DP-300 Implement a secure environment Practice Question
You are a database administrator for a technology company that uses Azure SQL Database to support a multi-tenant SaaS application. Each tenant has its own database. The security team requires that users from one tenant should never be able to access data from another tenant, even if a user's credentials are compromised. You need to implement a solution that enforces tenant isolation at the database level. The solution must be transparent to the application and must not require application code changes. What should you do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a contained database user for each tenant in their respective database and ensure that cross-database queries are not allowed by configuring server-level firewall rules to block access between databases
Each tenant has its own database, and by creating contained database users specific to each tenant and preventing cross-database access through firewall rules or private endpoints, you enforce tenant isolation. Even if credentials are compromised, the attacker can only access the single tenant's database. Option A is incorrect because Always Encrypted protects data at rest and in transit but does not restrict which data a user can query; it does not prevent cross-tenant access. Option C is incorrect because elastic queries are designed to query across databases, which would allow cross-tenant access if not carefully restricted. Option D is incorrect because a linked server enables cross-database queries, increasing the risk of cross-tenant access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Always Encrypted to encrypt each tenant's data with a separate column encryption key
Why it's wrong here
Always Encrypted encrypts data at the column level, but it does not prevent a user from accessing another tenant's data if they have appropriate permissions. It does not enforce tenant isolation.
- ✓
Create a contained database user for each tenant in their respective database and ensure that cross-database queries are not allowed by configuring server-level firewall rules to block access between databases
Why this is correct
Correct. Contained database users per tenant in their own database, combined with firewall rules that block cross-database queries, ensure that each user can only access their own tenant's database.
- ✗
Implement elastic queries to query across all tenant databases and use a view to filter by tenant ID
Why it's wrong here
Elastic queries allow querying across multiple databases, which would enable cross-tenant access if a user somehow obtains credentials. This increases the risk of tenant data leakage.
- ✗
Create a linked server between all tenant databases and use a security policy to restrict access
Why it's wrong here
Linked servers enable cross-database queries and do not inherently provide tenant isolation. A security policy (RLS) is applied within a database, not across databases, so this does not prevent cross-tenant access.
Go deeper
Related to this question
Learn chapter
Overview of Azure Data Platform Options
Key term
Azure SQL Performance Tuning
Azure SQL Performance Tuning is the process of optimizing the speed and efficiency of queries and database operations in Microsoft Azure SQL Database or SQL Managed Instance to reduce latency and improve throughput.
About these practice questions
Courseiva writes every DP-300 question from scratch — 906 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-300 exam.