Manage database access by adding users to the database, or allowing user access with secure connection strings.
Database-level firewall rules only apply to individual databases.
Reference:
https://docs.microsoft.com/en-us/azure/azure-sql/database/secure-database-tutorial Basic Concept: This question tests secure database administration, where the control must match the data state, access boundary, identity model, or compliance requirement.
Why B and E is Correct: Create users in each database. is a security-related control, but its value depends on whether the requirement is identity, encryption, auditing, network isolation, or data exposure reduction. This fits the case because the requested outcome is: You need to ensure that each customer can only connect to and access their respective database. The selected feature addresses that outcome directly rather than relying on a workaround. Create logins in the master database. is a security-related control, but its value depends on whether the requirement is identity, encryption, auditing, network isolation, or data exposure reduction. In this scenario, the important constraint is: You need to ensure that each customer can only connect to and access their respective database. Create logins in the master database. satisfies that constraint without adding an unrelated service or manual process.
Why A is Wrong: Row-Level Security filters rows returned by queries based on a predicate function, allowing different users or tenants to see different subsets of the same tables. It is not the right enforcement point for this case; the scenario needs the control that governs the data or identity path being tested.
Why C is Wrong: Database-level firewall rules restrict access to a specific Azure SQL database and are more granular than server-level firewall rules. It protects or manages a different security layer, so the required database access or protection behavior would still be incomplete.
Why D is Wrong: Server-level firewall rules apply to all databases on the logical server and are broader than database-level firewall rules. It is not the right enforcement point for this case; the scenario needs the control that governs the data or identity path being tested.
Why F is Wrong: Always Encrypted protects sensitive columns from exposure to the database engine by encrypting and decrypting data at the client side with keys protected outside the database. It protects or manages a different security layer, so the required database access or protection behavior would still be incomplete.

Azure RBAC is used to manage who can create, update, or delete the Synapse workspace and its SQL pools, Apache Spark pools, and Integration runtimes.
Define and implement network security configurations for resources related to your dedicated SQL pool with Azure Policy.
Reference:
https://docs.microsoft.com/en-us/azure/synapse-analytics/security/synapse-workspace-synapse-rbac
https://docs.microsoft.com/en-us/security/benchmark/azure/baselines/synapse-analytics-security-baseline Basic Concept: This question tests Azure monitoring and performance management, including which metric, log destination, or alerting behavior fits the operational requirement.
Why D and E is Correct: a custom role-based access control (RBAC) role is a security-related control, but its value depends on whether the requirement is identity, encryption, auditing, network isolation, or data exposure reduction. This fits the case because the requested outcome is: You need to ensure that users from each company can view only the data of their respective company. The selected feature addresses that outcome directly rather than relying on a workaround. a security policy is correct because it is the feature whose normal purpose matches the stated requirement. a security policy is a security-related control, but its value depends on whether the requirement is identity, encryption, auditing, network isolation, or data exposure reduction. The scenario wording points to that specific behavior: You need to ensure that users from each company can view only the data of their respective company.
Why A is Wrong: a column encryption key is a security-related control, but its value depends on whether the requirement is identity, encryption, auditing, network isolation, or data exposure reduction. It is not the right enforcement point for this case; the scenario needs the control that governs the data or identity path being tested.
Why B is Wrong: asymmetric keys is a security-related control, but its value depends on whether the requirement is identity, encryption, auditing, network isolation, or data exposure reduction. It does not satisfy the required identity, encryption, firewall, auditing, or data-exposure boundary described in the scenario: You need to ensure that users from each company can view only the data of their respective company.
Why C is Wrong: a function is a security-related control, but its value depends on whether the requirement is identity, encryption, auditing, network isolation, or data exposure reduction. It protects or manages a different security layer, so the required database access or protection behavior would still be incomplete.

Anomalies can be identified by routing data via IoT Hub to a built-in ML model in Azure Stream Analytics Reference:
https://docs.microsoft.com/en-us/learn/modules/data-anomaly-detection-using-azure-iot-hub/
https://docs.microsoft.com/en-us/azure/stream-analytics/azure-synapse-analytics-output Basic Concept: This question tests plan and implement data platform resources in the DP-300 exam context.
The correct choice is determined by the exact service boundary and operational requirement stated in the scenario.
Why C is Correct: Azure Stream Analytics is correct because it is the feature whose normal purpose matches the stated requirement. Azure Stream Analytics is an Azure data-platform feature, but it must match the workload model, service tier, migration path, or deployment constraint described in the scenario. The scenario wording points to that specific behavior: You are designing an anomaly detection solution for streaming data from an Azure IoT hub.
Why A is Wrong: Azure SQL Database is an Azure data-platform feature, but it must match the workload model, service tier, migration path, or deployment constraint described in the scenario. It would solve a neighboring problem, but not the deployment, sizing, or migration requirement in this item.
Why B is Wrong: Azure Databricks is an Azure data-platform feature, but it must match the workload model, service tier, migration path, or deployment constraint described in the scenario. It mismatches the target platform, migration method, compute tier, or deployment model described in the scenario, so it would not satisfy the workload as stated.

Basic Concept: This question tests identity and authentication for Azure SQL and SQL Server workloads, including when to use contained users, directory identities, certificate validation, or authentication profiles.
Why C is Correct: A private endpoint exposes an Azure service through a private IP address in a virtual network, avoiding public endpoint dependency. The scenario asks for: You need to recommend a process to automate the management of DB3. That makes Configure a private endpoint for connectivity to DB3. the option that satisfies the required Azure SQL layer and operational outcome.
Why A is Wrong: Configure Microsoft Entra authentication for the logical server that hosts DB3. is a security- related control, but its value depends on whether the requirement is identity, encryption, auditing, network isolation, or data exposure reduction. It is not the right enforcement point for this case; the scenario needs the control that governs the data or identity path being tested.
Why B is Wrong: Create a database that has database-scoped credentials. is a security-related control, but its value depends on whether the requirement is identity, encryption, auditing, network isolation, or data exposure reduction. It does not satisfy the required identity, encryption, firewall, auditing, or data-exposure boundary described in the scenario: You need to recommend a process to automate the management of DB3.
Why D is Wrong: Create data base-scoped credentials in DB3. is a security-related control, but its value depends on whether the requirement is identity, encryption, auditing, network isolation, or data exposure reduction. It is not the right enforcement point for this case; the scenario needs the control that governs the data or identity path being tested.

Explanation:

Step 1: Attach the SSISDB database
Step 2: Turn on the TRUSTWORTHY property and the CLR property
If you are restoring the SSISDB database to an SQL Server instance where the SSISDB catalog was never created, enable common language runtime (clr) Step 3: Open the master key for the SSISDB database Restore the master key by this method if you have the original password that was used to create SSISDB.
open master key decryption by password = ' LS1Setup! ' -- ' Password used when creating SSISDB ' Alter Master Key Add encryption by Service Master Key Step 4: Encrypt a copy of the mater key by using the service master key Reference:
https://docs.microsoft.com/en-us/sql/integration-services/backup-restore-and-move-the-ssis-catalog