You have an Azure subscription that contains the resources shown in the following table.You plan to use SQLDB11 as an elastic job database to run jobs on SQLDB11 and SQLDB22.What is the minimum number of database scoped credentials required for the elastic jobs?
Answer(s): B
Elastic jobs in Azure SQL DatabaseOne for jobuser and one for masteruser, in the example below.Authentication via database-scoped credentialsWhile Microsoft Entra (formerly Azure Active Directory) authentication is the recommended option, jobs can be configured to use database-scoped credentials to connect to the databases specified by the target group upon execution. Prior to October 2023, database-scoped credentials were the only authentication option.If a target group contains servers or pools, these database-scoped credentials are used to connect to the master database to enumerate the available databases.The database-scoped credentials must be created in the job database.All target databases must have a login with sufficient permissions for the job to complete successfully (jobuser in the following diagram).The following image is designed to help understand setting up the proper job credentials, and how the elastic job agent connects using database credentials as authentication to logins/users in target servers/databases.
https://learn.microsoft.com/en-us/azure/azure-sql/database/elastic-jobs-overview
SIMULATIONYou need to configure your user account as the Microsoft Entra admin for the server named sql12345678.To complete this task, sign in to the virtual machine. You may need to use SQL Server Management Studio and the Azure portal.
Answer(s): A
Manage administrator accounts in Azure Active Directory B2C You can assign a role when you create a user or invite a guest user. You can add a role, change the role, or remove a role for a user:Solution 1:Provision Microsoft Entra admin (SQL Managed Instance)Your SQL Managed Instance needs permission to read Microsoft Entra ID to accomplish tasks such as authentication of users through security group membership or creation of new users. For this to work, you must grant the SQL Managed Instance permission to read Microsoft Entra ID. You can do this using the Azure portal or PowerShell.To grant your SQL Managed Instance read permissions to Microsoft Entra ID using the Azure portal, sign in as a Global Administrator and follow these steps:Step 1: In the Azure portal, in the upper-right corner select your account, and then choose Switch directories to confirm which directory is your Current directory. Switch directories, if necessary.Step 2: Choose the correct Microsoft Entra directory as the Current directory.This step links the subscription associated with Microsoft Entra ID to the SQL Managed Instance, ensuring the Microsoft Entra tenant and SQL Managed Instance use the same subscription.Step 3: Now, you can choose your Microsoft Entra admin for your SQL Managed Instance. For that, go to your managed instance resource in the Azure portal and select Microsoft Entra admin under Settings.Step 4: Select the banner on top of the Microsoft Entra admin page and grant permission to the current user.Step 5: After the operation succeeds, the following notification will show up in the top-right corner:Step 6: On the Microsoft Entra admin page, select Set admin from the navigation bar to open the Microsoft Entra ID pane.Step 7: On the Microsoft Entra ID pane, search for a user, check the box next to the user or group to be an administrator, and then press Select to close the pane and go back to the Microsoft Entra admin page for your managed instance. [Select yourself]Step 8: From the navigation bar of the Microsoft Entra admin page for your managed instance, select Save to confirm your Microsoft Entra administrator.The process of changing the administrator might take several minutes. Then the new administrator appears in the Microsoft Entra admin box.Solution 2:Step 1: Sign in to the Azure portal with Global Administrator or Privileged Role Administrator permissions.Step 2: (If you have access to multiple tenants, select the Settings icon in the top menu to switch to your Azure AD B2C tenant from the Directories + subscriptions menu.)Step 3: Under Azure services, select Azure AD B2C. Or use the search box to find and select Azure AD B2C.Step 4: Under Manage, select Users.Step 5: Select the user you want to change the roles for. [Select your user account]. Then select Assigned roles.Step 6: Add a role assignmentStep 7: Select Add assignments, select the role to assign (for example, Application administrator), [Select Microsoft Entra administrator] and then choose Add.
https://learn.microsoft.com/en-us/azure/azure-sql/database/authentication-aad-configure https://learn.microsoft.com/en-us/azure/active-directory-b2c/tenant-management-manage-administrator
SIMULATIONYou need to create a new database role named role1 that can read the contents of the SalesLT.SalesOrderDetail table only in db1.To complete this task, sign in to the virtual machine. You may need to use SQL Server Management Studio and the Azure portal.
You can create a new server role in SQL Server by using SQL Server Management Studio or Transact-SQL.Using SQL Server Management Studio to create a new server roleStep 1: In Object Explorer, expand the server where you want to create the new server role.Step 2: Expand the Security folder.Step 3: Right-click the Server Roles folder and select New Server Role....Step 4: In the New Server Role -server_role_name dialog box, on the General page, enter a name for the new server role in the Server role name box. [Enter role1]Step 5: In the Owner box, enter the name of the server principal that will own the new role. Alternately, click the ellipsis (...) to open the Select Server Login or Role dialog box.Step 6: Under Securables, select one or more server-level securables [Select the SalesLT.SalesOrderDetail table]. When a securable is selected, this server role can be granted or denied permissions on that securable.Step 7: In the Permissions: Explicit box, select the check box to grant, grant with grant, or deny permission to this server role for the selected securables [Select Read]. If a permission cannot be granted or denied to all of the selected securables, the permission is represented as a partial select.Step 8: On the Members page, use the Add button to add logins that represent individuals or groups to the new server role. [Skip]Step 9: A user-defined server role can be a member of another server role. On the Memberships page, select a check box to make the current user-defined server role a member of a selected server role. [Skip]Step 10: Select OK.
https://learn.microsoft.com/en-us/sql/relational-databases/security/authentication-access/create-a-server-role
SIMULATIONYou need to classify the StandardCost and ListPrice columns of the SalesLT.Product table in db1. The columns must have the following configurations:An information type of FinancialA sensitivity label of ConfidentialTo complete this task, sign in to the virtual machine. You may need to use SQL Server Management Studio and the Azure portal.
To classify your SQL Server database:Step 1: In SQL Server Management Studio (SSMS), connect to the SQL Server.Step 2: In the SSMS Object Explorer, select the database [Here db1] that you would like to classify and choose Tasks > Data Discovery and Classification > Classify Data....Step 3: The classification engine scans your database for columns containing potentially sensitive data and provides a list of recommended column classifications:Step 4: You can change the recommended Information Type and Sensitivity Label using the drop-down boxes.Step 5: Select columns StandardCost and ListPrice. Unselect other columns if necessary. For StandardCost and ListPrice columns select information type of Financial, and sensitivity label of Confidential.Step 6: To apply the selected recommendations, select the Save selected recommendations button.Step 7: To display the classified columns, select appropriate schema and corresponding table from the drop- down, then select Load Columns.Step 8: You can also manually classify columns as an alternative, or in addition, to the recommendation-based classification:Select Add classification in the top menu of the window.Step 9: If you want to add classification for all the unclassified columns for a specific table in a single attempt, then select All Unclassified in the Column drop down of Add Classification page.Step 10: To complete your classification and persistently label (tag) the database columns with the new classification metadata, select the Save button on the top menu of the window.
https://learn.microsoft.com/en-us/sql/relational-databases/security/sql-data-discovery-and-classification
SIMULATIONYou need to protect all the databases on sql12345678 from SQL injection attacks.To complete this task, sign in to the virtual machine. You may need to use SQL Server Management Studio and the Azure portal.
Configure Advanced Threat Protection for Azure SQL Database Advanced Threat Protection for Azure SQL Database detects anomalous activities indicating unusual and potentially harmful attempts to access or exploit databases. Advanced Threat Protection can identify Potential *SQL injection*, Access from unusual location or data center, Access from unfamiliar principal or potentially harmful application, and Brute force SQL credentials.Set up Advanced Threat Protection in the Azure portalStep 1: Sign into the Azure portal.Step 2: Navigate to the configuration page of the server you want to protect. [Here sql12345678 ] In the security settings, select Microsoft Defender for Cloud.Step 3: On the Microsoft Defender for Cloud configuration page:Step 3a: If Microsoft Defender for SQL hasn't yet been enabled, select Enable Microsoft Defender for SQL.Step 3b: Select Configure.Step 3c: Under ADVANCED THREAT PROTECTION SETTINGS, select Add your contact details to the subscription's email settings in Defender for Cloud.Step 3d: Provide the list of emails to receive notifications upon detection of anomalous database activities in the Additional email addresses (separated by commas) text box. [Skip]Step 3e: Optionally customize the severity of alerts that will trigger notifications to be sent under Notification types. [Skip]Step 3f: Select Save.
https://learn.microsoft.com/en-us/azure/azure-sql/database/threat-detection-configure
Post your Comments and Discuss Microsoft DP-300 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the DP-300 content, but please register or login to continue.