Implement a secure environment →hardMultiple ChoiceObjective-mapped

DP-300 Implement a secure environment Practice Question

Exhibit

Refer to the exhibit.

```json
{
  "type": "Microsoft.Sql/servers/auditingSettings",
  "apiVersion": "2021-02-01-preview",
  "properties": {
    "state": "Enabled",
    "auditActionsAndGroups": [
      "DATABASE_LOGOUT_GROUP",
      "DATABASE_ROLE_MEMBER_CHANGE_GROUP",
      "BATCH_COMPLETED_GROUP"
    ],
    "isAzureMonitorTargetEnabled": true,
    "storageEndpoint": "https://auditlogs.blob.core.windows.net/",
    "retentionDays": 365
  }
}
```

You are a database administrator for a financial services company. You have deployed an Azure SQL Database and configured auditing using the JSON policy shown in the exhibit. After a security incident, you need to review all successful and failed login attempts to the database. However, you notice that login events are not being captured in the audit logs. What is the most likely reason?

⚠ Common exam trap

Candidates often assume auditing automatically captures all security events, but Azure SQL Database requires explicit inclusion of authentication action groups to log login attempts, and the JSON policy in the exhibit likely omits these groups.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The audit actions and groups do not include login events

The JSON policy shown in the exhibit defines audit actions and groups, but it does not include the `SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP` or `FAILED_DATABASE_AUTHENTICATION_GROUP` action groups. These groups are required to capture both successful and failed login attempts (authentication events) in Azure SQL Database. Without them, login events are not recorded in the audit logs, regardless of other settings.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The audit logs are being sent to Azure Monitor instead of blob storage
Why it's wrong here
The exhibit shows isAzureMonitorTargetEnabled is true, but logs can be sent to both Azure Monitor and blob storage. The storage endpoint is also configured, so logs should be in blob storage.
✗
The retention days are set too high, causing logs to be truncated
Why it's wrong here
Retention days of 365 is valid. Logs are not truncated due to retention; they are kept for the specified duration.
✓
The audit actions and groups do not include login events
Why this is correct
Login events are captured by 'SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP' and 'FAILED_DATABASE_AUTHENTICATION_GROUP', which are not listed in the audit actions and groups.
✗
Auditing is disabled at the server level
Why it's wrong here
The exhibit shows auditing is enabled at the database level. Server-level auditing is not required for database-level auditing to work.

Go deeper

DP-300 Implement a secure environment Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question