are supported authentication methods?

Select 2 answers

A.Windows authentication using Kerberos.

B.Microsoft Entra ID authentication with a service principal.

C.OAuth 2.0 token authentication.

D.SQL authentication with a username and password.

E.Certificate-based authentication for SQL logins.

AnswersB, D

Service principals in Microsoft Entra ID can authenticate to Azure SQL Database.

Why this answer

Microsoft Entra ID authentication with a service principal is supported in Azure SQL Database. A service principal is an identity created for use with applications, hosted services, and automated tools to access Azure resources, and it can authenticate to Azure SQL Database using Microsoft Entra ID (formerly Azure AD) tokens. This method enables secure, non-interactive authentication for applications and automation scenarios.

Exam trap

The trap here is that candidates often confuse supported authentication methods for Azure SQL Database with those available for on-premises SQL Server, mistakenly selecting Windows authentication or certificate-based SQL logins, which are not supported in Azure SQL Database.

Full explanation →

902

MCQeasy

You have an Azure SQL Database that uses the General Purpose service tier. The database is critical and you need to ensure that it remains available during a planned patching event that updates the underlying hardware. What does Azure SQL Database provide to maintain availability during such events?

A.The database is taken offline during patching and restored afterward.

B.You must manually fail over to a secondary database to avoid downtime.

C.Zone-redundant replicas that ensure zero downtime.

D.Automated failover to a built-in standby replica with minimal downtime.

AnswerD

General Purpose tier uses a built-in standby replica for high availability during patching.

Why this answer

The General Purpose tier includes built-in high availability with automated failover to a standby replica during planned patching events, minimizing downtime. Option A is incorrect because the database is not taken offline; it fails over seamlessly. Option B is incorrect because manual failover is not required—the process is automatic.

Option C is incorrect because General Purpose does not provide zone-redundant replicas by default; that is a feature of the Business Critical or Hyperscale tiers.

Full explanation →

903

MCQhard

You administer a SQL Managed Instance in the West Europe region. You need to create a disaster recovery replica in North Europe with automated failover. The replica must be readable and support backups. What should you configure?

A.Set up log shipping from West Europe to North Europe.

B.Configure active geo-replication between the instances.

C.Create a failover group, but note the secondary is not readable.

D.Create a failover group with the secondary instance in North Europe.

AnswerD

Failover groups provide automated failover and readable secondary for Managed Instance.

Why this answer

SQL Managed Instance supports failover groups for automated failover between regions, and the secondary instance in a failover group is readable and supports backups. Option A is incorrect because log shipping is not supported for SQL Managed Instance. Option B is incorrect because active geo-replication is not supported for SQL Managed Instance; failover groups are the appropriate solution.

Option C is incorrect because the secondary instance in a failover group is readable and can be used for read-only workloads.

Full explanation →

904

MCQmedium

A company manages an Azure SQL Database that stores sensitive customer data. The security team mandates that all connections to the database use Azure Active Directory (Azure AD) authentication and that no SQL authentication logins exist. You are tasked with implementing this requirement. What should you do first?

A.Set the server's 'Public network access' to 'Disabled'.

B.Remove the server admin login from the master database.

C.Set an Azure Active Directory admin for the Azure SQL Database server.

D.Deny the CONNECT permission to all SQL authentication logins.

AnswerC

An Azure AD admin must be set before disabling SQL authentication.

Why this answer

Before you can enforce Azure AD-only authentication, you must first designate an Azure AD admin for the Azure SQL Database server. This admin is the only identity that can manage Azure AD users and permissions in the database, and once set, you can then remove or disable SQL authentication logins. Without an Azure AD admin, there is no way to authenticate or manage Azure AD principals within the database, making the transition impossible.

Exam trap

The trap here is that candidates often confuse disabling network access or removing permissions with actually changing the authentication model, but the first required step is always to establish an Azure AD admin to enable Azure AD authentication at the server level.

How to eliminate wrong answers

Option A is wrong because disabling public network access restricts network connectivity but does not affect authentication methods; SQL authentication logins would still exist and could be used if network access were re-enabled. Option B is wrong because removing the server admin login from the master database would break all administrative access before an Azure AD admin is established, potentially locking you out of the server entirely. Option D is wrong because denying CONNECT permission to SQL authentication logins does not remove the logins themselves; they remain in the database and could be re-granted permissions, and this action does not enforce Azure AD-only authentication as a policy.

Full explanation →

905

Multi-Selecthard

Which THREE of the following are best practices for managing keys in Azure Key Vault for use with Azure SQL Database TDE?

Select 3 answers

A.Enable soft-delete and purge protection on the Key Vault.

B.Rotate the keys periodically.

C.Grant the server managed identity 'get', 'wrapKey', and 'unwrapKey' permissions.

D.Store the Key Vault in the same resource group as the SQL server.

E.Disable Key Vault auditing to reduce costs.

AnswersA, B, C

Prevents accidental key loss.

Why this answer

Enabling soft-delete and purge protection on the Key Vault is a best practice because soft-delete retains deleted keys for a configurable retention period (default 90 days), allowing recovery if a key is accidentally deleted. Purge protection prevents permanent deletion of keys even after the soft-delete retention period expires, which is critical for TDE because if the key is permanently lost, the encrypted database becomes inaccessible. Together, these features ensure that the TDE protector key is never irrevocably lost, maintaining database recoverability and compliance.

Exam trap

The trap here is that candidates often think placing the Key Vault in the same resource group simplifies management, but Microsoft explicitly recommends a separate resource group to avoid accidental deletion of the vault when the SQL server is deprovisioned.

Full explanation →

906

MCQmedium

You are configuring Microsoft Defender for SQL for Azure SQL Database. You need to ensure that alerts are sent to the security operations team via email and also integrated with Microsoft Sentinel. What should you configure?

A.In Microsoft Sentinel, connect the Azure SQL Database data source using the built-in connector.

B.Use Azure Logic Apps to forward Defender for SQL alerts to Sentinel.

C.Configure a diagnostic setting on the SQL server to stream logs to a Log Analytics workspace used by Sentinel.

D.Configure the alert rule in Defender for SQL to send email to the security team.

AnswerA

Sentinel has a built-in connector for Azure SQL Database that pulls alerts from Defender for SQL.

Why this answer

Microsoft Sentinel provides a built-in connector for Azure SQL Database that ingests security alerts from Microsoft Defender for SQL, satisfying the Sentinel integration requirement. The email notification requirement is addressed separately by configuring alert rules within Defender for SQL to send emails to the security operations team. Option A enables the Sentinel integration, while email notifications are a complementary configuration within Defender for SQL, not part of Option A itself.

Exam trap

The trap here is that candidates often confuse diagnostic settings (which stream performance and query logs) with the dedicated Sentinel connector (which ingests security alerts), leading them to choose Option C, or they overcomplicate the solution by selecting Logic Apps (Option B) when a native connector already exists.

How to eliminate wrong answers

Option B is wrong because Azure Logic Apps are not required; Sentinel already has a native connector for Azure SQL Database that directly pulls Defender for SQL alerts, making Logic Apps an unnecessary extra step that adds complexity and cost. Option C is wrong because diagnostic settings stream telemetry logs (such as SQLInsights, QueryStoreRuntimeStatistics) to a Log Analytics workspace, but they do not capture Defender for SQL security alerts; those alerts are ingested via the dedicated Sentinel connector, not through diagnostic logs. Option D is wrong because configuring the alert rule in Defender for SQL to send email only addresses the email notification requirement; it does not integrate with Microsoft Sentinel, leaving the security operations team without centralized alert management and automated incident response capabilities.

Full explanation →

Microsoft Azure Database Administrator Associate DP-300 (DP-300) — Questions 901–906