Basic Concept: This question tests database auditing and query visibility. DP-300 expects you to distinguish between collecting audit events, retaining logs, and analyzing query behavior.
Why C is Correct: CREATE DATABASE DB1 WITH LEDGER = ON is a security-related control, but its value depends on whether the requirement is identity, encryption, auditing, network isolation, or data exposure reduction. In this scenario, the important constraint is: You need to create a new database named DB1 in the subscription. CREATE DATABASE DB1 WITH LEDGER = ON satisfies that constraint without adding an unrelated service or manual process.
Why A is Wrong: Certificates support encryption and authentication, but the correct certificate-related object depends on whether the task is TLS, Always Encrypted, or user authentication. It protects or manages a different security layer, so the required database access or protection behavior would still be incomplete.
Why B is Wrong: CREATE DATABASE DB1 WITH TRUSTWORTHY is a security-related control, but its value depends on whether the requirement is identity, encryption, auditing, network isolation, or data exposure reduction. It is not the right enforcement point for this case; the scenario needs the control that governs the data or identity path being tested.
Why D is Wrong: CREATE DATABASE DB1 WITH EDITION = ' GeneralPurpose ' , SERVICE_OBJECTIVE = ' GP_Gen5_2 ' is a security-related control, but its value depends on whether the requirement is identity, encryption, auditing, network isolation, or data exposure reduction. It protects or manages a different security layer, so the required database access or protection behavior would still be incomplete.