A retail company stores customer credit card numbers in an Azure SQL Database. They are required to encrypt the credit card numbers at rest, but they do not want to encrypt the entire database because of performance concerns. They also need to ensure that the encryption keys are managed by their own security team. What should you implement?

Use Always Encrypted on the credit card column with a column master key stored in Azure Key Vault.

Enable TDE with a customer-managed key in Azure Key Vault.

Create a database-level firewall rule to restrict access to the credit card column.

Use dynamic data masking to hide the credit card numbers from non-privileged users.

Your Azure SQL Database is currently using service-managed keys for TDE. The security team now requires that you manage your own encryption keys using Azure Key Vault. What should you do?

Use a server-level firewall rule to restrict access.

Change the TDE key to a customer-managed key stored in Azure Key Vault.

Keep service-managed keys and add Always Encrypted.

A healthcare application stores patient names and social security numbers in an Azure SQL Database. The security team requires that these fields remain encrypted even from database administrators and that plaintext values never appear in query results on the server. What should you implement?

Always Encrypted with deterministic encryption on the sensitive columns.

Transparent Data Encryption (TDE) on the database.

Dynamic Data Masking on the sensitive columns.

Row-Level Security to restrict access to the sensitive columns.

A company uses Always Encrypted to protect a column that stores social security numbers. The application is a .NET application that uses the SqlClient driver. They need to rotate the column encryption key every 90 days. The rotation must not require the application to be taken offline, and the data must remain encrypted during the rotation. What should you do?

Use the ALTER COLUMN ENCRYPTION KEY statement with the ENCRYPTION BY clause to rotate the key in place.

Use TDE to encrypt the database and then rotate the TDE key.

Create a new column encryption key, update the application connection string, and manually re-encrypt the data.

Disable Always Encrypted, rotate the key, and then re-enable Always Encrypted.

What is required to implement Always Encrypted for a column in Azure SQL Database?

A column master key and a column encryption key, along with client-side driver support

A virtual network service endpoint and a private endpoint

A server-level firewall rule and a database-level firewall rule

An Azure Key Vault with a customer-managed key for TDE

Microsoft Certified:Azure Database Administrator Associate

Domain 2Objective 2

Implement Security for Data at Rest and Data in Transit DP-300 Practice Questions (Page 5)

Part of the Implement a secure environment domain, which accounts for 20–25% of the DP-300 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 3–5 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

9concepts

20–25%of the exam

Questions 21–25

21application · medium
A retail company stores customer credit card numbers in an Azure SQL Database. They are required to encrypt the credit card numbers at rest, but they do not want to encrypt the entire database because of performance concerns. They also need to ensure that the encryption keys are managed by their own security team. What should you implement?
Select an answer first
22application · medium
Your Azure SQL Database is currently using service-managed keys for TDE. The security team now requires that you manage your own encryption keys using Azure Key Vault. What should you do?
Select an answer first
23application · medium
A healthcare application stores patient names and social security numbers in an Azure SQL Database. The security team requires that these fields remain encrypted even from database administrators and that plaintext values never appear in query results on the server. What should you implement?
Select an answer first
24expert · hard
A company uses Always Encrypted to protect a column that stores social security numbers. The application is a .NET application that uses the SqlClient driver. They need to rotate the column encryption key every 90 days. The rotation must not require the application to be taken offline, and the data must remain encrypted during the rotation. What should you do?
Select an answer first
25foundation · easy
What is required to implement Always Encrypted for a column in Azure SQL Database?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DP-300

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “DP-300” is a trademark of its owner, used for identification only.

Implement Security for Data at Rest and Data in Transit DP-300 Practice Questions (Page 5)

Questions 21–25

Your Azure SQL Database is currently using service-managed keys for TDE. The security team now requires that you manage your own encryption keys using Azure Key Vault. What should you do?

A healthcare application stores patient names and social security numbers in an Azure SQL Database. The security team requires that these fields remain encrypted even from database administrators and that plaintext values never appear in query results on the server. What should you implement?

What is required to implement Always Encrypted for a column in Azure SQL Database?

Keep studying — Implement a secure environment