DP-300 Configure and manage automation of tasks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  A service principal with a client secret stored in the Automation account certificates

  Why it's wrong here

  A service principal with a client secret is a valid way to authenticate to Azure, but the secret must be stored and managed, potentially in the Automation account certificates. This still involves a credential that must be protected and rotated. It is more complex than using a managed identity, which eliminates secret management entirely. Therefore, it does not fully meet the goal of not storing credentials in the script.

• ✓

  A managed identity for the Automation account with a contained database user in the target database

  Why this is correct

  A managed identity for the Automation account allows the runbook to authenticate to Azure SQL Database without embedding credentials. You create a contained database user mapped to the managed identity and grant necessary permissions. This approach eliminates secret management and is the recommended secure method for Azure services to access databases. The runbook can use the identity to obtain a token and connect using Microsoft Entra ID authentication.

• ✗

  A SQL login with a strong password stored in an Automation variable

  Why it's wrong here

  Storing a password in an Automation variable, even if encrypted, still requires managing and rotating that secret. It introduces a credential that could be exposed and is not the most secure method. The scenario explicitly requires not storing credentials in the script, but a variable is still a stored credential. This approach also lacks the benefits of Microsoft Entra ID integration and centralized identity management.

• ✗

  Azure Key Vault to store the SQL admin credentials, retrieved by the runbook at runtime

  Why it's wrong here

  Using Key Vault improves security over plain variables, but the runbook still needs to authenticate to Key Vault and retrieve the secret, which adds complexity. It also still relies on a SQL login, which is less secure than a managed identity. The requirement is to avoid storing credentials in the script; while Key Vault does that, it does not eliminate the need for a credential entirely, making it a less optimal solution.

Go deeper

Related to this question