Your Azure SQL Database is accessed by an application running on an Azure VM in a virtual network. You want to restrict access so that only traffic from that virtual network can reach the database, and you want to avoid exposing the database to the public internet. What should you configure?

An Azure Bastion host and a firewall rule for the Bastion subnet.

A private endpoint for the database and a database-level firewall rule for the VM's private IP.

A virtual network service endpoint for Microsoft.Sql on the subnet, and a virtual network firewall rule on the logical server.

A server-level firewall rule allowing the VM's public IP address.

You have an Azure SQL Database with Always Encrypted columns. You need to rotate the column master key. The application is currently running and you want to minimize downtime. What should you do?

Drop the column master key and recreate it.

Change the encryption type from randomized to deterministic.

Create a new column master key, update the column encryption key to use the new master key, and then rotate the column encryption key.

Use TDE to re-encrypt the database.

What is the primary purpose of Transparent Data Encryption (TDE) in Azure SQL Database?

To encrypt individual columns containing sensitive data so that only the application can decrypt them

To mask sensitive data from unauthorized users by altering query results

To encrypt data as it travels between the client and the database

To encrypt the physical database files and backups at rest without requiring application changes

In Azure SQL Database, what is the difference between a server-level firewall rule and a database-level firewall rule?

Server-level rules apply to all databases on the server, while database-level rules apply only to a specific database

Server-level rules are more secure because they allow only one IP address, while database-level rules allow ranges

Database-level rules are required for all connections, while server-level rules are optional

Server-level rules can only be created by Azure administrators, while database-level rules can be created by any user

Microsoft Certified:Azure Database Administrator Associate

Domain 2Objective 2

Implement Security for Data at Rest and Data in Transit DP-300 Practice Questions (Page 2)

Part of the Implement a secure environment domain, which accounts for 20–25% of the DP-300 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 3–5 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

9concepts

20–25%of the exam

Questions 6–10

6application · medium
Your Azure SQL Database is accessed by an application running on an Azure VM in a virtual network. You want to restrict access so that only traffic from that virtual network can reach the database, and you want to avoid exposing the database to the public internet. What should you configure?
Select an answer first
7expert · hard
You have an Azure SQL Database with Always Encrypted columns. You need to rotate the column master key. The application is currently running and you want to minimize downtime. What should you do?
Select an answer first
8foundation · easy
What is the primary purpose of Transparent Data Encryption (TDE) in Azure SQL Database?
Select an answer first
9foundation · easy
Which Azure resource is created to establish a private connection to Azure SQL Database using Private Link?
Select an answer first
10foundation · easy
In Azure SQL Database, what is the difference between a server-level firewall rule and a database-level firewall rule?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DP-300

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “DP-300” is a trademark of its owner, used for identification only.