Implement a secure environment →hardMultiple Choice

DP-300 Implement a secure environment Practice Question

Exhibit

Refer to the exhibit.
```json
{
  "type": "Microsoft.Sql/servers/databases/auditingSettings",
  "apiVersion": "2022-05-01-preview",
  "properties": {
    "state": "Enabled",
    "auditActionsAndGroups": [
      "SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP",
      "FAILED_DATABASE_AUTHENTICATION_GROUP"
    ],
    "isAzureMonitorTargetEnabled": true,
    "storageEndpoint": "https://mystorageaccount.blob.core.windows.net",
    "storageAccountAccessKey": "...",
    "retentionDays": 90
  }
}
```

Refer to the exhibit. You are deploying an Azure SQL Database audit policy using an ARM template. What is the MOST significant security concern with the configuration shown?

⚠ Common exam trap

The trap here is that candidates may focus on audit event types or retention periods as security concerns, but the real risk is the plaintext storage account key in the template, which is a classic secret exposure vulnerability.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The storage account access key is exposed in the template

The ARM template exposes the storage account access key in plaintext as a parameter value. This is a critical security concern because anyone with access to the template (e.g., in source control or deployment logs) can retrieve the key and gain unrestricted access to the storage account, including reading, modifying, or deleting audit logs. Azure SQL Database audit policies should use managed identities or Microsoft Entra ID authentication to avoid embedding secrets.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Enabling Azure Monitor target could allow unauthorized access to logs
Why it's wrong here
Azure Monitor as an audit target is a supported, access-controlled destination; unauthorised access is not inherent to selecting it. It tempts because log exposure sounds dangerous, but the real risk lies in weak RBAC or public network access on the workspace, not the target type itself.
✓
The storage account access key is exposed in the template
Why this is correct
Embedding the storage account access key in the ARM template exposes a full-privilege credential in plaintext, readable by anyone with access to the template, deployment history or source control. This grants unrestricted access to the audit storage account, undermining the audit trail's integrity.
✗
Retention of 90 days may be too short for compliance
Why it's wrong here
Ninety days is a common baseline and the stem's exhibit would need to show a specific regulatory requirement to make this the most significant concern. It tempts because retention is a familiar audit talking point, but it is a policy preference rather than an exploitable security weakness.
✗
Including successful authentication events may expose sensitive login activity
Why it's wrong here
Auditing successful logins is standard and often required for compliance; it does not itself expose credentials or weaken controls. It tempts because verbose logging feels risky, but the actual concern in such templates is typically an unsecured storage or Log Analytics target, not the event category selected.

Go deeper

DP-300 Implement a secure environment Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question