Question
You have a Microsoft SQL Server 2025 instance that contains a database named SalesDB. SalesDB supports a Retrieval Augmented Generation (RAG) pattern for internal support tickets. The SQL Server instance runs without any outbound network connectivity.
You plan to generate embeddings inside the SQL Server instance and store them in a table for vector similarity queries.
You need to ensure that only a database user account named AIApplicationUser can run embedding generation by using the model.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
- A. Grant the CONTROL permission on SalesDB to AIApplicationUser.
- B. Create a database audit specification on SalesDB owned by AIApplicationUser.
- C. Grant the EXECUTE permission on the external model object to AIApplicationUser. Correct
- D. Create an external model object by using ONNX Runtime and local paths. Correct
- E. Create an external model object that points to a Microsoft Foundry REST endpoint.
Explanation
With no outbound connectivity, the model must run locally: CREATE EXTERNAL MODEL with API_FORMAT = 'ONNX Runtime', a local LOCATION for the model files and LOCAL_RUNTIME_PATH for the runtime. To use an external model in AI_GENERATE_EMBEDDINGS a principal needs EXECUTE on it, so granting EXECUTE on the external model only to AIApplicationUser restricts who can generate embeddings. A Foundry REST endpoint needs outbound network access, CONTROL on the database grants far more than needed, and an audit specification records activity but does not restrict it.
