Your Azure SQL Database is currently using TDE with service-managed keys. You need to ensure that the TDE protector can be rotated automatically on a schedule. What should you do?

Enable Azure Defender for SQL to rotate keys.

Keep service-managed keys and manually rotate them.

Use Always Encrypted to rotate the column master key.

Switch to customer-managed keys in Azure Key Vault and configure key rotation.

When configuring a virtual network service endpoint for Azure SQL Database, which firewall rule setting is used to allow traffic from the virtual network?

Add a firewall rule with the public IP address of the virtual network

Allow Azure Services and resources to access this server

Set the minimum TLS version to 1.2

Add a virtual network rule that references the virtual network and subnet

Which Azure SQL feature allows you to encrypt individual columns containing sensitive data using a certificate or asymmetric key stored in the database?

Column-level encryption using CREATE SYMMETRIC KEY and ENCRYPTBYKEY

Transparent Data Encryption (TDE)

A government agency uses Azure SQL Database to store citizen records. They have a requirement that sensitive columns (e.g., national ID) must be encrypted in transit between the application and the database, and also at rest. The application is a legacy .NET application that cannot be modified to use new client drivers. What should you do to meet the requirement?

Use a VPN gateway to connect the application to the database.

Use dynamic data masking to hide the national ID from users.

Enable TDE on the database and enforce TLS 1.2 for all connections.

Enable Always Encrypted on the national ID column.

Your application stores personally identifiable information (PII) in Azure SQL Database. You need to ensure that the PII is encrypted both at rest and in transit, and that the database administrators cannot view the plaintext values. What should you implement?

Always Encrypted on the PII columns.

Use Dynamic Data Masking on the PII columns.

Transparent Data Encryption (TDE) on the database.

Use TLS for all connections and TDE.

Microsoft Certified:Azure Database Administrator Associate

Domain 2Objective 2

Implement Security for Data at Rest and Data in Transit DP-300 Practice Questions (Page 3)

Part of the Implement a secure environment domain, which accounts for 20–25% of the DP-300 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 3–5 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

9concepts

20–25%of the exam

Questions 11–15

11application · medium
Your Azure SQL Database is currently using TDE with service-managed keys. You need to ensure that the TDE protector can be rotated automatically on a schedule. What should you do?
Select an answer first
12foundation · easy
When configuring a virtual network service endpoint for Azure SQL Database, which firewall rule setting is used to allow traffic from the virtual network?
Select an answer first
13foundation · easy
Which Azure SQL feature allows you to encrypt individual columns containing sensitive data using a certificate or asymmetric key stored in the database?
Select an answer first
14application · medium
A government agency uses Azure SQL Database to store citizen records. They have a requirement that sensitive columns (e.g., national ID) must be encrypted in transit between the application and the database, and also at rest. The application is a legacy .NET application that cannot be modified to use new client drivers. What should you do to meet the requirement?
Select an answer first
15application · medium
Your application stores personally identifiable information (PII) in Azure SQL Database. You need to ensure that the PII is encrypted both at rest and in transit, and that the database administrators cannot view the plaintext values. What should you implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DP-300

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “DP-300” is a trademark of its owner, used for identification only.