DP-800 · Case study method + full-length practice

Case Studies: What They Are, and How to Train For Them

The SQL in a case study is no harder than the rest of the exam. What's added is requirements traceability — pulling a dozen requirements out of prose, holding them all at once, and checking every option against all of them. That's a trainable skill, and it's the larger-scale version of the one thing that has cost you marks all along.

Method · Tabbed scenario · Built-in timer · 9 questions · Full debrief

Part 1 — What a case study actually is

Mechanics first, so nothing on the day is a surprise.

The layout

A case study is a tabbed scenario document with a set of questions attached. The scenario stays on screen the whole time — you can flip between tabs on every question. The usual tabs:

TabContainsRead priority
OverviewThe company, what it does, where it operatesLast, or never — but scan it for the platform name
Existing environmentCurrent databases, applications, versions, problemsSecond
Business requirementsWhat the business needs, in business languageFirst
Technical requirementsConstraints, SLAs, platform rulesFirst
Exhibits (sometimes)Table DDL, a T-SQL fragment, a config fileOnly what a question points at

The navigation rules — these are the ones that matter

You canYou cannot
Move freely between questions inside the case study sectionReturn to the section once you leave it
Mark questions for review within the sectionSee the case study again from the final review screen
Re-read any tab at any time while in the sectionGo back to questions you'd already seen if you take a break mid-case-study
Two mechanics confirmed by Microsoft's own documentation 1. You may take a break during a case study, but you will not be able to return to any question seen before the break. So don't break mid-case-study — finish the block first.

2. A separate non-reviewable type also exists: problem-solution questions (a problem, one proposed solution, answer Yes or No). Microsoft's published guidance on those is worth quoting exactly: "If the solution doesn't completely solve the problem or is just the first step, the answer is 'no.'" And: "More than one solution might solve the problem, or none of the solutions may solve it." Judge each one alone; never compare them to each other.
★
The method
Five steps, in this order

1 · Read the requirements tabs first

Not the Overview. The Overview is scene-setting written to consume your time — with one exception noted in step 2. Go straight to Business requirements and Technical requirements; that is where every answer is decided.

2 · Scan the Overview for exactly one thing: the platform

Somewhere in the background prose there is usually a sentence naming the platform — "Azure SQL Database", "SQL Managed Instance", "SQL Server on a VM", "Microsoft Fabric". That single phrase silently eliminates whole families of options (multiple filegroups, filegroup backup, cross-database queries, Agent jobs). Find it, note it, then leave the tab.

3 · Tag every requirement

On your whiteboard, write each one as a short tag. Three to five words each — you're building an index, not a transcript.

B1 archive month <1 min      T1 date-range partition elimination
B2 supplier sees own only     T2 globally unique order line
B3 mask phone, usability only  T3 one request, no backend
B4 DBA cannot read NI          T4 600k articles, <1 sec
B5 answer only from articles   T5 validate before merge
B6 no API keys anywhere        T6 diagnose via QPI
                               T7 PRIMARY filegroup only

This takes about three minutes and pays for itself by question two. You'll reference the list nine times.

4 · For each question, identify which requirements are in play

Usually two or three — and here's the part people miss: at least one of them is normally not mentioned in the question at all. The question asks about the primary key; the requirement that decides it is the archiving one three bullets away.

5 · Check every option against every tagged requirement

Not just the one the question names. When two options both look right, the tiebreak is always a requirement one of them quietly violates.

The three ways case studies trap you Requirement collision. Two requirements pull in opposite directions and only one option honours both. "Globally unique identifier" versus "archive in under a minute" — a non-aligned unique index satisfies the first and destroys the second.

The partial answer. An option satisfies the requirement the question names but not a second one that also applies. A filter predicate handles "must only see their own" but not "must not be able to reassign".

The platform constraint stated once. "Azure SQL Database" appears in the Overview and is never mentioned again — and it invalidates every option involving a second filegroup.
🔑 The one-line version: Requirements first, platform noted, everything tagged — then treat each question as a checklist, not a judgement call.

Part 2 — Full-length practice case study

Nine questions, tabbed exactly like the real thing. Target: 22 minutes including reading.
How to use this properly Start the timer. Read the tabs. Answer all nine on paper before opening a single answer. Revealing as you go turns a diagnostic into a reading exercise and tells you nothing. The answers are collapsed for exactly this reason.
Case study 1 of 1 — Lakeside Outdoors 00:00

General overview

Lakeside Outdoors is a United Kingdom retailer of outdoor and camping equipment. The company operates 240 physical stores and an e-commerce storefront, and sells through a network of 1,800 independent suppliers.

Lakeside Outdoors is consolidating its data estate onto Azure SQL Database. The company is also launching an AI-powered product assistant for customers and a self-service portal for suppliers.

Planned changes

Lakeside Outdoors plans to modernise its order history retention process, launch the supplier portal, deploy the AI product assistant, and formalise its database deployment pipeline.

Databases

SalesDB contains Sales.Order, Sales.OrderLine and dbo.Customer.
CatalogDB contains dbo.Product (1.4 million rows), dbo.Supplier and dbo.SupportArticle (600,000 articles averaging 3,000 words each).

Current issues

Sales.OrderLine contains 2.1 billion rows and grows by approximately 140 million rows per month. A nightly job deletes rows older than 36 months in batches. The job currently runs for five hours, causes blocking, and generates substantial transaction log activity.

The storefront issues many short SELECT statements per page request. During peak periods, CPU utilisation and Data I/O utilisation both remain below 20%, but page latency exceeds two seconds.

dbo.Customer contains the columns NationalInsuranceNumber, DateOfBirth and PhoneNumber. PhoneNumber is not classified as sensitive and is not encrypted.

Applications

The storefront is a .NET application hosted in Azure Container Apps.
The supplier portal will be a React single-page application. No server-side application code will be written for it.
The product assistant has not yet been built.

AI resources

An Azure AI Foundry resource named foundry-lakeside hosts a text-embedding-3-small deployment and a gpt-4.1-mini deployment.

Reporting

All reporting queries against Sales.OrderLine filter on OrderDate.

Business requirements

  • B1Lakeside Outdoors must be able to retire the oldest month of order line data in under one minute, with minimal transaction log usage.
  • B2Suppliers must be able to see only their own products, and must not be able to create a product for another supplier or reassign an existing product to another supplier.
  • B3Customer support agents must see only the last four digits of PhoneNumber on screen. This is a usability measure and is not a compliance control.
  • B4Database administrators must never be able to read NationalInsuranceNumber in plaintext. The storefront must still be able to look up a customer by exact National Insurance number.
  • B5The product assistant must answer customer questions in prose, using only content drawn from support articles, and must state when it cannot answer.
  • B6No API keys may be stored in application code, configuration files, or a secret store.

Technical requirements

  • T1Reporting queries that filter on OrderDate must read only the relevant months of data.
  • T2A globally unique identifier must be retained for every order line.
  • T3The supplier portal must retrieve a supplier, that supplier's products, and each product's current stock level in a single request.
  • T4Support article retrieval must return results in under one second across all 600,000 articles.
  • T5Database schema changes must be validated by a build before being merged into the main branch, and the same artifact must then be deployed to test and to production.
  • T6The cause of the storefront page latency must be identified by using Query Performance Insight.
  • T7All partitions must reside on the PRIMARY filegroup.

Exhibit — current definition of Sales.OrderLine

CREATE TABLE Sales.OrderLine (
    OrderLineID BIGINT IDENTITY(1,1) NOT NULL,
    OrderID     BIGINT        NOT NULL,
    OrderDate   DATETIME2(0)  NOT NULL,
    ProductID   INT           NOT NULL,
    Quantity    INT           NOT NULL,
    UnitPrice   DECIMAL(10,2) NOT NULL,
    CONSTRAINT PK_OrderLine PRIMARY KEY CLUSTERED (OrderLineID)
);

CREATE NONCLUSTERED INDEX IX_OrderLine_Product
    ON Sales.OrderLine (ProductID) INCLUDE (Quantity, UnitPrice);

Exhibit — dbo.Product

CREATE TABLE dbo.Product (
    ProductID  INT PRIMARY KEY,
    SupplierID INT NOT NULL,
    Name       NVARCHAR(200) NOT NULL,
    StockLevel INT NOT NULL
);

The nine questions

Answer all nine on paper before opening any reveal.
1
Design a data retention solution
How should you configure partitioning for Sales.OrderLine?
  • A. Create a partition function using RANGE LEFT with end-of-month boundary values, and a partition scheme mapping each partition to a separate filegroup.
  • B. Create a partition function using RANGE RIGHT with first-of-month boundary values, and a partition scheme mapping all partitions to [PRIMARY].
  • C. Create a partition function using RANGE RIGHT on OrderLineID, and a partition scheme mapping all partitions to [PRIMARY].
  • D. Keep the nightly batched DELETE and add a filtered index on OrderDate.
Show answer & debrief
Answer: B

B1T1T7 — three requirements, and the question names none of them.

Why B. Partitioning on OrderDate with first-of-month boundaries requires RANGE RIGHT, so the first instant of a month lands with that month. Partitioning on the date column is what delivers partition elimination for T1. Mapping everything to [PRIMARY] satisfies T7 — and is the only legal choice on Azure SQL Database anyway. SWITCH then retires a month as a metadata operation, satisfying B1.

A fails twice: RANGE LEFT with end-of-month boundaries misplaces rows from the last day of each month (on a datetime2 column, anything after midnight on the boundary date falls into the next partition), and multiple filegroups violate T7 and are impossible on this platform. C partitions on the wrong column — filtering by date wouldn't align with ID-based partitions, so T1 fails. D doesn't change the fundamental cost of deleting hundreds of millions of rows.

Platform trap: "Azure SQL Database" appears once, in the Overview, and never again. It is what kills option A's filegroup strategy. This is why step 2 of the method exists.
2
Design a data retention solution
After partitioning, the existing primary key cannot be created. What should you do?
  • A. Create a non-aligned unique index on OrderLineID.
  • B. Drop the primary key and leave the table as a heap.
  • C. Change the primary key to PRIMARY KEY CLUSTERED (OrderLineID, OrderDate).
  • D. Change OrderLineID to UNIQUEIDENTIFIER with a NEWID() default.
Show answer & debrief
Answer: C

T2B1 — and B1 is the one that decides it, despite not being mentioned.

Why C. A unique index on a partitioned table must include the partitioning column, so the key becomes (OrderLineID, OrderDate). IDENTITY still guarantees every generated OrderLineID is unique across the table, so T2 is satisfied by the column's semantics even though the constraint spans two columns.

★ This is a requirement collision — the signature case-study trap. Option A enforces uniqueness on OrderLineID alone and looks like a cleaner fit for T2. But a non-aligned index blocks partition SWITCH, which destroys B1 — a requirement the question never mentions. If you only checked the requirement named in the stem, you picked A.

B abandons the key entirely. D introduces a random 16-byte clustering key on a 2.1-billion-row table with 140 million monthly inserts — severe fragmentation, and it doesn't solve the partitioning constraint either.

3
Secure the supplier portal
How should you enforce supplier isolation on dbo.Product?
  • A. Create a security policy with a filter predicate on SupplierID.
  • B. Create a security policy with a filter predicate on SupplierID, and block predicates AFTER INSERT and AFTER UPDATE.
  • C. Create a view for each supplier and grant SELECT on the view.
  • D. Apply Dynamic Data Masking to SupplierID.
Show answer & debrief
Answer: B

B2 — one requirement, but it contains three verbs.

Read B2 again: suppliers must "see only their own products" (→ filter predicate), must not "create a product for another supplier" (→ AFTER INSERT), and must not "reassign an existing product to another supplier" (→ AFTER UPDATE). Three controls, one requirement.

The partial answer. Option A satisfies exactly one third of B2 and is the most commonly chosen wrong answer in this shape. A filter predicate alone would let a supplier successfully insert a row stamped with someone else's SupplierID — and then watch it vanish from their own view.

C is bypassable by querying the base table, and 1,800 views is unmanageable. D is a display control, not a boundary — and masking an ID column doesn't restrict anything.

4
Protect customer data
How should you protect NationalInsuranceNumber?
  • A. Transparent Data Encryption with a customer-managed key.
  • B. Always Encrypted with randomized encryption.
  • C. Always Encrypted with deterministic encryption.
  • D. Column-level encryption using ENCRYPTBYKEY.
Show answer & debrief
Answer: C

B4 — a requirement with two clauses that must both hold.

Clause one: "administrators must never read it in plaintext" → Always Encrypted, because the keys live outside the database. Clause two: "look up a customer by exact National Insurance number" → deterministic, the only encryption type supporting equality search.

A decrypts transparently for anyone who can authenticate, DBAs included — TDE protects files, not queries. B satisfies the security clause but breaks the lookup. D is server-side, so any DBA with key access reads plaintext.

Worth noting for the real thing: deterministic encryption is weaker than randomized because repeated values produce repeated ciphertext. You accept that here only because a requirement forces it. If B4 hadn't mentioned exact lookup, B would be correct.
5
Protect customer data
What should you implement for customer support agents?
  • A. Dynamic Data Masking using the partial() function, and do not grant UNMASK to the support role.
  • B. A second Row-Level Security policy scoped to the support role.
  • C. Deny SELECT on the column to the support role.
  • D. Always Encrypted with secure enclaves.
Show answer & debrief
Answer: A

B3 — and the deciding phrase is the disclaimer at the end.

Everywhere else, DDM is the wrong answer because it's defeatable by inference. Here the requirement explicitly says "this is a usability measure and is not a compliance control" — the stem has deliberately lowered the bar, which is precisely the narrow case where masking is correct.

★ The lesson. Case studies test whether you can tell when a normally-wrong answer is right. If you've learned "DDM is never the answer" as a rule rather than as a consequence, you'll reject A here. Rules from stems beat rules from memory.

B filters rows, not columns. C hides the value entirely — agents need the last four digits. D is disproportionate for a column that isn’t classified as sensitive.

Why B3 and B4 are about different columns. Dynamic Data Masking can’t be defined on an Always Encrypted column: masking runs in the engine, and the engine only ever holds ciphertext for that column. The first version of this case study put both requirements on NationalInsuranceNumber, which can’t work. If a scenario asks you to mask an encrypted column, the scenario is the trap.
6
Build the supplier portal
What should you use to expose supplier data to the React application?
  • A. Data API Builder, exposing the REST endpoint.
  • B. Data API Builder, exposing the GraphQL endpoint with relationships defined between Supplier and Product.
  • C. An Azure Function that queries the database and returns JSON.
  • D. Grant the SPA a database connection string and query CatalogDB directly.
Show answer & debrief
Answer: B

T3 — plus a constraint hidden in the Existing environment tab.

"In a single request" across a supplier, its products and their stock levels is exactly what GraphQL relationship traversal delivers. REST would need one call for the supplier and another for the products.

The constraint that isn't in the requirements tab. "No server-side application code will be written for it" sits in Existing environment, under Applications — not under Technical requirements. It's what eliminates option C. Requirements hide in the environment tab too; that's why step 1 of the method reads both requirement tabs and the environment.

D would embed credentials in a browser application — indefensible, and it also conflicts with B6's spirit.

7
Build the product assistant
How should you prepare and retrieve support articles?
  • A. Embed each full article as a single vector and query with VECTOR_DISTANCE.
  • B. Chunk each article with AI_GENERATE_CHUNKS, embed each chunk, create a DiskANN vector index, and query with VECTOR_SEARCH.
  • C. Chunk and embed each article, then query with VECTOR_DISTANCE across all chunks.
  • D. Create a full-text index on the article body and query with FREETEXT.
Show answer & debrief
Answer: B

T4 — two numbers in one requirement, each ruling out a different option.

"3,000 words per article" (from Existing environment) forces chunking — one vector for a 3,000-word article is a blurred average that matches nothing precisely. "600,000 articles, under one second" forces approximate search with a DiskANN index; exhaustive comparison across millions of chunks won't hit that latency.

A fails both halves. C chunks correctly but keeps the exhaustive scan, so it fails the latency requirement — this is the near-miss designed to catch a partial reading. D is keyword search: customers asking questions in their own words won't share vocabulary with the articles.

8
Build the product assistant
Which two actions should you perform? (Choose two.)
  • A. Include a system message instructing the model to answer only from the supplied context and to say when the answer is not present, and call the endpoint using POST.
  • B. Enable a managed identity on the SQL server and assign it the Cognitive Services OpenAI User role on foundry-lakeside.
  • C. Store the Azure OpenAI API key in Azure Key Vault and read it at runtime.
  • D. Call the endpoint using GET and pass the prompt as a query string parameter.
  • E. Instruct the model to supplement retrieved articles with its general knowledge.
Show answer & debrief
Answer: A and B

B5B6

A delivers both halves of B5 — grounding in retrieved content, plus explicit permission to decline. Without that second clause a model asked to always answer will invent something. B eliminates the key entirely, which is what B6 demands.

C is the near-miss on B6. Key Vault is far better than a config file — but B6 says no API keys "in application code, configuration files, or a secret store". That last clause exists specifically to rule out C. Read requirement lists to the end of the sentence.

D is mechanically impossible: GET has no request body, so a multi-kilobyte prompt has nowhere to go. E directly contradicts "using only content drawn from support articles".

9
Operations
Select the appropriate option for each requirement. (Two dropdowns.)

Dropdown 1 — to satisfy T5, the pull request validation pipeline must run:

  • A. dotnet build   B. dotnet publish   C. sqlpackage /Action:Export   D. sqlpackage /Action:Import

Dropdown 2 — to satisfy T6, Query Performance Insight should be configured with:

  • A. Resource Consuming Queries view, CPU metric
    B. Long Running Queries view, Duration metric
    C. Custom view, Execution count metric
    D. Long Running Queries view, Data I/O metric
Show answer & debrief
Answer: Dropdown 1 = A (dotnet build) · Dropdown 2 = C (Custom view, Execution count)

T5T6 — and each dropdown scores separately, so partial credit is available.

Dropdown 1. PR validation happens before the merge, against no database. dotnet build compiles the project into a .dacpac and surfaces unresolved references and syntax errors without needing a connection — which is exactly why it's the right validation step. Publishing the dacpac (SqlPackage /Action:Publish) is the deployment step; T5's second clause ("the same artifact must then be deployed") describes what happens after the merge, using the artifact the build produced.

Dropdown 2. The Existing environment tab says CPU and Data I/O are below 20% while latency exceeds two seconds. Low resource usage plus high latency means the database isn't working hard — the problem is the number of round trips, not the cost of any query. That eliminates every resource-based and duration-based view. Only the Custom view lets you rank by Execution count.

Note where the deciding evidence lived: not in T6, which only names the tool. The "below 20%" figures are buried in Existing environment under Current issues. Case studies routinely put the requirement in one tab and the evidence in another.

Part 3 — Debrief

What to look at after you've scored yourself.

Score yourself on the right thing

Raw score matters less than which kind of mistake you made. Categorise each miss:

If you missed…BecauseFix
Q2, Q3, Q7You answered the requirement the question named and missed a second oneStep 5 of the method — check every tagged requirement, every time
Q1You didn't register "Azure SQL Database"Step 2 — note the platform before anything else
Q5You applied "DDM is never right" as a ruleThe stem outranks your memorised rules. Look for disclaimers.
Q6, Q9The deciding fact was in Existing environment, not RequirementsRead the environment tab too — constraints hide there
Q8You stopped reading B6 before "or a secret store"Read requirement sentences to the full stop
Q4Two-clause requirement, satisfied oneUnderline every "and" in a requirement
The pattern across all nine Every single question was decided by information the question itself did not mention. Q2 by an archiving requirement, Q6 by a sentence in the applications section, Q9 by two percentages in Current issues, Q8 by the last four words of a bullet. That is not incidental — it is the case study format. The questions are deliberately underspecified so that only a candidate holding the whole scenario can answer them.

Which is why the three minutes spent tagging requirements at the start is the highest-return three minutes of the exam.

Where else to practise

SourceValue
Caldera Energy, the second case study in this kitSame collision design, different traps. Do it a few days after this one.
This one, re-timed in a weekYou'll remember some answers — that's fine. Time the reading and tagging, not the answering.
Case studies from DP-300 or AZ-305 practice materialWrong content, right format. Use them purely to drill requirement extraction.
Microsoft's official practice assessmentWorth checking whether it includes case studies at all — many practice assessments don't, which means the two you've taken may not have exercised this skill.
🔑 The whole method in one line: Requirements first · platform noted · everything tagged · check each option against all of them · finish the block before you leave it.