DP-300: Azure Database Administrator Associate Practice Exam

What the DP-300 exam covers

• Plan and Implement Data Platform Resources143 questions
• Implement a Secure Environment134 questions
• Monitor, Configure, and Optimize Resources131 questions
• Configure and Manage Automation of Tasks126 questions
• Plan and Configure HA and DR Environment143 questions

Free DP-300 practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 677.

1. Question 1Plan and Implement Data Platform Resources

   A mid-sized e-commerce company expects unpredictable traffic spikes during seasonal sales events. The database team needs to deploy multiple Azure SQL databases that share compute and storage resources to reduce costs while handling variable workloads. Which Azure SQL deployment option should the team choose?

   • ADeploy each database as a standalone Azure SQL Database with the General Purpose tier
   • BDeploy a single Azure SQL Managed Instance and create all databases inside it
   • CDeploy SQL Server on an Azure Virtual Machine with multiple databases
   • DDeploy all databases within an Azure SQL Database elastic poolCorrect
   ✓ Correct answer: D

   An elastic pool is the optimal choice for this scenario because it allows multiple databases to share a pool of compute and storage resources at a lower cost than provisioning individual databases. The elastic pool's dynamic resource allocation automatically adjusts compute capacity across databases based on their real-time workload demands, making it ideal for handling unpredictable traffic spikes. This provides cost efficiency while ensuring that each database receives adequate resources when needed during seasonal peaks.

   Why the other options are wrong

   • ADeploy each database as a standalone Azure SQL Database with the General Purpose tier is incorrect because standalone databases cannot share resources, resulting in higher costs and potential underutilization during low-traffic periods when you're still paying for full capacity.
   • BDeploy a single Azure SQL Managed Instance and create all databases inside it is incorrect because while Managed Instance can host multiple databases, it is optimized for on-premises compatibility scenarios rather than cost-effective resource sharing for variable workloads in SaaS multi-tenant architectures.
   • CDeploy SQL Server on an Azure Virtual Machine with multiple databases is incorrect because VMs require manual management of compute scaling, backup coordination, and security patching, increasing operational overhead without the automatic resource allocation benefits of elastic pools.
2. Question 2Plan and Implement Data Platform ResourcesSelect all that apply

   You are planning to deploy an Azure SQL Managed Instance. Which two networking requirements must be met? (Choose two.)

   • AThe managed instance must be deployed in a dedicated subnet within a virtual networkCorrect
   • BThe managed instance subnet must have a Network Security Group (NSG) with required management rulesCorrect
   • CThe managed instance must use a public IP endpoint for every client and inter-node data connection
   • DThe managed instance requires an Azure ExpressRoute circuit for all client and application connections
   ✓ Correct answer: A, B

   Azure SQL Managed Instance must be deployed into a dedicated (delegated) subnet within a virtual network that contains no other resources, and that subnet must have a Network Security Group carrying the required inbound/outbound management rules so the Azure control plane can manage the instance. Connectivity to Managed Instance is private by default through the VNet; ExpressRoute and public endpoints are optional, not mandatory.

   Why the other options are wrong

   • CManaged Instance connectivity is private through the VNet by default and the public endpoint is optional, never required for all traffic.
   • DExpressRoute is one optional hybrid private-connectivity choice, not a mandatory networking requirement for deploying Managed Instance.
3. Question 3Implement a Secure Environment

   You need to prevent users from viewing sensitive salary data in an Azure SQL Database table while still allowing them to query other columns. The column should remain encrypted at rest and in transit. Which feature should you implement?

   • AAlways EncryptedCorrect
   • BRow-Level Security
   • CTransparent Data Encryption
   • DDynamic Data Masking
   ✓ Correct answer: A

   Always Encrypted keeps a sensitive column such as salary encrypted both at rest and in transit because the data is encrypted in the client driver and only ciphertext flows to and is stored by the database. The encryption keys are never shared with the SQL engine, so the server cannot decrypt the column even though other columns remain queryable normally. Only clients holding the keys can read the plaintext, which excludes database administrators.

   Why the other options are wrong

   • BRow-Level Security filters which rows a user can access based on context but stores the data in plaintext, so it neither encrypts the salary column nor hides it from administrators.
   • CTransparent Data Encryption encrypts the whole database at rest yet decrypts transparently on the server, leaving plaintext visible to administrators and to authorized queries.
   • DDynamic Data Masking only masks the displayed value in results and stores the column unencrypted, so the data is not protected in transit or at rest and is exposed to users with UNMASK permission.
4. Question 4Monitor, Configure, and Optimize ResourcesSelect all that apply

   You are using Query Store to analyze query performance regressions in Azure SQL Database. Which TWO reports in Query Store help identify regressed queries? (Choose two.)

   • ATop Resource Consuming QueriesCorrect
   • BRegressed QueriesCorrect
   • CDatabase File Space Usage
   • DOverall Resource Consumption
   ✓ Correct answer: A, B

   Query Store provides built-in reports that help identify performance issues. The "Top Resource Consuming Queries" report displays queries ranked by total CPU, I/O, duration, or memory usage, helping identify the most expensive queries. The "Regressed Queries" report specifically shows queries whose performance has degraded, displaying plan changes and comparing execution statistics across time periods. These two reports are specifically designed to identify and troubleshoot query performance regressions.

   Why the other options are wrong

   • CDatabase File Space Usage is incorrect because this report shows the space consumed by different database files and filegroups, not query performance metrics.
   • DOverall Resource Consumption is incorrect because this report shows database-level resource utilization trends but does not drill down to individual query-level regression analysis like the Regressed Queries report does.
5. Question 5Configure and Manage Automation of Tasks

   Wide World Importers uses Azure SQL Managed Instance and needs to automate the execution of a stored procedure every day at 2:00 AM. Which feature should you use?

   • AAzure Functions with a CRON timer trigger
   • BSQL Server Agent jobs on the Managed InstanceCorrect
   • CAzure Logic Apps recurrence trigger workflow
   • DAzure Scheduler recurring job service (retired)
   ✓ Correct answer: B

   Azure SQL Managed Instance includes SQL Server Agent, which is the native SQL Server scheduling and job execution service. SQL Server Agent jobs can be configured to execute stored procedures on specific schedules (such as 2:00 AM daily) with full T-SQL support, making it the ideal solution for scheduled stored procedure execution on Managed Instance. This provides feature parity with on-premises SQL Server scheduling.

   Why the other options are wrong

   • AA Function timer trigger runs external code rather than using the instance's native SQL Server Agent scheduler.
   • CLogic Apps is an integration and orchestration service, not the native SQL scheduling engine on Managed Instance.
   • DAzure Scheduler is a retired service and was never the native scheduler for SQL workloads on Managed Instance.
6. Question 6Plan and Configure HA and DR Environment

   Contoso Suites needs to retain Azure SQL Database backups for 7 years to comply with regulatory requirements. The default backup retention period is 7 days. What should they configure?

   • AConfigure long-term retention (LTR) policy with weekly, monthly, and yearly retentionCorrect
   • BIncrease the short-term point-in-time restore retention setting to 7 years
   • CSet up a continuous automated BACPAC export pipeline to Azure Data Lake Storage
   • DSchedule a runbook to create manual BACPAC exports every week for seven years
   ✓ Correct answer: A

   Long-term retention (LTR) policy is the proper solution for 7-year compliance requirements. LTR allows you to define separate retention schedules for weekly, monthly, and yearly backup tiers, extending retention from the default 7-day maximum up to 10 years. By configuring the LTR policy with appropriate retention values (for example, Y=7 for 7-year yearly retention), you preserve backups for the required compliance duration. The LTR backups are stored in geo-redundant storage, ensuring both availability and geographic protection for regulatory compliance.

   Why the other options are wrong

   • BShort-term PITR retention caps at 35 days, so it can never reach a 7-year requirement.
   • CAutomated BACPAC export is a data-copy workflow, not the built-in backup retention mechanism used for compliance.
   • DManual BACPAC exports are unmanaged, non-transaction-consistent copies and are not the supported long-term retention path.
7. Question 7Configure and Manage Automation of Tasks

   You need to automate the scaling of an Azure SQL Database from Standard S2 to S4 tier during business hours and back to S2 after hours. Which automation approach should you use?

   • ASQL Server Agent jobs running on a schedule inside Azure SQL Database
   • BAzure Data Factory pipeline triggered on a business-hours schedule
   • CAzure Automation with PowerShell runbooks and a recurring scheduleCorrect
   • DManual scaling through the Azure portal blade twice every business day
   ✓ Correct answer: C

   Azure SQL Database has no built-in SQL Agent, so scheduled tier scaling between Standard S2 and S4 is best implemented with Azure Automation: a PowerShell runbook calls Set-AzSqlDatabase to change the service objective, and a recurring schedule (or two schedules) runs it to scale up during business hours and back down afterward. This is automated, code-driven, and repeatable. Azure Data Factory is a data-integration/orchestration service and is not the standard mechanism for time-based database tier scaling.

   Why the other options are wrong

   • ASQL Server Agent is not available in Azure SQL Database, so it cannot schedule service-tier scaling.
   • BData Factory orchestrates data movement and transformation, not scheduled scaling of a database service tier.
   • DManual scaling twice a day is error-prone and labor-intensive and fails the requirement to automate scaling.
8. Question 8Implement a Secure EnvironmentSelect all that apply

   Contoso Ltd wants non-privileged support staff to query a customer table in Azure SQL Database for troubleshooting, but the email and phone columns must appear obfuscated to those users while remaining fully readable to members of an administrative role. The obfuscation should be applied automatically at query time without changing the stored values. Which TWO configuration steps should the administrator take? (Choose two.)

   • ADefine dynamic data masking rules on the email and phone columnsCorrect
   • BGrant the administrative role the UNMASK permissionCorrect
   • CEncrypt the columns with Always Encrypted deterministic encryption
   • DCreate a row-level security predicate on the customer table
   • EEnable Transparent Data Encryption on the database
   ✓ Correct answer: A, B

   Dynamic data masking applies a mask to designated columns at query time for non-privileged users without altering the stored data, which matches the requirement to show obfuscated email and phone values to support staff. Granting the UNMASK permission to the administrative role lets those members see the real, unmasked values, delivering the differential visibility the scenario requires.

   Why the other options are wrong

   • CAlways Encrypted encrypts data end to end and cannot selectively reveal plaintext to one role while masking another at query time, and it also changes how the data is stored.
   • DRow-level security filters which rows a user can see rather than obfuscating specific column values within a visible row, so it does not meet the masking requirement.
   • ETransparent Data Encryption protects files at rest and has no effect on what column values users see when they query the table.
9. Question 9Configure and Manage Automation of Tasks

   Your Azure Automation PowerShell runbook fails on the line calling Set-AzSqlDatabase with a 'term is not recognized' error, even though the cmdlet name and syntax are correct. What is the most likely cause?

   • AThe Az.Sql module is not imported into the Automation accountCorrect
   • BThe runbook was never published so its cmdlets are unavailable
   • CThe managed identity lacks the SQL DB Contributor role on it
   • DThe runbook schedule was created in a different Automation region
   ✓ Correct answer: A

   Azure Automation only exposes cmdlets from modules that have been imported into the Automation account's shared resources. If Az.Sql is missing, calls like Set-AzSqlDatabase raise a 'not recognized' error at runtime regardless of correct syntax. Importing or updating the Az.Sql module resolves it. Publishing state, role assignments, and schedule region affect other behaviors but would not produce a command-not-recognized error.

   Why the other options are wrong

   • BAn unpublished runbook can still run in a test pane; missing modules, not publish state, cause a not-recognized error.
   • CA missing role produces an authorization failure when calling Azure, not a term-not-recognized parser error.
   • DSchedule region does not change which cmdlets are loaded; the module must simply be present in the account.
10. Question 10Implement a Secure Environment

    An auditor asks how Azure SQL Database ensures that historical data changes cannot be altered without detection. Which feature provides cryptographically verifiable, tamper-evident proof of data history using a database digest?

    • ALedger (updatable and append-only ledger tables)Correct
    • BDynamic Data Masking with custom masking rules
    • CRow-Level Security using restrictive security predicates
    • DTransparent Data Encryption with a customer-managed key
    ✓ Correct answer: A

    Azure SQL Database Ledger maintains a hash-chained history of changes in a blockchain-like structure and produces a database digest that can be stored externally for independent verification. If any historical row is tampered with, verification against the digest fails. This gives auditors strong, mathematically provable integrity guarantees.

    Why the other options are wrong

    • BMasking only obscures data on display and provides no integrity or tamper-evidence guarantees.
    • CRow-Level Security filters which rows users can see but cannot protect or verify data history.
    • DTDE encrypts data at rest but does nothing to detect tampering with historical values.

Who this DP-300 practice exam is for

This practice set is for anyone preparing for the DP-300: Azure Database Administrator Associate exam at the intermediate level - from first-time candidates building a foundation to experienced Microsoft practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this DP-300 practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real DP-300 exam.

Related Microsoft resources

• DP-300 study guideKey concepts
• Microsoft practice examsAll Microsoft
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• DP-420 practice examRelated
• DP-600 practice examRelated
• DP-700 practice examRelated

DP-300 practice exam FAQ