DP-300 Implement a secure environment Practice Question
You are configuring Microsoft Defender for SQL for an Azure SQL Database. You want to receive email notifications when a suspicious activity is detected. What should you configure?
⚠ Common exam trap
Many candidates confuse the purpose of vulnerability assessment (periodic scanning) with real-time threat detection, or assume that Azure Monitor metric alerts are the correct way to receive email notifications for Defender for SQL alerts, when in fact the email notification is configured directly within the Defender for SQL settings.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
In the Microsoft Defender for SQL settings, enable 'Email notifications to admins and subscription owners'.
Microsoft Defender for SQL includes a dedicated 'Email notifications to admins and subscription owners' setting under its threat detection policy. When enabled, this sends email alerts to Azure subscription owners and administrators whenever Defender detects suspicious activities such as SQL injection, brute-force attacks, or anomalous access patterns. This is the direct, built-in mechanism for email-based alerting on threat detections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a vulnerability assessment recurring scan and email the report.
Why it's wrong here
Vulnerability assessment is for identifying weaknesses, not real-time threat detection.
- ✗
Create an Azure Monitor alert rule for the 'SQL database threat detection' metric.
Why it's wrong here
Creating an Azure Monitor alert rule for the 'SQL database threat detection' metric fails because that metric does not exist; Microsoft Defender for SQL sends email notifications through its own dedicated alert configuration within the Microsoft Defender for Cloud security policy, not via Azure Monitor metric alerts. This option is tempting because Azure Monitor is the central platform for alerting on performance and resource metrics, and one might assume security alerts follow the same pattern, but Defender for SQL manages its own notification settings independently.
- ✓
In the Microsoft Defender for SQL settings, enable 'Email notifications to admins and subscription owners'.
Why this is correct
This directly sends email alerts for detected threats.
- ✗
Enable SQL auditing and stream logs to a Log Analytics workspace.
Why it's wrong here
Auditing logs require additional setup for alerts; not the direct method.
Go deeper
Related to this question
Learn chapter
Overview of Azure Data Platform Options
Key term
Azure SQL Threat Detection
Azure SQL Threat Detection is a built-in security feature that continuously monitors your Azure SQL database for suspicious activities and sends alerts when potential threats are found.
Key term
Azure SQL Performance Tuning
Azure SQL Performance Tuning is the process of optimizing the speed and efficiency of queries and database operations in Microsoft Azure SQL Database or SQL Managed Instance to reduce latency and improve throughput.
About these practice questions
This DP-300 question is part of Courseiva's 906-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-300 exam.