Scenario: Authenticate database users by using Active Directory credentials.
(Create a new Azure SQL database named ResearchDB1 on a logical server named ResearchSrv01.)
Authenticate the user in SQL Database or SQL Data Warehouse based on an Azure Active Directory user:
CREATE USER [Fritz@contoso.com] FROM EXTERNAL PROVIDER;
[Reference:, https://docs.microsoft.com/en-us/sql/t-sql/statements/create-user-transact-sql, , , , , , , , Basic Concept: This question tests identity and authentication for Azure SQL and SQL Server workloads, including when to use contained users, directory identities, certificate validation, or authentication profiles., Why E is Correct: CREATE USER ... FROM EXTERNAL PROVIDER creates contained users mapped to Microsoft Entra identities for Azure SQL authentication. The scenario asks for: You need to implement authentication for ResearchDB1. That makes CREATE USER and the FROM EXTERNAL PROVIDER clause the option that satisfies the required Azure SQL layer and operational outcome., Why A is Wrong: CREATE LOGIN and the FROM WINDOWS clause is a security-related control, but its value depends on whether the requirement is identity, encryption, auditing, network isolation, or data exposure reduction. It is not the right enforcement point for this case; the scenario needs the control that governs the data or identity path being tested., Why B is Wrong: Certificates support encryption and authentication, but the correct certificate-related object depends on whether the task is TLS, Always Encrypted, or user authentication. It does not satisfy the required identity, encryption, firewall, auditing, or data-exposure boundary described in the scenario: You need to implement authentication for ResearchDB1., Why C is Wrong: CREATE USER and the FROM LOGIN clause is a security-related control, but its value depends on whether the requirement is identity, encryption, auditing, network isolation, or data exposure reduction. It protects or manages a different security layer, so the required database access or protection behavior would still be incomplete., Why D is Wrong: CREATE USER and the ASYMMETRIC KEY clause is a security-related control, but its value depends on whether the requirement is identity, encryption, auditing, network isolation, or data exposure reduction. It is not the right enforcement point for this case; the scenario needs the control that governs the data or identity path being tested., ]
