DP-300 Configure and manage automation of tasks Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Store the SQL admin credentials in Azure Key Vault and retrieve them in the runbook

  Why it's wrong here

  Storing SQL admin credentials in Key Vault is a secure way to manage secrets, but it is not necessary if you use a managed identity. The scenario asks for two actions to enable authentication; using Key Vault would be an alternative approach but would require additional steps like configuring Key Vault access and retrieving the secret. It does not leverage the managed identity, making it less optimal and not required.

• ✗

  Configure the runbook to use a service principal with a client secret stored in an Automation variable

  Why it's wrong here

  Using a service principal with a client secret stored in an Automation variable is a valid authentication method, but it involves managing a secret, which is less secure than a managed identity. The scenario does not specify that a service principal must be used, and the goal is to securely connect. This action is not required if a managed identity is used, and it adds unnecessary complexity.

• ✓

  Enable a managed identity for the Automation account

  Why this is correct

  Enabling a managed identity for the Automation account creates an identity in Microsoft Entra ID that the runbook can use to authenticate to Azure SQL Database without storing credentials. This is a secure, recommended practice. The identity must then be granted access to the database. This action is essential for the runbook to obtain a token and connect.

• ✗

  Assign the Automation account the Contributor role on the Azure SQL Server

  Why it's wrong here

  Assigning the Contributor role on the Azure SQL Server grants management-plane permissions, such as the ability to create or delete databases, but does not grant data-plane access to execute T-SQL. The runbook needs to connect to the database and run queries, which requires database-level permissions. The Contributor role is insufficient and not the correct action for enabling authentication to the database.

• ✓

  Create a contained database user in the target database for the managed identity

  Why this is correct

  After enabling the managed identity, you must create a contained database user in the target Azure SQL Database that maps to that identity. This allows the identity to authenticate and be authorized. Without this user, the managed identity cannot access the database. You also need to assign appropriate permissions, such as db_owner or specific roles, to perform maintenance tasks.

Go deeper

Related to this question