You have an Azure subscription named Sub1 that contains the resources shown in the following table. You need to ensure that you can provide VM1 with secure access to a database on SQL1 by using a…

Question

Exhibits

Options

• AEnable a managed service identity on VM1.
• BCreate a secret in KV1.
• CConfigure a service endpoint on SQL1.
• DCreate a key in KV1.

• A
  71% (37)
• B
  4% (2)
• C
  10% (5)
• D
  15% (8)

Explanation

Explanation

Enabling a Managed Service Identity (MSI) on VM1 is correct because it assigns VM1 an Azure AD identity, allowing it to authenticate to SQL1 without storing credentials. A contained database user can then be created in the SQL database mapped to that Azure AD identity, enabling secure, credential-free access - which is exactly what the scenario requires.

Why the distractors are wrong:

• B (Create a secret in KV1): Storing a secret in Key Vault would require VM1 to manage and retrieve credentials, which doesn't align with the passwordless, identity-based approach of a contained database user.
• C (Configure a service endpoint on SQL1): Service endpoints control network access to SQL, not identity-based authentication - they don't enable contained database user functionality.
• D (Create a key in KV1): Keys in Key Vault are used for encryption/decryption operations, not for database authentication via contained users.

Memory Tip

Think of it this way: a contained database user = no passwords, and Managed Identity = no passwords. Whenever you see "contained database user" paired with a VM, your instinct should be "give the VM an identity first!" - MSI is the bridge between Azure resources and Azure AD authentication.

No community discussion yet for this question.