DP-300 Implement a secure environment Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Enable Microsoft Entra ID authentication in the Azure SQL Database firewall settings.

  Why it's wrong here

  There is no such setting as enabling Microsoft Entra ID authentication in firewall settings. Firewall settings control network access, not authentication methods. Entra ID authentication is enabled by configuring an Entra ID admin on the logical server. This option misidentifies where the configuration is made.

• ✗

  Configure a Conditional Access policy to require MFA for all users.

  Why it's wrong here

  A Conditional Access policy is used to enforce MFA, but it requires that Microsoft Entra ID authentication is already enabled for Azure SQL Database. Without setting an Entra ID admin, the database cannot use Entra ID authentication, so the policy would have no effect. Thus, this is not the first step.

• ✓

  Set a Microsoft Entra ID admin for the Azure SQL logical server.

  Why this is correct

  To enable Microsoft Entra ID authentication for Azure SQL Database, you must first assign a Microsoft Entra ID admin at the server level. This admin can then create contained database users mapped to Microsoft Entra identities. Once set, clients can authenticate using Microsoft Entra ID, and MFA can be enforced through Conditional Access policies. This is the foundational step for Entra ID authentication.

• ✗

  Create a contained database user for each Microsoft Entra ID user.

  Why it's wrong here

  Creating contained database users is a subsequent step after setting the Microsoft Entra ID admin. Without a server-level Entra ID admin, you cannot create Entra ID-based contained users. Therefore, this is not the first action. It is necessary but not sufficient on its own to enforce MFA, which is handled via Conditional Access.

Go deeper

Related to this question