cert
cert-1
cert-2

Pass Microsoft DP-300 Exam in First Attempt Guaranteed!

Get 100% Latest Exam Questions, Accurate & Verified Answers to Pass the Actual Exam!
30 Days Free Updates, Instant Download!

cert-5
cert-6
DP-300 Exam - Verified By Experts
DP-300 Premium Bundle
$29.98

DP-300 Premium Bundle

$79.99
$109.97
  • Premium File 470 Questions & Answers. Last update: Nov 10, 2026
  • Training Course 130 Video Lectures
  • Study Guide 672 Pages
 
$109.97
$79.99
accept 43 downloads in last 7 days
block-screenshots
Purchase Microsoft DP-300 Exam Training Products Individually
Microsoft DP-300 Premium File
Premium File 470 Q&A
$76.99$69.99
Microsoft DP-300 Video Training Course
Training Course 130 Lectures
$21.99 $19.99
Microsoft DP-300 PDF Study Guide
Study Guide 672 Pages
$21.99 $19.99
Microsoft DP-300 Practice Test 41

Question 400

A procedure executes quickly for a small branch but spills tempdb when a national branch passes a very different parameter distribution. Which observable result BEST proves the database administration requirement is satisfied?

  1. A problematic query recovers representative execution time without forcing a plan that fails under other parameter or schema conditions.
  2. Performance improvements persist under measured production workloads and failed recommendations are reversed or disabled according to policy.
  3. Access paths and estimates remain healthy with acceptable maintenance duration, transaction log growth and production concurrency.
  4. A representative mix of small and large parameter executions achieves stable resource use, with intelligent feature effects monitored over time.

Explanation

Correct Answer

D:

A representative mix of small and large parameter executions achieves stable resource use, with intelligent feature effects monitored over time. This is the observable database and application outcome rather than merely a saved setting. Intelligent recommendations require contextual validation; SQL intelligent query processing features depend on engine version, database compatibility and workload shape.

Incorrect Answers

A:

A problematic query recovers representative execution time without forcing a plan that fails under other parameter or schema conditions. This would validate Query Store plan regressions and forced plans, but it does not establish the required outcome here. Verify instead: A representative mix of small and large parameter executions achieves stable resource use, with intelligent feature effects monitored over time.

B:

Performance improvements persist under measured production workloads and failed recommendations are reversed or disabled according to policy. This would validate Automatic tuning and intelligent query processing guardrails, but it does not establish the required outcome here. Verify instead: A representative mix of small and large parameter executions achieves stable resource use, with intelligent feature effects monitored over time.

C:

Access paths and estimates remain healthy with acceptable maintenance duration, transaction log growth and production concurrency. This would validate Index and statistics maintenance with targeted cadence, but it does not establish the required outcome here. Verify instead: A representative mix of small and large parameter executions achieves stable resource use, with intelligent feature effects monitored over time.

Question 401

A SQL Server availability group fails to synchronize because its mirroring endpoint cannot communicate through the network security policy. Which observable result BEST proves the database administration requirement is satisfied?

  1. A restore to the required historical point completes into a supported database target and data plus dependent identities are validated.
  2. The intended database replicas transition primary role as designed and application connections reach the listener without unsupported database or instance assumptions.
  3. The SQL Server instance restarts on an eligible node using accessible shared data and log storage while the application resolves the cluster virtual network name.
  4. Approved managed-instance failover or hybrid transition works after controlled traffic redirection, with required instance features and logins present.

Explanation

Correct Answer

B:

The intended database replicas transition primary role as designed and application connections reach the listener without unsupported database or instance assumptions. This is the observable database and application outcome rather than merely a saved setting. An AG protects replicated user databases and requires cluster/listener configuration; it does not automatically synchronize every SQL Agent job or server-level login.

Incorrect Answers

A:

A restore to the required historical point completes into a supported database target and data plus dependent identities are validated. This would validate Azure SQL automatic PITR and long-term retention, but it does not establish the required outcome here. Verify instead: The intended database replicas transition primary role as designed and application connections reach the listener without unsupported database or instance assumptions.

C:

The SQL Server instance restarts on an eligible node using accessible shared data and log storage while the application resolves the cluster virtual network name. This would validate SQL Server failover cluster instances shared storage constraints, but it does not establish the required outcome here. Verify instead: The intended database replicas transition primary role as designed and application connections reach the listener without unsupported database or instance assumptions.

D:

Approved managed-instance failover or hybrid transition works after controlled traffic redirection, with required instance features and logins present. This would validate Managed Instance hybrid recovery and operational readiness, but it does not establish the required outcome here. Verify instead: The intended database replicas transition primary role as designed and application connections reach the listener without unsupported database or instance assumptions.

Question 402

A legacy reporting service depends on access to operating-system file paths and custom SQL instance extensions that are unavailable on its proposed PaaS target. Which TWO complementary actions provide the appropriate response AND evidence to verify it? Select TWO.

  1. Measure vCore pressure, memory grants, data and log latency, tempdb contention, IOPS ceilings, disk caching, VM SKU caps and scaling windows.
  2. Use Azure Arc-enabled SQL Server to inventory and govern supported SQL Server instances outside Azure without assuming Arc moves their databases or turns them into PaaS.
  3. The chosen tier or pool absorbs expected peaks with measured response times while avoiding waste from persistently idle dedicated allocations.
  4. Inventory SQL Agent, cross-database dependencies, instance features, latency, licensing, OS access and application connection requirements before choosing a target.
  5. Select Azure SQL Database for managed database-level PaaS needs, Azure SQL Managed Instance when near-instance compatibility is required, or SQL Server on Azure VMs for OS and instance control.

Explanation

Correct Answers

D:

Inventory SQL Agent, cross-database dependencies, instance features, latency, licensing, OS access and application connection requirements before choosing a target. This is the discriminating system or configuration evidence for the case. A managed database offering does not necessarily expose every SQL Server instance feature; platform responsibility differs from SQL Server on a VM. Corresponding approach: Select Azure SQL Database for managed database-level PaaS needs, Azure SQL Managed Instance when near-instance compatibility is required, or SQL Server on Azure VMs for OS and instance control. It supplies the evidence portion of this complementary answer.

E:

Select Azure SQL Database for managed database-level PaaS needs, Azure SQL Managed Instance when near-instance compatibility is required, or SQL Server on Azure VMs for OS and instance control. This is the supported administration mechanism for the described workload. A managed database offering does not necessarily expose every SQL Server instance feature; platform responsibility differs from SQL Server on a VM. Verify with: Inventory SQL Agent, cross-database dependencies, instance features, latency, licensing, OS access and application connection requirements before choosing a target. It supplies the implementation portion of this complementary answer.

Incorrect Answers

A:

Measure vCore pressure, memory grants, data and log latency, tempdb contention, IOPS ceilings, disk caching, VM SKU caps and scaling windows. This choice pertains to Managed Instance and SQL VM compute storage scaling, not the needed response/evidence pair. Use: Select Azure SQL Database for managed database-level PaaS needs, Azure SQL Managed Instance when near-instance compatibility is required, or SQL Server on Azure VMs for OS and instance control. Check: Inventory SQL Agent, cross-database dependencies, instance features, latency, licensing, OS access and application connection requirements before choosing a target.

B:

Use Azure Arc-enabled SQL Server to inventory and govern supported SQL Server instances outside Azure without assuming Arc moves their databases or turns them into PaaS. This choice pertains to Azure Arc-enabled SQL and hybrid fleet governance, not the needed response/evidence pair. Use: Select Azure SQL Database for managed database-level PaaS needs, Azure SQL Managed Instance when near-instance compatibility is required, or SQL Server on Azure VMs for OS and instance control. Check: Inventory SQL Agent, cross-database dependencies, instance features, latency, licensing, OS access and application connection requirements before choosing a target.

C:

The chosen tier or pool absorbs expected peaks with measured response times while avoiding waste from persistently idle dedicated allocations. This choice pertains to Azure SQL Database service tiers and elastic pools, not the needed response/evidence pair. Use: Select Azure SQL Database for managed database-level PaaS needs, Azure SQL Managed Instance when near-instance compatibility is required, or SQL Server on Azure VMs for OS and instance control. Check: Inventory SQL Agent, cross-database dependencies, instance features, latency, licensing, OS access and application connection requirements before choosing a target.

Question 403

An app requires consistent millisecond latency during unpredictable bursts and the team chooses a serverless auto-pause configuration without checking resume latency. Which diagnostic evidence should the database administrator check FIRST?

  1. Inspect CPU, data IO, log write, storage, concurrent sessions, DTU/vCore utilization, pool-level pressure and per-database limits.
  2. Inspect migration replication health, source change rate, lag, database compatibility, authentication, connection-string cutover and residual transaction state.
  3. Inspect backup format, target offering limits, export size, authentication mapping, integrity checks, DBCC findings, workload baselines and cutover test results.
  4. Inspect predicate selectivity, partition elimination, split/merge plans, aligned indexes, compression CPU overhead and real data size reduction.

Explanation

Correct Answer

A:

Inspect CPU, data IO, log write, storage, concurrent sessions, DTU/vCore utilization, pool-level pressure and per-database limits. This is the discriminating system or configuration evidence for the case. Elastic pools share resources across eligible Azure SQL databases; adding a pool cannot eliminate an individual database's workload or resource configuration limits. Corresponding approach: Choose database vCore or DTU purchasing models, compute tier and elastic-pool membership from measured resource patterns, isolation needs and predictable workload peaks.

Incorrect Answers

B:

Inspect migration replication health, source change rate, lag, database compatibility, authentication, connection-string cutover and residual transaction state. These checks primarily test Online migration with controlled cutover and validation instead of the critical system behavior in this case. Examine: Inspect CPU, data IO, log write, storage, concurrent sessions, DTU/vCore utilization, pool-level pressure and per-database limits.

C:

Inspect backup format, target offering limits, export size, authentication mapping, integrity checks, DBCC findings, workload baselines and cutover test results. These checks primarily test Offline migration and post-migration verification instead of the critical system behavior in this case. Examine: Inspect CPU, data IO, log write, storage, concurrent sessions, DTU/vCore utilization, pool-level pressure and per-database limits.

D:

Inspect predicate selectivity, partition elimination, split/merge plans, aligned indexes, compression CPU overhead and real data size reduction. These checks primarily test Table partitioning compression and scale-out tradeoffs instead of the critical system behavior in this case. Examine: Inspect CPU, data IO, log write, storage, concurrent sessions, DTU/vCore utilization, pool-level pressure and per-database limits.

Question 404

A recurring statistics update job overlaps itself during peak hours because the prior execution exceeded the scheduling interval. Which observable result BEST proves the database administration requirement is satisfied?

  1. The repaired scheduled job completes reliably and re-executing a partially completed workflow does not double-post or delete unintended data.
  2. The maintenance job executes on the approved cadence with least-privilege identity and traceable execution logs without depending on a personal admin login.
  3. The automation updates only intended database resources and produces repeatable audit evidence of changes and failures without storing plaintext passwords.
  4. The job runs on intended databases with controlled concurrency and job history that identifies any failed or skipped target for remediation.

Explanation

Correct Answer

A:

The repaired scheduled job completes reliably and re-executing a partially completed workflow does not double-post or delete unintended data. This is the observable database and application outcome rather than merely a saved setting. Retrying a failed job without tracking committed work can create duplicate actions; application and SQL job state must be reconciled.

Incorrect Answers

B:

The maintenance job executes on the approved cadence with least-privilege identity and traceable execution logs without depending on a personal admin login. This would validate SQL Server Agent schedules and job ownership, but it does not establish the required outcome here. Verify instead: The repaired scheduled job completes reliably and re-executing a partially completed workflow does not double-post or delete unintended data.

C:

The automation updates only intended database resources and produces repeatable audit evidence of changes and failures without storing plaintext passwords. This would validate Azure PowerShell and CLI operations with scoped automation identity, but it does not establish the required outcome here. Verify instead: The repaired scheduled job completes reliably and re-executing a partially completed workflow does not double-post or delete unintended data.

D:

The job runs on intended databases with controlled concurrency and job history that identifies any failed or skipped target for remediation. This would validate Azure SQL Database elastic jobs for fleet maintenance, but it does not establish the required outcome here. Verify instead: The repaired scheduled job completes reliably and re-executing a partially completed workflow does not double-post or delete unintended data.

Question 405

A team proposes a range comparison on randomized encrypted values without checking whether its target and enclave configuration support the operation. Which TWO complementary actions provide the appropriate response AND evidence to verify it? Select TWO.

  1. Enable supported Transparent Data Encryption and choose managed or customer-managed protectors based on compliance, rotating keys without losing the ability to decrypt database backups.
  2. Use Always Encrypted to protect selected columns with client-side cryptography and evaluate secure enclaves for supported confidential computations and richer query operations.
  3. A previously failing user connects with the correct principal and performs only approved operations after a narrowly scoped corrective change.
  4. Inspect encrypted column metadata, column master and encryption keys, driver feature support, enclave attestation where applicable and key store permissions.
  5. Review key hierarchy, certificate availability, encrypted payload format, authorized decryption path, T-SQL function usage, rotation and backup procedures.

Explanation

Correct Answers

B:

Use Always Encrypted to protect selected columns with client-side cryptography and evaluate secure enclaves for supported confidential computations and richer query operations. This is the supported administration mechanism for the described workload. Always Encrypted is distinct from TDE; queries and operations may be constrained without supported enclave capabilities and drivers. Verify with: Inspect encrypted column metadata, column master and encryption keys, driver feature support, enclave attestation where applicable and key store permissions. It supplies the implementation portion of this complementary answer.

D:

Inspect encrypted column metadata, column master and encryption keys, driver feature support, enclave attestation where applicable and key store permissions. This is the discriminating system or configuration evidence for the case. Always Encrypted is distinct from TDE; queries and operations may be constrained without supported enclave capabilities and drivers. Corresponding approach: Use Always Encrypted to protect selected columns with client-side cryptography and evaluate secure enclaves for supported confidential computations and richer query operations. It supplies the evidence portion of this complementary answer.

Incorrect Answers

A:

Enable supported Transparent Data Encryption and choose managed or customer-managed protectors based on compliance, rotating keys without losing the ability to decrypt database backups. This choice pertains to Transparent data encryption keys and protector lifecycle, not the needed response/evidence pair. Use: Use Always Encrypted to protect selected columns with client-side cryptography and evaluate secure enclaves for supported confidential computations and richer query operations. Check: Inspect encrypted column metadata, column master and encryption keys, driver feature support, enclave attestation where applicable and key store permissions.

C:

A previously failing user connects with the correct principal and performs only approved operations after a narrowly scoped corrective change. This choice pertains to Diagnosing login failure and group-based access, not the needed response/evidence pair. Use: Use Always Encrypted to protect selected columns with client-side cryptography and evaluate secure enclaves for supported confidential computations and richer query operations. Check: Inspect encrypted column metadata, column master and encryption keys, driver feature support, enclave attestation where applicable and key store permissions.

E:

Review key hierarchy, certificate availability, encrypted payload format, authorized decryption path, T-SQL function usage, rotation and backup procedures. This choice pertains to Object-level encryption and database cryptographic controls, not the needed response/evidence pair. Use: Use Always Encrypted to protect selected columns with client-side cryptography and evaluate secure enclaves for supported confidential computations and richer query operations. Check: Inspect encrypted column metadata, column master and encryption keys, driver feature support, enclave attestation where applicable and key store permissions.

Question 406

A DBA disables intelligent query processing globally because one query regressed after a compatibility-level change, without isolating the affected feature. Which Azure SQL or SQL Server administrative approach is MOST appropriate?

  1. Use Query Store to compare query runtime and plan history, identify a genuine plan regression, and force a known suitable plan only with ongoing validation and rollback.
  2. Diagnose blocked and deadlocked sessions using live DMVs and deadlock graphs, then fix transaction scope, indexing or isolation behavior with concurrency tests.
  3. Schedule integrity checks, index and statistics maintenance based on measured fragmentation, modification rates and SLA rather than indiscriminately rebuilding every object each night.
  4. Correlate Azure SQL Intelligent Insights or Query Store evidence with parameter sensitivity and memory grant patterns, selecting documented plan or query changes instead of blindly upgrading SKU.

Explanation

Correct Answer

D:

Correlate Azure SQL Intelligent Insights or Query Store evidence with parameter sensitivity and memory grant patterns, selecting documented plan or query changes instead of blindly upgrading SKU. This is the supported administration mechanism for the described workload. Intelligent recommendations require contextual validation; SQL intelligent query processing features depend on engine version, database compatibility and workload shape. Verify with: Inspect diagnostic recommendations, Query Store plan variability, runtime skew, parameter compilation, memory grant feedback and database compatibility settings.

Incorrect Answers

A:

Use Query Store to compare query runtime and plan history, identify a genuine plan regression, and force a known suitable plan only with ongoing validation and rollback. This addresses Query Store plan regressions and forced plans, not the controlling requirement here. Forcing a historical plan can mitigate a regression but does not make poor statistics or parameter sensitivity disappear and may fail after schema changes. Prefer: Correlate Azure SQL Intelligent Insights or Query Store evidence with parameter sensitivity and memory grant patterns, selecting documented plan or query changes instead of blindly upgrading SKU.

B:

Diagnose blocked and deadlocked sessions using live DMVs and deadlock graphs, then fix transaction scope, indexing or isolation behavior with concurrency tests. This addresses Blocking deadlocks and isolation strategy, not the controlling requirement here. Raising an app timeout does not remove a blocking root cause; snapshot isolation can reduce some reader/writer contention but changes version-store behavior. Prefer: Correlate Azure SQL Intelligent Insights or Query Store evidence with parameter sensitivity and memory grant patterns, selecting documented plan or query changes instead of blindly upgrading SKU.

C:

Schedule integrity checks, index and statistics maintenance based on measured fragmentation, modification rates and SLA rather than indiscriminately rebuilding every object each night. This addresses Index and statistics maintenance with targeted cadence, not the controlling requirement here. Small index fragmentation percentages do not automatically justify full rebuild; large rebuilds consume log space and can block workloads. Prefer: Correlate Azure SQL Intelligent Insights or Query Store evidence with parameter sensitivity and memory grant patterns, selecting documented plan or query changes instead of blindly upgrading SKU.

Question 407

A team expects every Agent job and linked-server configuration to appear on a secondary AG replica without separately synchronizing those instance objects. Which diagnostic evidence should the database administrator check FIRST?

  1. Inspect Windows Server failover cluster or supported Linux HA configuration, availability replica state, listener IP/DNS, synchronization health, AG endpoint port and failover readiness.
  2. Inspect shared disk or supported file-share topology, Windows cluster validation, storage permissions, listener name, resource ownership and node failover tests.
  3. Check service tier, available restore points, retention setting, logical server and database permissions, LTR vault policy and restore destination.
  4. Inspect replica role, readable secondary capacity, asynchronous replication lag, failover-group listener endpoint, DNS TTL and connection retry handling.

Explanation

Correct Answer

A:

Inspect Windows Server failover cluster or supported Linux HA configuration, availability replica state, listener IP/DNS, synchronization health, AG endpoint port and failover readiness. This is the discriminating system or configuration evidence for the case. An AG protects replicated user databases and requires cluster/listener configuration; it does not automatically synchronize every SQL Agent job or server-level login. Corresponding approach: Build and monitor supported SQL Server Always On availability groups on Azure VMs and understand SQL MI link behavior, verifying cluster quorum, replica health, endpoint access and synchronization mode.

Incorrect Answers

B:

Inspect shared disk or supported file-share topology, Windows cluster validation, storage permissions, listener name, resource ownership and node failover tests. These checks primarily test SQL Server failover cluster instances shared storage constraints instead of the critical system behavior in this case. Examine: Inspect Windows Server failover cluster or supported Linux HA configuration, availability replica state, listener IP/DNS, synchronization health, AG endpoint port and failover readiness.

C:

Check service tier, available restore points, retention setting, logical server and database permissions, LTR vault policy and restore destination. These checks primarily test Azure SQL automatic PITR and long-term retention instead of the critical system behavior in this case. Examine: Inspect Windows Server failover cluster or supported Linux HA configuration, availability replica state, listener IP/DNS, synchronization health, AG endpoint port and failover readiness.

D:

Inspect replica role, readable secondary capacity, asynchronous replication lag, failover-group listener endpoint, DNS TTL and connection retry handling. These checks primarily test Azure SQL failover groups versus active geo replication decisions instead of the critical system behavior in this case. Examine: Inspect Windows Server failover cluster or supported Linux HA configuration, availability replica state, listener IP/DNS, synchronization health, AG endpoint port and failover readiness.

Question 408

A planned cluster failover completes only for the Windows role while SQL Server cannot open its shared data volumes because permissions differ across nodes. Which observable result BEST proves the database administration requirement is satisfied?

  1. The SQL Server instance restarts on an eligible node using accessible shared data and log storage while the application resolves the cluster virtual network name.
  2. The secondary replays the intended log sequence and can be recovered with documented RPO/RTO and acceptable data loss when primary fails.
  3. After a planned or forced failover the intended database endpoint serves valid writes and read-only workloads under documented consistency limits.
  4. A complete chain can be restored to the required point using valid full, differential and sequential log backups with proven integrity.

Explanation

Correct Answer

A:

The SQL Server instance restarts on an eligible node using accessible shared data and log storage while the application resolves the cluster virtual network name. This is the observable database and application outcome rather than merely a saved setting. An FCI moves SQL Server instance ownership over shared storage but does not automatically provide a separate cross-region copy of database files.

Incorrect Answers

B:

The secondary replays the intended log sequence and can be recovered with documented RPO/RTO and acceptable data loss when primary fails. This would validate Log shipping health and recovery orchestration, but it does not establish the required outcome here. Verify instead: The SQL Server instance restarts on an eligible node using accessible shared data and log storage while the application resolves the cluster virtual network name.

C:

After a planned or forced failover the intended database endpoint serves valid writes and read-only workloads under documented consistency limits. This would validate Azure SQL Database active geo replication and failover groups, but it does not establish the required outcome here. Verify instead: The SQL Server instance restarts on an eligible node using accessible shared data and log storage while the application resolves the cluster virtual network name.

D:

A complete chain can be restored to the required point using valid full, differential and sequential log backups with proven integrity. This would validate SQL Server native backup chain and recovery model, but it does not establish the required outcome here. Verify instead: The SQL Server instance restarts on an eligible node using accessible shared data and log storage while the application resolves the cluster virtual network name.

Question 409

A production SQL Server VM experiences brief deadlocks and the DBA enables an unfiltered statement-level trace for every query for a week. Which Azure SQL or SQL Server administrative approach is MOST appropriate?

  1. Use supported Azure SQL automatic tuning or IQP features with monitoring and safety controls; verify supported recommendations and their observed effect before treating them as universal fixes.
  2. Distinguish compute, data IO, log IO, memory and blocking contention using correlated counters, wait types and workload-specific thresholds before changing resources.
  3. Configure supported metrics, diagnostic settings and alerts for Azure SQL resources to detect real performance or availability regressions with correct thresholds and missing-data treatment.
  4. Use Extended Events sessions to capture targeted SQL events and wait/blocking evidence with bounded collection and a safe target rather than enabling excessive full-query traces in production.

Explanation

Correct Answer

D:

Use Extended Events sessions to capture targeted SQL events and wait/blocking evidence with bounded collection and a safe target rather than enabling excessive full-query traces in production. This is the supported administration mechanism for the described workload. Extended Events supports focused diagnostic collection; an unfiltered high-volume session can itself increase production overhead and leak query text. Verify with: Inspect event session predicates, event fields, ring buffer or event file targets, dropped events, blocked process reports and collection overhead.

Incorrect Answers

A:

Use supported Azure SQL automatic tuning or IQP features with monitoring and safety controls; verify supported recommendations and their observed effect before treating them as universal fixes. This addresses Automatic tuning and intelligent query processing guardrails, not the controlling requirement here. Automatic tuning may need time to evaluate evidence and can reverse actions; feature availability is platform and compatibility-level dependent. Prefer: Use Extended Events sessions to capture targeted SQL events and wait/blocking evidence with bounded collection and a safe target rather than enabling excessive full-query traces in production.

B:

Distinguish compute, data IO, log IO, memory and blocking contention using correlated counters, wait types and workload-specific thresholds before changing resources. This addresses SQL operational baseline across waits locks and storage, not the controlling requirement here. One wait type alone is not a universal diagnosis; waits, plan behavior, request duration and resource data must be read together. Prefer: Use Extended Events sessions to capture targeted SQL events and wait/blocking evidence with bounded collection and a safe target rather than enabling excessive full-query traces in production.

C:

Configure supported metrics, diagnostic settings and alerts for Azure SQL resources to detect real performance or availability regressions with correct thresholds and missing-data treatment. This addresses Azure Monitor alerts diagnostics and resource metrics, not the controlling requirement here. A low CPU value does not mean an app is healthy; incorrect aggregation or missing telemetry can hide blocked sessions and failures. Prefer: Use Extended Events sessions to capture targeted SQL events and wait/blocking evidence with bounded collection and a safe target rather than enabling excessive full-query traces in production.

Question 410

A migration replaces shared SQL login credentials with a service principal but grants db_owner to avoid mapping the required read-only permissions. Which TWO complementary actions provide the appropriate response AND evidence to verify it? Select TWO.

  1. Review sign-in error number and state, selected database, Entra token principal, group claims, CREATE USER scope, role membership and firewall reachability.
  2. Inspect tenant and server Entra administrator settings, token audience, user mapping, group membership, service principal, role grants and sign-in failures.
  3. Configure supported Microsoft Entra authentication and database users or contained identities for Azure SQL, ensuring the application principal receives only required permissions.
  4. Select Entra or SQL authentication deliberately for Azure SQL Database, Managed Instance and SQL Server VMs based on platform support, application constraints and security controls.
  5. Authorized workloads resolve the intended endpoint and connect over the required private or permitted path while unauthorized public sources are blocked.

Explanation

Correct Answers

B:

Inspect tenant and server Entra administrator settings, token audience, user mapping, group membership, service principal, role grants and sign-in failures. This is the discriminating system or configuration evidence for the case. A successful token request is not sufficient if the database principal, scope or permissions are missing or the token targets the wrong resource. Corresponding approach: Configure supported Microsoft Entra authentication and database users or contained identities for Azure SQL, ensuring the application principal receives only required permissions. It supplies the evidence portion of this complementary answer.

C:

Configure supported Microsoft Entra authentication and database users or contained identities for Azure SQL, ensuring the application principal receives only required permissions. This is the supported administration mechanism for the described workload. A successful token request is not sufficient if the database principal, scope or permissions are missing or the token targets the wrong resource. Verify with: Inspect tenant and server Entra administrator settings, token audience, user mapping, group membership, service principal, role grants and sign-in failures. It supplies the implementation portion of this complementary answer.

Incorrect Answers

A:

Review sign-in error number and state, selected database, Entra token principal, group claims, CREATE USER scope, role membership and firewall reachability. This choice pertains to Diagnosing login failure and group-based access, not the needed response/evidence pair. Use: Configure supported Microsoft Entra authentication and database users or contained identities for Azure SQL, ensuring the application principal receives only required permissions. Check: Inspect tenant and server Entra administrator settings, token audience, user mapping, group membership, service principal, role grants and sign-in failures.

D:

Select Entra or SQL authentication deliberately for Azure SQL Database, Managed Instance and SQL Server VMs based on platform support, application constraints and security controls. This choice pertains to SQL authentication versus Entra and managed-instance principals, not the needed response/evidence pair. Use: Configure supported Microsoft Entra authentication and database users or contained identities for Azure SQL, ensuring the application principal receives only required permissions. Check: Inspect tenant and server Entra administrator settings, token audience, user mapping, group membership, service principal, role grants and sign-in failures.

E:

Authorized workloads resolve the intended endpoint and connect over the required private or permitted path while unauthorized public sources are blocked. This choice pertains to Azure SQL private endpoints firewall and TLS boundary, not the needed response/evidence pair. Use: Configure supported Microsoft Entra authentication and database users or contained identities for Azure SQL, ensuring the application principal receives only required permissions. Check: Inspect tenant and server Entra administrator settings, token audience, user mapping, group membership, service principal, role grants and sign-in failures.

Administering Microsoft Azure SQL Solutions (DP-300) Practice Tests