Configure and manage automation of tasks →hardMultiple ChoiceObjective-mapped

DP-300 Configure and manage automation of tasks Practice Question

Exhibit

Refer to the exhibit.
```json
{
  "type": "Microsoft.Sql/servers/databases/securityAlertPolicies",
  "apiVersion": "2021-11-01",
  "name": "[concat(parameters('serverName'), '/', parameters('databaseName'), '/Default')]",
  "properties": {
    "state": "Enabled",
    "emailAccountAdmins": true,
    "emailAddresses": ["admin@contoso.com"],
    "disabledAlerts": ["Sql_Injection", "Access_Anomaly"],
    "retentionDays": 30,
    "storageAccountAccessKey": "...",
    "storageEndpoint": "https://stgaccount.blob.core.windows.net/"
  }
}
```

You are reviewing an ARM template snippet that configures a Security Alert Policy for an Azure SQL Database. The policy is enabled, and email notifications are sent to the account admin and admin@contoso.com. However, you notice that SQL Injection alerts are disabled. What is the most likely reason for disabling SQL Injection alerts?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Because SQL injection detection is already handled by Microsoft Defender for SQL.

Microsoft Defender for SQL provides built-in SQL injection detection, which can supersede the need for separate Security Alert Policy rules. When Defender for SQL is enabled, it automatically monitors and alerts on SQL injection attempts, so duplicating with a custom alert policy would be redundant and could cause confusion. Option A is incorrect because disabling alerts does not save costs; it weakens security. Option B is incorrect because vulnerability assessment policies do not override alert rules. Option C is incorrect because there is no known incompatibility between SQL injection alerts and storage account endpoints.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
To reduce the number of false positives and save costs on alert processing.
Why it's wrong here
False positives can be tuned, but disabling alerts reduces security.
✗
Because the database is configured with a conflicting vulnerability assessment policy that overrides SQL injection detection.
Why it's wrong here
There is no conflict; vulnerability assessment is separate.
✗
Because SQL injection alerts are incompatible with the chosen storage account endpoint.
Why it's wrong here
Storage endpoint is for audit logs, not related to alert types.
✓
Because SQL injection detection is already handled by Microsoft Defender for SQL.
Why this is correct
Microsoft Defender for SQL provides advanced threat protection, so the basic alert policy may be disabled to avoid duplication.

Go deeper

DP-300 Configure and manage automation of tasks Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question