DP-300 Practice Question: Plan and configure high availability and disaster recovery
You administer an Azure SQL Database that must remain available if the primary region becomes unavailable. The business requires a secondary region with read-only access for reporting, and during a failover the application connection string must not change. You configure an auto-failover group. Which feature of the auto-failover group satisfies the requirement that the application connection string remains unchanged after failover?
⚠ Common exam trap
The trap here is assuming that any failover group configuration automatically preserves the application connection string, when only the listener endpoint provides that stability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The read-write listener endpoint of the failover group.
An auto-failover group creates listener endpoints with stable DNS names. The read-write listener always resolves to the current primary, so applications using that listener do not need to change their connection strings after a geo-failover. Firewall rules, backup retention, and TDE protectors are important for security and recoverability but do not provide a stable connection endpoint.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The geo-secondary database's server-level firewall rules.
Why it's wrong here
Firewall rules control which client IP addresses can reach the logical server; they do not provide a stable connection endpoint. Even if the secondary server has identical firewall rules, the application would still need to change its target server name after failover. Firewall rules are necessary for connectivity but do not keep the connection string unchanged.
- ✗
The transparent data encryption (TDE) protector stored in Azure Key Vault.
Why it's wrong here
The TDE protector is used to encrypt data at rest and must be available on the secondary for the database to be accessible, but it does not define how clients connect. It cannot keep a connection string stable across regions. Encryption configuration is unrelated to the DNS endpoint that applications target during failover.
- ✗
The automatic backup retention policy of the primary database.
Why it's wrong here
Backup retention determines how far back you can restore a database, which is a recovery capability, not a connectivity mechanism. It has no effect on the server name or listener that clients use. After a failover, the application would still need to point to the new primary unless a listener endpoint is used.
- ✓
The read-write listener endpoint of the failover group.
Why this is correct
The read-write listener endpoint is a stable DNS name that always points to the current primary database. Applications connect to this listener instead of the server name, so after a geo-failover the same connection string continues to work without modification. This directly satisfies the requirement that the application connection string must not change during a regional failover.
Visual reference
Go deeper
Related to this question
Learn chapter
Managing Identity and Access for Azure SQL
Key term
Transparent Data Encryption
Transparent Data Encryption is a security feature that automatically encrypts data written to a database and decrypts it when read, without requiring any changes to the application.
Key term
Azure SQL Performance Tuning
Azure SQL Performance Tuning is the process of optimizing the speed and efficiency of queries and database operations in Microsoft Azure SQL Database or SQL Managed Instance to reduce latency and improve throughput.
About these practice questions
This DP-300 question is part of Courseiva's 574-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This DP-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-300 exam.