Plan and manage an Azure AI solution →mediumMultiple Choice

AI-102 Plan and manage an Azure AI solution Practice Question

You are deploying an Azure AI solution that uses Azure AI Search. The solution must be able to index data from an Azure SQL database and provide search results to an application. You need to ensure that the search service can access the database securely without storing credentials in the indexer definition. What should you do?

⚠ Common exam trap

The trap here is thinking that storing credentials in Key Vault eliminates the need for a managed identity, but the search service still requires an identity to access Key Vault, and the indexer would need to reference the secret, which is a form of credential storage.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Configure the Azure AI Search service to use a managed identity and grant it access to the Azure SQL database.

Using a managed identity for the Azure AI Search service and granting it access to the Azure SQL database allows the indexer to authenticate without storing credentials. This is the most secure and recommended approach for service-to-service authentication in Azure.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Configure the Azure AI Search service to use a managed identity and grant it access to the Azure SQL database.
Why this is correct
By enabling a managed identity on the Azure AI Search service and granting that identity the appropriate permissions (such as db_datareader) on the Azure SQL database, you can avoid storing credentials in the indexer. The indexer can then use the managed identity to authenticate to the database, providing secure access without secrets.
✗
Store the Azure SQL database connection string in Azure Key Vault and reference it in the indexer definition.
Why it's wrong here
While Azure Key Vault can securely store secrets, referencing it in the indexer definition still requires the search service to have access to the key vault, which may involve managing credentials or using a managed identity. This adds complexity and does not eliminate the need for a managed identity to access the key vault. The question specifically asks to avoid storing credentials in the indexer definition, and using Key Vault still involves a credential reference.
✗
Use SQL authentication with a username and password, and encrypt the connection string using Azure AI Search's built-in encryption.
Why it's wrong here
Using SQL authentication with a username and password means credentials must be stored in the indexer definition or retrieved from a secure store. Azure AI Search does not provide built-in encryption for connection strings; it relies on Azure Key Vault for that. This approach does not meet the requirement of not storing credentials in the indexer definition.
✗
Configure the Azure SQL database to allow access from all Azure services and use a firewall rule.
Why it's wrong here
Allowing access from all Azure services does not provide authentication; it only permits network connectivity. The indexer still needs to authenticate to the database, which would require credentials unless a managed identity is used. This approach also weakens security by allowing a broad range of services to connect.

Go deeper

AI-102 Plan and manage an Azure AI solution Practice Question

Why each option matters

Option-by-option breakdown

Related to this question