Implement a secure environment →easyMultiple ChoiceObjective-mapped

DP-300 Implement a secure environment Practice Question

Exhibit

Refer to the exhibit.

```sql
CREATE USER [user@contoso.com] FROM EXTERNAL PROVIDER;
ALTER ROLE db_datareader ADD MEMBER [user@contoso.com];
```

Refer to the exhibit. You run these commands in an Azure SQL Database. What is the result?

⚠ Common exam trap

Many exam-takers confuse the FROM EXTERNAL PROVIDER syntax with creating a contained database user for SQL authentication, leading them to incorrectly choose option C or A, when in fact the command explicitly maps to an Entra ID identity.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

A Microsoft Entra ID user is created and granted read access to the database.

The commands create a user in an Azure SQL Database mapped to a Microsoft Entra ID (formerly Azure AD) identity. The CREATE USER statement with FROM EXTERNAL PROVIDER creates a user that corresponds to an Entra ID user or group. The ALTER ROLE statement then adds this user to the db_datareader database role, granting read access to all tables and views. Therefore, option D correctly describes the outcome: a Microsoft Entra ID user is created and granted read access.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The user is created but not granted any permissions.
Why it's wrong here
The ALTER ROLE statement grants db_datareader.
✗
The commands fail because Entra ID users cannot be created in Azure SQL Database.
Why it's wrong here
Entra ID users can be created in Azure SQL Database.
✗
A SQL Server authentication user is created and granted read access.
Why it's wrong here
The FROM EXTERNAL PROVIDER clause creates an Entra ID user, not SQL authentication.
✓
A Microsoft Entra ID user is created and granted read access to the database.
Why this is correct
The user is from Entra ID and granted db_datareader.

Go deeper

DP-300 Implement a secure environment Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question