Drag and Drop Question You manage an Azure Machine Learning workspace that has an Azure Machine Learning datastore. Data must be loaded from the following sources: - a credential-less Azure Blob…

The correct answer is User identity passthrough; Service principal. The question requires matching appropriate Azure Machine Learning data access mechanisms to specific Azure storage types based on whether they are configured for credential-less access or require explicit credentials.

Design and prepare a machine learning solution

Question

Drag and Drop Question You manage an Azure Machine Learning workspace that has an Azure Machine Learning datastore. Data must be loaded from the following sources: - a credential-less Azure Blob Storage - an Azure Data Lake Storage (ADLS) Gen 2 which is not a credential- less datastore You need to define the authentication mechanisms to access data in the Azure Machine Learning datastore. Which data access mechanism should you use? To answer, move the appropriate data access mechanisms to the correct storage types. You may use each data access mechanism once, more than once, or not at all. You may need to move the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Answer:

Exhibit

Answer Area

Drag items

Access keyShared access signature tokenService principalUser identity passthrough

Correct arrangement

User identity passthrough
Service principal

Explanation

The question requires matching appropriate Azure Machine Learning data access mechanisms to specific Azure storage types based on whether they are configured for credential-less access or require explicit credentials.

Approach. For the 'Azure Blob Storage' which is described as 'credential-less', 'User identity passthrough' is the correct data access mechanism. A credential-less datastore in Azure Machine Learning implies that the identity of the user running the experiment or accessing the datastore is directly passed through to authenticate against the underlying storage. This mechanism leverages Azure Active Directory (Azure AD) for authentication, eliminating the need to store explicit credentials like keys or SAS tokens in the datastore definition, as long as the user's identity has the appropriate Azure RBAC roles on the Blob Storage.

For the 'Azure Data Lake Storage (ADLS) Gen 2' which is explicitly stated as 'not a credential-less datastore', 'Service principal' is the appropriate choice. When a datastore is not credential-less, it means explicit credentials or a distinct identity are required for access. A Service Principal is an identity created in Azure AD for applications, services, or automation tools to access Azure resources. It provides a secure, programmatic, and manageable way to grant access to ADLS Gen 2 without using highly privileged account keys or individual user identities directly. This is a common and recommended practice for automated processes and non-interactive access.

Common mistakes.

common_mistake. Using 'Access key' or 'Shared access signature token' for either storage type would be incorrect in this scenario. Access keys are highly privileged, static credentials for the entire storage account, and SAS tokens are delegated access tokens with limited validity; neither aligns with the 'credential-less' requirement for Azure Blob Storage, and while they can technically provide access to ADLS Gen 2, 'Service principal' offers a more secure and manageable Azure AD-integrated solution when 'not credential-less' implies a programmatic application identity. Applying 'User identity passthrough' to the ADLS Gen 2 (not credential-less) would be wrong because 'not credential-less' means an explicit credential or application identity is needed, not the direct passthrough of the user's interactive identity. Conversely, using 'Service principal' for the credential-less Azure Blob Storage would be incorrect because 'credential-less' specifically points to using the user's identity directly, and a service principal itself requires managing an application identity and its credentials, hence it's not truly 'credential-less' in the context of user-driven access.

Concept tested. Azure Machine Learning datastore authentication methods, Azure Storage access mechanisms (User Identity Passthrough, Service Principals, Access Keys, SAS tokens), credential-less datastores, Azure Active Directory integration for storage access, and best practices for securing data access in Azure ML.

Topics

#Azure ML Datastores#Data Access Control#Managed Identity#Azure Storage

Community Discussion

No community discussion yet for this question.

Full DP-100 Practice