DP-900 Describe core data concepts Practice Question
Your company is implementing a data governance solution using Microsoft Purview. The data catalog must automatically scan and classify sensitive data in Azure SQL Database, Azure Synapse Analytics, and Amazon S3. The company uses Microsoft Entra ID for identity management. You need to ensure that the Purview managed identity can authenticate to these data sources. Which authentication method should you configure for the Amazon S3 connection?
⚠ Common exam trap
A common mix-up: candidates assume Microsoft Entra ID authentication works for all data sources because the question mentions Entra ID for identity management, but Amazon S3 is an AWS service that requires AWS IAM, not Microsoft's identity system.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS IAM authentication
Amazon S3 is an external cloud storage service that does not support Microsoft Entra ID, SQL Authentication, or Windows Authentication. To authenticate Purview's managed identity to S3, you must configure AWS IAM authentication, which allows Purview to assume an IAM role with permissions to read the S3 bucket metadata and data for scanning and classification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS IAM authentication
Why this is correct
Amazon S3 only accepts requests signed with AWS credentials, specifically AWS IAM identities such as a user or role. To let Microsoft Purview scan an S3 bucket, you must create an IAM role in the AWS account, configure its trust policy to allow the Purview service principal (via an external ID) to assume the role, and attach policies that grant read access to the bucket. The Purview managed identity then uses that IAM role to authenticate, so AWS IAM authentication is the only valid method for this connection.
- ✗
SQL Authentication
Why it's wrong here
SQL Authentication is a database-specific login method that relies on a username and password stored in a relational engine such as SQL Server or Azure SQL Database. This mechanism does not exist for Amazon S3, which is an object storage service that validates access purely through AWS IAM signed HTTP requests. Purview cannot present a SQL login to S3 because there is no SQL engine to verify the credentials, making this option incorrect.
- ✗
Windows Authentication
Why it's wrong here
Windows Authentication uses Active Directory Kerberos tickets to validate a user's identity against domain controllers, which are typically on-premises or in a private cloud. Amazon S3 has no awareness of Windows domain accounts and does not accept Kerberos tokens or NTLM challenges; its REST API requires AWS Signature Version 4 authentication. Since Purview cannot provide Windows domain credentials to an AWS S3 endpoint, this method is inapplicable.
- ✗
Microsoft Entra ID authentication
Why it's wrong here
Microsoft Entra ID (formerly Azure Active Directory) is the identity service for Azure resources, and Purview itself is authenticated to the Azure portal using an Entra ID account. However, when Purview connects to an S3 bucket, the request is outside the Azure trust boundary, and S3 does not recognize Entra ID tokens. AWS IAM is the sole identity namespace for S3, so even though Entra ID works for Azure-native data sources, it cannot be used for this S3 connection.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
Learn chapter
Data Roles and Core Concepts
Key term
Data catalog
A data catalog is a centralized inventory of data assets that helps people find, understand, and trust the data they need for analytics or business decisions.
Key term
Data
Data is raw, unprocessed information, like numbers, words, or measurements, that can be stored, processed, and analyzed by computers.
About these practice questions
Courseiva writes every DP-900 question from scratch — 820 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-900 exam.