A healthcare organization stores patient data in Azure SQL Database. Compliance requires that specific columns (e.g., patient name and social security number) remain encrypted even when queried by application users. The application uses standard ADO.NET with a connection string. You need to implement a solution that prevents plaintext data from ever being sent to the database for those columns. What should you do?

Enable TDE on the database and configure the application connection string with 'Encrypt=True'.

Use dynamic data masking to mask the sensitive columns for non-privileged users.

Enable Always Encrypted on the columns and configure the application connection string with 'Column Encryption Setting=Enabled'.

Create a database-level firewall rule that only allows the application server's IP address.

Your Azure SQL Database contains a table with a column that stores credit card numbers. The compliance team requires that this column be encrypted at rest, but you cannot change the application code. What should you implement?

Use Dynamic Data Masking on the column.

Create a column master key and encrypt the column manually.

Use Always Encrypted on the credit card column.

Enable Transparent Data Encryption (TDE) on the database.

What is a key limitation of using column-level encryption with database-stored keys (e.g., ENCRYPTBYKEY) in Azure SQL Database?

It only works with Azure SQL Managed Instance, not Azure SQL Database

It requires the use of Azure Key Vault for all keys

It encrypts data in transit but not at rest

Encrypted columns cannot be indexed or used in WHERE clauses efficiently

What is the purpose of a virtual network service endpoint for Azure SQL Database?

To provide a private IP address for the database within the virtual network

To restrict access to Azure SQL Database so that it can only be reached from a specific virtual network subnet

To encrypt all data in transit between the virtual network and the database

To connect to the database from on-premises networks using a VPN gateway

What is the purpose of Azure Private Link for Azure SQL Database?

To allow access from any Azure service without firewall rules

To encrypt data in transit using TLS 1.2

To connect to Azure SQL Database privately from a virtual network, without exposing the database to the public internet

To provide a public endpoint with a custom domain name

Microsoft Certified:Azure Database Administrator Associate

Domain 2Objective 2

Implement Security for Data at Rest and Data in Transit DP-300 Practice Questions (Page 1)

Part of the Implement a secure environment domain, which accounts for 20–25% of the DP-300 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 3–5 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

9concepts

20–25%of the exam

Questions 1–5

1application · medium
A healthcare organization stores patient data in Azure SQL Database. Compliance requires that specific columns (e.g., patient name and social security number) remain encrypted even when queried by application users. The application uses standard ADO.NET with a connection string. You need to implement a solution that prevents plaintext data from ever being sent to the database for those columns. What should you do?
Select an answer first
2application · medium
Your Azure SQL Database contains a table with a column that stores credit card numbers. The compliance team requires that this column be encrypted at rest, but you cannot change the application code. What should you implement?
Select an answer first
3foundation · easy
What is a key limitation of using column-level encryption with database-stored keys (e.g., ENCRYPTBYKEY) in Azure SQL Database?
Select an answer first
4foundation · easy
What is the purpose of a virtual network service endpoint for Azure SQL Database?
Select an answer first
5foundation · easy
What is the purpose of Azure Private Link for Azure SQL Database?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DP-300

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “DP-300” is a trademark of its owner, used for identification only.