Implement a secure environment →hardMultiple ChoiceObjective-mapped

DP-300 Implement a secure environment Practice Question

Exhibit

Refer to the exhibit.
```json
{
  "properties": {
    "name": "myAuditPolicy",
    "type": "Microsoft.Sql/servers/databases/auditingSettings",
    "apiVersion": "2023-02-01-preview",
    "properties": {
      "state": "Enabled",
      "auditActionsAndGroups": [
        "SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP",
        "FAILED_DATABASE_AUTHENTICATION_GROUP"
      ],
      "storageEndpoint": "https://mystorage.blob.core.windows.net",
      "storageAccountAccessKey": "...",
      "retentionDays": 90,
      "isAzureMonitorTargetEnabled": true
    }
  }
}
```

You are reviewing an Azure SQL Database audit policy configuration. The policy is set to audit successful and failed database authentication events. You notice that audit logs are being written to both Azure Blob Storage and Azure Monitor. However, you are concerned about security of the storage account access key in the policy. What is the recommended approach to securely reference the storage account?

⚠ Common exam trap

A common mix-up: candidates think removing the access key property (Option A) is sufficient, not realizing that Azure SQL Database audit requires explicit authentication to the storage account and will fail without a valid access key or managed identity configuration.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Configure the server's system-assigned managed identity and grant it access to the storage account.

Using a system-assigned managed identity for the Azure SQL Database logical server eliminates the need to store a storage account access key in the audit policy configuration. Managed identities provide a secure, Azure AD-backed identity that can be granted specific permissions (e.g., Storage Blob Data Contributor) on the storage account, ensuring that access is controlled via RBAC rather than a static key. This approach aligns with security best practices by removing the risk of key exposure or rotation failures.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Remove the storageAccountAccessKey property and rely on the storage endpoint.
Why it's wrong here
The key is required for Blob Storage destination.
✗
Use a different storage account with a key that expires daily.
Why it's wrong here
Still exposes the key in the policy.
✗
Disable the Azure Monitor destination and only use Blob Storage.
Why it's wrong here
Does not remove the key requirement.
✓
Configure the server's system-assigned managed identity and grant it access to the storage account.
Why this is correct
Managed identity eliminates the need for access keys.

Quick reference

Azure Blob Storage Tier Comparison

Tier	Storage Cost	Retrieval Cost	Latency	Use Case
Hot	Highest	Lowest	Immediate	Active data, frequent reads
Cool	Lower	Higher	Immediate	Data accessed < once / month
Cold	Lower still	Higher	Immediate	Data accessed < once / quarter
Archive	Lowest	Highest + rehydration delay	Hours	Long-term compliance retention

Go deeper

DP-300 Implement a secure environment Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Azure Blob Storage Tier Comparison

Related to this question