70-466 · Question #116
70-466 Question #116: Real Exam Question with Answer & Explanation
The correct answer is C: Create and use a new Windows domain account. Grant least privilege to this account in the source database.. When configuring impersonation for an SSAS tabular data source, a dedicated Windows domain account with least privilege is the best practice for secure, maintainable service identity.
Question
Options
- AUse the credentials of the SQL Server Analysis Services (SSAS) service account. Grant least privilege to this account in the source database.
- BUse your domain credentials. Grant least privilege to your account in the source database.
- CCreate and use a new Windows domain account. Grant least privilege to this account in the source database.
- DUse SQL Server authentication.
Explanation
When configuring impersonation for an SSAS tabular data source, a dedicated Windows domain account with least privilege is the best practice for secure, maintainable service identity.
Common mistakes.
- A. Using the SSAS service account conflates service identity with data source access, violating separation of concerns and potentially granting broader permissions than needed.
- B. Using personal domain credentials creates a dependency on an individual user - if that account's password changes or the user leaves, the connection breaks, making it unsuitable for automated daily loads.
- D. SQL Server authentication uses a username/password login rather than Windows integrated security, which is incompatible with the challenge/response (Windows auth) connection model described in the question.
Concept tested. SSAS tabular impersonation mode for data source
Reference. https://learn.microsoft.com/en-us/analysis-services/tabular-models/impersonation-ssas-tabular
Community Discussion
No community discussion yet for this question.