nerdexam
Microsoft

DP-300 · Question #322

Drag and Drop Question You have an Azure subscription that contains an instance of SQL Server on Azure Virtual Machines named SQLVM1 and a virtual machine named Server1 that runs Windows Server. SQLVM

The correct answer is Create a credential.; Create a proxy.; Assign the proxy to the job step.. To allow a SQL Server Agent job step to access an external resource like a file share using least privilege, you first create a credential that maps to a Windows domain account with access to Share1, then create a proxy that uses that credential to define the security context for

Submitted by yousef_jo· Mar 6, 2026Implement a secure environment for database services - specifically configuring SQL Server Agent job step security using credentials and proxies in an Azure IaaS SQL Server deployment.

Question

Drag and Drop Question You have an Azure subscription that contains an instance of SQL Server on Azure Virtual Machines named SQLVM1 and a virtual machine named Server1 that runs Windows Server. SQLVM1 and Server1 are joined to an Active Directory Domain Services (AD DS) domain. Server1 hosts a file share named Share1. You need to ensure that a SOL Server Agent job step on SQLVM1 can access the files in Share1. The solution must use the principle of least privilege. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Answer:

Exhibit

DP-300 question #322 exhibit

Answer Area

Drag items

Assign the proxy to the job step.Create a login.Create a database user.Create a credential.Create a proxy.

Correct arrangement

  • Create a credential.
  • Create a proxy.
  • Assign the proxy to the job step.

Explanation

To allow a SQL Server Agent job step to access an external resource like a file share using least privilege, you first create a credential that maps to a Windows domain account with access to Share1, then create a proxy that uses that credential to define the security context for the job step, and finally assign the proxy to the specific job step so it runs under that limited account rather than the SQL Server Agent service account. This approach follows least privilege because only the specific job step gets elevated access, not the entire SQL Server Agent service.

Topics

#SQL Server Agent#Proxies and Credentials#Azure SQL on VMs#Least Privilege Security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full DP-300 Practice