QuestionQ115

Design security solutions for applications and data

An Azure subscription contains a web app named App1. App1 uses a Microsoft Entra user account named SRV1 as a service account to authenticate to an Azure SQL database named DB1.

You discover that a developer directly accessed DB1 by using SRV1.

You need to recommend a secure authentication method that prevents credential misuse outside App1 while minimizing administrative effort.

What should you recommend?

  • A a managed identity
  • B a group managed service account (gMSA)
  • C a delegated managed service account (dMSA)
  • D a federated identity credential
Explanation

A managed identity gives App1 an automatically managed Microsoft Entra identity that can obtain tokens for Azure SQL Database without storing or sharing user credentials. Granting DB1 permissions to that identity restricts database access to the app’s workload and eliminates developer-managed credential reuse.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!