Question 410
A migration replaces shared SQL login credentials with a service principal but grants db_owner to avoid mapping the required read-only permissions. Which TWO complementary actions provide the appropriate response AND evidence to verify it? Select TWO.
Explanation
Correct Answers
Inspect tenant and server Entra administrator settings, token audience, user mapping, group membership, service principal, role grants and sign-in failures. This is the discriminating system or configuration evidence for the case. A successful token request is not sufficient if the database principal, scope or permissions are missing or the token targets the wrong resource. Corresponding approach: Configure supported Microsoft Entra authentication and database users or contained identities for Azure SQL, ensuring the application principal receives only required permissions. It supplies the evidence portion of this complementary answer.
Configure supported Microsoft Entra authentication and database users or contained identities for Azure SQL, ensuring the application principal receives only required permissions. This is the supported administration mechanism for the described workload. A successful token request is not sufficient if the database principal, scope or permissions are missing or the token targets the wrong resource. Verify with: Inspect tenant and server Entra administrator settings, token audience, user mapping, group membership, service principal, role grants and sign-in failures. It supplies the implementation portion of this complementary answer.
Incorrect Answers
Review sign-in error number and state, selected database, Entra token principal, group claims, CREATE USER scope, role membership and firewall reachability. This choice pertains to Diagnosing login failure and group-based access, not the needed response/evidence pair. Use: Configure supported Microsoft Entra authentication and database users or contained identities for Azure SQL, ensuring the application principal receives only required permissions. Check: Inspect tenant and server Entra administrator settings, token audience, user mapping, group membership, service principal, role grants and sign-in failures.
Select Entra or SQL authentication deliberately for Azure SQL Database, Managed Instance and SQL Server VMs based on platform support, application constraints and security controls. This choice pertains to SQL authentication versus Entra and managed-instance principals, not the needed response/evidence pair. Use: Configure supported Microsoft Entra authentication and database users or contained identities for Azure SQL, ensuring the application principal receives only required permissions. Check: Inspect tenant and server Entra administrator settings, token audience, user mapping, group membership, service principal, role grants and sign-in failures.
Authorized workloads resolve the intended endpoint and connect over the required private or permitted path while unauthorized public sources are blocked. This choice pertains to Azure SQL private endpoints firewall and TLS boundary, not the needed response/evidence pair. Use: Configure supported Microsoft Entra authentication and database users or contained identities for Azure SQL, ensuring the application principal receives only required permissions. Check: Inspect tenant and server Entra administrator settings, token audience, user mapping, group membership, service principal, role grants and sign-in failures.


