The correct answer is to enable Azure SQL Auditing for the server, configure the audit log destination to Log Analytics, and enable Microsoft Sentinel for threat detection. This works because Azure SQL Auditing captures both successful and failed login attempts as part of its audit logs, and sending these logs to a Log Analytics workspace allows for centralized storage and querying. Microsoft Sentinel then uses built-in analytics rules to correlate patterns of failed logins across time and IP addresses, effectively detecting brute-force attacks. On the DP-300 exam, this scenario tests your understanding of the layered security approach: auditing handles compliance logging, while Sentinel provides the intelligent threat detection layer. A common trap is thinking that just enabling auditing or just using Log Analytics alone satisfies the brute-force detection requirement—you need Sentinel’s analytics for that. Memory tip: “Audit logs go to Log Analytics, Sentinel sniffs out the brute.”
DP-300 Implement a secure environment Practice Question
This DP-300 practice question tests your understanding of implement a secure environment. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
You are responsible for security compliance of Azure SQL databases. You need to audit all successful and failed login attempts and store the audit logs in a Log Analytics workspace for analysis. You also want to detect potential brute-force attacks. What should you implement?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Azure SQL Auditing for the server, configure the audit log destination to Log Analytics, and enable Microsoft Sentinel for threat detection.
Option C is correct because Azure SQL Auditing captures both successful and failed login attempts (audit logs) and can be configured to send them directly to a Log Analytics workspace for centralized analysis. Microsoft Sentinel, when enabled, provides built-in analytics rules to detect brute-force attacks by correlating failed login patterns across time and IP addresses, fulfilling the threat detection requirement.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Configure Azure Policy to enforce auditing on all SQL databases in the subscription.
Why it's wrong here
Azure Policy enforces compliance but does not store or analyze logs.
✗
Enable SQL Vulnerability Assessment and schedule recurring scans.
Why it's wrong here
Vulnerability Assessment identifies security misconfigurations, not login attempts.
✓
Enable Azure SQL Auditing for the server, configure the audit log destination to Log Analytics, and enable Microsoft Sentinel for threat detection.
Why this is correct
This combination provides logging and analysis.
Related concept
Read the scenario before looking for a memorised answer.
✗
Enable Advanced Threat Protection (ATP) for Azure SQL Database.
Why it's wrong here
ATP alerts on suspicious activities but does not store all login attempts.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates confuse Advanced Threat Protection (ATP) with the combination of auditing and Sentinel, assuming ATP alone covers login auditing and brute-force detection, but ATP does not capture all login attempts nor store them in Log Analytics for custom analysis.
Detailed technical explanation
How to think about this question
Azure SQL Auditing uses server-level audit policies to log events such as SQL Server Audit events (including LOGIN_FAILED and LOGIN_SUCCEEDED) and writes them to the configured destination. When the destination is Log Analytics, the logs are ingested into the AzureDiagnostics table under the SQLSecurityAuditEvents category, enabling KQL queries for brute-force detection. Microsoft Sentinel’s ‘Brute force attack against SQL server’ analytics rule uses these logs to trigger alerts when multiple failed logins occur from the same IP within a short window.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A cloud solutions architect for a retail company is evaluating services for a new workload. The correct answer here reflects best practice for the specific scenario described — not a general cloud recommendation. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Cloud exam questions reward reading the constraint carefully: the same technology can be right or wrong depending on the use case.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this DP-300 question in full detail.
Implement a secure environment — This question tests Implement a secure environment — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Enable Azure SQL Auditing for the server, configure the audit log destination to Log Analytics, and enable Microsoft Sentinel for threat detection. — Option C is correct because Azure SQL Auditing captures both successful and failed login attempts (audit logs) and can be configured to send them directly to a Log Analytics workspace for centralized analysis. Microsoft Sentinel, when enabled, provides built-in analytics rules to detect brute-force attacks by correlating failed login patterns across time and IP addresses, fulfilling the threat detection requirement.
What should I do if I get this DP-300 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This DP-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-300 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.