DP-900 Practice Question: Identify considerations for relational data on Azure
A company uses Azure SQL Database and needs to audit all data modifications (INSERT, UPDATE, DELETE) for compliance purposes. The audit logs must be stored for 7 years. Which feature should they enable?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SQL Database auditing
SQL Database auditing captures all data modifications (INSERT, UPDATE, DELETE) and can store logs in Azure storage, Log Analytics, or Event Hubs with retention up to 7 years. Option A is wrong because Advanced Threat Protection detects suspicious activities, not audits modifications. Option C is wrong because vulnerability assessment scans for security weaknesses, not logging changes. Option D is wrong because Transparent Data Encryption (TDE) encrypts data at rest, it does not log modifications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Advanced Threat Protection
Why it's wrong here
Advanced Threat Protection is a detection service that monitors database behavior and alerts on suspicious activities, such as SQL injection attempts, anomalous access patterns, or brute-force attacks. It does not maintain a historical audit trail of data modifications or record which users changed data, so it cannot satisfy an audit requirement. Use it to detect threats reactively, not to log changes for compliance.
- ✓
SQL Database auditing
Why this is correct
Azure SQL Database auditing tracks database events and writes them to an audit log in Azure Storage, Azure Monitor, or Log Analytics, capturing actions like INSERT, UPDATE, and DELETE along with user, time, and affected data. This feature retains the logs for a configurable period, which can be years, enabling the company to prove and review exactly what data was modified and by whom. It directly meets the need to audit all data modifications.
- ✗
Vulnerability assessment
Why it's wrong here
Vulnerability assessment evaluates the database for security weaknesses, including misconfigurations, missing patches, overly permissive permissions, and sensitive-data exposure, then provides a score and remediation steps. It is a point-in-time health scan rather than an ongoing recording mechanism, and its reports do not capture the transactional details of data changes. Threat alerts and scans help security posture but do not produce a modification audit trail.
- ✗
Transparent Data Encryption (TDE)
Why it's wrong here
Transparent Data Encryption (TDE) encrypts the underlying database files, backups, and transaction logs at rest so that a stolen disk or backup cannot be read without the encryption key. Its encryption operations are transparent to applications and users and do not create user-actionable records of which rows were inserted, updated, or deleted. It protects confidentiality of data but does not assist with auditing data modifications.
Go deeper
Related to this question
Learn chapter
Data Roles and Core Concepts
Key term
Azure Storage
Azure Storage is Microsoft's cloud-based service for storing data like files, messages, and backups with high durability and scalability.
Key term
Azure SQL Database
Azure SQL Database is a fully managed relational database-as-a-service (DBaaS) in Microsoft Azure, based on the SQL Server engine, that handles scaling, backups, patching, and high availability automatically.
About these practice questions
Courseiva writes every DP-900 question from scratch — 820 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-900 exam.