Exam DP-201 topic 3 question 27 discussion

Actual exam question from Microsoft's DP-201

Question #: 27
Topic #: 3

You are designing the security for an Azure SQL database.
You have an Azure Active Directory (Azure AD) group named Group1.
You need to recommend a solution to provide Group1 with read access to the database only.
What should you include in the recommendation?

A. a contained database user
B. a SQL login
C. an RBAC role
D. a shared access signature (SAS)

Show Suggested Answer

Suggested Answer: A 🗳️
Create a User for a security group
A best practice for managing your database is to use Windows security groups to manage user access. That way you can simply manage the customer at the
Security Group level in Active Directory granting appropriate permissions. To add a security group to SQL Data Warehouse, you use the Display Name of the security group as the principal in the CREATE USER statement.
CREATE USER [<Security Group Display Name>] FROM EXTERNAL PROVIDER WITH DEFAULT_SCHEMA = [<schema>];
In our AD instance, we have a security group called Sales Team with an alias of [email protected]. To add this security group to SQL Data Warehouse you simply run the following statement:
CREATE USER [Sales Team] FROM EXTERNAL PROVIDER WITH DEFAULT_SCHEMA = [sales];
Reference:
https://blogs.msdn.microsoft.com/sqldw/2017/07/28/adding-ad-users-and-security-groups-to-azure-sql-data-warehouse/

by Yuri1101 at April 20, 2020, 8:44 p.m.

Comments

Submit Cancel

syu31svc

Highly Voted 4 years, 6 months ago

https://docs.microsoft.com/en-us/sql/relational-databases/security/contained-database-users-making-your-database-portable?view=sql-server-ver15: "Use contained database users to authenticate SQL Server and SQL Database connections at the database level" A is correct

upvoted 7 times

...

muni53

Most Recent 3 years, 8 months ago

indeed contained db user needed

upvoted 1 times

...

Yuri1101

5 years, 1 month ago

Should be C since we already have an Azure AD group.

upvoted 1 times

Tombarc

5 years, 1 month ago

You cannot grant access to database access using RBAC, it must be on the database level, so the correct answer is "contained user access".

upvoted 36 times

rajneesharora

4 years, 4 months ago

This is correct... Please see below: https://docs.microsoft.com/en-us/azure/azure-sql/database/authentication-aad-overview Statement: "Azure AD authentication uses contained database users to authenticate identities at the database level."

upvoted 3 times

...