Exam Bundle

The signed-off cutover log proves the agreed recovery point and reconciles final source and target transaction counts. That result is evidence for another corrective change: Define a cutover protocol to quiesce writes, confirm synchronization, record the recovery point and switch only after validation. The alternative problem is: A hybrid migration loses writes because engineers stop applications before verifying the final transaction synchronization and recovery checkpoint. The current Westhaven Retail issue is instead: A migration assessment reports unsupported CLR or linked-server behavior but the team ignores the result and retries a failing transfer. Its decisive acceptance evidence would be: The revised destination or remediated workload passes an explicit test of the formerly unsupported feature before production cutover.

The migration service reports healthy synchronization of representative source changes and a documented cutover readiness state. That result is evidence for another corrective change: Preflight the supported online migration prerequisites including source access, network, target state and ongoing change capture. The alternative problem is: A migration team starts an online Azure Database Migration Service workflow without ensuring source log retention, permissions or network reachability. The current Westhaven Retail issue is instead: A migration assessment reports unsupported CLR or linked-server behavior but the team ignores the result and retries a failing transfer. Its decisive acceptance evidence would be: The revised destination or remediated workload passes an explicit test of the formerly unsupported feature before production cutover.

The application completes signed-off transactions on the new endpoint with verified identities and an available rollback path. That result is evidence for another corrective change: Include connection routing, authentication, networking, monitoring and post-migration tests in the Azure SQL cutover plan. The alternative problem is: A database is copied to Azure but application traffic is redirected before connection strings, identity and firewall access have been validated. The current Westhaven Retail issue is instead: A migration assessment reports unsupported CLR or linked-server behavior but the team ignores the result and retries a failing transfer. Its decisive acceptance evidence would be: The revised destination or remediated workload passes an explicit test of the formerly unsupported feature before production cutover.

Create dedicated application identities with least privilege and enable audit attribution rather than sharing the high-privilege administrator. That relates to a separate SQL administration problem: An Azure SQL database uses a shared administrator account in every application connection string and operations cannot attribute individual changes. The Keystone BioLabs requirement is instead: An Azure SQL Database application stores SQL user passwords in deployment scripts even though its users have centrally managed Microsoft Entra identities. That approach does not directly establish the required fix; the requested acceptance evidence is: A permitted Entra user signs in to Azure SQL and the retired application secret is absent from source control and deployment settings.

Inspect effective permissions and explicit DENY precedence before removing or correcting the conflicting access policy with approval. That relates to a separate SQL administration problem: A database principal can log in but SELECT queries fail after an object-level DENY was added and administrators repeatedly add more GRANT statements. The Keystone BioLabs requirement is instead: An Azure SQL Database application stores SQL user passwords in deployment scripts even though its users have centrally managed Microsoft Entra identities. That approach does not directly establish the required fix; the requested acceptance evidence is: A permitted Entra user signs in to Azure SQL and the retired application secret is absent from source control and deployment settings.

Grant narrowly scoped EXECUTE permission on the intended procedure or suitable custom role instead of db_owner. That relates to a separate SQL administration problem: An automation identity is made db_owner just to execute a read-only stored procedure, violating a documented least-privilege policy. The Keystone BioLabs requirement is instead: An Azure SQL Database application stores SQL user passwords in deployment scripts even though its users have centrally managed Microsoft Entra identities. That approach does not directly establish the required fix; the requested acceptance evidence is: A permitted Entra user signs in to Azure SQL and the retired application secret is absent from source control and deployment settings.

A test user reads the approved objects and receives permission denial on a restricted payroll table. That result is evidence for another corrective change: Create a custom database role and grant SELECT only on explicitly approved objects rather than all readable tables. The alternative problem is: A team assigns the fixed db_datareader role for an application that should read only one sensitive table and one approved view. The current Keystone BioLabs issue is instead: An Azure SQL Database application stores SQL user passwords in deployment scripts even though its users have centrally managed Microsoft Entra identities. Its decisive acceptance evidence would be: A permitted Entra user signs in to Azure SQL and the retired application secret is absent from source control and deployment settings.

Audited sessions identify the intended service principal and the administrator is no longer used for routine application traffic. That result is evidence for another corrective change: Create dedicated application identities with least privilege and enable audit attribution rather than sharing the high-privilege administrator. The alternative problem is: An Azure SQL database uses a shared administrator account in every application connection string and operations cannot attribute individual changes. The current Keystone BioLabs issue is instead: An Azure SQL Database application stores SQL user passwords in deployment scripts even though its users have centrally managed Microsoft Entra identities. Its decisive acceptance evidence would be: A permitted Entra user signs in to Azure SQL and the retired application secret is absent from source control and deployment settings.

A controlled execution reaches only authorized objects and fails a test query against a protected table outside the approved boundary. That result is evidence for another corrective change: Review module execution context and use signed modules or narrowly scoped permissions that avoid unnecessary privilege escalation. The alternative problem is: A SQL Server application uses EXECUTE AS OWNER for dynamic statements although the impersonation chain allows unintended access to other objects. The current Keystone BioLabs issue is instead: An Azure SQL Database application stores SQL user passwords in deployment scripts even though its users have centrally managed Microsoft Entra identities. Its decisive acceptance evidence would be: A permitted Entra user signs in to Azure SQL and the retired application secret is absent from source control and deployment settings.

Create dedicated application identities with least privilege and enable audit attribution rather than sharing the high-privilege administrator. That relates to a separate SQL administration problem: An Azure SQL database uses a shared administrator account in every application connection string and operations cannot attribute individual changes. The Silvercrest University requirement is instead: An Azure SQL Database application stores SQL user passwords in deployment scripts even though its users have centrally managed Microsoft Entra identities. That approach does not directly establish the required fix; the requested acceptance evidence is: A permitted Entra user signs in to Azure SQL and the retired application secret is absent from source control and deployment settings.

Inspect effective permissions and explicit DENY precedence before removing or correcting the conflicting access policy with approval. That relates to a separate SQL administration problem: A database principal can log in but SELECT queries fail after an object-level DENY was added and administrators repeatedly add more GRANT statements. The Silvercrest University requirement is instead: An Azure SQL Database application stores SQL user passwords in deployment scripts even though its users have centrally managed Microsoft Entra identities. That approach does not directly establish the required fix; the requested acceptance evidence is: A permitted Entra user signs in to Azure SQL and the retired application secret is absent from source control and deployment settings.

Create scoped database users or groups and explicit role grants after configuring the instance Entra administrator. That relates to a separate SQL administration problem: A SQL Managed Instance team assumes its Microsoft Entra administrator automatically grants every Entra group access to all databases. The Silvercrest University requirement is instead: An Azure SQL Database application stores SQL user passwords in deployment scripts even though its users have centrally managed Microsoft Entra identities. That approach does not directly establish the required fix; the requested acceptance evidence is: A permitted Entra user signs in to Azure SQL and the retired application secret is absent from source control and deployment settings.

A member of a granted group performs only the specified database actions while an unrelated Entra group remains denied. That result is evidence for another corrective change: Create scoped database users or groups and explicit role grants after configuring the instance Entra administrator. The alternative problem is: A SQL Managed Instance team assumes its Microsoft Entra administrator automatically grants every Entra group access to all databases. The current Silvercrest University issue is instead: An Azure SQL Database application stores SQL user passwords in deployment scripts even though its users have centrally managed Microsoft Entra identities. Its decisive acceptance evidence would be: A permitted Entra user signs in to Azure SQL and the retired application secret is absent from source control and deployment settings.

A controlled execution reaches only authorized objects and fails a test query against a protected table outside the approved boundary. That result is evidence for another corrective change: Review module execution context and use signed modules or narrowly scoped permissions that avoid unnecessary privilege escalation. The alternative problem is: A SQL Server application uses EXECUTE AS OWNER for dynamic statements although the impersonation chain allows unintended access to other objects. The current Silvercrest University issue is instead: An Azure SQL Database application stores SQL user passwords in deployment scripts even though its users have centrally managed Microsoft Entra identities. Its decisive acceptance evidence would be: A permitted Entra user signs in to Azure SQL and the retired application secret is absent from source control and deployment settings.

A test domain account authenticates using the intended method and unsupported login paths remain disabled. That result is evidence for another corrective change: Configure the supported domain or Microsoft Entra authentication method for the SQL Server on Azure VM after checking version and platform prerequisites. The alternative problem is: An Azure-hosted SQL Server application needs domain-integrated Windows login behavior but its virtual machine is deployed without the required directory integration. The current Silvercrest University issue is instead: An Azure SQL Database application stores SQL user passwords in deployment scripts even though its users have centrally managed Microsoft Entra identities. Its decisive acceptance evidence would be: A permitted Entra user signs in to Azure SQL and the retired application secret is absent from source control and deployment settings.

Configure the supported domain or Microsoft Entra authentication method for the SQL Server on Azure VM after checking version and platform prerequisites. That relates to a separate SQL administration problem: An Azure-hosted SQL Server application needs domain-integrated Windows login behavior but its virtual machine is deployed without the required directory integration. The Silvercrest University requirement is instead: A SQL Managed Instance has Microsoft Entra authentication enabled but service identities lack database users and cannot read required tables. That approach does not directly establish the required fix; the requested acceptance evidence is: The intended managed identity connects and reads its allowed data while a separate unassigned identity receives an authorization denial.

Create dedicated application identities with least privilege and enable audit attribution rather than sharing the high-privilege administrator. That relates to a separate SQL administration problem: An Azure SQL database uses a shared administrator account in every application connection string and operations cannot attribute individual changes. The Silvercrest University requirement is instead: A SQL Managed Instance has Microsoft Entra authentication enabled but service identities lack database users and cannot read required tables. That approach does not directly establish the required fix; the requested acceptance evidence is: The intended managed identity connects and reads its allowed data while a separate unassigned identity receives an authorization denial.

Separate deployment-time elevated operations from runtime accounts and scope required DDL permissions to the target schema. That relates to a separate SQL administration problem: A developer executes GRANT CONTROL at database scope to permit a single schema deployment and inadvertently grants broad management capability. The Silvercrest University requirement is instead: A SQL Managed Instance has Microsoft Entra authentication enabled but service identities lack database users and cannot read required tables. That approach does not directly establish the required fix; the requested acceptance evidence is: The intended managed identity connects and reads its allowed data while a separate unassigned identity receives an authorization denial.

The deployment identity performs the approved schema change while the runtime application identity cannot alter unrelated schemas. That result is evidence for another corrective change: Separate deployment-time elevated operations from runtime accounts and scope required DDL permissions to the target schema. The alternative problem is: A developer executes GRANT CONTROL at database scope to permit a single schema deployment and inadvertently grants broad management capability. The current Silvercrest University issue is instead: A SQL Managed Instance has Microsoft Entra authentication enabled but service identities lack database users and cannot read required tables. Its decisive acceptance evidence would be: The intended managed identity connects and reads its allowed data while a separate unassigned identity receives an authorization denial.

An authorization test executes the approved procedure while unrelated table modification and database ownership actions fail. That result is evidence for another corrective change: Grant narrowly scoped EXECUTE permission on the intended procedure or suitable custom role instead of db_owner. The alternative problem is: An automation identity is made db_owner just to execute a read-only stored procedure, violating a documented least-privilege policy. The current Silvercrest University issue is instead: A SQL Managed Instance has Microsoft Entra authentication enabled but service identities lack database users and cannot read required tables. Its decisive acceptance evidence would be: The intended managed identity connects and reads its allowed data while a separate unassigned identity receives an authorization denial.

A member of a granted group performs only the specified database actions while an unrelated Entra group remains denied. That result is evidence for another corrective change: Create scoped database users or groups and explicit role grants after configuring the instance Entra administrator. The alternative problem is: A SQL Managed Instance team assumes its Microsoft Entra administrator automatically grants every Entra group access to all databases. The current Silvercrest University issue is instead: A SQL Managed Instance has Microsoft Entra authentication enabled but service identities lack database users and cannot read required tables. Its decisive acceptance evidence would be: The intended managed identity connects and reads its allowed data while a separate unassigned identity receives an authorization denial.

Map the login to the appropriate database user or use a contained identity pattern supported by the chosen SQL service. That relates to a separate SQL administration problem: A script creates a SQL login in the master database but never creates a usable user inside the application database. The Oakridge Public Services requirement is instead: A SQL Managed Instance has Microsoft Entra authentication enabled but service identities lack database users and cannot read required tables. That approach does not directly establish the required fix; the requested acceptance evidence is: The intended managed identity connects and reads its allowed data while a separate unassigned identity receives an authorization denial.

Configure the supported domain or Microsoft Entra authentication method for the SQL Server on Azure VM after checking version and platform prerequisites. That relates to a separate SQL administration problem: An Azure-hosted SQL Server application needs domain-integrated Windows login behavior but its virtual machine is deployed without the required directory integration. The Oakridge Public Services requirement is instead: A SQL Managed Instance has Microsoft Entra authentication enabled but service identities lack database users and cannot read required tables. That approach does not directly establish the required fix; the requested acceptance evidence is: The intended managed identity connects and reads its allowed data while a separate unassigned identity receives an authorization denial.

Create or identify the database principal and grant the minimum required schema or object permissions rather than broad server administration. That relates to a separate SQL administration problem: A reporting user can access an Azure SQL database but receives permission denied for a particular schema because a login was mistaken for data access. The Oakridge Public Services requirement is instead: A SQL Managed Instance has Microsoft Entra authentication enabled but service identities lack database users and cannot read required tables. That approach does not directly establish the required fix; the requested acceptance evidence is: The intended managed identity connects and reads its allowed data while a separate unassigned identity receives an authorization denial.

A test user reads the approved objects and receives permission denial on a restricted payroll table. That result is evidence for another corrective change: Create a custom database role and grant SELECT only on explicitly approved objects rather than all readable tables. The alternative problem is: A team assigns the fixed db_datareader role for an application that should read only one sensitive table and one approved view. The current Oakridge Public Services issue is instead: A SQL Managed Instance has Microsoft Entra authentication enabled but service identities lack database users and cannot read required tables. Its decisive acceptance evidence would be: The intended managed identity connects and reads its allowed data while a separate unassigned identity receives an authorization denial.

The deployment identity performs the approved schema change while the runtime application identity cannot alter unrelated schemas. That result is evidence for another corrective change: Separate deployment-time elevated operations from runtime accounts and scope required DDL permissions to the target schema. The alternative problem is: A developer executes GRANT CONTROL at database scope to permit a single schema deployment and inadvertently grants broad management capability. The current Oakridge Public Services issue is instead: A SQL Managed Instance has Microsoft Entra authentication enabled but service identities lack database users and cannot read required tables. Its decisive acceptance evidence would be: The intended managed identity connects and reads its allowed data while a separate unassigned identity receives an authorization denial.

Audited sessions identify the intended service principal and the administrator is no longer used for routine application traffic. That result is evidence for another corrective change: Create dedicated application identities with least privilege and enable audit attribution rather than sharing the high-privilege administrator. The alternative problem is: An Azure SQL database uses a shared administrator account in every application connection string and operations cannot attribute individual changes. The current Oakridge Public Services issue is instead: A SQL Managed Instance has Microsoft Entra authentication enabled but service identities lack database users and cannot read required tables. Its decisive acceptance evidence would be: The intended managed identity connects and reads its allowed data while a separate unassigned identity receives an authorization denial.

Combine approved credential revocation with session termination and verify connection-pool and token behavior for the selected SQL service. That relates to a separate SQL administration problem: An incident response team revokes a compromised login but long-running connections persist and the team assumes access was instantly terminated. The Oakridge Public Services requirement is instead: An Azure-hosted SQL Server application needs domain-integrated Windows login behavior but its virtual machine is deployed without the required directory integration. That approach does not directly establish the required fix; the requested acceptance evidence is: A test domain account authenticates using the intended method and unsupported login paths remain disabled.

Create the appropriate contained database users from Microsoft Entra identities and grant only their documented database roles. That relates to a separate SQL administration problem: A SQL Managed Instance has Microsoft Entra authentication enabled but service identities lack database users and cannot read required tables. The Oakridge Public Services requirement is instead: An Azure-hosted SQL Server application needs domain-integrated Windows login behavior but its virtual machine is deployed without the required directory integration. That approach does not directly establish the required fix; the requested acceptance evidence is: A test domain account authenticates using the intended method and unsupported login paths remain disabled.

Map the login to the appropriate database user or use a contained identity pattern supported by the chosen SQL service. That relates to a separate SQL administration problem: A script creates a SQL login in the master database but never creates a usable user inside the application database. The Oakridge Public Services requirement is instead: An Azure-hosted SQL Server application needs domain-integrated Windows login behavior but its virtual machine is deployed without the required directory integration. That approach does not directly establish the required fix; the requested acceptance evidence is: A test domain account authenticates using the intended method and unsupported login paths remain disabled.

The target principal reads precisely the intended objects and an access audit shows the offending DENY no longer masks the approved grant. That result is evidence for another corrective change: Inspect effective permissions and explicit DENY precedence before removing or correcting the conflicting access policy with approval. The alternative problem is: A database principal can log in but SELECT queries fail after an object-level DENY was added and administrators repeatedly add more GRANT statements. The current Oakridge Public Services issue is instead: An Azure-hosted SQL Server application needs domain-integrated Windows login behavior but its virtual machine is deployed without the required directory integration. Its decisive acceptance evidence would be: A test domain account authenticates using the intended method and unsupported login paths remain disabled.

A controlled execution reaches only authorized objects and fails a test query against a protected table outside the approved boundary. That result is evidence for another corrective change: Review module execution context and use signed modules or narrowly scoped permissions that avoid unnecessary privilege escalation. The alternative problem is: A SQL Server application uses EXECUTE AS OWNER for dynamic statements although the impersonation chain allows unintended access to other objects. The current Oakridge Public Services issue is instead: An Azure-hosted SQL Server application needs domain-integrated Windows login behavior but its virtual machine is deployed without the required directory integration. Its decisive acceptance evidence would be: A test domain account authenticates using the intended method and unsupported login paths remain disabled.

An authorization test executes the approved procedure while unrelated table modification and database ownership actions fail. That result is evidence for another corrective change: Grant narrowly scoped EXECUTE permission on the intended procedure or suitable custom role instead of db_owner. The alternative problem is: An automation identity is made db_owner just to execute a read-only stored procedure, violating a documented least-privilege policy. The current Oakridge Public Services issue is instead: An Azure-hosted SQL Server application needs domain-integrated Windows login behavior but its virtual machine is deployed without the required directory integration. Its decisive acceptance evidence would be: A test domain account authenticates using the intended method and unsupported login paths remain disabled.