Courseiva

DP-900 Practice Question: Identify considerations for relational data on Azure

A company uses Azure SQL Database and needs to audit all data modifications (INSERT, UPDATE, DELETE) for compliance purposes. The audit logs must be stored for 7 years. Which feature should they enable?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

SQL Database auditing

SQL Database auditing captures all data modifications (INSERT, UPDATE, DELETE) and can store logs in Azure storage, Log Analytics, or Event Hubs with retention up to 7 years. Option A is wrong because Advanced Threat Protection detects suspicious activities, not audits modifications. Option C is wrong because vulnerability assessment scans for security weaknesses, not logging changes. Option D is wrong because Transparent Data Encryption (TDE) encrypts data at rest, it does not log modifications.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Advanced Threat Protection

    Why it's wrong here

    Advanced Threat Protection is a detection service that monitors database behavior and alerts on suspicious activities, such as SQL injection attempts, anomalous access patterns, or brute-force attacks. It does not maintain a historical audit trail of data modifications or record which users changed data, so it cannot satisfy an audit requirement. Use it to detect threats reactively, not to log changes for compliance.

  • SQL Database auditing

    Why this is correct

    Azure SQL Database auditing tracks database events and writes them to an audit log in Azure Storage, Azure Monitor, or Log Analytics, capturing actions like INSERT, UPDATE, and DELETE along with user, time, and affected data. This feature retains the logs for a configurable period, which can be years, enabling the company to prove and review exactly what data was modified and by whom. It directly meets the need to audit all data modifications.

  • Vulnerability assessment

    Why it's wrong here

    Vulnerability assessment evaluates the database for security weaknesses, including misconfigurations, missing patches, overly permissive permissions, and sensitive-data exposure, then provides a score and remediation steps. It is a point-in-time health scan rather than an ongoing recording mechanism, and its reports do not capture the transactional details of data changes. Threat alerts and scans help security posture but do not produce a modification audit trail.

  • Transparent Data Encryption (TDE)

    Why it's wrong here

    Transparent Data Encryption (TDE) encrypts the underlying database files, backups, and transaction logs at rest so that a stolen disk or backup cannot be read without the encryption key. Its encryption operations are transparent to applications and users and do not create user-actionable records of which rows were inserted, updated, or deleted. It protects confidentiality of data but does not assist with auditing data modifications.

About these practice questions

Courseiva writes every DP-900 question from scratch — 820 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This DP-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-900 exam.