Exam Bundle

A controlled execution reaches only authorized objects and fails a test query against a protected table outside the approved boundary. That result is evidence for another corrective change: Review module execution context and use signed modules or narrowly scoped permissions that avoid unnecessary privilege escalation. The alternative problem is: A SQL Server application uses EXECUTE AS OWNER for dynamic statements although the impersonation chain allows unintended access to other objects. The current Alpine Healthcare issue is instead: An automation identity is made db_owner just to execute a read-only stored procedure, violating a documented least-privilege policy. Its decisive acceptance evidence would be: An authorization test executes the approved procedure while unrelated table modification and database ownership actions fail.

A test user reads the approved objects and receives permission denial on a restricted payroll table. That result is evidence for another corrective change: Create a custom database role and grant SELECT only on explicitly approved objects rather than all readable tables. The alternative problem is: A team assigns the fixed db_datareader role for an application that should read only one sensitive table and one approved view. The current Alpine Healthcare issue is instead: An automation identity is made db_owner just to execute a read-only stored procedure, violating a documented least-privilege policy. Its decisive acceptance evidence would be: An authorization test executes the approved procedure while unrelated table modification and database ownership actions fail.

Removing a test user from the authorized group stops new authorized database access after documented token or session refresh. That result is evidence for another corrective change: Use Microsoft Entra group-based database access where supported and govern group membership and conditional access outside SQL. The alternative problem is: An application creates SQL logins for hundreds of human users and cannot promptly disable a terminated employee across several databases. The current Alpine Healthcare issue is instead: An automation identity is made db_owner just to execute a read-only stored procedure, violating a documented least-privilege policy. Its decisive acceptance evidence would be: An authorization test executes the approved procedure while unrelated table modification and database ownership actions fail.

Differentiate Azure resource-management RBAC from SQL data-plane authentication and create the appropriate database principal and grants. That relates to a separate SQL administration problem: A service principal is assigned an Azure RBAC Contributor role and engineers assume this automatically grants SQL SELECT permission inside Azure SQL Database. The Alpine Healthcare requirement is instead: A database principal can log in but SELECT queries fail after an object-level DENY was added and administrators repeatedly add more GRANT statements. That approach does not directly establish the required fix; the requested acceptance evidence is: The target principal reads precisely the intended objects and an access audit shows the offending DENY no longer masks the approved grant.

Create or identify the database principal and grant the minimum required schema or object permissions rather than broad server administration. That relates to a separate SQL administration problem: A reporting user can access an Azure SQL database but receives permission denied for a particular schema because a login was mistaken for data access. The Alpine Healthcare requirement is instead: A database principal can log in but SELECT queries fail after an object-level DENY was added and administrators repeatedly add more GRANT statements. That approach does not directly establish the required fix; the requested acceptance evidence is: The target principal reads precisely the intended objects and an access audit shows the offending DENY no longer masks the approved grant.

Configure Microsoft Entra authentication and an appropriate administrator and database principals while removing hardcoded database passwords. That relates to a separate SQL administration problem: An Azure SQL Database application stores SQL user passwords in deployment scripts even though its users have centrally managed Microsoft Entra identities. The Alpine Healthcare requirement is instead: A database principal can log in but SELECT queries fail after an object-level DENY was added and administrators repeatedly add more GRANT statements. That approach does not directly establish the required fix; the requested acceptance evidence is: The target principal reads precisely the intended objects and an access audit shows the offending DENY no longer masks the approved grant.

Audited sessions identify the intended service principal and the administrator is no longer used for routine application traffic. That result is evidence for another corrective change: Create dedicated application identities with least privilege and enable audit attribution rather than sharing the high-privilege administrator. The alternative problem is: An Azure SQL database uses a shared administrator account in every application connection string and operations cannot attribute individual changes. The current Alpine Healthcare issue is instead: A database principal can log in but SELECT queries fail after an object-level DENY was added and administrators repeatedly add more GRANT statements. Its decisive acceptance evidence would be: The target principal reads precisely the intended objects and an access audit shows the offending DENY no longer masks the approved grant.

Removing a test user from the authorized group stops new authorized database access after documented token or session refresh. That result is evidence for another corrective change: Use Microsoft Entra group-based database access where supported and govern group membership and conditional access outside SQL. The alternative problem is: An application creates SQL logins for hundreds of human users and cannot promptly disable a terminated employee across several databases. The current Alpine Healthcare issue is instead: A database principal can log in but SELECT queries fail after an object-level DENY was added and administrators repeatedly add more GRANT statements. Its decisive acceptance evidence would be: The target principal reads precisely the intended objects and an access audit shows the offending DENY no longer masks the approved grant.

An authorization test executes the approved procedure while unrelated table modification and database ownership actions fail. That result is evidence for another corrective change: Grant narrowly scoped EXECUTE permission on the intended procedure or suitable custom role instead of db_owner. The alternative problem is: An automation identity is made db_owner just to execute a read-only stored procedure, violating a documented least-privilege policy. The current Alpine Healthcare issue is instead: A database principal can log in but SELECT queries fail after an object-level DENY was added and administrators repeatedly add more GRANT statements. Its decisive acceptance evidence would be: The target principal reads precisely the intended objects and an access audit shows the offending DENY no longer masks the approved grant.

Combine approved credential revocation with session termination and verify connection-pool and token behavior for the selected SQL service. That relates to a separate SQL administration problem: An incident response team revokes a compromised login but long-running connections persist and the team assumes access was instantly terminated. The Granite SaaS requirement is instead: A database principal can log in but SELECT queries fail after an object-level DENY was added and administrators repeatedly add more GRANT statements. That approach does not directly establish the required fix; the requested acceptance evidence is: The target principal reads precisely the intended objects and an access audit shows the offending DENY no longer masks the approved grant.

Differentiate Azure resource-management RBAC from SQL data-plane authentication and create the appropriate database principal and grants. That relates to a separate SQL administration problem: A service principal is assigned an Azure RBAC Contributor role and engineers assume this automatically grants SQL SELECT permission inside Azure SQL Database. The Granite SaaS requirement is instead: A database principal can log in but SELECT queries fail after an object-level DENY was added and administrators repeatedly add more GRANT statements. That approach does not directly establish the required fix; the requested acceptance evidence is: The target principal reads precisely the intended objects and an access audit shows the offending DENY no longer masks the approved grant.

Separate deployment-time elevated operations from runtime accounts and scope required DDL permissions to the target schema. That relates to a separate SQL administration problem: A developer executes GRANT CONTROL at database scope to permit a single schema deployment and inadvertently grants broad management capability. The Granite SaaS requirement is instead: A database principal can log in but SELECT queries fail after an object-level DENY was added and administrators repeatedly add more GRANT statements. That approach does not directly establish the required fix; the requested acceptance evidence is: The target principal reads precisely the intended objects and an access audit shows the offending DENY no longer masks the approved grant.

The intended managed identity connects and reads its allowed data while a separate unassigned identity receives an authorization denial. That result is evidence for another corrective change: Create the appropriate contained database users from Microsoft Entra identities and grant only their documented database roles. The alternative problem is: A SQL Managed Instance has Microsoft Entra authentication enabled but service identities lack database users and cannot read required tables. The current Granite SaaS issue is instead: A database principal can log in but SELECT queries fail after an object-level DENY was added and administrators repeatedly add more GRANT statements. Its decisive acceptance evidence would be: The target principal reads precisely the intended objects and an access audit shows the offending DENY no longer masks the approved grant.

A test user reads the approved objects and receives permission denial on a restricted payroll table. That result is evidence for another corrective change: Create a custom database role and grant SELECT only on explicitly approved objects rather than all readable tables. The alternative problem is: A team assigns the fixed db_datareader role for an application that should read only one sensitive table and one approved view. The current Granite SaaS issue is instead: A database principal can log in but SELECT queries fail after an object-level DENY was added and administrators repeatedly add more GRANT statements. Its decisive acceptance evidence would be: The target principal reads precisely the intended objects and an access audit shows the offending DENY no longer masks the approved grant.

The deployment identity performs the approved schema change while the runtime application identity cannot alter unrelated schemas. That result is evidence for another corrective change: Separate deployment-time elevated operations from runtime accounts and scope required DDL permissions to the target schema. The alternative problem is: A developer executes GRANT CONTROL at database scope to permit a single schema deployment and inadvertently grants broad management capability. The current Granite SaaS issue is instead: A database principal can log in but SELECT queries fail after an object-level DENY was added and administrators repeatedly add more GRANT statements. Its decisive acceptance evidence would be: The target principal reads precisely the intended objects and an access audit shows the offending DENY no longer masks the approved grant.

Configure Microsoft Entra authentication and an appropriate administrator and database principals while removing hardcoded database passwords. That relates to a separate SQL administration problem: An Azure SQL Database application stores SQL user passwords in deployment scripts even though its users have centrally managed Microsoft Entra identities. The Granite SaaS requirement is instead: An application creates SQL logins for hundreds of human users and cannot promptly disable a terminated employee across several databases. That approach does not directly establish the required fix; the requested acceptance evidence is: Removing a test user from the authorized group stops new authorized database access after documented token or session refresh.

Map the login to the appropriate database user or use a contained identity pattern supported by the chosen SQL service. That relates to a separate SQL administration problem: A script creates a SQL login in the master database but never creates a usable user inside the application database. The Granite SaaS requirement is instead: An application creates SQL logins for hundreds of human users and cannot promptly disable a terminated employee across several databases. That approach does not directly establish the required fix; the requested acceptance evidence is: Removing a test user from the authorized group stops new authorized database access after documented token or session refresh.

Inspect effective permissions and explicit DENY precedence before removing or correcting the conflicting access policy with approval. That relates to a separate SQL administration problem: A database principal can log in but SELECT queries fail after an object-level DENY was added and administrators repeatedly add more GRANT statements. The Granite SaaS requirement is instead: An application creates SQL logins for hundreds of human users and cannot promptly disable a terminated employee across several databases. That approach does not directly establish the required fix; the requested acceptance evidence is: Removing a test user from the authorized group stops new authorized database access after documented token or session refresh.

A test domain account authenticates using the intended method and unsupported login paths remain disabled. That result is evidence for another corrective change: Configure the supported domain or Microsoft Entra authentication method for the SQL Server on Azure VM after checking version and platform prerequisites. The alternative problem is: An Azure-hosted SQL Server application needs domain-integrated Windows login behavior but its virtual machine is deployed without the required directory integration. The current Granite SaaS issue is instead: An application creates SQL logins for hundreds of human users and cannot promptly disable a terminated employee across several databases. Its decisive acceptance evidence would be: Removing a test user from the authorized group stops new authorized database access after documented token or session refresh.

A member of a granted group performs only the specified database actions while an unrelated Entra group remains denied. That result is evidence for another corrective change: Create scoped database users or groups and explicit role grants after configuring the instance Entra administrator. The alternative problem is: A SQL Managed Instance team assumes its Microsoft Entra administrator automatically grants every Entra group access to all databases. The current Granite SaaS issue is instead: An application creates SQL logins for hundreds of human users and cannot promptly disable a terminated employee across several databases. Its decisive acceptance evidence would be: Removing a test user from the authorized group stops new authorized database access after documented token or session refresh.

A new connection with the revoked credential fails and the previously active unauthorized session no longer executes queries. That result is evidence for another corrective change: Combine approved credential revocation with session termination and verify connection-pool and token behavior for the selected SQL service. The alternative problem is: An incident response team revokes a compromised login but long-running connections persist and the team assumes access was instantly terminated. The current Granite SaaS issue is instead: An application creates SQL logins for hundreds of human users and cannot promptly disable a terminated employee across several databases. Its decisive acceptance evidence would be: Removing a test user from the authorized group stops new authorized database access after documented token or session refresh.

Differentiate Azure resource-management RBAC from SQL data-plane authentication and create the appropriate database principal and grants. That relates to a separate SQL administration problem: A service principal is assigned an Azure RBAC Contributor role and engineers assume this automatically grants SQL SELECT permission inside Azure SQL Database. The Keystone BioLabs requirement is instead: An application creates SQL logins for hundreds of human users and cannot promptly disable a terminated employee across several databases. That approach does not directly establish the required fix; the requested acceptance evidence is: Removing a test user from the authorized group stops new authorized database access after documented token or session refresh.

Inspect effective permissions and explicit DENY precedence before removing or correcting the conflicting access policy with approval. That relates to a separate SQL administration problem: A database principal can log in but SELECT queries fail after an object-level DENY was added and administrators repeatedly add more GRANT statements. The Keystone BioLabs requirement is instead: An application creates SQL logins for hundreds of human users and cannot promptly disable a terminated employee across several databases. That approach does not directly establish the required fix; the requested acceptance evidence is: Removing a test user from the authorized group stops new authorized database access after documented token or session refresh.

Create the appropriate contained database users from Microsoft Entra identities and grant only their documented database roles. That relates to a separate SQL administration problem: A SQL Managed Instance has Microsoft Entra authentication enabled but service identities lack database users and cannot read required tables. The Keystone BioLabs requirement is instead: An application creates SQL logins for hundreds of human users and cannot promptly disable a terminated employee across several databases. That approach does not directly establish the required fix; the requested acceptance evidence is: Removing a test user from the authorized group stops new authorized database access after documented token or session refresh.

The deployment identity performs the approved schema change while the runtime application identity cannot alter unrelated schemas. That result is evidence for another corrective change: Separate deployment-time elevated operations from runtime accounts and scope required DDL permissions to the target schema. The alternative problem is: A developer executes GRANT CONTROL at database scope to permit a single schema deployment and inadvertently grants broad management capability. The current Keystone BioLabs issue is instead: An application creates SQL logins for hundreds of human users and cannot promptly disable a terminated employee across several databases. Its decisive acceptance evidence would be: Removing a test user from the authorized group stops new authorized database access after documented token or session refresh.

A permitted Entra user signs in to Azure SQL and the retired application secret is absent from source control and deployment settings. That result is evidence for another corrective change: Configure Microsoft Entra authentication and an appropriate administrator and database principals while removing hardcoded database passwords. The alternative problem is: An Azure SQL Database application stores SQL user passwords in deployment scripts even though its users have centrally managed Microsoft Entra identities. The current Keystone BioLabs issue is instead: An application creates SQL logins for hundreds of human users and cannot promptly disable a terminated employee across several databases. Its decisive acceptance evidence would be: Removing a test user from the authorized group stops new authorized database access after documented token or session refresh.

The user can run the authorized report query but cannot change unrelated schemas or grant new rights. That result is evidence for another corrective change: Create or identify the database principal and grant the minimum required schema or object permissions rather than broad server administration. The alternative problem is: A reporting user can access an Azure SQL database but receives permission denied for a particular schema because a login was mistaken for data access. The current Keystone BioLabs issue is instead: An application creates SQL logins for hundreds of human users and cannot promptly disable a terminated employee across several databases. Its decisive acceptance evidence would be: Removing a test user from the authorized group stops new authorized database access after documented token or session refresh.

Inspect effective permissions and explicit DENY precedence before removing or correcting the conflicting access policy with approval. That relates to a separate SQL administration problem: A database principal can log in but SELECT queries fail after an object-level DENY was added and administrators repeatedly add more GRANT statements. The Keystone BioLabs requirement is instead: A script creates a SQL login in the master database but never creates a usable user inside the application database. That approach does not directly establish the required fix; the requested acceptance evidence is: The application identity establishes its intended database session and a second database remains inaccessible without a separate grant.

Create the appropriate contained database users from Microsoft Entra identities and grant only their documented database roles. That relates to a separate SQL administration problem: A SQL Managed Instance has Microsoft Entra authentication enabled but service identities lack database users and cannot read required tables. The Keystone BioLabs requirement is instead: A script creates a SQL login in the master database but never creates a usable user inside the application database. That approach does not directly establish the required fix; the requested acceptance evidence is: The application identity establishes its intended database session and a second database remains inaccessible without a separate grant.

Create dedicated application identities with least privilege and enable audit attribution rather than sharing the high-privilege administrator. That relates to a separate SQL administration problem: An Azure SQL database uses a shared administrator account in every application connection string and operations cannot attribute individual changes. The Keystone BioLabs requirement is instead: A script creates a SQL login in the master database but never creates a usable user inside the application database. That approach does not directly establish the required fix; the requested acceptance evidence is: The application identity establishes its intended database session and a second database remains inaccessible without a separate grant.

The intended managed identity connects and reads its allowed data while a separate unassigned identity receives an authorization denial. That result is evidence for another corrective change: Create the appropriate contained database users from Microsoft Entra identities and grant only their documented database roles. The alternative problem is: A SQL Managed Instance has Microsoft Entra authentication enabled but service identities lack database users and cannot read required tables. The current Keystone BioLabs issue is instead: A script creates a SQL login in the master database but never creates a usable user inside the application database. Its decisive acceptance evidence would be: The application identity establishes its intended database session and a second database remains inaccessible without a separate grant.

Removing a test user from the authorized group stops new authorized database access after documented token or session refresh. That result is evidence for another corrective change: Use Microsoft Entra group-based database access where supported and govern group membership and conditional access outside SQL. The alternative problem is: An application creates SQL logins for hundreds of human users and cannot promptly disable a terminated employee across several databases. The current Keystone BioLabs issue is instead: A script creates a SQL login in the master database but never creates a usable user inside the application database. Its decisive acceptance evidence would be: The application identity establishes its intended database session and a second database remains inaccessible without a separate grant.

A member of a granted group performs only the specified database actions while an unrelated Entra group remains denied. That result is evidence for another corrective change: Create scoped database users or groups and explicit role grants after configuring the instance Entra administrator. The alternative problem is: A SQL Managed Instance team assumes its Microsoft Entra administrator automatically grants every Entra group access to all databases. The current Keystone BioLabs issue is instead: A script creates a SQL login in the master database but never creates a usable user inside the application database. Its decisive acceptance evidence would be: The application identity establishes its intended database session and a second database remains inaccessible without a separate grant.