Microsoft DP-800 Exam Questions Instant Access

Question 1

You have an Azure SQL database that contains a column named Notes.

A security review discovers that Notes contains sensitive data.

You need to ensure that the data is protected so that neither the stored values nor the query inputs reveal information about the actual data. The solution must prevent a user from inferring relationships or repetitions in the data based on the encrypted output

Which should you use?

AAlways Encrypted with secure enclaves

BAlways Encrypted with randomized encryption

Crow-level security <RLS)

DAlways Encrypted with deterministic encryption

Answer : B

The requirement says the stored values and query inputs must both be protected, and users must not be able to infer relationships or repetitions in the data from the encrypted output. Microsoft documents that deterministic encryption always produces the same ciphertext for the same plaintext, which allows equality comparisons but also leaks patterns. By contrast, randomized encryption produces a different encrypted value each time for the same plaintext, which improves security and prevents pattern analysis based on repeated ciphertext values.

That makes randomized encryption the right choice here:

It protects data at rest and in transit/query parameters under Always Encrypted's client-side encryption model.

It prevents attackers from learning that the same plaintext value appears repeatedly, because repeated inputs do not produce repeated ciphertext.

Why the other options are wrong:

A . Always Encrypted with secure enclaves adds richer confidential query support, but the key protection property the question is testing is the encryption type. The requirement to prevent inference from repeated ciphertext points specifically to randomized encryption.

C . RLS controls row access, not value confidentiality.

Question 2

You have an Azure SQL database that contains the following SQL graph tables:

* A NODE table named dbo.Person

* An EDGE table named dbo.Knows

Each row in dbo.Person contains the following columns:

* Personid (int)

* DisplayName (nvarchar(100))

You need to use a HATCH operator and exactly two directed Knows relationships to return the Personid and DisplayName of people that are reachable from the person identified by an input parameter named @startPersonid.

Which Transact-SQL query should you use?

AOption A

BOption B

COption C

DOption D

Answer : D

The correct query is Option D because it starts from the input person and uses exactly two directed Knows edges in a single MATCH pattern:

MATCH(p1-(k1)->p2-(k2)->p3)

Microsoft documents that SQL Graph uses the MATCH predicate in the WHERE clause to express graph traversal patterns over node and edge tables, and directed relationships are written with arrow syntax such as node1-(edge)->node2.

Why D is correct:

It anchors the starting node with p1.PersonId = @StartPersonId.

It traverses two directed hops: p1 -> p2 -> p3.

It returns p3.PersonId, p3.DisplayName, which are the people reachable in exactly two Knows relationships.

Why the others are wrong:

A filters on DisplayName = DisplayName, which is unrelated to the required input parameter and does not correctly anchor the start node.

B reverses the traversal direction in the pattern.

C uses two separate MATCH predicates instead of the required single two-hop directed pattern. The proper graph pattern syntax supports chaining the hops directly in one MATCH expression.

Question 3

You have a database named DB1. The schema is stored in a Git repository as an SDK-style SQL database project.

You have a GitHub Actions workflow that already runs dotnet build and produces a database artifact.

You need to add a deployment step that publishes the dacpac file to an Azure SQL database by using the secrets stored in GitHub repository secrets

What should you include in the workflow?

AOption A

BOption B

COption C

DOption D

Answer : C

The correct workflow step is Option C because it uses the Azure SQL GitHub Action to publish a .dacpac file and reads the connection string from GitHub repository secrets, which is exactly what the requirement asks for. Microsoft's Azure SQL GitHub Actions guidance shows using azure/sql-action@v2 with a connection string stored in secrets and a DACPAC path for deployment.

The key parts that make C correct are:

uses: azure/sql-action@v2

action: publish

path: bin/Debug/db1.dacpac

connection-string: ${{ secrets.SQL_CONNECTION_STRING }}

That matches the documented publish pattern for deploying a DACPAC to Azure SQL Database from GitHub Actions. Microsoft and the Azure SQL action documentation both describe Publish as the deployment action for applying a DACPAC to a target database, while Extract is used to create a DACPAC from an existing database, not deploy one.

Why the other options are incorrect:

A uses an environment variable defined inline with a visible connection string rather than using GitHub repository secrets, which does not meet the requirement.

B uses action: extract, which would create a DACPAC from a database instead of publishing the existing DACPAC artifact.

D passes a target connection string to dotnet build, but the question says the workflow already runs dotnet build and produces a database artifact. The missing step is the deployment/publish step, not another build step. Microsoft's SQL project automation guidance separates build the DACPAC from publish the DACPAC.

Question 4

You have an SDK-style SQL database project stored in a Git repository. The project targets an Azure SQL database.

The CI build fails with unresolved reference errors when the project references system objects.

You need to update the SQL database project to ensure that dotnet build validates successfully by including the correct system objects in the database model for Azure SQL Database.

Solution: Add the Microsoft.SqlServer.Dacpacs.Azure.Master NuGet package to the project.

Does this meet the goal?

AYes

BNo

Answer : A

This does meet the goal. Microsoft documents that SDK-style SQL projects can add the master.dacpac database reference as a package reference, and for Azure SQL Database the correct package is the Azure-specific master DACPAC package. The Azure SQL system DACPACs are available through NuGet, and this is the recommended way to include the right system objects in the database model for dotnet build validation.

So for an SDK-style SQL database project that targets Azure SQL Database, adding Microsoft.SqlServer.Dacpacs.Azure.Master is the correct fix for unresolved references to system objects.

Question 5

You have a Microsoft SQL Server 2025 instance that contains a database named SalesDB SalesDB supports a Retrieval Augmented Generation (RAG) pattern for internal support tickets. The SQL Server instance runs without any outbound network connectivity.

You plan to generate embeddings inside the SQL Server instance and store them in a table for vector similarity queries.

You need to ensure that only a database user account named AlApplicationUser can run embedding generation by using the model.

Which two actions should you perform? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

AGrant the control permission on SalesDB to AlApplicationUser.

BCreate a database audit specification on SalesDB owned by AlApplicationUser.

CGrant the execute permission on the external model project to AlApplicationUser.

DCreate an external model project by using ONNX runtime and local paths.

ECreate an external model project that points to a Microsoft Foundry REST endpoint.

Answer : C, D

Because the SQL Server 2025 instance has no outbound network connectivity, the embedding model cannot rely on a remote REST endpoint such as Azure AI Foundry or Azure OpenAI. Microsoft's CREATE EXTERNAL MODEL documentation includes a local deployment pattern using ONNX Runtime running locally with local runtime/model paths. That is the right design when embeddings must be generated inside the SQL Server instance without external network access. Microsoft explicitly documents a local ONNX Runtime example for SQL Server 2025 and notes the required local runtime setup and model path configuration.

The permission requirement is handled by granting the application user access to use the external embeddings model. Microsoft's AI_GENERATE_EMBEDDINGS documentation states that, as a prerequisite, you must create an external model of type EMBEDDINGS that is accessible via the correct grants, roles, and/or permissions. Among the choices, the exam-appropriate action is to grant execute permission on the external model project to AlApplicationUser so only that database user can run embedding generation through the model.

Question 6

You have an Azure SQL database that stores order data. A reporting query aggregates monthly revenue per customer runs frequently.

You need to reduce how long it takes to retrieve the calculated values. The solution must NOT alter any underlying table structure. What should you do?

ACreate a view by using ORDER BY without TOP. and then create a unique clustered index on the view.

BCreate a view without using with SCHEMABHIDING, and then create a nonclustered index on the view.

CCreate a view by using GROUP BV. and then create a unique clustered index on the view.

DCreate a view by using WITH SCHEHABINDING, include COUNT_BIG(*). and then create a unique clustered index on the view.

Answer : D

To speed up repeated aggregate retrieval without changing base-table structure, the right pattern is an indexed view. Microsoft requires that an indexed view be created with WITH SCHEMABINDING, and if the view uses GROUP BY, it must also include COUNT_BIG(*). After that, the first index on the view must be a unique clustered index.

The other options fail Microsoft's indexed-view rules:

A is invalid because ORDER BY is not allowed in the indexed-view definition.

B is invalid because indexed views require WITH SCHEMABINDING, and the first index cannot just be a nonclustered index.

C is incomplete because a grouped indexed view must include COUNT_BIG(*).

Question 7

Your team is developing an Azure SQL dataset solution from a locally cloned GitHub repository by using Microsoft Visual Studio Code and GitHub Copilot Chat.

You need to disable the GitHub Copilot repository-level instructions for yourself without affecting other users.

What should you do?

AFrom Visual Studio Code, modify your GitHub Copilot Chat user settings.

BAdd a - debug flag when you start the GitHub Copilot Chat extension.

CDelete .github/copilot-instruetions.md

Answer : A

GitHub documents that repository custom instructions for Copilot Chat can be disabled for your own use in the editor settings, and that doing so does not affect other users. In VS Code, this is controlled through settings related to instruction files, where you can disable the use of repository instruction files for your own environment.

The other options are incorrect:

B is not a documented mechanism for disabling repository-level Copilot instructions.

C would remove the repository instruction file itself and therefore affect everyone using that repository, which violates the requirement.

Microsoft Developing AI-Enabled Database Solutions DP-800 Exam Questions