AZ-204 · Question #566
Case Study 10 - Fourth Coffee Background Fourth Coffee is a global coffeehouse chain and coffee company recognized as one of the world's most influential coffee brands. The company is renowned for…
The correct answer is A. Create a SQL role definition under the Azure Cosmos DB account. B. Create a SQL role definition under the Azure Cosmas DB account. E. Create a system-assigned managed ident for the function app with read access to secrets in. To manage fine-grained data plane permissions within Azure Cosmos DB, a SQL role definition is used, and a system-assigned managed identity is a secure way for an Azure Function App to access secrets or other Azure resources.
Question
Options
- ACreate a SQL role definition under the Azure Cosmos DB account.
- BCreate a SQL role definition under the Azure Cosmas DB account.
- CCreate a custom Microsoft Entra role.
- DCreate a custom Microsoft Entra role.
- ECreate a system-assigned managed ident for the function app with read access to secrets in
How the community answered
(71 responses)- A77% (55)
- C14% (10)
- D8% (6)
Why each option
To manage fine-grained data plane permissions within Azure Cosmos DB, a SQL role definition is used, and a system-assigned managed identity is a secure way for an Azure Function App to access secrets or other Azure resources.
Creating a SQL role definition under the Azure Cosmos DB account is the correct method for defining custom data plane permissions for accessing data within a Cosmos DB SQL API database.
Creating a SQL role definition under the Azure Cosmos DB account is the correct method for defining custom data plane permissions for accessing data within a Cosmos DB SQL API database.
Creating a custom Microsoft Entra role is primarily for control plane access (managing Azure resources) or managing users/groups in Entra ID, not for fine-grained data plane access within Azure Cosmos DB itself.
Creating a custom Microsoft Entra role is primarily for control plane access (managing Azure resources) or managing users/groups in Entra ID, not for fine-grained data plane access within Azure Cosmos DB itself.
Creating a system-assigned managed identity for an Azure Function App is a secure and recommended practice for allowing the Function App to authenticate to other Azure services, such as Azure Key Vault for secrets, without managing credentials.
Concept tested: Azure Cosmos DB data plane RBAC, Managed Identities, Azure AD roles
Source: https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-setup-rbac
Topics
Community Discussion
No community discussion yet for this question.