Implement a secure environment →mediumMultiple Choice

DP-300 Implement a secure environment Practice Question

Exhibit

Refer to the exhibit.

$auditRule = @{
    AuditAction = @("SELECT", "UPDATE", "DELETE")
    AuditActionGroup = @("DATABASE_OBJECT_CHANGE_GROUP")
    RetentionDays = 90
    StorageEndpoint = "https://auditlogs.blob.core.windows.net"
    StorageAccountAccessKey = $storageKey
    StorageAccountSubscriptionId = $subscriptionId
}

You are reviewing a PowerShell script that configures auditing for an Azure SQL Database. The script sets an audit rule with the specified parameters. After running the script, you notice that SELECT operations are not being audited. What is the most likely cause?

⚠ Common exam trap

Watch out — candidates often assume all DML operations (including SELECT) are captured by default, but Azure SQL Database auditing requires explicit inclusion of the appropriate action group for SELECT operations.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The AuditActionGroup specified does not capture SELECT operations.

The script likely specifies an AuditActionGroup that does not include the group responsible for capturing SELECT operations. In Azure SQL Database auditing, SELECT operations are captured by the SUCCESSFUL_SCHEMA_OBJECT_ACCESS_GROUP or similar action groups. If the configured AuditActionGroup omits this group, SELECT statements will not be logged, even though other operations may be audited correctly.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The AuditActionGroup specified does not capture SELECT operations.
Why this is correct
Auditing captures only the action groups and actions defined in the audit rule. If the configured AuditActionGroup excludes SELECT, statement-level reads are never recorded, so SELECT operations go unaudited even though the rule runs successfully.
✗
The retention days are set too low, causing logs to be overwritten.
Why it's wrong here
Low retention days only shorten how long written audit records persist before deletion; they cannot stop SELECT operations from being captured in the first place. It tempts because retention settings do govern audit log lifetime, and short retention would matter if the concern were historical log availability.
✗
The storage endpoint is incorrectly formatted.
Why it's wrong here
A malformed storage endpoint causes log delivery to fail entirely, not the selective omission of SELECT statements, which depends on the action groups defined in the audit rule. It tempts because endpoint errors do stop auditing, but they affect all recorded operations rather than one statement type.
✗
The storage account access key is invalid.
Why it's wrong here
An invalid storage account access key prevents audit logs from being written to the storage target, but the audit rule still captures SELECT operations, so the action groups configured determine what is recorded. It tempts because key failures do break auditing, yet they cause write failures rather than selective omission of one statement type.

Go deeper

DP-300 Implement a secure environment Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question