A GraphQL API is used by multiple client applications to access an Azure SQL Database. Each client application has its own managed identity. Security requires that each client can only see rows belonging to its own organization. The API currently uses a single database login. You need to enforce tenant isolation without modifying the GraphQL schema. What should you do?

Use a single database login and rely on the GraphQL resolvers to filter data by organization.

Pass the client's managed identity object ID to the database using SESSION_CONTEXT and implement Row-Level Security.

Create a separate database user for each managed identity and have the GraphQL API impersonate the user.

Enable Dynamic Data Masking on all columns and use a different mask for each organization.

An application uses a Model Context Protocol (MCP) endpoint to allow AI agents to query a database. Security requires that the endpoint authenticate the AI agent and that all queries be logged for audit. The agent runs in Azure and has a managed identity. What should you configure?

Disable authentication on the MCP endpoint and rely on network security groups.

Use a shared secret stored in the MCP endpoint's configuration.

Use API keys for the MCP endpoint and log all requests in the application.

Configure the MCP endpoint to accept Microsoft Entra ID tokens and enable Azure SQL auditing for the underlying database.

Which key hierarchy is used by Transparent Data Encryption (TDE) in Azure SQL Database to protect the database encryption key?

Service master key -> Database encryption key

Database master key -> Certificate -> Database encryption key

Server-level protector -> Database encryption key

Column master key -> Column encryption key

A multi-tenant SaaS application uses a single Azure SQL Database. Each tenant's data is identified by a TenantId column. You need to ensure that users from Tenant A can only see rows belonging to Tenant A, even if they join tables or use views. The application already passes the TenantId as a session context. What should you implement?

Create a separate database for each tenant and use a login trigger to switch databases.

Use Dynamic Data Masking to hide the TenantId column from users.

Create a security policy with a filter predicate that compares TenantId to SESSION_CONTEXT(N'TenantId').

Grant SELECT only on views that include a WHERE TenantId = SESSION_CONTEXT(N'TenantId') clause.

Microsoft Certified:SQL AI Developer Associate

Domain 2Objective 1

Implement Data Security and Compliance DP-800 Practice Questions (Page 8)

Part of the Secure, optimize, and deploy database solutions domain, which accounts for 35–40% of the DP-800 exam. Microsoft does not publish an official question count, but from its 120-minute exam (~50–80 total, ~18–32 in this domain), expect 5–8 from this objective — we provide 55 practice questions to prepare you well beyond it. (estimate)

55questions here

11free pages

15concepts

35–40%of the exam

Questions 36–40

36expert · hard
A GraphQL API is used by multiple client applications to access an Azure SQL Database. Each client application has its own managed identity. Security requires that each client can only see rows belonging to its own organization. The API currently uses a single database login. You need to enforce tenant isolation without modifying the GraphQL schema. What should you do?
Select an answer first
37application · medium
An application uses a Model Context Protocol (MCP) endpoint to allow AI agents to query a database. Security requires that the endpoint authenticate the AI agent and that all queries be logged for audit. The agent runs in Azure and has a managed identity. What should you configure?
Select an answer first
38foundation · easy
What does MCP stand for in the context of secure endpoints?
Select an answer first
39foundation · easy
Which key hierarchy is used by Transparent Data Encryption (TDE) in Azure SQL Database to protect the database encryption key?
Select an answer first
40application · medium
A multi-tenant SaaS application uses a single Azure SQL Database. Each tenant's data is identified by a TenantId column. You need to ensure that users from Tenant A can only see rows belonging to Tenant A, even if they join tables or use views. The application already passes the TenantId as a session context. What should you implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DP-800

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “DP-800” is a trademark of its owner, used for identification only.

Implement Data Security and Compliance DP-800 Practice Questions (Page 8)

Questions 36–40

An application uses a Model Context Protocol (MCP) endpoint to allow AI agents to query a database. Security requires that the endpoint authenticate the AI agent and that all queries be logged for audit. The agent runs in Azure and has a managed identity. What should you configure?

What does MCP stand for in the context of secure endpoints?

Which key hierarchy is used by Transparent Data Encryption (TDE) in Azure SQL Database to protect the database encryption key?

Keep studying — Secure, optimize, and deploy database solutions