Free DP-800 Practice Questions With Full Rationale
11 scenarios split 4 / 4 / 3 across DP-800's three real exam domains, with the reasoning behind every correct answer and every distractor.
TL;DR:These 11 DP-800 practice questions test designing database solutions, securing/optimizing/deploying them, and implementing AI capabilities — weighted 4/4/3 to match the real exam's domain split. Every question includes the rationale for the correct answer and why each distractor fails.
Before You Start: How These DP-800 Questions Are Weighted
Answer each question before reading the rationale. DP-800 scenario questions tend to describe a constraint (latency, tamper-evidence, "without changing storage format") rather than naming the feature directly — the skill being tested is matching the constraint to the right T-SQL or platform feature, not recalling a definition.
For 29 more free questions in this format, start the free DP-800 quiz. For a domain-by-domain refresher, the DP-800 cheat sheet covers every domain as a quick-reference table.
Design and develop database solutions
Question 1
An application repeatedly filters orders by a 'region' attribute stored inside a JSON column, and the query gets slower as the table grows because SQL Server re-parses the JSON on every execution. What should the developer implement to fix this without changing the storage format?
- A. Add a computed column derived from JSON_VALUE on the region path, and create an index on that computed column
- B. Migrate the entire table to a separate document database
- C. Cache the filtered results only in the application layer
- D. Increase the SQL Server instance memory allocation
Correct: A. A computed column built from JSON_VALUE, indexed directly, lets the query engine use an index seek instead of parsing JSON on every row for every execution — the standard fix for hot JSON-path filters.
- Why not B: A full platform migration is disproportionate when the JSON column feature already supports indexed computed columns for exactly this case.
- Why not C: Application-layer caching masks the symptom for repeat queries but does nothing for the underlying scan cost on first execution or cache misses.
- Why not D: More memory does not remove the per-row JSON parsing cost; the query still re-parses the JSON on every scan.
Question 2
A financial services company needs a table for transaction history where records must be provably unaltered for regulators — any tampering, even by a privileged database administrator, must be detectable. Which specialized table type satisfies this?
- A. Temporal table
- B. Ledger table
- C. In-memory table
- D. External table
Correct: B. Ledger tables maintain a cryptographically verifiable history, so any tampering — including by someone with administrative access — is detectable, which is the specific regulatory requirement described.
- Why not A: Temporal tables track historical row versions for point-in-time queries, but they do not provide cryptographic tamper-evidence against a privileged user.
- Why not C: In-memory tables optimize for throughput and latency, not tamper-evidence.
- Why not D: External tables reference data stored outside the database and have no bearing on tamper-evidence for local transaction records.
Question 3
A customer data team needs to flag likely-duplicate customer names that differ by minor typos (e.g., "Jon Smith" vs. "John Smyth") directly in a T-SQL query, without exporting data to an external tool. Which function is built for this?
- A. OPENJSON
- B. REGEXP_LIKE
- C. JARO_WINKLER_DISTANCE
- D. MATCH
Correct: C. JARO_WINKLER_DISTANCE is a fuzzy string-matching function designed specifically to score how similar two strings are, which is exactly what near-duplicate name detection needs.
- Why not A: OPENJSON shreds JSON text into rows and columns — unrelated to string similarity.
- Why not B: REGEXP_LIKE tests for an exact pattern match; it cannot score approximate similarity between two arbitrary strings.
- Why not D: MATCH is the graph-query operator for traversing node and edge tables, not for comparing string similarity.
Question 4
A developer wants a GitHub Copilot chat session inside their SQL editor to answer questions using the live schema and sample data from a specific Fabric lakehouse, rather than relying on the model's general knowledge. What should they configure?
- A. Use REGEXP_LIKE to search local script files for matching table names
- B. Manually paste the full table DDL into the chat before every question
- C. Disable the security review step for AI-assisted tools
- D. An MCP server endpoint connection from the Copilot chat session to the Fabric lakehouse
Correct: D. Connecting to an MCP (Model Context Protocol) server endpoint, including for a Fabric lakehouse, is exactly how GitHub Copilot gets live, structured context about a specific data source instead of relying on general knowledge.
- Why not A: A local text-pattern search of scripts has no connection to a live lakehouse and cannot see current schema or data.
- Why not B: Works but does not scale, must be repeated every session, and is the manual workaround for what MCP is built to automate.
- Why not C: Skipping the security review of AI-assisted tools is a compliance risk unrelated to the actual goal of live schema context.
Secure, optimize, and deploy database solutions
Question 5
A support application shows customer service agents a customer's phone number, but the last four digits must appear as 'XXXX' in the app's query results while the full number remains stored normally for other authorized processes. Which feature fits?
- A. Dynamic Data Masking
- B. Always Encrypted
- C. Row-Level Security
- D. Revoke SELECT permission on the column entirely
Correct: A. Dynamic Data Masking obscures a column's value in query results for specified users without changing the stored data, which is exactly the display-only masking described.
- Why not B: Always Encrypted would prevent the application from reading the plaintext value at all for authorized processes too, breaking the described workflow.
- Why not C: Row-Level Security restricts which entire rows are visible, not how a specific column value is displayed.
- Why not D: Revoking access entirely removes the column from the query results altogether rather than showing a masked value.
Question 6
A multi-tenant SaaS database stores every customer's orders in one shared table. Each customer's application users must only ever see their own company's rows, enforced at the database layer regardless of what the application code does. What should be implemented?
- A. Column-level encryption on the customer ID column
- B. Row-Level Security (RLS)
- C. Dynamic Data Masking on the order-amount column
- D. A single shared application login with no per-tenant distinction
Correct: B. Row-Level Security enforces a predicate at the database level that filters which rows any given query can return, exactly matching a database-enforced, per-tenant row-visibility requirement.
- Why not A: Encrypting the customer ID column protects that value's confidentiality but does not filter which rows a query returns.
- Why not C: Masking hides a value in the result set; it does not stop a query from returning another tenant's rows.
- Why not D: A shared login with no distinction is the opposite of tenant isolation and would rely entirely on application logic the scenario says can't be trusted alone.
Question 7
Two concurrent transactions are intermittently freezing each other when updating overlapping rows in the same table, and the team needs to identify exactly which queries are involved before deciding how to fix it. What should they use first?
- A. Add more memory to the server without further investigation
- B. Rebuild every index on the table on a nightly schedule
- C. Query Store and dynamic management views (DMVs) to identify the blocking and deadlock chain
- D. Convert the table to a graph table
Correct: C. Query Store and DMVs are the built-in diagnostic tools for identifying blocking sessions and deadlock chains — the necessary first step before choosing a fix such as an isolation-level change.
- Why not A: Adding hardware without diagnosis does not address a locking/blocking pattern and skips the diagnostic step the scenario calls for.
- Why not B: Index rebuilds address fragmentation, not a concurrency/locking problem between two specific transactions.
- Why not D: A graph table changes the data model for relationship queries; it has no bearing on transaction blocking.
Question 8
A team wants every schema change reviewed in a pull request, built and validated before merge, and automatically flagged if someone modifies the database directly outside the normal deployment pipeline. What should they implement?
- A. Sharing one administrator login across the whole database team
- B. Emailing .sql change scripts to the team lead for a verbal sign-off
- C. Making changes directly in production and documenting them afterward in a wiki
- D. A SQL Database Project with schema drift detection, source control, and branching/pull-request policies
Correct: D. SQL Database Projects provide source-controlled, buildable database models with schema drift detection and configurable branching/PR/approval policies — the exact CI/CD workflow described.
- Why not A: A shared login removes the accountability and review trail the scenario explicitly requires.
- Why not B: An email-based approval is not source-controlled, not automatically validated, and cannot detect drift from out-of-band changes.
- Why not C: Direct production changes with after-the-fact documentation is the exact anti-pattern schema drift detection exists to catch.
Implement AI capabilities in database solutions
Question 9
A product catalog's description column changes frequently, and the embeddings used for search must reflect each change within seconds, without any scheduled polling job. Which mechanism fits?
- A. Azure Functions with a SQL trigger binding that fires immediately on the row change
- B. A nightly batch job that regenerates all embeddings
- C. Manually re-embedding a product only when a user reports stale search results
- D. Change Tracking polled once per hour
Correct: A. An Azure Function bound to a SQL trigger fires immediately when the underlying row changes, giving near-real-time embedding updates without any polling interval.
- Why not B: A nightly batch job introduces up to 24 hours of staleness, which fails the "within seconds" requirement.
- Why not C: Manual, user-triggered re-embedding does not scale and leaves most changes permanently stale until someone happens to notice.
- Why not D: Hourly polling is far slower than the seconds-level freshness the scenario requires, even though Change Tracking is a valid mechanism for less time-sensitive cases.
Question 10
A retailer's product catalog has grown to several million rows, and similarity search over embeddings needs to return results in well under a second. A small amount of approximation in the results is acceptable. Which vector search approach fits?
- A. ENN (Exact Nearest Neighbor)
- B. ANN (Approximate Nearest Neighbor)
- C. Full-text search only, with no vector component
- D. REGEXP_LIKE pattern matching against product names
Correct: B. ANN is designed to trade a small amount of accuracy for speed and scalability, which is exactly the tradeoff acceptable at multi-million-row scale with a sub-second requirement.
- Why not A: ENN guarantees exact results but scales worse — the scenario explicitly accepts approximation in exchange for speed, which points away from ENN.
- Why not C: Full-text search alone matches keywords, not semantic similarity between embeddings, so it does not answer a similarity-search requirement.
- Why not D: Regex pattern matching on product names has no relationship to vector embedding similarity.
Question 11
A team wants to build a retrieval-augmented generation flow entirely in T-SQL: pull a customer's recent order rows, send them as context to an external language model, and return a natural-language summary. Which sequence is correct?
- A. Run VECTOR_SEARCH exclusively, with no external model call at all
- B. Store the order rows as embeddings only and skip calling any language model
- C. Convert the order rows to JSON, call the model with sp_invoke_external_rest_endpoint, then extract the response text
- D. Apply Always Encrypted to the order rows before returning them to the customer as the summary
Correct: C. This is the documented RAG-in-T-SQL sequence: convert structured data to JSON, invoke the external model through sp_invoke_external_rest_endpoint, then extract the model's response — matching the "send results to language model, extract response" objective directly.
- Why not A: VECTOR_SEARCH retrieves similar rows; it does not generate a natural-language summary without a subsequent call to a language model.
- Why not B: Embeddings alone produce vectors for similarity search, not a natural-language summary — an actual model call is required for that.
- Why not D: Always Encrypted is a data-protection feature, not a mechanism for generating or returning a summary.
Wrong-Answer Patterns in These DP-800 Questions
Across these 11 questions, the wrong answers cluster into a handful of repeatable traps:
| Pattern | What it looks like |
|---|---|
| Encryption vs. masking confusion | Treating Always Encrypted and Dynamic Data Masking as interchangeable, when one hides data from everyone including DBAs and the other only hides a displayed value. |
| Batch or manual fix for a real-time need | Reaching for a nightly job, polling interval, or manual step when the scenario explicitly needs near-real-time or event-driven behavior. |
| Row-security vs. column-security mismatch | Picking a column-level control (masking or encryption) to solve a row-visibility problem, or the reverse. |
| Reimplementing a native T-SQL function | Choosing an app-side or unrelated workaround for something a specific built-in function or indexed computed column already solves natively. |
| Wrong lever for the diagnosis | Throwing hardware, a full migration, or an unrelated redesign at a problem that has a specific diagnostic or feature built for it (Query Store, schema drift detection, MCP endpoints). |
MSCertQuiz sells practice-exam access for DP-800 and other Microsoft certifications; these 11 questions are a free sample from the same 500-question bank the team maintains.
More DP-800 Prep
Every domain as a quick-reference table, plus decision tables for confused feature pairs.
A fuller, timed read on where you stand before booking the exam.
Domain weights, a 4-week plan, and where candidates lose points.
A related exam for operating AI systems already in production.
Ready for the Full DP-800 Readiness Quiz?
Take the DP-800 exam readiness quiz for a realistic read on where you stand across all three domains.
Take the Readiness Quiz