Exam DP-300 topic 2 question 24 discussion

D is correct. However, you could also select B or C because User1 has an Azure Active Directory (Azure AD) account. So you could create a contained database user with the Azure AD account, or you could create a Login and User with the Azure AD account. Since principal of least privilege is mentioned, wouldnt a contained Azure AD User be the better option?

As the solution must use the principle of least privilege then we should create a contained DB user (we can do it using an AD account or using SQL Server authentication due to both are allowed to create contained DB users)

B and D are the correct answer. With the contained database user satisfy the request of the least privilege ( B) The role db_ddladmin si more selective than db_owner, so D is correct.

B. Create a contained database user. D. Assign the database user the db_ddladmin role.

BD is the correct answer. Least privilege means the user should not be associated with a master db login. When connecting to the database his connection string must include the database so he goes directly to the db rather than logging into the server.

Note As Microsoft evolves the SQL Database service and moves towards higher guaranteed SLAs you may be required to switch to the contained database user model and database-scoped firewall rules to attain the higher availability SLA and higher max login rates for a given database. Microsoft encourage you to consider such changes today. https://learn.microsoft.com/en-us/sql/relational-databases/security/contained-database-users-making-your-database-portable?view=sql-server-ver16

I also agree with lukelin08