Implement a secure environment →hardMultiple ChoiceObjective-mapped

DP-300 Implement a secure environment Practice Question

Exhibit

Refer to the exhibit.
```json
{
  "type": "Microsoft.Sql/servers/databases/auditingSettings",
  "apiVersion": "2022-05-01-preview",
  "properties": {
    "state": "Enabled",
    "auditActionsAndGroups": [
      "SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP",
      "FAILED_DATABASE_AUTHENTICATION_GROUP"
    ],
    "isAzureMonitorTargetEnabled": true,
    "storageEndpoint": "https://mystorageaccount.blob.core.windows.net",
    "storageAccountAccessKey": "...",
    "retentionDays": 90
  }
}
```

Refer to the exhibit. You are deploying an Azure SQL Database audit policy using an ARM template. What is the MOST significant security concern with the configuration shown?

⚠ Common exam trap

The trap here is that candidates may focus on audit event types or retention periods as security concerns, but the real risk is the plaintext storage account key in the template, which is a classic secret exposure vulnerability.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The storage account access key is exposed in the template

The ARM template exposes the storage account access key in plaintext as a parameter value. This is a critical security concern because anyone with access to the template (e.g., in source control or deployment logs) can retrieve the key and gain unrestricted access to the storage account, including reading, modifying, or deleting audit logs. Azure SQL Database audit policies should use managed identities or Azure AD authentication to avoid embedding secrets.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Enabling Azure Monitor target could allow unauthorized access to logs
Why it's wrong here
Azure Monitor target is secure when configured correctly.
✓
The storage account access key is exposed in the template
Why this is correct
Hardcoding keys is insecure; use a managed identity or Key Vault reference.
✗
Retention of 90 days may be too short for compliance
Why it's wrong here
Retention is a compliance requirement, not a security concern.
✗
Including successful authentication events may expose sensitive login activity
Why it's wrong here
Successful authentication auditing is normal and not a security concern.

Go deeper

DP-300 Implement a secure environment Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question