Microsoft DP-800 Questions & Answers

API generation does not automatically imply that exposed data is appropriately authorized.

Network allowlisting does not establish user identity or object authorization.

Exposing a constrained view can limit data surface without broad base-table rights.

An authorized request runs the report and rejects unauthorized procedure calls. However, that result would not establish the required outcome: the customer fixture returns exactly its own order items.

Load tests enforce limits and approved users retain service. However, that result would not establish the required outcome: the customer fixture returns exactly its own order items.

Canary tests validate the new route and old clients have an agreed migration path. However, that result would not establish the required outcome: the customer fixture returns exactly its own order items.

Identity permission at one Azure service does not imply access to adjacent resources. The actual technical constraint is that an open endpoint may expose inputs, outputs or costly compute to unauthorized callers.

Azure identity authentication and database authorization are distinct checks. The actual technical constraint is that an open endpoint may expose inputs, outputs or costly compute to unauthorized callers.

Authorized query transformations and inference can expose sensitive values despite masking. The actual technical constraint is that an open endpoint may expose inputs, outputs or costly compute to unauthorized callers.

Run deployment reports and a verified rollback strategy. The current task instead requires this action: require environment approvals and target validation.

Enforce secret masking and log retention policy. The current task instead requires this action: require environment approvals and target validation.

Maintaining a per-platform compatibility matrix addresses a different database behavior; the relevant distinction is that require environment approvals and target validation.

Referential integrity prevents orphan children unless cascade or other actions are deliberately configured.

Memory-optimized OLTP can reduce contention but adds feature and durability constraints.

External tables abstract remote data but do not automatically remove network or predicate-pushdown costs.

A test mismatch is detected and the fabricated amount is withheld. However, that result would not establish the required outcome: malformed output is quarantined and valid output produces typed records.

A cross-client negative test yields no unauthorized quoted text. However, that result would not establish the required outcome: malformed output is quarantined and valid output produces typed records.

The computed amount matches audited ledger SQL exactly. However, that result would not establish the required outcome: malformed output is quarantined and valid output produces typed records.

Configuration must resolve the correct database per environment without leaking secrets. The actual technical constraint is that syntactic JSON validity alone does not prove a mapped SQL object exists.

GraphQL can request related fields through a typed schema rather than repeated round trips. The actual technical constraint is that syntactic JSON validity alone does not prove a mapped SQL object exists.

Publishing the API does not grant the host network or SQL access automatically. The actual technical constraint is that syntactic JSON validity alone does not prove a mapped SQL object exists.

Tune weighting using labeled relevance judgments. The current task instead requires this action: record contribution of each retrieval branch for diagnostics.

Validating runtime-specific function availability addresses a different database behavior; the relevant distinction is that record contribution of each retrieval branch for diagnostics.

Returning more approximate candidates cannot remove duplicate document IDs or calibrate the ranks from two retrieval branches. Merging and source-aware deduplication are needed.

This action addresses a different case: An RLS policy uses SESSION_CONTEXT set directly from untrusted request text. For that case, session context is only safe as an authorization input when callers cannot impersonate other tenants. For this case, it does not directly correct the observed problem; the distinguishing issue is read filtering alone does not necessarily stop unauthorized DML that changes row ownership. The specifically relevant immediate technical action is: Add an RLS block predicate in addition to any required filter predicate.

Least-privilege object permissions reduce exposed DDL and direct data paths.

Database roles and schema grants can bound an automation's change surface.

A spoofed request cannot change access to another tenant's rows. However, that result would not establish the required outcome: an export returns only rows permitted to its assigned role.

The identity creates an approved test object but cannot alter production schemas. However, that result would not establish the required outcome: an export returns only rows permitted to its assigned role.

A test UPDATE appears in protected audit storage with correct identity. However, that result would not establish the required outcome: an export returns only rows permitted to its assigned role.

Generated output is not guaranteed to follow instructions unless independently checked. The actual technical constraint is that HTTP response metadata and generated text are different parts of the payload.

Rate limiting is often transient and should not erase durable database work. The actual technical constraint is that HTTP response metadata and generated text are different parts of the payload.

Arbitrary external REST calls risk server-side request forgery and data exfiltration. The actual technical constraint is that HTTP response metadata and generated text are different parts of the payload.