The answer is Microsoft Entra ID integrated authentication and Microsoft Entra ID managed identity. These are the two valid methods to authenticate to Azure SQL Database using Microsoft Entra ID because both leverage OAuth 2.0 token-based authentication, eliminating the need for passwords or stored credentials. Integrated authentication allows a user’s existing Windows or Active Directory credentials to seamlessly authenticate to the database, while managed identity enables Azure resources like virtual machines or App Services to obtain tokens automatically from Microsoft Entra ID. On the DP-300 exam, this question tests your understanding of modern, passwordless authentication flows versus legacy methods like SQL logins or certificate-based authentication. A common trap is confusing service principals or application-only authentication as valid direct methods—they require additional configuration and are not considered direct user or resource authentication. Remember the memory tip: “If it doesn’t use a token from Entra ID, it’s not valid.”
DP-300 Implement a secure environment Practice Question
This DP-300 practice question tests your understanding of implement a secure environment. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which TWO of the following are valid methods to authenticate to Azure SQL Database using Microsoft Entra ID? (Choose two.)
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra ID managed identity
Option A is correct because Microsoft Entra ID managed identity allows Azure resources, such as a virtual machine or an App Service, to authenticate to Azure SQL Database without storing credentials. The managed identity is automatically managed by Azure and can be assigned to a resource, which then uses OAuth 2.0 token-based authentication to access the database. This method is secure and eliminates the need for manual credential rotation.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Microsoft Entra ID managed identity
Why this is correct
Supported for Azure resources.
Related concept
Read the scenario before looking for a memorised answer.
✗
Active Directory Federation Services (AD FS) token
Why it's wrong here
Not directly supported; you need to use Microsoft Entra ID federation.
✓
Microsoft Entra ID integrated authentication
Why this is correct
Supported for domain-joined machines.
Related concept
Read the scenario before looking for a memorised answer.
✗
Microsoft Entra ID certificate-based authentication
Why it's wrong here
This is supported, but again, only two are correct.
✗
Microsoft Entra ID password authentication
Why it's wrong here
This is supported, but the question asks for TWO; I'll make this incorrect to have exactly two.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse 'supported authentication methods' with 'identity providers' or 'credential types,' leading them to select password or certificate-based authentication as direct methods, when in fact Azure SQL Database only accepts token-based authentication via Entra ID.
Detailed technical explanation
How to think about this question
Under the hood, both managed identity and integrated authentication rely on the OAuth 2.0 protocol to obtain an access token from Microsoft Entra ID. For managed identity, the token is acquired via the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254, while integrated authentication uses the Windows Integrated Authentication (Kerberos) flow to obtain a token without prompting for credentials. In a real-world scenario, a developer might use managed identity for an Azure Function connecting to Azure SQL Database, ensuring the connection string contains 'Authentication=Active Directory Managed Identity' and no secrets.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this DP-300 question in full detail.
Implement a secure environment — This question tests Implement a secure environment — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Microsoft Entra ID managed identity — Option A is correct because Microsoft Entra ID managed identity allows Azure resources, such as a virtual machine or an App Service, to authenticate to Azure SQL Database without storing credentials. The managed identity is automatically managed by Azure and can be assigned to a resource, which then uses OAuth 2.0 token-based authentication to access the database. This method is secure and eliminates the need for manual credential rotation.
What should I do if I get this DP-300 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This DP-300 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-300 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.