Exam Bundle

The target principal reads precisely the intended objects and an access audit shows the offending DENY no longer masks the approved grant. That result is evidence for another corrective change: Inspect effective permissions and explicit DENY precedence before removing or correcting the conflicting access policy with approval. The alternative problem is: A database principal can log in but SELECT queries fail after an object-level DENY was added and administrators repeatedly add more GRANT statements. The current Oakridge Public Services issue is instead: An Azure-hosted SQL Server application needs domain-integrated Windows login behavior but its virtual machine is deployed without the required directory integration. Its decisive acceptance evidence would be: A test domain account authenticates using the intended method and unsupported login paths remain disabled.

A controlled execution reaches only authorized objects and fails a test query against a protected table outside the approved boundary. That result is evidence for another corrective change: Review module execution context and use signed modules or narrowly scoped permissions that avoid unnecessary privilege escalation. The alternative problem is: A SQL Server application uses EXECUTE AS OWNER for dynamic statements although the impersonation chain allows unintended access to other objects. The current Oakridge Public Services issue is instead: An Azure-hosted SQL Server application needs domain-integrated Windows login behavior but its virtual machine is deployed without the required directory integration. Its decisive acceptance evidence would be: A test domain account authenticates using the intended method and unsupported login paths remain disabled.

An authorization test executes the approved procedure while unrelated table modification and database ownership actions fail. That result is evidence for another corrective change: Grant narrowly scoped EXECUTE permission on the intended procedure or suitable custom role instead of db_owner. The alternative problem is: An automation identity is made db_owner just to execute a read-only stored procedure, violating a documented least-privilege policy. The current Oakridge Public Services issue is instead: An Azure-hosted SQL Server application needs domain-integrated Windows login behavior but its virtual machine is deployed without the required directory integration. Its decisive acceptance evidence would be: A test domain account authenticates using the intended method and unsupported login paths remain disabled.

Create the appropriate contained database users from Microsoft Entra identities and grant only their documented database roles. That relates to a separate SQL administration problem: A SQL Managed Instance has Microsoft Entra authentication enabled but service identities lack database users and cannot read required tables. The Maplewood Schools requirement is instead: An Azure-hosted SQL Server application needs domain-integrated Windows login behavior but its virtual machine is deployed without the required directory integration. That approach does not directly establish the required fix; the requested acceptance evidence is: A test domain account authenticates using the intended method and unsupported login paths remain disabled.

Use Microsoft Entra group-based database access where supported and govern group membership and conditional access outside SQL. That relates to a separate SQL administration problem: An application creates SQL logins for hundreds of human users and cannot promptly disable a terminated employee across several databases. The Maplewood Schools requirement is instead: An Azure-hosted SQL Server application needs domain-integrated Windows login behavior but its virtual machine is deployed without the required directory integration. That approach does not directly establish the required fix; the requested acceptance evidence is: A test domain account authenticates using the intended method and unsupported login paths remain disabled.

Create scoped database users or groups and explicit role grants after configuring the instance Entra administrator. That relates to a separate SQL administration problem: A SQL Managed Instance team assumes its Microsoft Entra administrator automatically grants every Entra group access to all databases. The Maplewood Schools requirement is instead: An Azure-hosted SQL Server application needs domain-integrated Windows login behavior but its virtual machine is deployed without the required directory integration. That approach does not directly establish the required fix; the requested acceptance evidence is: A test domain account authenticates using the intended method and unsupported login paths remain disabled.

The identity can manage only its approved Azure resources and SQL SELECT becomes possible only after explicit database permissions exist. That result is evidence for another corrective change: Differentiate Azure resource-management RBAC from SQL data-plane authentication and create the appropriate database principal and grants. The alternative problem is: A service principal is assigned an Azure RBAC Contributor role and engineers assume this automatically grants SQL SELECT permission inside Azure SQL Database. The current Maplewood Schools issue is instead: An Azure-hosted SQL Server application needs domain-integrated Windows login behavior but its virtual machine is deployed without the required directory integration. Its decisive acceptance evidence would be: A test domain account authenticates using the intended method and unsupported login paths remain disabled.

Removing a test user from the authorized group stops new authorized database access after documented token or session refresh. That result is evidence for another corrective change: Use Microsoft Entra group-based database access where supported and govern group membership and conditional access outside SQL. The alternative problem is: An application creates SQL logins for hundreds of human users and cannot promptly disable a terminated employee across several databases. The current Maplewood Schools issue is instead: An Azure-hosted SQL Server application needs domain-integrated Windows login behavior but its virtual machine is deployed without the required directory integration. Its decisive acceptance evidence would be: A test domain account authenticates using the intended method and unsupported login paths remain disabled.

A member of a granted group performs only the specified database actions while an unrelated Entra group remains denied. That result is evidence for another corrective change: Create scoped database users or groups and explicit role grants after configuring the instance Entra administrator. The alternative problem is: A SQL Managed Instance team assumes its Microsoft Entra administrator automatically grants every Entra group access to all databases. The current Maplewood Schools issue is instead: An Azure-hosted SQL Server application needs domain-integrated Windows login behavior but its virtual machine is deployed without the required directory integration. Its decisive acceptance evidence would be: A test domain account authenticates using the intended method and unsupported login paths remain disabled.

Create a custom database role and grant SELECT only on explicitly approved objects rather than all readable tables. That relates to a separate SQL administration problem: A team assigns the fixed db_datareader role for an application that should read only one sensitive table and one approved view. The Maplewood Schools requirement is instead: A reporting user can access an Azure SQL database but receives permission denied for a particular schema because a login was mistaken for data access. That approach does not directly establish the required fix; the requested acceptance evidence is: The user can run the authorized report query but cannot change unrelated schemas or grant new rights.

Create scoped database users or groups and explicit role grants after configuring the instance Entra administrator. That relates to a separate SQL administration problem: A SQL Managed Instance team assumes its Microsoft Entra administrator automatically grants every Entra group access to all databases. The Maplewood Schools requirement is instead: A reporting user can access an Azure SQL database but receives permission denied for a particular schema because a login was mistaken for data access. That approach does not directly establish the required fix; the requested acceptance evidence is: The user can run the authorized report query but cannot change unrelated schemas or grant new rights.

Separate deployment-time elevated operations from runtime accounts and scope required DDL permissions to the target schema. That relates to a separate SQL administration problem: A developer executes GRANT CONTROL at database scope to permit a single schema deployment and inadvertently grants broad management capability. The Maplewood Schools requirement is instead: A reporting user can access an Azure SQL database but receives permission denied for a particular schema because a login was mistaken for data access. That approach does not directly establish the required fix; the requested acceptance evidence is: The user can run the authorized report query but cannot change unrelated schemas or grant new rights.

A member of a granted group performs only the specified database actions while an unrelated Entra group remains denied. That result is evidence for another corrective change: Create scoped database users or groups and explicit role grants after configuring the instance Entra administrator. The alternative problem is: A SQL Managed Instance team assumes its Microsoft Entra administrator automatically grants every Entra group access to all databases. The current Maplewood Schools issue is instead: A reporting user can access an Azure SQL database but receives permission denied for a particular schema because a login was mistaken for data access. Its decisive acceptance evidence would be: The user can run the authorized report query but cannot change unrelated schemas or grant new rights.

A permitted Entra user signs in to Azure SQL and the retired application secret is absent from source control and deployment settings. That result is evidence for another corrective change: Configure Microsoft Entra authentication and an appropriate administrator and database principals while removing hardcoded database passwords. The alternative problem is: An Azure SQL Database application stores SQL user passwords in deployment scripts even though its users have centrally managed Microsoft Entra identities. The current Maplewood Schools issue is instead: A reporting user can access an Azure SQL database but receives permission denied for a particular schema because a login was mistaken for data access. Its decisive acceptance evidence would be: The user can run the authorized report query but cannot change unrelated schemas or grant new rights.

An authorization test executes the approved procedure while unrelated table modification and database ownership actions fail. That result is evidence for another corrective change: Grant narrowly scoped EXECUTE permission on the intended procedure or suitable custom role instead of db_owner. The alternative problem is: An automation identity is made db_owner just to execute a read-only stored procedure, violating a documented least-privilege policy. The current Maplewood Schools issue is instead: A reporting user can access an Azure SQL database but receives permission denied for a particular schema because a login was mistaken for data access. Its decisive acceptance evidence would be: The user can run the authorized report query but cannot change unrelated schemas or grant new rights.

Review module execution context and use signed modules or narrowly scoped permissions that avoid unnecessary privilege escalation. That relates to a separate SQL administration problem: A SQL Server application uses EXECUTE AS OWNER for dynamic statements although the impersonation chain allows unintended access to other objects. The Meadowbrook Finance requirement is instead: A reporting user can access an Azure SQL database but receives permission denied for a particular schema because a login was mistaken for data access. That approach does not directly establish the required fix; the requested acceptance evidence is: The user can run the authorized report query but cannot change unrelated schemas or grant new rights.

Differentiate Azure resource-management RBAC from SQL data-plane authentication and create the appropriate database principal and grants. That relates to a separate SQL administration problem: A service principal is assigned an Azure RBAC Contributor role and engineers assume this automatically grants SQL SELECT permission inside Azure SQL Database. The Meadowbrook Finance requirement is instead: A reporting user can access an Azure SQL database but receives permission denied for a particular schema because a login was mistaken for data access. That approach does not directly establish the required fix; the requested acceptance evidence is: The user can run the authorized report query but cannot change unrelated schemas or grant new rights.

Create dedicated application identities with least privilege and enable audit attribution rather than sharing the high-privilege administrator. That relates to a separate SQL administration problem: An Azure SQL database uses a shared administrator account in every application connection string and operations cannot attribute individual changes. The Meadowbrook Finance requirement is instead: A reporting user can access an Azure SQL database but receives permission denied for a particular schema because a login was mistaken for data access. That approach does not directly establish the required fix; the requested acceptance evidence is: The user can run the authorized report query but cannot change unrelated schemas or grant new rights.

The target principal reads precisely the intended objects and an access audit shows the offending DENY no longer masks the approved grant. That result is evidence for another corrective change: Inspect effective permissions and explicit DENY precedence before removing or correcting the conflicting access policy with approval. The alternative problem is: A database principal can log in but SELECT queries fail after an object-level DENY was added and administrators repeatedly add more GRANT statements. The current Meadowbrook Finance issue is instead: A reporting user can access an Azure SQL database but receives permission denied for a particular schema because a login was mistaken for data access. Its decisive acceptance evidence would be: The user can run the authorized report query but cannot change unrelated schemas or grant new rights.

A permitted Entra user signs in to Azure SQL and the retired application secret is absent from source control and deployment settings. That result is evidence for another corrective change: Configure Microsoft Entra authentication and an appropriate administrator and database principals while removing hardcoded database passwords. The alternative problem is: An Azure SQL Database application stores SQL user passwords in deployment scripts even though its users have centrally managed Microsoft Entra identities. The current Meadowbrook Finance issue is instead: A reporting user can access an Azure SQL database but receives permission denied for a particular schema because a login was mistaken for data access. Its decisive acceptance evidence would be: The user can run the authorized report query but cannot change unrelated schemas or grant new rights.

The identity can manage only its approved Azure resources and SQL SELECT becomes possible only after explicit database permissions exist. That result is evidence for another corrective change: Differentiate Azure resource-management RBAC from SQL data-plane authentication and create the appropriate database principal and grants. The alternative problem is: A service principal is assigned an Azure RBAC Contributor role and engineers assume this automatically grants SQL SELECT permission inside Azure SQL Database. The current Meadowbrook Finance issue is instead: A reporting user can access an Azure SQL database but receives permission denied for a particular schema because a login was mistaken for data access. Its decisive acceptance evidence would be: The user can run the authorized report query but cannot change unrelated schemas or grant new rights.

Configure Microsoft Entra authentication and an appropriate administrator and database principals while removing hardcoded database passwords. That relates to a separate SQL administration problem: An Azure SQL Database application stores SQL user passwords in deployment scripts even though its users have centrally managed Microsoft Entra identities. The Meadowbrook Finance requirement is instead: An automation identity is made db_owner just to execute a read-only stored procedure, violating a documented least-privilege policy. That approach does not directly establish the required fix; the requested acceptance evidence is: An authorization test executes the approved procedure while unrelated table modification and database ownership actions fail.

Create scoped database users or groups and explicit role grants after configuring the instance Entra administrator. That relates to a separate SQL administration problem: A SQL Managed Instance team assumes its Microsoft Entra administrator automatically grants every Entra group access to all databases. The Meadowbrook Finance requirement is instead: An automation identity is made db_owner just to execute a read-only stored procedure, violating a documented least-privilege policy. That approach does not directly establish the required fix; the requested acceptance evidence is: An authorization test executes the approved procedure while unrelated table modification and database ownership actions fail.

Create dedicated application identities with least privilege and enable audit attribution rather than sharing the high-privilege administrator. That relates to a separate SQL administration problem: An Azure SQL database uses a shared administrator account in every application connection string and operations cannot attribute individual changes. The Meadowbrook Finance requirement is instead: An automation identity is made db_owner just to execute a read-only stored procedure, violating a documented least-privilege policy. That approach does not directly establish the required fix; the requested acceptance evidence is: An authorization test executes the approved procedure while unrelated table modification and database ownership actions fail.

Removing a test user from the authorized group stops new authorized database access after documented token or session refresh. That result is evidence for another corrective change: Use Microsoft Entra group-based database access where supported and govern group membership and conditional access outside SQL. The alternative problem is: An application creates SQL logins for hundreds of human users and cannot promptly disable a terminated employee across several databases. The current Meadowbrook Finance issue is instead: An automation identity is made db_owner just to execute a read-only stored procedure, violating a documented least-privilege policy. Its decisive acceptance evidence would be: An authorization test executes the approved procedure while unrelated table modification and database ownership actions fail.

The deployment identity performs the approved schema change while the runtime application identity cannot alter unrelated schemas. That result is evidence for another corrective change: Separate deployment-time elevated operations from runtime accounts and scope required DDL permissions to the target schema. The alternative problem is: A developer executes GRANT CONTROL at database scope to permit a single schema deployment and inadvertently grants broad management capability. The current Meadowbrook Finance issue is instead: An automation identity is made db_owner just to execute a read-only stored procedure, violating a documented least-privilege policy. Its decisive acceptance evidence would be: An authorization test executes the approved procedure while unrelated table modification and database ownership actions fail.

A test user reads the approved objects and receives permission denial on a restricted payroll table. That result is evidence for another corrective change: Create a custom database role and grant SELECT only on explicitly approved objects rather than all readable tables. The alternative problem is: A team assigns the fixed db_datareader role for an application that should read only one sensitive table and one approved view. The current Meadowbrook Finance issue is instead: An automation identity is made db_owner just to execute a read-only stored procedure, violating a documented least-privilege policy. Its decisive acceptance evidence would be: An authorization test executes the approved procedure while unrelated table modification and database ownership actions fail.

Review module execution context and use signed modules or narrowly scoped permissions that avoid unnecessary privilege escalation. That relates to a separate SQL administration problem: A SQL Server application uses EXECUTE AS OWNER for dynamic statements although the impersonation chain allows unintended access to other objects. The Alpine Healthcare requirement is instead: An automation identity is made db_owner just to execute a read-only stored procedure, violating a documented least-privilege policy. That approach does not directly establish the required fix; the requested acceptance evidence is: An authorization test executes the approved procedure while unrelated table modification and database ownership actions fail.

Create the appropriate contained database users from Microsoft Entra identities and grant only their documented database roles. That relates to a separate SQL administration problem: A SQL Managed Instance has Microsoft Entra authentication enabled but service identities lack database users and cannot read required tables. The Alpine Healthcare requirement is instead: An automation identity is made db_owner just to execute a read-only stored procedure, violating a documented least-privilege policy. That approach does not directly establish the required fix; the requested acceptance evidence is: An authorization test executes the approved procedure while unrelated table modification and database ownership actions fail.

Combine approved credential revocation with session termination and verify connection-pool and token behavior for the selected SQL service. That relates to a separate SQL administration problem: An incident response team revokes a compromised login but long-running connections persist and the team assumes access was instantly terminated. The Alpine Healthcare requirement is instead: An automation identity is made db_owner just to execute a read-only stored procedure, violating a documented least-privilege policy. That approach does not directly establish the required fix; the requested acceptance evidence is: An authorization test executes the approved procedure while unrelated table modification and database ownership actions fail.

A controlled execution reaches only authorized objects and fails a test query against a protected table outside the approved boundary. That result is evidence for another corrective change: Review module execution context and use signed modules or narrowly scoped permissions that avoid unnecessary privilege escalation. The alternative problem is: A SQL Server application uses EXECUTE AS OWNER for dynamic statements although the impersonation chain allows unintended access to other objects. The current Alpine Healthcare issue is instead: An automation identity is made db_owner just to execute a read-only stored procedure, violating a documented least-privilege policy. Its decisive acceptance evidence would be: An authorization test executes the approved procedure while unrelated table modification and database ownership actions fail.

A test user reads the approved objects and receives permission denial on a restricted payroll table. That result is evidence for another corrective change: Create a custom database role and grant SELECT only on explicitly approved objects rather than all readable tables. The alternative problem is: A team assigns the fixed db_datareader role for an application that should read only one sensitive table and one approved view. The current Alpine Healthcare issue is instead: An automation identity is made db_owner just to execute a read-only stored procedure, violating a documented least-privilege policy. Its decisive acceptance evidence would be: An authorization test executes the approved procedure while unrelated table modification and database ownership actions fail.

Removing a test user from the authorized group stops new authorized database access after documented token or session refresh. That result is evidence for another corrective change: Use Microsoft Entra group-based database access where supported and govern group membership and conditional access outside SQL. The alternative problem is: An application creates SQL logins for hundreds of human users and cannot promptly disable a terminated employee across several databases. The current Alpine Healthcare issue is instead: An automation identity is made db_owner just to execute a read-only stored procedure, violating a documented least-privilege policy. Its decisive acceptance evidence would be: An authorization test executes the approved procedure while unrelated table modification and database ownership actions fail.