Read this the night before or on exam morning. It assumes you’ve studied the notes. It’s here to refresh, not to teach.
Exam day
- Microsoft publishes no fixed question count or length for DP-300. Expect a mix of multiple choice, drag and drop, hot area, and case studies, with the time shown on your exam confirmation. Scaled score out of 1,000; you need 700.
- Some sections can’t be revisited once answered. Read the instructions on each screen and use the review screen where it exists.
- Domain weights (skills measured as of October 27, 2026): plan and implement data platform resources 15-20%, secure environment 20-25%, monitor, configure and optimize 20-25%, automation of tasks 15-20%, HA/DR 20-25%.
- Expect T-SQL, PowerShell and CLI snippets. Recognise verbs and clauses; you rarely need to recall every flag.
How to read a DP-300 question
| The question says | Think |
|---|---|
| Minimal migration effort, SQL Agent, cross-database queries, linked servers | Managed Instance |
| OS access, old SQL version, SSIS/SSRS on the same host | SQL Server on a VM |
| Many databases with different peak times | Elastic pool |
| Intermittent use, pay only when active | Serverless with auto-pause |
| Hide data from DBAs | Always Encrypted (enclaves for LIKE/range) |
| Encrypt files and backups on disk | TDE |
| Show partial values to support staff | Dynamic data masking |
| Prove records weren’t tampered with | Ledger |
| Users see only their rows | Row-level security |
| Access from on-premises over private IP | Private endpoint |
| No passwords in code | Managed identity + Entra authentication |
| Plan regressed after an upgrade | Query Store force plan, automatic tuning |
| Failover with no connection-string change | Failover group listener |
| Undo a bad update from yesterday | Point-in-time restore to a new database |
| Keep backups for 7 years | Long-term retention |
Elimination tricks
- SQL Database has no SQL Server Agent, no Resource Governor, no Database Mail, no cross-database queries (without elastic query), and no native
BACKUP. - Intelligent Insights and automatic create/drop index exist on SQL Database only.
- Restores in PaaS always create a new database; they never overwrite.
- If two answers both work, choose the one that is managed and automatic unless the question needs control.
Platform feature gaps
| Feature | SQL Database | Managed Instance | SQL Server VM |
|---|---|---|---|
| SQL Agent | No (elastic jobs) | Yes | Yes |
| Resource Governor | No | Yes | Yes |
| Cross-database queries | No | Yes | Yes |
| Native BACKUP | No | COPY_ONLY to URL only |
Full |
| Automatic backups and PITR | Yes | Yes | Automated Backup, Azure Backup |
| Active geo-replication | Yes | No (failover group) | No |
| Failover groups | Yes | Yes | No |
| Always On AG / FCI | No | No (MI link) | Yes |
| Firewall rules | Yes | No (NSG) | NSG |
| Intelligent Insights | Yes | No | No |
Backups and restore
| Fact | Value |
|---|---|
| Automatic backup cadence | Full weekly, differential every 12 or 24 hours, log about every 10 minutes |
| PITR retention | 1-35 days, default 7 |
| LTR | Up to 10 years, weekly/monthly/yearly policy |
| Default backup redundancy | Geo-redundant (RA-GRS) |
| Restore order | Full, then latest differential, then logs |
| Leave database restoring | WITH NORECOVERY |
| Stop at a time | RESTORE LOG ... WITH STOPAT |
| Recovery model for log backups | FULL |
| Backup to URL | Block blobs, SAS credential or managed identity |
HA/DR at a glance
| Need | Technology |
|---|---|
| Single DB cross-region, manual | Active geo-replication (up to 4 secondaries) |
| Many DBs or whole MI, listeners | Auto-failover group |
| VM database-level HA, readable | Always On availability group (WSFC, listener via load balancer or DNN, cloud witness) |
| VM instance-level HA | FCI (shared disks, Premium file share, S2D) |
| Warm standby, minutes of data loss | Log shipping |
| Hybrid DR or migration to MI | Managed Instance link |
| Zone failure | Zone-redundant configuration |
Security one-liners
- Entra admin on the server; users with
CREATE USER ... FROM EXTERNAL PROVIDER; Entra-only disables SQL logins. - GRANT/DENY/REVOKE: deny wins over grant. Give rights to roles and schemas.
- TDE protector in Key Vault: lose key access and the database goes inaccessible. Back up certificates on VMs.
- Firewall: database rules checked first, then server rules. Allow Azure services is broad.
- Deterministic encryption allows equality; randomized is stronger.
- Change tracking records that a row changed; CDC records the values.
- Auditing goes to storage, Log Analytics or Event Hubs.
Tuning one-liners
sys.dm_db_resource_statsabout 1 hour at 15 seconds;sys.resource_stats14 days at 5 minutes.- Reorganize at 5-30% fragmentation, rebuild above 30%.
- Query Store is on by default in Azure SQL; full store turns read-only.
- Memory grant feedback fixes spills; Parameter Sensitive Plan fixes sniffing (compat 160); batch mode on rowstore and scalar UDF inlining need compat 150.
- Automatic tuning: force last good plan everywhere; index actions on SQL Database only.
- Waits:
PAGEIOLATCH= IO,LCK_M_*= blocking,WRITELOG= log IO,RESOURCE_SEMAPHORE= memory grants.
Automation one-liners
- Agent job = steps + schedules + operators + alerts; history in
msdb; Database Mail required for email. - Elastic jobs need a job agent, a job database (SQL Database), target groups and credentials; T-SQL only.
- Bicep compiles to ARM; incremental mode is the default;
what-ifpreviews. - Alert on metric, action group runs a runbook or Logic App to scale automatically.