- A
Use the 'Audit Logs' feature in the Azure portal to enable auditing and set retention to 365 days
Why wrong: There is no separate 'Audit Logs' feature; you must configure auditing through the database's auditing blade.
- B
Enable auditing on the database and configure it to send logs to a Log Analytics workspace, then set the retention in Log Analytics to 365 days
Why wrong: While this works, the question does not specify using Log Analytics. Storage account is simpler and meets the requirement.
- C
Enable auditing on the server and configure it to send logs to an event hub
Why wrong: Server-level auditing is possible, but event hub does not provide built-in long-term retention; you would need additional services.
- D
Enable auditing on the database, set the audit log destination to a storage account, and configure retention to 365 days
This captures all database events and retains logs for one year.
Quick Answer
The correct answer is to enable auditing on the database, set the audit log destination to a storage account, and configure retention to 365 days. This works because Azure SQL Database auditing captures both successful and failed login attempts by default when enabled, and directing the logs to Azure Blob Storage allows you to define a precise retention period directly within the audit policy settings—meeting the one-year compliance requirement without needing additional lifecycle management rules. On the DP-300 exam, this scenario tests your understanding that database-level auditing is the granular control needed for specific compliance policies, while server-level auditing is broader and often used for enterprise-wide tracking. A common trap is choosing a Log Analytics workspace destination, which does not natively enforce a fixed 365-day retention on the audit configuration itself. Memory tip: think “DB-Level + Blob + 365” as the compliance trifecta for audit retention.
DP-300 Implement a secure environment Practice Question
This DP-300 practice question tests your understanding of implement a secure environment. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
You are a database administrator for an e-commerce company that uses Azure SQL Database to store order data. The company is implementing a new policy that requires all database access to be audited, including both successful and failed attempts. Additionally, the audit logs must be retained for at least one year for compliance purposes. You need to configure auditing for the database. What should you do?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue:
"least"Why it matters: You want the option with minimum overhead, fewest steps, or lowest impact — not the most feature-rich or comprehensive answer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Enable auditing on the database, set the audit log destination to a storage account, and configure retention to 365 days
Option D is correct because Azure SQL Database auditing can be configured at the database level to send audit logs to a storage account, which allows you to set a retention policy of 365 days directly on the audit configuration. This meets the requirement to audit both successful and failed attempts and retain logs for at least one year for compliance.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the 'Audit Logs' feature in the Azure portal to enable auditing and set retention to 365 days
Why it's wrong here
There is no separate 'Audit Logs' feature; you must configure auditing through the database's auditing blade.
- ✗
Enable auditing on the database and configure it to send logs to a Log Analytics workspace, then set the retention in Log Analytics to 365 days
Why it's wrong here
While this works, the question does not specify using Log Analytics. Storage account is simpler and meets the requirement.
- ✗
Enable auditing on the server and configure it to send logs to an event hub
Why it's wrong here
Server-level auditing is possible, but event hub does not provide built-in long-term retention; you would need additional services.
- ✓
Enable auditing on the database, set the audit log destination to a storage account, and configure retention to 365 days
Why this is correct
This captures all database events and retains logs for one year.
Clue confirmation
The clue word "least" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may confuse server-level auditing with database-level auditing or assume that Log Analytics or event hubs inherently support retention policies, but only storage accounts allow direct retention configuration within the audit settings.
Detailed technical explanation
How to think about this question
Azure SQL Database auditing uses server-level or database-level audit policies, with the database-level policy overriding the server-level for the same database. When using a storage account as the destination, the retention policy is defined in days (0 for indefinite) and is enforced by automatically deleting audit files older than the specified period. This is ideal for compliance scenarios where logs must be retained for a fixed duration, as storage accounts are cost-effective and support long-term retention without additional services.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
Implement a secure environment — study guide chapter
Learn the concepts, then practise the questions
- →
Implement a secure environment practice questions
Targeted practice on this topic area only
- →
All DP-300 questions
953 questions across all exam domains
- →
Microsoft Azure Database Administrator Associate DP-300 study guide
Full concept coverage aligned to exam objectives
- →
DP-300 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related DP-300 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Plan and configure a high availability and disaster recovery environment practice questions
Practise DP-300 questions linked to Plan and configure a high availability and disaster recovery environment.
Plan and implement data platform resources practice questions
Practise DP-300 questions linked to Plan and implement data platform resources.
Monitor, configure, and optimize database resources practice questions
Practise DP-300 questions linked to Monitor, configure, and optimize database resources.
Configure and manage automation of tasks practice questions
Practise DP-300 questions linked to Configure and manage automation of tasks.
Plan and configure high availability and disaster recovery practice questions
Practise DP-300 questions linked to Plan and configure high availability and disaster recovery.
Implement a secure environment practice questions
Practise DP-300 questions linked to Implement a secure environment.
DP-300 fundamentals practice questions
Practise DP-300 questions linked to DP-300 fundamentals.
DP-300 scenario practice questions
Practise DP-300 questions linked to DP-300 scenario.
DP-300 troubleshooting practice questions
Practise DP-300 questions linked to DP-300 troubleshooting.
Practice this exam
Start a free DP-300 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this DP-300 question test?
Implement a secure environment — This question tests Implement a secure environment — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Enable auditing on the database, set the audit log destination to a storage account, and configure retention to 365 days — Option D is correct because Azure SQL Database auditing can be configured at the database level to send audit logs to a storage account, which allows you to set a retention policy of 365 days directly on the audit configuration. This meets the requirement to audit both successful and failed attempts and retain logs for at least one year for compliance.
What should I do if I get this DP-300 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "least". You want the option with minimum overhead, fewest steps, or lowest impact — not the most feature-rich or comprehensive answer.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on DP-300
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are the database administrator for a SaaS company that uses Azure SQL Database. The company has a new requirement to audit all SELECT operations on a specific table containing sensitive customer data. You enable auditing on the server and configure a storage account for audit logs. However, after 24 hours, you notice that no SELECT operations are captured in the audit logs. You verify that the table is being accessed frequently. What is the most likely cause?
hard- A.The storage account key was rotated and the audit configuration is using an expired key
- ✓ B.The audit policy is not configured to capture SELECT operations; only UPDATE, INSERT, and DELETE are captured
- C.The client application is using a connection string that bypasses the server firewall
- D.The storage account is in a different region than the SQL Database server
Why B: Option B is correct because the default server-level audit policy in Azure SQL Database captures only data manipulation language (DML) operations like UPDATE, INSERT, and DELETE, not SELECT queries. To audit SELECT operations, you must explicitly configure a database-level audit action group such as DATABASE_OBJECT_ACCESS_GROUP or SCHEMA_OBJECT_ACCESS_GROUP, or use a custom audit action like SELECT on the specific table. Without this configuration, SELECT operations are not recorded in the audit logs, even if server auditing is enabled and the storage account is properly configured.
Variation 2. You are a database administrator for a financial services company. You have deployed an Azure SQL Database and configured auditing using the JSON policy shown in the exhibit. After a security incident, you need to review all successful and failed login attempts to the database. However, you notice that login events are not being captured in the audit logs. What is the most likely reason?
hard- A.The audit logs are being sent to Azure Monitor instead of blob storage
- B.The retention days are set too high, causing logs to be truncated
- ✓ C.The audit actions and groups do not include login events
- D.Auditing is disabled at the server level
Why C: The JSON policy shown in the exhibit defines audit actions and groups, but it does not include the `SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP` or `FAILED_DATABASE_AUTHENTICATION_GROUP` action groups. These groups are required to capture both successful and failed login attempts (authentication events) in Azure SQL Database. Without them, login events are not recorded in the audit logs, regardless of other settings.
Last reviewed: Jun 24, 2026
This DP-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-300 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.