Overview
Domain 2 is one of the three heaviest DP-300 areas. Microsoft groups it into three functional groups. Authentication and authorization covers Microsoft Entra ID authentication across Azure SQL Database, Managed Instance and SQL Server, authentication for SQL on VMs, security principals, users created from Entra identities, permissions set with graphical tools and T-SQL, least privilege and troubleshooting access.
The data protection group covers transparent data encryption, object-level encryption, server and database firewall rules, Always Encrypted with and without secure enclaves, and private links and service endpoints. The compliance group covers data classification, server and database audits, change tracking, dynamic data masking, ledger and row-level security. The October 27, 2026 outline update marked the data at rest and in transit group as a minor change, so review its current bullets closely.
How it's tested
Expect a compliance or security requirement, such as hiding card numbers from DBAs, proving no tampering, or restricting each salesperson to their region, followed by four features that all sound plausible. The winning answer matches who must be blocked, what must be protected, and where the protection must hold.
-
Who must not see it
If administrators must not read values, choose Always Encrypted; if only app users should see partial values, choose masking.
-
Identity setup
Entra admin, Entra-only authentication, contained users or logins, and the minimal role are chosen from a sign-in requirement.
-
Prove or track change
Tamper evidence points to ledger, compliance trails to auditing, and incremental sync needs point to change tracking.
An auditor requires that DBAs with sysadmin rights cannot read patient identifiers, while the application must still query them by equality. TDE does not help because data is decrypted in memory for anyone who queries it. Dynamic data masking can be bypassed by privileged users. Always Encrypted with deterministic encryption keeps values encrypted inside the engine and still supports equality lookups, with keys held by the client application.
Functional groups 3
Official functional groups from the Microsoft outline, in outline order.
2.1 Configure database authentication and authorizationMicrosoft Entra and SQL authentication, principals, permissions, least privilege and troubleshooting.
- What it means
- This group covers configuring Microsoft Entra ID authentication for Azure SQL Database, Azure SQL Managed Instance and SQL Server, configuring authentication for SQL on Azure VMs and Managed Instance, configuring security principals, creating users from Entra identities, granting database and object permissions with graphical tools and T-SQL, applying least privilege, and troubleshooting access problems.
- What to understand
- Each logical server or managed instance has one Microsoft Entra admin, and you can enforce Entra-only authentication to disable SQL logins. Contained users are created with CREATE USER ... FROM EXTERNAL PROVIDER inside a database, while logins from Entra principals live in master and suit Managed Instance and server-wide access. SQL Server 2022 and later can use Entra authentication through Azure Arc or the SQL IaaS Agent extension. Grant permissions to roles instead of individuals, use fixed database roles such as db_datareader carefully, and use the built-in server roles in Azure SQL Database for server-level tasks. Login failures often trace to the wrong database context, missing users or firewall blocks.
- How it shows up
- Expect a requirement to let an Entra group read one schema, disable SQL authentication, or diagnose error 18456 for a contained user.
- Common confusion
- Assuming a server login automatically maps to a user in every database; each database still needs a user.
2.2 Implement security for data at rest and data in transitTDE, object-level encryption, firewall rules, Always Encrypted, secure enclaves, private links and service endpoints.
- What it means
- This group covers implementing transparent data encryption, object-level encryption, server and database firewall rules, Always Encrypted, Always Encrypted with secure enclaves, and private links and service endpoints for Azure SQL.
- What to understand
- TDE encrypts data files, logs and backups at rest and is enabled by default for new Azure SQL databases, with service-managed keys or customer-managed keys in Azure Key Vault. Object-level encryption uses symmetric keys and certificates with functions such as ENCRYPTBYKEY. Server-level firewall rules apply to all databases on a logical server, while database-level rules travel with the database. Always Encrypted uses a column master key and column encryption key, with deterministic encryption for equality searches and randomized for stronger protection. Secure enclaves allow rich computations such as range queries and in-place encryption. Private endpoints give the server a private IP; service endpoints restrict access to chosen subnets. TLS protects data in transit.
- How it shows up
- Expect a requirement on key ownership, query capabilities over encrypted columns, or blocking public network access.
- Common confusion
- Thinking TDE stops a DBA from reading data; TDE decrypts pages transparently for any authorized query.
2.3 Implement compliance controls for sensitive dataClassification, auditing, change tracking, dynamic data masking, ledger and row-level security.
- What it means
- This group covers applying a data classification strategy, configuring server and database audits, implementing change data tracking, implementing dynamic data masking, implementing ledger in Azure SQL, and implementing row-level security.
- What to understand
- Data Discovery and Classification labels sensitive columns with information types and sensitivity labels that appear in audit logs. Auditing writes to Azure Storage, Log Analytics or Event Hubs, and a server-level policy applies to every database on the server. Change tracking records which rows changed, while change data capture records the changed values. Dynamic data masking hides values for users without UNMASK permission but is not encryption. Ledger tables, updatable or append-only, create cryptographic hashes and database digests that prove data was not altered. Row-level security uses an inline table-valued predicate function and a security policy with filter and block predicates.
- How it shows up
- Expect a requirement for tamper evidence, per-user row filtering, masking for support staff or capturing who ran queries.
- Common confusion
- Using dynamic data masking as a security boundary against users who can run ad hoc queries.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Microsoft Entra admin
The Entra user or group with admin rights on a server or instance.
- Remember
- One admin per server; use a group.
- Tested as
- Identity setup questions.
- Trap
- Setting it per database.
-
Entra-only authentication
Setting that disables SQL authentication.
- Remember
- Existing SQL logins stop working.
- Tested as
- Hardening questions.
- Trap
- Expecting SQL logins to keep working.
-
Contained database user
User defined in the database without a login in master.
- Remember
- Portable with the database.
- Tested as
- Geo-replication and failover questions.
- Trap
- Creating a login when a contained user suffices.
-
Transparent data encryption
At-rest encryption of data, log and backup files.
- Remember
- Customer-managed keys live in Azure Key Vault.
- Tested as
- Encryption questions.
- Trap
- Expecting protection from privileged queries.
-
Always Encrypted
Client-side encryption of columns; keys never reach the engine.
- Remember
- Deterministic allows equality; randomized does not.
- Tested as
- Separation of duties questions.
- Trap
- Assuming range queries work without enclaves.
-
Secure enclaves
Protected memory region that allows richer operations on encrypted columns.
- Remember
- Enables pattern matching, range comparisons and in-place encryption.
- Tested as
- Advanced Always Encrypted questions.
- Trap
- Thinking enclaves expose keys to DBAs.
-
Server-level firewall rule
IP rule on a logical server covering all databases.
- Remember
- Stored in master.
- Tested as
- Network access questions.
- Trap
- Expecting it on Managed Instance.
-
Database-level firewall rule
IP rule scoped to one database.
- Remember
- Moves with the database in geo-replication.
- Tested as
- Portability questions.
- Trap
- Creating it in the portal; it uses T-SQL.
-
Data Discovery and Classification
Labels for sensitive columns.
- Remember
- Labels appear in audit records.
- Tested as
- Compliance questions.
- Trap
- Treating labels as access control.
-
Auditing
Tracks database events to Storage, Log Analytics or Event Hubs.
- Remember
- Server-level policy covers all databases.
- Tested as
- Compliance questions.
- Trap
- Doubling audits by enabling both levels unintentionally.
-
Dynamic data masking
Masks query output for users without UNMASK.
- Remember
- Data is unchanged on disk.
- Tested as
- Support staff scenarios.
- Trap
- Calling it encryption.
-
Ledger
Tamper-evidence through hashed history and digests.
- Remember
- Append-only tables block updates and deletes.
- Tested as
- Integrity proof questions.
- Trap
- Expecting it to prevent all changes.
-
Row-level security
Predicate function plus security policy that filters rows.
- Remember
- Block predicates stop disallowed writes.
- Tested as
- Multitenant and regional access questions.
- Trap
- Using views when RLS is required.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Data protection features
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| TDE | Encrypts files and backups at rest | Transparent to queries | Choosing it to hide data from DBAs |
| Always Encrypted | Encrypts columns client-side | Engine and DBAs never see plaintext | Forgetting driver and key access setup |
| Dynamic data masking | Obscures values in results | No encryption, bypassable by privileged users | Treating it as a security boundary |
| Row-level security | Filters rows per user context | Controls which rows, not which columns | Using it to hide column values |
Change tracking options
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Change tracking | Records that a row changed | Lightweight, no historical values | Expecting old values |
| Change data capture | Records the changed column values | Supports full history extraction | Assuming it proves tamper evidence |
| Ledger | Cryptographic proof of history | Detects tampering | Using it for incremental ETL |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Masking as protection
- What candidates pick
- Enable dynamic data masking so DBAs cannot see card numbers.
- Why it looks right
- The values appear hidden in results.
- Why it's wrong
- Administrators and users with UNMASK see real values, and inference attacks remain possible.
Clue to watch for The people to block hold elevated rights.
-
TDE hides data
- What candidates pick
- Turn on TDE to satisfy a separation of duties rule.
- Why it looks right
- Encryption sounds like it hides everything.
- Why it's wrong
- TDE only protects files at rest; queries return plaintext to authorized users.
Clue to watch for Requirement mentions administrators or cloud operators not reading data.
-
Randomized for lookups
- What candidates pick
- Use randomized Always Encrypted on a column used in WHERE equality searches.
- Why it looks right
- Randomized is stronger.
- Why it's wrong
- Randomized encryption blocks equality comparisons unless enclaves are used.
Clue to watch for The column must still be filtered or joined.
-
Login equals access
- What candidates pick
- Create a login and assume database access follows.
- Why it looks right
- Logins are familiar from on-premises SQL Server.
- Why it's wrong
- Access to a database requires a user in that database mapped to the login or contained.
Clue to watch for Error 18456 or cannot open database messages.
-
Auditing for tamper proof
- What candidates pick
- Use auditing to prove rows were never altered.
- Why it looks right
- Audit logs record activity.
- Why it's wrong
- Auditing records events; ledger provides cryptographic proof that data was not changed.
Clue to watch for Requirement says verify or prove integrity.
-
Firewall on Managed Instance
- What candidates pick
- Add a server-level IP firewall rule to Managed Instance.
- Why it looks right
- It works for Azure SQL Database.
- Why it's wrong
- Managed Instance relies on its VNet, NSGs and private or public endpoints.
Clue to watch for The target is Managed Instance.
Answer framework
Apply these steps to choose identity, encryption and compliance controls for a DP-300 security scenario.
- Identify the identity source and whether SQL authentication must be disabled, then set the Entra admin as a group and choose contained users or server logins based on scope.
- Grant access through roles and schema permissions at the lowest scope that meets the requirement.
- Decide who must not read data: use TDE for stolen files, Always Encrypted for administrators, masking for casual exposure, and customer-managed keys when key ownership matters.
- Restrict network paths with firewall rules, private endpoints or service endpoints, and disable public access where required.
- Add compliance controls: classification, auditing destination, change tracking, ledger for tamper evidence and row-level security for row filtering, then confirm each control with a test user.
Practice question
Want more like this? The DP-300 practice test has questions for every domain.
Checklist
0 of 13
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start by drawing a protection map with four questions: who signs in, what they may do, what must be hidden and from whom, and what must be proven later. Place every Domain 2 feature on that map. This turns most scenario questions into a quick match between the requirement and one feature.
Next, build hands-on familiarity. On a test logical server, set an Entra admin, create a contained user for an Entra group and grant a schema-level permission. Enable Always Encrypted on a column with SQL Server Management Studio, then try equality and range filters to feel the limits. Add a masking rule and test it with and without UNMASK. Create an updatable ledger table and verify the digest. Write a simple row-level security policy with both filter and block predicates.
Finally, revisit the data at rest and in transit bullets, since Microsoft marked that group as changed in October 2026, and review private endpoint versus service endpoint behavior for Azure SQL.
FAQ
How much of DP-300 is Domain 2, Implement a secure environment?
Microsoft weights it at 20–25%, tied for the largest share, across three functional groups: authentication and authorization, data at rest and in transit, and compliance controls.
What changed in this domain in the October 2026 update?
The change log marks the data at rest and in transit functional group as a minor change, while authentication and compliance groups are unchanged.
Does TDE protect data from database administrators?
No. TDE protects data files and backups at rest. Anyone with query access sees plaintext. Use Always Encrypted to keep values hidden from administrators.
When are secure enclaves needed?
When you must run range comparisons, pattern matching or sorting on encrypted columns, or encrypt existing data in place without moving it out of the database.
Can I use firewall rules on Managed Instance?
No. Managed Instance is deployed into a VNet subnet and is controlled with network security groups, private endpoints and an optional public endpoint.
What is the difference between ledger and auditing?
Auditing records who did what. Ledger uses hashes and digests to prove that table data has not been altered after the fact.
Other Data & Analytics certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 2 knowledge
You have covered Entra authentication, permissions, encryption, network controls and compliance features. Test whether you can match each security requirement to the correct feature.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the DP-300 AI tutor Get any concept explained your way