SMTP authentication<\/span><\/p>\nAnswer: 1) Microsoft Entra authentication<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Microsoft Entra authentication allows users and applications to connect to Azure SQL Managed Instance using Microsoft Entra identities instead of relying exclusively on SQL authentication. This approach can integrate database access with centralized identity management, multifactor authentication, and organizational access policies. A database administrator can configure a Microsoft Entra administrator and then create appropriate Microsoft Entra-based logins or users. This is particularly useful when organizations want consistent identity management across Azure resources. The other options are unrelated to database authentication and do not provide a supported method for authenticating users to SQL Managed Instance.<\/span><\/p>\nQuestion 342. What is a key advantage of using contained database users?<\/b><\/h3>\n
1)<\/b> They eliminate the need for indexes<\/span>
\n<\/span>2)<\/b> They can authenticate without requiring a server-level login<\/span>
\n<\/span>3)<\/b> They automatically create backups<\/span>
\n<\/span>4)<\/b> They increase the maximum database size<\/span><\/p>\nAnswer: 2) They can authenticate without requiring a server-level login<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Contained database users store authentication information within the database rather than depending entirely on a login defined at the SQL Server instance level. This can simplify database movement because the user and associated authentication information travel with the database. Contained users are particularly useful in environments where databases are migrated between servers or instances. They can also help reduce dependencies on instance-level login configurations. However, contained users do not eliminate the need for permissions or authorization configuration. Database administrators still need to grant appropriate access to schemas, objects, and other securables according to the user’s responsibilities.<\/span><\/p>\nQuestion 343. What is the primary purpose of a database-scoped credential?<\/b><\/h3>\n
1)<\/b> To store credentials used by database-level features and external resources<\/span>
\n<\/span>2)<\/b> To create clustered indexes automatically<\/span>
\n<\/span>3)<\/b> To configure database backups<\/span>
\n<\/span>4)<\/b> To monitor CPU utilization<\/span><\/p>\nAnswer: 1) To store credentials used by database-level features and external resources<\/b><\/p>\n
Explanation:<\/b><\/p>\n
A database-scoped credential provides a secure way to store authentication information that database-level features can use when accessing external resources. Unlike a traditional server-level credential, its scope is associated with a particular database. Database-scoped credentials can support features that need to authenticate to external services or resources. The credential separates sensitive authentication information from application code and database definitions. Proper permissions should still be applied so that only authorized principals can use the credential. It does not directly manage indexes, backups, or monitoring metrics, because those tasks require different SQL Server or Azure services.<\/span><\/p>\nQuestion 344. Which Azure service is commonly integrated with Azure SQL for securely managing encryption keys?<\/b><\/h3>\n
1)<\/b> Azure Key Vault<\/span>
\n<\/span>2)<\/b> Azure Storage Explorer<\/span>
\n<\/span>3)<\/b> Azure DNS<\/span>
\n<\/span>4)<\/b> Azure Traffic Manager<\/span><\/p>\nAnswer: 1) Azure Key Vault<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Azure Key Vault is designed to securely store and manage cryptographic keys, secrets, certificates, and other sensitive information. Azure SQL Database and related services can integrate with Key Vault when organizations use customer-managed keys for encryption scenarios. This allows administrators to maintain greater control over the lifecycle and access permissions of encryption keys. Key Vault access can be controlled using Azure identity and authorization mechanisms. The other services have different purposes: Azure DNS handles name resolution, Traffic Manager distributes traffic using DNS-based routing, and Storage Explorer is a management utility rather than a dedicated key-management service.<\/span><\/p>\nQuestion 345. What is the purpose of using a customer-managed key with Transparent Data Encryption?<\/b><\/h3>\n
1)<\/b> To allow an organization to control the encryption key<\/span>
\n<\/span>2)<\/b> To disable database encryption<\/span>
\n<\/span>3)<\/b> To remove database authentication<\/span>
\n<\/span>4)<\/b> To increase query result size<\/span><\/p>\nAnswer: 1) To allow an organization to control the encryption key<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Transparent Data Encryption protects data at rest by encrypting database files, transaction log files, and related storage. When a customer-managed key is configured, the organization manages the encryption key through a supported key-management service such as Azure Key Vault. This provides additional control over key lifecycle operations, access policies, rotation, and administrative responsibilities. Customer-managed keys do not disable encryption or replace database authentication. They also do not directly affect query result size. Database administrators should carefully configure permissions and key availability because improper key management can affect the ability of the database service to access encrypted data.<\/span><\/p>\nQuestion 346. What is a major difference between service-managed and customer-managed encryption keys?<\/b><\/h3>\n
1)<\/b> Customer-managed keys provide greater organizational control over key management<\/span>
\n<\/span>2)<\/b> Service-managed keys require users to manually encrypt every table<\/span>
\n<\/span>3)<\/b> Customer-managed keys disable encryption<\/span>
\n<\/span>4)<\/b> Service-managed keys cannot encrypt data at rest<\/span><\/p>\nAnswer: 1) Customer-managed keys provide greater organizational control over key management<\/b><\/p>\n
Explanation:<\/b><\/p>\n
With service-managed keys, the cloud service manages the encryption key lifecycle on behalf of the customer, reducing administrative overhead. Customer-managed keys provide organizations with more direct control over key management activities, including access policies, rotation processes, and lifecycle decisions. This distinction is important for organizations with specific security, compliance, or governance requirements. Neither model requires administrators to manually encrypt individual tables or rows. Encryption remains a platform-level capability. The choice between the models depends on organizational requirements, operational responsibilities, and the desired level of control over cryptographic keys.<\/span><\/p>\nQuestion 347. In Always Encrypted, what is the purpose of the key hierarchy?<\/b><\/h3>\n
1)<\/b> It separates key-management responsibilities between encryption keys<\/span>
\n<\/span>2)<\/b> It automatically creates database backups<\/span>
\n<\/span>3)<\/b> It controls SQL Server Agent schedules<\/span>
\n<\/span>4)<\/b> It determines query execution order<\/span><\/p>\nAnswer: 1) It separates key-management responsibilities between encryption keys<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Always Encrypted uses a key hierarchy to protect encrypted column data while keeping sensitive encryption keys separate from the database engine. The hierarchy includes a column encryption key, which encrypts the actual data, and a column master key, which protects the column encryption key. This separation helps prevent unauthorized database administrators or processes from directly accessing plaintext sensitive information. Key metadata is stored in the database, while the actual master key is maintained in an external key store or certificate store. The hierarchy therefore supports stronger separation of duties and protection for sensitive column-level data.<\/span><\/p>\nQuestion 348. What does a column master key protect in Always Encrypted?<\/b><\/h3>\n
1)<\/b> Column encryption keys<\/span>
\n<\/span>2)<\/b> Database backups<\/span>
\n<\/span>3)<\/b> SQL Agent jobs<\/span>
\n<\/span>4)<\/b> Database indexes<\/span><\/p>\nAnswer: 1) Column encryption keys<\/b><\/p>\n
Explanation:<\/b><\/p>\n
In Always Encrypted, the column master key is used to protect column encryption keys. The column encryption key is responsible for encrypting sensitive column data, while the column master key provides another layer of protection around that encryption key. The column master key is typically stored outside the database engine in a supported key store, such as a certificate store or Azure Key Vault. This design helps prevent the database engine from having direct access to plaintext encryption keys. Understanding the distinction between the two keys is important when configuring and troubleshooting Always Encrypted environments.<\/span><\/p>\nQuestion 349. What is the primary purpose of a column encryption key in Always Encrypted?<\/b><\/h3>\n
1)<\/b> To encrypt the sensitive column data<\/span>
\n<\/span>2)<\/b> To configure database firewall rules<\/span>
\n<\/span>3)<\/b> To authenticate database administrators<\/span>
\n<\/span>4)<\/b> To create database backups<\/span><\/p>\nAnswer: 1) To encrypt the sensitive column data<\/b><\/p>\n
Explanation:<\/b><\/p>\n
The column encryption key is the key that performs encryption and decryption operations for protected Always Encrypted columns. It is protected by the column master key, creating a layered key hierarchy. When an authorized client accesses encrypted data, the appropriate client-side encryption components can use the protected key to decrypt values. This architecture keeps sensitive plaintext information and encryption keys protected from unauthorized database-level access. Column encryption keys are not used for firewall configuration, administrator authentication, or backup scheduling. Those functions are handled by separate security, networking, and database-management mechanisms.<\/span><\/p>\nQuestion 350. What is the role of a certificate in SQL Server encryption?<\/b><\/h3>\n
1)<\/b> It can be used as a cryptographic object for protecting keys or data<\/span>
\n<\/span>2)<\/b> It automatically rebuilds indexes<\/span>
\n<\/span>3)<\/b> It controls database compatibility levels<\/span>
\n<\/span>4)<\/b> It increases available CPU resources<\/span><\/p>\nAnswer: 1) It can be used as a cryptographic object for protecting keys or data<\/b><\/p>\n
Explanation:<\/b><\/p>\n
SQL Server certificates are cryptographic objects that can participate in encryption and key-protection mechanisms. Depending on the security design, certificates can protect symmetric keys, support database encryption structures, or be used for other cryptographic operations. Certificates contain a public key and an associated private key and can be protected through database security mechanisms. They are not intended to manage indexing, compatibility levels, or compute resources. Database administrators should understand where certificates are stored, who can access their private keys, and how certificate backups are handled when encryption-dependent databases or keys need to be restored.<\/span><\/p>\nQuestion 351. What is the primary purpose of a database master key in SQL Server?<\/b><\/h3>\n
1)<\/b> To protect cryptographic keys stored within the database<\/span>
\n<\/span>2)<\/b> To control database storage size<\/span>
\n<\/span>3)<\/b> To manage SQL Server Agent schedules<\/span>
\n<\/span>4)<\/b> To define firewall rules<\/span><\/p>\nAnswer: 1) To protect cryptographic keys stored within the database<\/b><\/p>\n
Explanation:<\/b><\/p>\n
The database master key is a symmetric key used by SQL Server to protect other cryptographic keys and secrets stored within a database. It can participate in encryption hierarchies for features such as credentials, certificates, and other database-level security objects. The database master key is therefore an important part of the database’s cryptographic infrastructure. Administrators must protect and back up the master key when required, especially when encryption-related objects depend on it. It does not manage storage capacity, SQL Server Agent scheduling, or network firewall configuration.<\/span><\/p>\nQuestion 352. What is the purpose of encrypting a SQL Server backup?<\/b><\/h3>\n
1)<\/b> To protect backup data from unauthorized access<\/span>
\n<\/span>2)<\/b> To improve SELECT query performance<\/span>
\n<\/span>3)<\/b> To increase transaction throughput<\/span>
\n<\/span>4)<\/b> To disable database encryption<\/span><\/p>\nAnswer: 1) To protect backup data from unauthorized access<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Backup encryption protects database backup files while they are stored or transferred. Without encryption, someone who gains unauthorized access to a backup file may be able to restore it elsewhere and inspect its contents. Encrypting backups adds a security layer that protects sensitive information outside the active database environment. SQL Server supports backup encryption using appropriate encryption algorithms and certificates or asymmetric keys depending on the configuration. Administrators should also protect and back up the encryption credentials because losing the required key material can prevent successful restoration of encrypted backups.<\/span><\/p>\nQuestion 353. Why should encryption keys used for encrypted backups be backed up securely?<\/b><\/h3>\n
1)<\/b> The keys may be required to restore encrypted backups<\/span>
\n<\/span>2)<\/b> The keys automatically improve query performance<\/span>
\n<\/span>3)<\/b> The keys replace database indexes<\/span>
\n<\/span>4)<\/b> The keys increase database storage capacity<\/span><\/p>\nAnswer: 1) The keys may be required to restore encrypted backups<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Encrypted backups depend on cryptographic key material for successful restoration. If the certificate or asymmetric key used to encrypt a backup is lost, a database administrator may be unable to restore that backup even when the backup file itself is available. Therefore, encryption keys and certificates should be backed up securely and protected from unauthorized access. Key-management procedures should include appropriate storage, access controls, documentation, and recovery planning. Encryption improves confidentiality, but poor key management can create a recovery problem. Database administrators should test restoration procedures to verify that required encryption credentials remain available.<\/span><\/p>\nQuestion 354. Which backup feature provides protection by maintaining backup copies in a paired Azure region?<\/b><\/h3>\n
1)<\/b> Geo-redundant backup storage<\/span>
\n<\/span>2)<\/b> Temporary tables<\/span>
\n<\/span>3)<\/b> Query Store<\/span>
\n<\/span>4)<\/b> Local database roles<\/span><\/p>\nAnswer: 1) Geo-redundant backup storage<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Geo-redundant backup storage maintains backup data in a secondary geographic region in addition to the primary storage location. This provides additional resilience if the primary Azure region becomes unavailable because of a major infrastructure event. Geo-redundant backups are particularly useful for disaster-recovery planning because they provide another location from which backup data may be recovered, subject to the service’s supported recovery capabilities. This feature is separate from Query Store, temporary tables, and database roles. Database administrators should select backup redundancy according to recovery requirements, data-residency considerations, and business continuity objectives.<\/span><\/p>\nQuestion 355. What is a key benefit of geo-redundant backups for Azure SQL Database?<\/b><\/h3>\n
1)<\/b> They provide an additional geographically separated copy of backup data<\/span>
\n<\/span>2)<\/b> They eliminate the need for database permissions<\/span>
\n<\/span>3)<\/b> They automatically remove all indexes<\/span>
\n<\/span>4)<\/b> They guarantee zero data loss in every disaster<\/span><\/p>\nAnswer: 1) They provide an additional geographically separated copy of backup data<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Geo-redundant backups improve resilience by maintaining backup information in a geographically separate Azure region. If the primary region experiences a significant outage, the additional copy can support disaster-recovery operations according to the configured service capabilities and retention policies. However, geo-redundancy does not automatically guarantee zero data loss under every circumstance. Recovery objectives still depend on backup timing, retention, service behavior, and the organization’s recovery strategy. Database administrators should understand the distinction between backup redundancy and high availability. Backup copies are primarily intended for recovery rather than for providing uninterrupted access to the running database.<\/span><\/p>\nQuestion 356. Which Azure SQL capability allows a database to be restored to a specific earlier point in time?<\/b><\/h3>\n
1)<\/b> Point-in-time restore<\/span>
\n<\/span>2)<\/b> Query Store<\/span>
\n<\/span>3)<\/b> Dynamic Data Masking<\/span>
\n<\/span>4)<\/b> Resource Governor<\/span><\/p>\nAnswer: 1) Point-in-time restore<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Point-in-time restore allows an Azure SQL database to be recovered to a selected time within the available backup retention period. This capability is useful when data is accidentally deleted, incorrectly modified, or otherwise affected by an unwanted operation. The restored database is typically created as a separate database rather than overwriting the original database. Administrators can then validate the recovered data and determine the appropriate next steps. Point-in-time restore depends on the platform’s automated backup infrastructure and configured retention period. Query Store, Dynamic Data Masking, and Resource Governor serve different purposes.<\/span><\/p>\nQuestion 357. Why would an administrator restore an Azure SQL Database to a new database instead of overwriting the existing database?<\/b><\/h3>\n
1)<\/b> To preserve the original database while validating recovered data<\/span>
\n<\/span>2)<\/b> To automatically increase CPU resources<\/span>
\n<\/span>3)<\/b> To remove all database permissions<\/span>
\n<\/span>4)<\/b> To disable backup retention<\/span><\/p>\nAnswer: 1) To preserve the original database while validating recovered data<\/b><\/p>\n
Explanation:<\/b><\/p>\n
Restoring a database to a new database allows administrators to preserve the original database while examining the recovered version. This is useful after accidental data modification or deletion because administrators can compare the restored information with the current database before deciding how to recover individual records or replace the database. Keeping the original database available can reduce the risk of making the situation worse during recovery. The restored database remains a separate database resource and must be managed appropriately. Restoration does not automatically increase compute capacity, remove permissions, or change backup retention settings.<\/span><\/p>\nQuestion 358. In an Azure SQL failover group, what is the purpose of the read-write listener endpoint?<\/b><\/h3>\n
1)<\/b> It directs applications to the current primary database<\/span>
\n<\/span>2)<\/b> It always connects applications to the secondary database<\/span>
\n<\/span>3)<\/b> It provides access to Azure Storage files<\/span>
\n<\/span>4)<\/b> It manages database indexes<\/span><\/p>\n