Explanation:

https://learn.microsoft.com/en-us/azure/azure-sql/database/authentication-aad-service-principal-tutorial?
view=azuresql
Basic Concept: This question tests identity and authentication for Azure SQL and SQL Server workloads, including when to use contained users, directory identities, certificate validation, or authentication profiles.
Why the selected answer is Correct: The selected values fit this scenario because they apply the required Azure SQL configuration at the correct scope and sequence: You need to ensure that app1 can access db1.
Why the alternate choices are Wrong: The alternate actions fail because Entra authentication must be established at the server/administrator level first, then mapped to contained database users, and finally used by the client connection.