DP-300 Implement a secure environment Practice Question
Your company uses Azure SQL Database and wants to automatically detect and alert on potential SQL injection attacks. Which Azure service should you enable?
⚠ Common exam trap
Watch out — candidates often confuse Azure SQL Auditing (logging) with threat detection, assuming that because auditing records events, it can also alert on attacks, but it lacks the real-time analysis and machine learning required for SQL injection detection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Defender for Cloud (formerly Azure Security Center) with Advanced Threat Protection for Azure SQL Database
Microsoft Defender for Cloud with Advanced Threat Protection for Azure SQL Database is the correct choice because it specifically detects anomalous activities indicating SQL injection attempts, such as unusual SQL queries or patterns, and triggers security alerts. Azure SQL Auditing only logs database events for compliance and forensic analysis, not real-time threat detection. SQL Vulnerability Assessment identifies configuration weaknesses but does not monitor for active attacks. Azure Policy enforces compliance rules but lacks intrusion detection capabilities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure SQL Auditing
Why it's wrong here
Azure SQL Auditing records executed statements and login events to storage or Log Analytics, but it neither analyses query patterns nor raises alerts; detection requires Microsoft Defender for SQL's advanced threat protection. Auditing is the right choice when the requirement is a retained trail of database activity for compliance or forensics.
- ✗
SQL Vulnerability Assessment
Why it's wrong here
SQL Vulnerability Assessment scans databases against a baseline of known weaknesses and configuration gaps, producing findings rather than runtime attack detection, so it cannot alert on SQL injection attempts. It is tempting because it addresses SQL security scanning, and would be the right choice when you need recurring vulnerability reports and remediation guidance for a database's configuration.
- ✓
Microsoft Defender for Cloud (formerly Azure Security Center) with Advanced Threat Protection for Azure SQL Database
Why this is correct
Microsoft Defender for Cloud's Advanced Threat Protection for Azure SQL Database analyses audit logs to detect anomalous queries indicative of SQL injection, raising alerts automatically. This directly satisfies the requirement to detect and alert on potential injection attacks without manual monitoring.
- ✗
Azure Policy
Why it's wrong here
Azure Policy enforces resource configuration rules, such as allowed SKUs or required tags, and cannot inspect query text for injection patterns. It is tempting because it governs compliance at scale, and would be correct for preventing non-compliant resource deployments, not for detecting runtime threats.
Go deeper
Related to this question
Learn chapter
Implementing Auditing and Threat Detection
Key term
Azure SQL Auditing
Azure SQL Auditing is a feature that tracks and records database events, such as data changes and logins, and writes them to an audit log for security monitoring and compliance.
Key term
Azure SQL Threat Detection
Azure SQL Threat Detection is a built-in security feature that continuously monitors your Azure SQL database for suspicious activities and sends alerts when potential threats are found.
About these practice questions
One of 574 original DP-300 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-300 exam.