I85PREP
⌘ K
Azure DP-300 study materials
Azure DP-300 study resources

Azure DP-300 practice questions

One question at a time. Build your Azure DP-300 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Plan and implement data platform resources

A company plans to move an on-premises application to Azure with minimal code changes. The application requires registry access, custom file-system filter drivers, and a linked server to a legacy instance. Which Azure data platform option should you choose?

  1. Azure SQL Database single database
  2. Azure Synapse Analytics dedicated SQL pool
  3. SQL Server on Azure Virtual Machines Correct answer.
  4. Azure SQL Database elastic pool

Explanation

Requirements such as registry access, custom drivers, and file-system control are only possible with a platform that gives operating-system level access, which SQL Server on Azure Virtual Machines provides. The managed PaaS offerings abstract the operating system and restrict these capabilities.

Question 2Plan and implement data platform resources

Which statement correctly describes the DTU purchasing model for Azure SQL Database?

  1. It requires the customer to bring existing SQL Server licenses and Software Assurance.
  2. It bills per query executed against the database.
  3. Compute, storage, and I/O are bundled into one blended unit. Correct answer.
  4. Compute and storage are billed separately, based on the number of vCores selected by the customer.

Explanation

A DTU is a blended measure that bundles compute, memory, I/O, and the storage included in the selected service tier into a single unit. The vCore model, by contrast, separates compute from storage and lets you choose hardware.

Question 3Plan and implement data platform resources

You have a development Azure SQL Database that is used only during business hours. You want the database to pause automatically when idle and resume on the next connection. Which compute tier should you select?

  1. Provisioned General Purpose
  2. Serverless Correct answer.
  3. Provisioned Business Critical
  4. Hyperscale

Explanation

The serverless compute tier automatically pauses a database after an inactivity delay that you configure and resumes it when a connection arrives, billing only for compute used while active. Storage is billed separately and continues while the database is paused.

Question 4Plan and implement data platform resources

Which Azure SQL Database backup storage redundancy option keeps all backups within a single Azure region and is the least expensive?

  1. Read-access geo-redundant storage (RA-GRS)
  2. Zone-redundant storage (ZRS)
  3. Geo-redundant storage (GRS)
  4. Locally redundant storage (LRS) Correct answer.

Explanation

Locally redundant storage keeps three copies of backups within one region, making it the lowest-cost choice but offering no protection against a regional outage. Zone-redundant and geo-redundant options add resilience at a higher price.

Question 5Plan and implement data platform resources

You have dozens of tenant databases on a single Azure SQL logical server. Each database has unpredictable, bursty usage, but the combined peak for all databases is well understood. Which approach is most cost effective?

  1. Move every database to the Hyperscale service tier.
  2. Create a separate Azure SQL Managed Instance for every tenant database.
  3. Put each database on its own server at the maximum service tier.
  4. Place the databases in an elastic pool sized to the combined peak. Correct answer.

Explanation

An elastic pool assigns a shared set of eDTUs or vCores to many databases so that individual peaks are averaged across the group, which lowers cost when usage patterns are intermittent. The pool size is set from the combined expected peak rather than from the sum of individual maximums.

Question 6Plan and implement data platform resources

You are moving an on-premises SQL Server workload to Azure SQL Managed Instance. You own SQL Server Enterprise Edition licenses with active Software Assurance. How can you lower the compute cost?

  1. Change the backup storage redundancy to locally redundant storage.
  2. Enable zone redundancy on the instance.
  3. Enable the Azure Hybrid Benefit for the instance. Correct answer.
  4. Purchase a five-year reserved capacity for the instance.

Explanation

Azure Hybrid Benefit lets you exchange Software Assurance-covered SQL Server licenses for a reduced rate on vCore-based Azure SQL compute, and it can be combined with reserved capacity. The other options affect resilience or backup cost rather than license cost.

Question 7Plan and implement data platform resources

You need to deploy Azure SQL Managed Instance. What must exist in the target subscription and region before the instance can be created?

  1. An App Service Environment deployed in the target region.
  2. A dedicated SQL pool inside an Azure Synapse workspace.
  3. A virtual network subnet delegated to Microsoft.Sql. Correct answer.
  4. An Azure SQL logical server in the target region.

Explanation

Managed Instance is injected into a virtual network and requires a dedicated subnet delegated to the Microsoft.Sql service, along with a network security group and route table. The instance is not created inside an Azure SQL logical server.

Question 8Plan and implement data platform resources

A workload requires a single Azure SQL database that can grow to 60 TB and needs rapid scale-out of read-only replicas. Which service tier should you choose?

  1. General Purpose
  2. Premium
  3. Hyperscale Correct answer.
  4. Business Critical

Explanation

The Hyperscale tier supports databases far larger than the other tiers and provides a distributed architecture in which additional read-only replicas can be added quickly. General Purpose, Business Critical, and Premium are limited to much smaller maximum database sizes.

Question 9Plan and implement data platform resources

An application connects to an Azure SQL database by using a server name in its connection string. You need automatic cross-region failover that preserves the same connection string, and you also need a read-only endpoint for reporting. What should you configure?

  1. An auto-failover group with read-write and read-only listeners. Correct answer.
  2. A point-in-time restore of the database into the secondary region.
  3. A zone-redundant configuration of the primary database.
  4. Active geo-replication with a manually updated connection string.

Explanation

An auto-failover group provides read-write and read-only listener endpoints whose DNS names stay constant, so applications keep the same connection string after a failover. Geo-replication alone requires you to change the connection string manually.

Question 10Plan and implement data platform resources

You must identify compatibility issues, deprecated features, and unsupported features in an on-premises SQL Server instance before migrating to Azure SQL Database. Which tool should you use?

  1. Data Migration Assistant Correct answer.
  2. SQL Server Management Studio Activity Monitor
  3. SQL Server Distributed Replay
  4. Azure Data Factory

Explanation

Data Migration Assistant performs compatibility assessment of on-premises databases against target Azure options and reports blocking issues, deprecated features, and recommendations. It can also recommend the appropriate Azure target.

Question 11Plan and implement data platform resources

An OLTP application requires the lowest possible I/O latency from Azure SQL Database and a built-in readable secondary replica for reporting. Which service tier meets these requirements?

  1. Standard S3
  2. Business Critical Correct answer.
  3. General Purpose
  4. Basic

Explanation

Business Critical uses local solid-state storage attached to the compute node and includes a free readable secondary replica through an Always On availability group. General Purpose uses remote storage, and the DTU-based Basic and Standard tiers provide neither feature.

Question 12Plan and implement data platform resources

A security policy requires that an Azure SQL Database accept connections only through a private IP address inside a virtual network and that the public endpoint be blocked. What should you configure?

  1. A virtual network rule on the logical server's firewall.
  2. The 'Allow Azure services and resources to access this server' option.
  3. A private endpoint, with public network access set to Disabled. Correct answer.
  4. A server-level firewall rule that allows the application's public IP address.

Explanation

A private endpoint gives the logical server a private IP address in your virtual network, and disabling public network access blocks all connections that do not come through that private path. Firewall and virtual network rules still use the public endpoint.

Question 13Plan and implement data platform resources

You deploy SQL Server on an Azure virtual machine. You want to manage automated backup and automated patching from the Azure portal and have the SQL Server instance appear as a manageable resource in the resource group. What should you do?

  1. Join the VM to Azure Arc-enabled servers.
  2. Install the Log Analytics agent on the virtual machine.
  3. Register the VM with the SQL IaaS Agent extension. Correct answer.
  4. Enable Microsoft Defender for SQL on the virtual machine.

Explanation

Registering the VM with the SQL IaaS Agent extension in full management mode surfaces the instance in the portal and enables features such as automated backup and automated patching. The extension is the supported mechanism for managing SQL Server on Azure VMs.

Question 14Plan and implement data platform resources

An application running on an Azure virtual machine must connect to an Azure SQL Database through the public endpoint, and the VM's outbound IP address changes frequently. Which server firewall setting is the simplest way to allow the connection?

  1. Disable public network access on the logical server.
  2. Enable 'Allow Azure services and resources to access this server'. Correct answer.
  3. Add the VM's MAC address to a virtual network rule.
  4. Create a database-level firewall rule for the VM's private IP address.

Explanation

Enabling the Azure services option creates a firewall rule that permits connections originating from Azure, so a VM with a changing IP address can connect without maintaining individual rules. A private endpoint or virtual network rule would be more restrictive but is not the simplest option here.

Question 15Plan and implement data platform resources

You need to reduce the cost of a production Azure SQL Database that will run at a fixed service tier for the next three years. Which purchasing option provides the largest saving for this steady-state workload?

  1. Serverless compute tier with auto-pause enabled.
  2. A three-year reserved capacity for the vCores. Correct answer.
  3. Pay-as-you-go vCore pricing for the database.
  4. Azure Hybrid Benefit combined with the DTU model.

Explanation

Reserved capacity lets you prepay for compute at a one-year or three-year term and is intended for predictable, long-running workloads. Serverless and pay-as-you-go pricing are better suited to variable or short-lived usage.

Question 16Plan and implement data platform resources

You are provisioning an Azure Synapse Analytics dedicated SQL pool. Which characteristic applies to this resource?

  1. Compute and storage are scaled together, and performance is measured in DTUs.
  2. It supports rowstore tables only and cannot use columnstore indexes.
  3. Performance is measured in DWUs, and compute can be paused. Correct answer.
  4. Data is stored in memory across all nodes for sub-second query latency.

Explanation

A dedicated SQL pool is measured in Data Warehouse Units and has a massively parallel processing architecture; you can pause it to stop compute billing while storage remains. Compute and storage scale independently, unlike DTU-based relational tiers.

Question 17Plan and implement data platform resources

You need a managed PostgreSQL database in Azure that supports zone-redundant high availability and integration into a delegated virtual network subnet. What should you deploy?

  1. Azure Database for MySQL flexible server
  2. Azure Database for PostgreSQL single server with geo-redundant backup
  3. Azure Database for PostgreSQL flexible server Correct answer.
  4. Azure SQL Managed Instance

Explanation

Azure Database for PostgreSQL flexible server supports zone-redundant high availability and can be deployed into a virtual network subnet for private connectivity. Single server does not offer zone-redundant high availability.

Question 18Plan and implement data platform resources

You have an elastic pool with 200 eDTUs containing five databases. One reporting database periodically consumes all pool resources and degrades the others. You want to guarantee each of the other four databases at least 20 eDTUs while limiting the reporting database to at most 100 eDTUs. What should you configure?

  1. Move the reporting database to the Basic service tier.
  2. Set per-database minimum and maximum eDTUs in the pool. Correct answer.
  3. Increase the pool's eDTU limit to 500 eDTUs for all databases.
  4. Enable read scale-out on the pool's logical server.

Explanation

Per-database minimum and maximum settings in an elastic pool reserve guaranteed resources for each database and cap how much a single database can consume. The requested values fit within the 200 eDTU pool because four databases at 20 eDTUs plus one at 100 eDTUs totals 180.

Question 19Plan and implement data platform resources

You want users to authenticate to Azure SQL Database with their Microsoft Entra ID accounts and multifactor authentication, and you want one group to administer the logical server. What should you configure?

  1. Windows Authentication delegated to an on-premises domain controller.
  2. A Microsoft Entra ID administrator on the logical server. Correct answer.
  3. SQL logins for each user with a strong, rotating password.
  4. Certificate-based authentication for the logical server.

Explanation

Setting a Microsoft Entra ID administrator, ideally an Entra group, on the logical server enables Entra authentication and multifactor authentication for contained database users and grants administrative rights to that identity. SQL logins cannot use multifactor authentication.

Question 20Plan and implement data platform resources

You deploy SQL Server on an Azure virtual machine with separate premium SSD disks for data and log files. Which host caching setting should you use for the log disk?

  1. Read-only
  2. Write-only
  3. None Correct answer.
  4. Read/write

Explanation

SQL Server log writes must be durable, so the log disk should use no host cache to avoid losing acknowledged writes. Read-only caching is appropriate for data files, and read/write caching should not be used for SQL Server data or log disks.

Question 21Plan and implement data platform resources

You need to deploy identical Azure SQL logical servers and databases to three environments and be able to re-run the deployment safely. What approach should you use?

  1. A T-SQL script executed with sqlcmd against each server.
  2. A script that runs CREATE DATABASE statements manually in each environment.
  3. An Azure Resource Manager template deployed in incremental mode. Correct answer.
  4. A BACPAC export and import for each environment.

Explanation

Resource Manager templates and Bicep files declare the desired state, so re-running an incremental deployment converges the environments without duplicating resources. Imperative scripts and BACPAC copies are not idempotent and drift between environments.

Question 22Plan and implement data platform resources

The primary region hosting an Azure SQL database becomes unavailable, and you need to bring the database online in a secondary region from its geo-replicated backup. Which action should you perform?

  1. Perform a copy of the database on the same logical server.
  2. Perform a point-in-time restore on the original logical server.
  3. Restore the database from a locally redundant backup taken in the primary region.
  4. Perform a geo-restore to a new logical server in the secondary region. Correct answer.

Explanation

Geo-restore uses a geo-redundant backup to create the database on any server in any region, including the region where the backups are replicated. Point-in-time restore and copy both depend on the original server being available.

Question 23Plan and implement data platform resources

Analysts occasionally query Parquet files in Azure Data Lake Storage with T-SQL a few times each day. The workload must not require provisioned capacity. Which Azure Synapse option should you use?

  1. An Azure SQL Managed Instance that queries external tables with PolyBase.
  2. A dedicated SQL pool sized at DW100c.
  3. An Azure SQL Database General Purpose database.
  4. A serverless SQL pool that bills per terabyte of data processed. Correct answer.

Explanation

A serverless SQL pool queries files in the data lake directly and charges per terabyte of data processed, so occasional ad hoc queries incur no provisioned compute cost. A dedicated SQL pool would bill for provisioned DWUs even when idle.

Question 24Plan and implement data platform resources

A developer accidentally deleted rows from a table in an Azure SQL Database four hours ago. The logical server still exists and the database uses the default backup retention settings. Which recovery approach restores the database to the state just before the deletion?

  1. Export a BACPAC from the current database and import it with a new name.
  2. Restore from the long-term retention policy's last full backup.
  3. Geo-restore to a new server in the paired region.
  4. Point-in-time restore to a timestamp before the deletion. Correct answer.

Explanation

Point-in-time restore creates a new database from the automatic backups at any timestamp within the retention period, which defaults to seven days, so four hours ago is available. The restore is always performed to a new database, not over the existing one.

Question 25Plan and implement data platform resources

You have a .bacpac file exported from an on-premises SQL Server database and need to deploy it to Azure SQL Database. Which tool should you use?

  1. sqlcmd
  2. SqlPackage Correct answer.
  3. Distributed Replay
  4. bcp

Explanation

SqlPackage imports and exports BACPAC files, recreating schema and data in Azure SQL Database. The other tools either move row data or execute scripts but do not process the BACPAC package format.

Question 26Plan and implement data platform resources

You are planning an Azure SQL Database deployment. You must be able to apply Azure Hybrid Benefit for SQL Server and to choose the compute hardware generation for the database. Which purchasing model should you select?

  1. An elastic pool that uses eDTU allocation
  2. A vCore-based purchasing model Correct answer.
  3. The Basic service tier
  4. A DTU-based purchasing model

Explanation

Azure Hybrid Benefit for Azure SQL Database and selection of the hardware generation are features of the vCore purchasing model. DTU-based tiers (Basic, Standard, Premium, and eDTU pools) expose only a fixed bundled amount of compute and storage. Choosing vCore also lets you set the number of cores independently of storage.

Question 27Plan and implement data platform resources

A development Azure SQL database is used for a few hours on weekdays only. You want compute to pause automatically when the database is idle and to be billed per second for compute while it is active. Which compute configuration should you choose?

  1. Business Critical provisioned compute
  2. General Purpose serverless compute Correct answer.
  3. Hyperscale with one named replica
  4. Basic DTU service tier

Explanation

Serverless compute, available in the General Purpose tier, automatically scales compute and can pause the database after a configurable idle delay, billing only storage while paused. Compute is billed per second while the database is active. Provisioned tiers never pause and bill continuously.

Question 28Plan and implement data platform resources

You must report Azure costs for each SQL database separately by department and by environment (production or development). Which approach should you implement?

  1. Enable diagnostic settings on each database
  2. Apply tags that record department and environment, then group cost analysis by tag Correct answer.
  3. Place a Delete resource lock on each database
  4. Create an Azure Policy definition with an Audit effect

Explanation

Tags are the supported mechanism for attaching business metadata such as cost center and environment to resources, and Azure Cost Management can group and filter costs by tag. Resource locks, diagnostic settings, and audit policies do not provide cost attribution.

Question 29Plan and implement data platform resources

You have a nonproduction Azure Database for MySQL workload that is used only between 09:00 and 17:00. You want to stop the server overnight and start it again in the morning to reduce cost. Which deployment option supports stopping and starting the server on demand?

  1. Azure Database for MySQL Flexible Server Correct answer.
  2. Azure Database for MySQL Single Server
  3. Azure SQL Managed Instance
  4. Azure Synapse Analytics dedicated SQL pool

Explanation

Flexible Server supports stopping and starting the server, and compute charges stop while the server is stopped (storage charges continue). Single Server does not offer a stop operation. The other options are different database products entirely.

Question 30Plan and implement data platform resources

You want to add an existing Azure SQL database to an elastic pool. Which condition must be satisfied?

  1. The database can be on any logical server in the same region as the pool
  2. The database must use the Hyperscale service tier
  3. The database must use the Business Critical service tier
  4. The database must be on the same logical server as the pool and the pool must have capacity for it Correct answer.

Explanation

An elastic pool is a resource of a specific logical server, so every database in the pool must reside on that server, and the pool's eDTU or vCore capacity must accommodate the database's min/max settings. Databases on other servers must first be moved or copied to the pool's server.

Question 31Plan and implement data platform resources

Backups of an Azure SQL database must be replicated to the paired Azure region so that a restore is possible during a regional outage, and you also need read access to the backup data in that secondary region. Which backup storage redundancy option should you choose?

  1. Zone-redundant storage (ZRS)
  2. Locally redundant storage (LRS)
  3. Read-access geo-redundant storage (RA-GRS) Correct answer.
  4. Geo-redundant storage (GRS) without read access

Explanation

RA-GRS keeps three copies in the primary region and replicates them asynchronously to the paired region, where the data can be read. GRS also replicates to the paired region but does not permit reads there. LRS and ZRS keep data within the primary region only.

Question 32Plan and implement data platform resources

You must retain weekly backups of an Azure SQL database for five years and monthly backups for three years, independent of the point-in-time restore retention. What should you configure?

  1. Increase the point-in-time restore retention to 35 days
  2. Enable zone redundancy for the database
  3. Configure a long-term retention (LTR) policy Correct answer.
  4. Configure active geo-replication

Explanation

Long-term retention policies define separate weekly, monthly, and yearly retention periods for full backups and can extend retention to up to 10 years. Point-in-time restore retention is limited to a maximum of 35 days, and neither zone redundancy nor geo-replication affects backup retention length.

Question 33Plan and implement data platform resources

Several applications share one Azure SQL logical server, each using its own database. You must allow a client IP address to connect to only one specific database on the server. What should you create?

  1. A virtual network service endpoint on the server
  2. A private endpoint for the database
  3. A server-level firewall rule on the logical server
  4. A database-level firewall rule in that database Correct answer.

Explanation

Database-level firewall rules are created with T-SQL inside a specific database and apply only to connections targeting that database. Server-level rules apply to every database on the logical server, so they cannot restrict access to a single database.

Question 34Plan and implement data platform resources

You need an Azure SQL Managed Instance that maintains a read-only replica usable for reporting at no additional cost and that stores data on local SSD for the lowest latency. Which service tier should you choose?

  1. Hyperscale
  2. General Purpose
  3. Standard (DTU-based)
  4. Business Critical Correct answer.

Explanation

The Business Critical tier of Azure SQL Managed Instance uses local SSD storage and includes a built-in readable secondary replica. General Purpose uses remote premium storage and does not include a free readable secondary. Hyperscale and DTU-based Standard are not tiers offered for Managed Instance.

Question 35Plan and implement data platform resources

You deploy three SQL Server instances on Azure virtual machines in the same region. You need automatic failover of a database between the instances and a single client connection point that is reachable only from inside the virtual network. What should you configure?

  1. An Always On availability group with an internal load balancer listener Correct answer.
  2. A Basic availability group with a distributed network name
  3. A failover cluster instance with a public IP address
  4. Active geo-replication between the instances

Explanation

An Always On availability group provides automatic failover between replicas, and on Azure the listener is placed behind an internal load balancer so clients connect by using a single private IP address. Basic availability groups do not support listeners, and active geo-replication is a feature of Azure SQL Database, not of SQL Server on virtual machines.

Question 36Plan and implement data platform resources

A production Azure SQL database must receive planned maintenance only on Sundays between 02:00 and 05:00. What should you configure on the database?

  1. A read-scale-out secondary replica
  2. A long-term retention policy
  3. An auto-failover group
  4. A maintenance window that specifies the day and time range Correct answer.

Explanation

The maintenance window setting lets you choose the day and time range in which planned maintenance is scheduled for a database or elastic pool. It reduces disruption but does not guarantee that all maintenance occurs inside the window. Retention, read-scale, and failover settings do not influence maintenance timing.

Question 37Plan and implement data platform resources

You must deploy many small Azure SQL Managed Instances, each with 2 vCores, for separate customers. You want the compute capacity to be pre-provisioned so that new instances deploy quickly and share the underlying resources. What should you use?

  1. One Hyperscale database per customer
  2. An elastic pool on a single logical server
  3. A Managed Instance instance pool Correct answer.
  4. One large Managed Instance with a database per customer

Explanation

Instance pools pre-provision vCore compute on a host and let you deploy many smaller Managed Instances, including 2-vCore instances that are otherwise unavailable, into that pool. This shortens deployment time and shares the underlying capacity. Elastic pools are an Azure SQL Database feature, not a Managed Instance one.

Question 38Plan and implement data platform resources

A governance requirement states that Azure SQL logical servers may be created only in West Europe or East US, and only when a cost-center tag is supplied. What should you implement?

  1. Management group hierarchy changes
  2. Azure Policy definitions with a Deny effect Correct answer.
  3. Resource locks on the subscription
  4. A custom Azure RBAC role

Explanation

Azure Policy can evaluate the location and tags of a resource at deployment time, and a Deny effect blocks noncompliant creations. Resource locks, RBAC roles, and management group structure control access and organization, not resource properties such as region or tags.

Question 39Plan and implement data platform resources

You must prevent deletion of a production Azure SQL logical server while still allowing the database team to create and modify databases on it. What should you configure?

  1. A Delete resource lock on the logical server Correct answer.
  2. A Delete resource lock on each database
  3. A ReadOnly resource lock on the resource group
  4. A ReadOnly resource lock on the logical server

Explanation

A Delete lock on the logical server blocks deletion of the server while permitting create, read, and update operations on the server and its databases. A ReadOnly lock would block the create and modify operations the team needs. Locks placed only on databases do not protect the server itself.

Question 40Plan and implement data platform resources

SQL Server on an Azure virtual machine requires sub-millisecond disk latency, and the storage must allow IOPS and throughput to be changed without detaching the disk or stopping the VM. Which disk type should you use?

  1. Standard SSD
  2. Standard HDD
  3. Ultra Disk Correct answer.
  4. Premium SSD

Explanation

Ultra Disks provide the lowest latency and let you adjust IOPS and throughput independently at runtime without detaching the disk. Premium SSD offers good performance but its size determines the provisioned IOPS and throughput. Standard SSD and HDD cannot meet sub-millisecond latency requirements.

Question 41Implement a secure environment

An Azure App Service web app must connect to Azure SQL Database without storing credentials in code or configuration. Which feature should you use?

  1. A contained database user with a fixed password
  2. A SQL login and password stored in application settings
  3. A shared access signature for the database
  4. A system-assigned managed identity for the App Service Correct answer.

Explanation

Managed identities give an application an automatically managed Microsoft Entra identity that it uses to request a token for Azure SQL Database, so no secret is stored anywhere in the app. The identity still has to be created as a contained database user and granted the permissions the app needs.

Question 42Implement a secure environment

How many Microsoft Entra administrators can be configured as the administrator on a single Azure SQL logical server?

  1. Two Correct answer.
  2. One
  3. Five
  4. Unlimited

Explanation

A logical server has exactly one Microsoft Entra administrator, which can be a user, a group, or a service principal. When a group is designated, every member of that group gains the administrative rights that the group is granted.

Question 43Implement a secure environment

Which Azure SQL Database feature encrypts data at rest at the page level and is enabled by default for new databases?

  1. Always Encrypted with secure enclaves
  2. Cell-level encryption
  3. Dynamic data masking rules
  4. Transparent data encryption Correct answer.

Explanation

Transparent data encryption encrypts the database, its backups, and its transaction log at rest, and it is on by default for new Azure SQL databases with a service-managed certificate. Applications do not need to change to benefit from it.

Question 44Implement a secure environment

Which TCP port must normally be reachable for a client to connect to Azure SQL Database by using the Tabular Data Stream protocol?

  1. Port 445
  2. Port 1521
  3. Port 443
  4. Port 1433 Correct answer.

Explanation

Azure SQL Database listens for TDS connections on TCP port 1433 when the server uses the proxy connection policy. With the redirect policy, the client is sent to a port in the 11000-11999 range after the initial connection is established.

Question 45Implement a secure environment

Which feature restricts the rows a user can retrieve based on the user's identity, enforced inside the database engine regardless of the client tool used?

  1. Column-level encryption
  2. Row-level security Correct answer.
  3. Transparent data encryption
  4. Dynamic data masking

Explanation

Row-level security applies a security policy whose predicate function filters or blocks rows for the current user, so the restriction applies to every client and query path. It is enforced by the engine rather than by application code.

Question 46Implement a secure environment

A user without the UNMASK permission queries a column that has a dynamic data masking rule applied. What does the user receive?

  1. No rows
  2. A permission error for the query
  3. Masked values in the result set Correct answer.
  4. Encrypted binary values

Explanation

Dynamic data masking rewrites the values in the result set at query time, so unauthorized users see the masked form while the stored data is untouched. Users granted UNMASK, and certain privileged roles, see the original values.

Question 47Implement a secure environment

Which Azure SQL auditing destination stores audit records in a workspace where they can be queried with Kusto Query Language?

  1. Azure Event Hubs
  2. An Azure Storage account
  3. A Log Analytics workspace Correct answer.
  4. A file share on a virtual machine

Explanation

Auditing can write to Azure Storage, to Log Analytics, or to Event Hubs. Choosing a Log Analytics workspace makes the records queryable with KQL and lets Azure Monitor alerts and workbooks consume them.

Question 48Implement a secure environment

Which service detects anomalous database access patterns and potential SQL injection attacks against Azure SQL Database?

  1. Microsoft Defender for SQL Correct answer.
  2. Azure Firewall
  3. Azure Policy
  4. Microsoft Entra ID Protection

Explanation

Microsoft Defender for SQL, delivered through Microsoft Defender for Cloud, provides advanced threat protection alerts for suspicious activity such as SQL injection and unusual access locations. It also includes vulnerability assessment and data classification capabilities.

Question 49Implement a secure environment

Which statement creates a database user that authenticates with Microsoft Entra ID and has no login in the master database?

  1. CREATE LOGIN [[email protected]] FROM EXTERNAL PROVIDER;
  2. CREATE USER [[email protected]] FOR LOGIN [[email protected]];
  3. CREATE USER [[email protected]] WITH PASSWORD = 'P@ssw0rd';
  4. CREATE USER [[email protected]] FROM EXTERNAL PROVIDER; Correct answer.

Explanation

Contained database users for Microsoft Entra identities are created inside the user database with FROM EXTERNAL PROVIDER, and they do not depend on a server-level login. This makes the database portable and keeps authentication tied to the directory.

Question 50Implement a secure environment

A client application runs parameterized queries against columns protected by Always Encrypted. Which connection string setting must be enabled?

  1. TrustServerCertificate=True
  2. Column Encryption Setting=Enabled Correct answer.
  3. MultipleActiveResultSets=True
  4. Encrypt=True

Explanation

Always Encrypted is performed by the client driver, which must be told to encrypt parameters and decrypt results through Column Encryption Setting=Enabled. Without it, the driver treats the encrypted columns as binary data.