Microsoft DP-300 Practice Test

DP-300 practice test: what's covered

• Azure SQL Database Administrator Associate

Free DP-300 sample questions

1. A retail team runs an unpredictable workload that is idle every night and on weekends but spikes during business hours, and they want to pay only for compute actually used. Which Azure SQL Database compute tier best fits this pattern?

   • A. Provisioned compute in the General Purpose tier with a fixed vCore count billed continuously
   • B. Serverless compute in the General Purpose tier, which auto-scales vCores and auto-pauses when idle
   • C. Hyperscale tier configured with a minimum of eight named replicas at all times
   • D. Business Critical tier with read scale-out enabled on the local SSD replicas
   Show answer

   Correct: B. Serverless in the General Purpose tier scales vCores between a configured min and max and auto-pauses after an inactivity delay, so you are billed per second of compute used plus storage, which matches a bursty, frequently idle workload. Provisioned compute bills continuously even when idle, so it is not cost-optimal here. Hyperscale and Business Critical target large or low-latency workloads and do not auto-pause, so they would keep charging during idle periods.

2. You must migrate a 2 TB on-premises SQL Server 2016 database to Azure SQL Managed Instance with near-zero downtime, keeping the source online until the final cutover. Which tool performs this online migration?

   • A. Data Migration Assistant to copy the schema and then bulk insert rows manually
   • B. Azure Database Migration Service running in online mode with continuous log restore
   • C. The Azure Import/Export service shipping encrypted disks to the datacenter
   • D. BACPAC export and import through SqlPackage during a scheduled outage window
   Show answer

   Correct: B. Azure Database Migration Service (DMS) supports online migration to Managed Instance by continuously restoring backups and log, allowing cutover at your convenience with minimal downtime. Data Migration Assistant only assesses compatibility and migrates schema or small data, not large online moves. Import/Export targets blob and table storage, not SQL databases, and a BACPAC import requires the source to be quiesced, causing significant downtime.

3. A team is deciding to deploy SQL Server on an Azure VM (IaaS) instead of a PaaS offering for a legacy application. Which capabilities justify choosing SQL Server on Azure VM? (Choose TWO)

   • A. Full operating-system access to install agents, drivers, and third-party tools
   • B. Automatic high availability with a built-in 99.99 percent SLA and no patching
   • C. Support for instance-level features such as SQL Server Agent, cross-database queries, and CLR without restrictions
   • D. Fully managed automatic backups with point-in-time restore requiring zero configuration
   • E. Built-in serverless auto-pause to eliminate compute charges when the instance is idle
   Show answer

   Correct: A and C. SQL Server on Azure VM gives full OS control and complete instance-level feature parity with on-premises SQL Server, which is why it suits legacy apps needing custom drivers or unrestricted features. The other options are incorrect because IaaS does not provide automatic HA, fully managed backups, or serverless auto-pause out of the box; those are PaaS benefits of Azure SQL Database or Managed Instance, and on a VM you remain responsible for patching, backups, and high availability configuration.

4. An application must search and update encrypted credit-card columns by exact-match value while ensuring the Azure SQL Database engine never sees plaintext. Which Always Encrypted encryption type supports equality lookups on the protected column?

   • A. Randomized encryption, because it produces a different ciphertext for each identical value
   • B. Deterministic encryption, because identical plaintext always produces the same ciphertext
   • C. Transparent Data Encryption applied at the database level for data at rest
   • D. Dynamic Data Masking with a default mask exposing only the last four digits
   Show answer

   Correct: B. Deterministic encryption generates the same ciphertext for the same plaintext, which enables equality joins, grouping, and point lookups on encrypted columns while keys stay client-side. Randomized encryption is more secure but produces different ciphertext each time, so it cannot support equality operations. TDE encrypts data at rest but the engine still processes plaintext, and Dynamic Data Masking only obscures output without encryption, so neither meets the requirement that the engine never sees plaintext.

5. A compliance auditor requires that your organization control and rotate the encryption key used for data at rest in Azure SQL Database, rather than relying on the platform-managed key. Which configuration satisfies this requirement?

   • A. Disable Transparent Data Encryption entirely and rely on network isolation only
   • B. Configure TDE with a customer-managed key (BYOK) stored in Azure Key Vault
   • C. Enable Always Encrypted on every table so the platform manages all rotation
   • D. Switch the database to the DTU purchasing model to unlock key rotation
   Show answer

   Correct: B. TDE with a customer-managed key, also called Bring Your Own Key, places the TDE protector in Azure Key Vault so the organization controls access, rotation, and revocation for compliance. Disabling TDE removes encryption at rest, which fails the audit. Always Encrypted protects specific columns client-side and does not govern the database-level TDE protector, and the purchasing model has no bearing on key management, so those options do not satisfy the requirement.

Last updated: 2026-10-19

DP-300 practice test FAQ

Related practice tests

• Microsoft DP-900 practice test
• Microsoft DP-420 practice test
• Microsoft DP-700 practice test
• Microsoft DP-600 practice test
• Azure AZ-104 practice test
• Azure AZ-305 practice test