The correct answer is that the database scoped credential stores the shared access signature token for accessing the blob storage. This credential securely holds the SAS token, which acts as the authentication key when Azure SQL Database connects to Azure Blob Storage via an external data source. Without this credential, the database cannot authorize read operations for PolyBase or external table queries against the storage endpoint. On the Microsoft Azure Database Administrator Associate DP-300 exam, this concept tests your understanding of how to securely bridge Azure SQL and external storage, often appearing in scenarios where you must choose between authentication methods like managed identity, storage account keys, or SAS tokens. A common trap is confusing database scoped credentials with server-level credentials—remember that the database scoped version is tied to a specific database and is ideal for granular, token-based access. Memory tip: think "SAS in a glass"—the credential is a secure container holding the SAS token, just like a glass holds water.
DP-300 Plan and implement data platform resources Practice Question
This DP-300 practice question tests your understanding of plan and implement data platform resources. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
Refer to the exhibit.
```sql
CREATE DATABASE SCOPED CREDENTIAL [https://mystorageaccount.blob.core.windows.net/data]
WITH IDENTITY = 'SHARED ACCESS SIGNATURE',
SECRET = 'sv=2022-11-02&ss=b&srt=sco&sp=rw&se=2025-01-01T00:00:00Z&st=2024-01-01T00:00:00Z&spr=https&sig=...';
CREATE EXTERNAL DATA SOURCE [MyDataSource]
WITH (
LOCATION = 'https://mystorageaccount.blob.core.windows.net/data',
CREDENTIAL = [https://mystorageaccount.blob.core.windows.net/data]
);
CREATE EXTERNAL TABLE [dbo].[ExternalTable]
(
[ProductID] INT,
[ProductName] NVARCHAR(100)
)
WITH (
LOCATION = 'products/',
DATA_SOURCE = [MyDataSource],
FILE_FORMAT = [ParquetFormat]
);
```
You are analyzing the SQL script in the exhibit. This script is used to query data stored in Azure Blob Storage from Azure SQL Database. What is the primary purpose of the database scoped credential?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "primary"
Why it matters: Asks for the main purpose or function, not a secondary benefit. Eliminate answers that describe side-effects or partial functions.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To store the shared access signature token for accessing the blob storage.
The database scoped credential in this context securely stores the Shared Access Signature (SAS) token required to authenticate and authorize access to Azure Blob Storage. When creating an external data source with the CREDENTIAL option, SQL Database uses this credential to pass the SAS token to the storage endpoint, enabling read operations for PolyBase or external table queries.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
To store the shared access signature token for accessing the blob storage.
Why this is correct
The credential holds the SAS token for authentication.
Clue confirmation
The clue word "primary" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
To define the file format of the external data.
Why it's wrong here
File format is defined separately.
✗
To specify the schema of the external table.
Why it's wrong here
Schema is defined in the CREATE EXTERNAL TABLE statement.
✗
To provide the location of the external data source.
Why it's wrong here
Location is specified in the external data source.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates confuse the credential's role with the external data source's LOCATION or the external table's schema, but the credential is strictly an authentication mechanism, not a metadata or location definition.
Detailed technical explanation
How to think about this question
Under the hood, the database scoped credential is stored encrypted in the master database and is used by PolyBase or Elastic Query to authenticate against Azure Blob Storage using the SAS token. The credential is referenced by the external data source via the CREDENTIAL = [credential_name] clause, and the SAS token must have at least read (r) and list (l) permissions for the container. In real-world scenarios, rotating the SAS token requires updating only the credential, not the external data source or table definitions.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this DP-300 question in full detail.
Plan and implement data platform resources — This question tests Plan and implement data platform resources — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: To store the shared access signature token for accessing the blob storage. — The database scoped credential in this context securely stores the Shared Access Signature (SAS) token required to authenticate and authorize access to Azure Blob Storage. When creating an external data source with the CREDENTIAL option, SQL Database uses this credential to pass the SAS token to the storage endpoint, enabling read operations for PolyBase or external table queries.
What should I do if I get this DP-300 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "primary". Asks for the main purpose or function, not a secondary benefit. Eliminate answers that describe side-effects or partial functions.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This DP-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-300 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.