Implement a secure environment →mediumMultiple ChoiceObjective-mapped

DP-300 Implement a secure environment Practice Question

Exhibit

Refer to the exhibit.

$auditRule = @{
    AuditAction = @("SELECT", "UPDATE", "DELETE")
    AuditActionGroup = @("DATABASE_OBJECT_CHANGE_GROUP")
    RetentionDays = 90
    StorageEndpoint = "https://auditlogs.blob.core.windows.net"
    StorageAccountAccessKey = $storageKey
    StorageAccountSubscriptionId = $subscriptionId
}

You are reviewing a PowerShell script that configures auditing for an Azure SQL Database. The script sets an audit rule with the specified parameters. After running the script, you notice that SELECT operations are not being audited. What is the most likely cause?

⚠ Common exam trap

Watch out — candidates often assume all DML operations (including SELECT) are captured by default, but Azure SQL Database auditing requires explicit inclusion of the appropriate action group for SELECT operations.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The AuditActionGroup specified does not capture SELECT operations.

The script likely specifies an AuditActionGroup that does not include the group responsible for capturing SELECT operations. In Azure SQL Database auditing, SELECT operations are captured by the SUCCESSFUL_SCHEMA_OBJECT_ACCESS_GROUP or similar action groups. If the configured AuditActionGroup omits this group, SELECT statements will not be logged, even though other operations may be audited correctly.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The AuditActionGroup specified does not capture SELECT operations.
Why this is correct
DATABASE_OBJECT_CHANGE_GROUP captures DDL changes, not SELECT.
✗
The retention days are set too low, causing logs to be overwritten.
Why it's wrong here
90 days is typical; not related to missing SELECT logs.
✗
The storage endpoint is incorrectly formatted.
Why it's wrong here
The endpoint appears valid.
✗
The storage account access key is invalid.
Why it's wrong here
Invalid key would cause all auditing to fail, not just SELECT.

Go deeper

DP-300 Implement a secure environment Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question