Implement a secure environment →hardMultiple Choice

DP-300 Implement a secure environment Practice Question

Exhibit

{
  "properties": {
    "publicNetworkAccess": "Disabled",
    "minimalTlsVersion": "1.2",
    "azureAdOnlyAuthentication": true,
    "administratorLogin": "admin123",
    "administratorLoginPassword": "P@ssw0rd!"
  }
}

Refer to the exhibit. You are reviewing an Azure Resource Manager template for deploying an Azure SQL Database server. The template sets publicNetworkAccess to Disabled, minimalTlsVersion to 1.2, and azureAdOnlyAuthentication to true. However, the deployment fails with an error. What is the most likely cause?

⚠ Common exam trap

Many candidates assume the deployment fails due to a missing private endpoint or password issue, but the real conflict is the simultaneous presence of SQL admin credentials and Microsoft Entra ID-only authentication, which the ARM template validation explicitly rejects.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

When azureAdOnlyAuthentication is true, the administratorLogin and administratorLoginPassword properties must not be specified

When azureAdOnlyAuthentication is set to true in an Azure SQL Database ARM template, the administratorLogin and administratorLoginPassword properties must be omitted because Microsoft Entra ID authentication replaces SQL authentication as the sole identity provider. Including these properties causes a validation conflict, as the deployment expects no SQL admin credentials when Microsoft Entra ID-only authentication is enabled.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
minimalTlsVersion 1.2 is not supported in Azure SQL Database
Why it's wrong here
Azure SQL Database supports minimalTlsVersion 1.2, so this setting does not cause the failure. It is tempting because older TLS versions were deprecated, but the actual error arises from azureAdOnlyAuthentication requiring an Entra ID administrator to be specified in the template.
✗
publicNetworkAccess Disabled requires a private endpoint to be defined in the same template
Why it's wrong here
Disabling publicNetworkAccess does not require a private endpoint in the same template; the server deploys successfully without one. It is tempting because private endpoints are the usual access path, but the failure stems from azureAdOnlyAuthentication needing an Entra ID administrator defined.
✓
When azureAdOnlyAuthentication is true, the administratorLogin and administratorLoginPassword properties must not be specified
Why this is correct
Enabling azureAdOnlyAuthentication removes SQL authentication entirely, so supplying administratorLogin and administratorLoginPassword conflicts with that setting and fails validation. The template must omit both properties and instead designate a Microsoft Entra ID administrator, satisfying the stem's azureAdOnlyAuthentication constraint.
✗
The password does not meet complexity requirements
Why it's wrong here
Setting azureAdOnlyAuthentication to true removes SQL authentication entirely, so no administrator password is validated and complexity rules are never evaluated. The deployment fails because Entra-only authentication requires an existing Microsoft Entra administrator object. Password complexity would matter only when SQL authentication remains enabled.

Go deeper

DP-300 Implement a secure environment Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question