DP-300 Cheat Sheet: Task-to-Tool Quick Reference for the Azure Database Administrator Exam
Organized by what you're trying to do, not by domain — find the task, get the portal path or command, and check the pattern table when a scenario feels ambiguous.
Exam Quick Facts
Fee and duration are Microsoft's general Associate-exam baseline, not published specifically for DP-300.
How to Use This Cheat Sheet
Each table below is organized around a task you're trying to accomplish — "schedule a recurring script," "stop public internet access," "fix a plan regression" — and maps it to the specific portal path, T-SQL, or PowerShell mechanism DP-300 expects you to know. That's deliberately different from a domain-by-domain outline: exam scenarios describe a goal, not a domain name, so practicing the goal-to-tool mapping directly is closer to how the real questions are worded.
Every fact on this page traces to Microsoft's official DP-300 study guide and exam-duration reference pages, checked September 7, 2026, with skills measured as of April 24, 2026, and is cross-checked against our 500-question DP-300 bank, which we audit against Microsoft Learn documentation before anything goes live.
Task Ledger — Deployment, Scaling & Migration
| Task | Where you do it | Note |
|---|---|---|
| Deploy Azure SQL Database | Portal, ARM, Bicep, PowerShell, or CLI | Choosing the automated method is itself a tested skill, not just the deployment result |
| Deploy Azure SQL Managed Instance | Portal, ARM, or Bicep | Provisioning takes longer than a single database — plan around it |
| Deploy SQL Server on an Azure VM | Marketplace image + ARM | Full IaaS — OS patching stays your responsibility unless automated separately |
| Configure table partitioning | T-SQL: CREATE PARTITION FUNCTION / SCHEME | Tested for both planning the strategy and implementing it |
| Identify an Azure Arc-enabled SQL use case | Azure Arc portal blade | For hybrid/on-premises servers you want to manage centrally from Azure |
| Identify an Azure SQL Database in Fabric use case | Microsoft Fabric workspace | Newer addition — an analytics-adjacent scenario, not a general OLTP one |
| Perform an online migration | Azure Database Migration Service (online mode) | Source stays available; cutover window measured in minutes |
| Perform an offline migration | Backup/restore, or BACPAC export/import | Source goes down for the duration; simpler to execute |
| Copy or move a Managed Instance database | Managed Instance database copy/move feature | A distinct, lighter-weight mechanism from a full DMS project |
Task Ledger — Authentication & Data Protection
| Task | Where you do it | Note |
|---|---|---|
| Configure Microsoft Entra ID authentication | Portal > SQL server > Microsoft Entra ID blade | Can coexist with SQL authentication, or replace it entirely |
| Enforce Entra-only authentication | Portal, or PowerShell (-EnableActiveDirectoryOnlyAuthentication) | Disables SQL logins server-wide, not just for new users |
| Create a user from an Entra identity | T-SQL: CREATE USER [user@domain] FROM EXTERNAL PROVIDER | Run against the target database, not the master database |
| Restrict connections by IP range | Portal > Networking, or T-SQL sp_set_firewall_rule | Controls who can attempt a connection, not who can authenticate |
| Remove public internet reachability | Portal > Private Link Center (private endpoint) | Pair with "disable public network access" to fully close the public path |
| Encrypt data at rest | Portal > Security > TDE | On by default for Azure SQL; covers data files, logs, and backups |
| Encrypt a column client-side | SSMS Always Encrypted wizard | Blocks most server-side operations (range, pattern) on that column |
| Run range queries on an encrypted column | SSMS wizard with enclave attestation enabled | Always Encrypted with secure enclaves — the enclave variant specifically |
| Mask sensitive values in query results | Portal > Security > Dynamic Data Masking | Display-only — not a real encryption or access control |
| Restrict which rows a user sees | T-SQL: CREATE SECURITY POLICY | Row-level security — filters transparently without changing app queries |
Cross-referencing while you study?
Drill every task above against MSCertQuiz's 500-question DP-300 bank — 40 questions free to start.
Start Free DP-300 PracticeTask Ledger — Performance Monitoring & Tuning
| Task | Where you do it | Note |
|---|---|---|
| Establish a performance baseline | Query Performance Insight / Azure Monitor metrics | Capture before making changes, not after — you need the "before" number |
| Check live blocking or waits right now | DMVs: sys.dm_exec_requests, sys.dm_tran_locks | Point-in-time diagnostics, not historical trend data |
| Track query performance over time | Query Store | Also the mechanism for forcing a specific plan back into use |
| Diagnose why one query is slow | SSMS actual execution plan / Query Store plan comparison | Confirms scan vs. seek and surfaces missing-index suggestions |
| Fix a plan regression without rewriting the query | Query Store > Tracked Queries > Force Plan | Restores a previously-known-good plan directly |
| Auto-correct future plan regressions | Portal > Automatic tuning | Automatic plan correction plus automatic index management |
| Cap resources for a lower-priority workload | Resource Governor (T-SQL: CREATE WORKLOAD GROUP / POOL) | SQL Server and Managed Instance only — not plain Azure SQL Database |
| Maintain indexes and statistics on a schedule | SQL Server Agent (VM/MI) or Elastic Job (Azure SQL DB) | Which mechanism depends entirely on the platform — see the automation table |
Task Ledger — Automation
| Task | Where you do it | Note |
|---|---|---|
| Schedule a recurring job on one instance | SQL Server Agent | Native scheduler for SQL Server on a VM or Managed Instance |
| Schedule a script across Azure SQL Database(s) | Elastic Jobs | Exists because Azure SQL Database has no built-in Agent; can target one DB, several, or a whole pool |
| Automate resource deployment itself | ARM template, Bicep, Azure PowerShell, or Azure CLI | The skill tested is automating the deployment, not deploying manually once |
| Get notified when a scheduled job fails | Agent alerts, or Elastic Job monitoring | Both mechanisms support failure notifications, configured differently |
| Troubleshoot a failed automated task | Agent job history, or Elastic Job execution history | Elastic Jobs centralize history across every database it touched |
Task Ledger — High Availability & Disaster Recovery
| Task | Where you do it | Note |
|---|---|---|
| Protect one Azure SQL Database across regions | Active geo-replication | Database-level; Azure SQL Database only, not Managed Instance |
| Protect a Managed Instance or VM instance across regions | Failover group (on Managed Instance HA or Always On AGs) | Instance-level; adds a stable listener endpoint for transparent failover |
| Provide in-region instance HA on VMs | Always On availability groups | Manually configured — you own the topology |
| Provide in-region instance HA on Managed Instance | Built-in HA (zone-redundant option available) | No manual availability-group configuration required |
| Set up a simpler, higher-RPO failover path | Log shipping | Higher RPO than AGs or geo-replication, but simpler to configure |
| Take a restorable backup | Automated backups (Azure SQL) or native BACKUP DATABASE (VM/MI) | Default retention window differs by tier — check before assuming |
| Keep backups beyond the default retention window | Portal > Backups > long-term retention policy | A separate configuration from the default point-in-time restore window |
| Restore to a specific moment in time | Portal restore UI, or T-SQL RESTORE DATABASE ... WITH STOPAT | Only works within the point-in-time restore retention window |
"If the Question Says X, Think Y" — DP-300 Pattern Table
Scenario questions often signal the intended answer through a specific phrase rather than naming the feature outright. These are the phrasings that come up repeatedly across DP-300's security and HA/DR domains.
| If the scenario says... | Think |
|---|---|
| "...must not change the application's connection string after failover" | Failover group |
| "...run range queries against an encrypted column" | Always Encrypted with secure enclaves |
| "...no SQL logins allowed at all" | Microsoft Entra-only authentication |
| "...must not be reachable from the public internet" | Private endpoint + disable public network access |
| "...recurring script across many Azure SQL Databases" | Elastic Jobs |
| "...regression right after a deployment or statistics update" | Query Store plan forcing |
| "...cap CPU/memory for a lower-priority workload" | Resource Governor |
| "...near-zero data loss, automatic failover" | Synchronous replication (AGs / failover groups) — not backup/restore |
| "...acceptable recovery window measured in hours" | Backup and restore is sufficient — don't over-engineer with AGs |
Exam Day Quick Facts
| Detail | Value |
|---|---|
| Exam code | DP-300 |
| Exam name | Administering Microsoft Azure SQL Solutions |
| Certification | Microsoft Certified: Azure Database Administrator Associate |
| Level | Intermediate (Associate) |
| Domain count | 5 |
| Passing score | 700 out of 1000 |
| Exam duration | ~100 minutes (120-minute seat time) — general Associate-exam baseline, not confirmed for DP-300 |
| Price | ~$165 USD — general Associate-exam baseline, not confirmed for DP-300 |
| Renewal | Every 12 months, free online assessment |
| Prerequisites | None formally enforced |
| Skills measured as of | April 24, 2026 |
Frequently Asked Questions About the DP-300 Exam
Is a cheat sheet enough to pass DP-300?
No. DP-300 is scenario-based and expects hands-on reasoning about trade-offs, not tool-name recall alone. This page is a quick reference for the final days before the exam — the depth needs to come from actually working with Azure SQL, plus scenario practice.
What is the difference between active geo-replication and a failover group?
Active geo-replication is an Azure SQL Database feature that maintains readable secondary replicas of a single database, typically for cross-region DR. A failover group sits on top of geo-replication (or Always On availability groups on Managed Instance/VMs) to add automatic, application-transparent failover through a stable listener endpoint.
What is the difference between SQL Server Agent and Elastic Jobs?
SQL Server Agent is the native, instance-level scheduler on SQL Server (on-premises, on a VM, or Managed Instance). Elastic Jobs exist because plain Azure SQL Database has no built-in Agent at all — they run scheduled T-SQL centrally across one database, several databases, or an entire elastic pool.
Does Always Encrypted with secure enclaves require special setup?
Yes — it requires enclave attestation configured in addition to the standard Always Encrypted wizard steps, since the enclave has to be verified as trustworthy before the engine will process operations like range queries inside it.
What is the passing score and cost for DP-300?
The passing score is 700 out of 1000. Duration and price aren't published on DP-300's own exam page — Microsoft's general Associate-exam baseline is roughly 100 minutes and $165 USD, but that isn't confirmed specifically for DP-300, so treat it as a starting estimate, not a guarantee.
Can I print this DP-300 cheat sheet?
Yes — every table here is plain HTML, so a browser print or "print to PDF" renders cleanly.
MSCertQuiz sells practice-exam access for DP-300 and other Microsoft certifications; this cheat sheet is written by the same team that builds and maintains those questions.
Where to Go Next
The full domain-by-domain plan behind this quick reference.
12 scenario questions by difficulty, with full rationale.
A 5-minute check on which domains need more study time.
Full exam details and the complete 500-question practice bank.
Reference saved. Now run it against a scenario.
Start with 40 free DP-300 questions covering every task ledger above.
Start Free DP-300 Practice