Hotspot Question You have an Azure subscription that contains an Azure SQL database named SQL1. You plan to deploy a web app named App1. You need to provide App1 with read and write access to SQL1…

Question

Exhibit

Answer Area

• Account type:
  Azure Active Directory UserManaged identityService Principal
• Roles:
  db_datawriter onlydb_datareader and db_datawriterdb owner only

Explanation

This question tests knowledge of Azure managed identities for passwordless authentication to Azure SQL Database and the principle of least privilege using database roles.

Approach. App1 should use a System-assigned Managed Identity (or User-assigned Managed Identity) to access SQL1 without storing a password - managed identities eliminate the need for credentials in code or configuration. For read and write access following least privilege, App1 should be assigned the 'db_datareader' and 'db_datawriter' roles in SQL1, which grant SELECT and INSERT/UPDATE/DELETE permissions respectively without granting administrative or schema-modification rights. This minimizes administrative effort because the managed identity lifecycle is tied to the app, and assigning built-in database roles is straightforward without needing custom role creation.

Concept tested. Azure Managed Identity for passwordless Azure SQL Database authentication, combined with least-privilege database role assignment (db_datareader + db_datawriter) instead of db_owner or SQL authentication with stored credentials.

Reference. https://learn.microsoft.com/en-us/azure/app-service/tutorial-connect-msi-azure-database

No community discussion yet for this question.