Your application uses an Azure SQL Database and needs to store credit card numbers. The security team requires that the credit card numbers be encrypted at rest and in transit, and that the application must be able to perform equality searches on the credit card numbers. What should you implement?

Always Encrypted with deterministic encryption on the credit card column.

Always Encrypted with randomized encryption on the credit card column.

Use TLS for connections and TDE.

Transparent Data Encryption (TDE) on the database.

Which component in Always Encrypted is stored in a secure location outside of the database and is used to protect the column encryption keys?

Transparent data encryption certificate

You have an Azure SQL Database with Always Encrypted columns using randomized encryption. The application needs to perform equality lookups on an encrypted column, but the current setup does not support them. You want to enable rich queries without rewriting the application to use client-side computations. What should you do?

Use a computed column with a hash of the encrypted value.

Switch to Transparent Data Encryption (TDE) for the database.

Change the encryption type to deterministic encryption.

Enable Always Encrypted with VBS enclaves and use secure enclave attestation.

Your application uses Always Encrypted with VBS enclaves. You need to perform a bulk update on an encrypted column, but the current setup does not support in-place encryption operations. What should you do?

Use ALTER TABLE ... ALTER COLUMN to re-encrypt the column in-place.

Export the data, decrypt it, and re-import it.

Disable Always Encrypted and use TDE.

Use a client-side application to encrypt the data before inserting.

Your company requires that an Azure SQL Database be accessible only from a specific virtual network and that the database's public endpoint be completely disabled. You also need to ensure that traffic between the VM and the database never traverses the public internet. What should you implement?

Add a virtual network service endpoint and a firewall rule for the subnet.

Configure a network security group (NSG) on the database subnet.

Use an Azure VPN gateway and a server-level firewall rule for the VPN client IP.

Create a private endpoint for the database and disable public network access.

Microsoft Certified:Azure Database Administrator Associate

Domain 2Objective 2

Implement Security for Data at Rest and Data in Transit DP-300 Practice Questions (Page 4)

Part of the Implement a secure environment domain, which accounts for 20–25% of the DP-300 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 3–5 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

9concepts

20–25%of the exam

Questions 16–20

16application · medium
Your application uses an Azure SQL Database and needs to store credit card numbers. The security team requires that the credit card numbers be encrypted at rest and in transit, and that the application must be able to perform equality searches on the credit card numbers. What should you implement?
Select an answer first
17foundation · easy
Which component in Always Encrypted is stored in a secure location outside of the database and is used to protect the column encryption keys?
Select an answer first
18expert · hard
You have an Azure SQL Database with Always Encrypted columns using randomized encryption. The application needs to perform equality lookups on an encrypted column, but the current setup does not support them. You want to enable rich queries without rewriting the application to use client-side computations. What should you do?
Select an answer first
19expert · hard
Your application uses Always Encrypted with VBS enclaves. You need to perform a bulk update on an encrypted column, but the current setup does not support in-place encryption operations. What should you do?
Select an answer first
20application · medium
Your company requires that an Azure SQL Database be accessible only from a specific virtual network and that the database's public endpoint be completely disabled. You also need to ensure that traffic between the VM and the database never traverses the public internet. What should you implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DP-300

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “DP-300” is a trademark of its owner, used for identification only.