Exam Bundle

The intended managed identity connects and reads its allowed data while a separate unassigned identity receives an authorization denial. That result is evidence for another corrective change: Create the appropriate contained database users from Microsoft Entra identities and grant only their documented database roles. The alternative problem is: A SQL Managed Instance has Microsoft Entra authentication enabled but service identities lack database users and cannot read required tables. The current Keystone BioLabs issue is instead: A script creates a SQL login in the master database but never creates a usable user inside the application database. Its decisive acceptance evidence would be: The application identity establishes its intended database session and a second database remains inaccessible without a separate grant.

Removing a test user from the authorized group stops new authorized database access after documented token or session refresh. That result is evidence for another corrective change: Use Microsoft Entra group-based database access where supported and govern group membership and conditional access outside SQL. The alternative problem is: An application creates SQL logins for hundreds of human users and cannot promptly disable a terminated employee across several databases. The current Keystone BioLabs issue is instead: A script creates a SQL login in the master database but never creates a usable user inside the application database. Its decisive acceptance evidence would be: The application identity establishes its intended database session and a second database remains inaccessible without a separate grant.

A member of a granted group performs only the specified database actions while an unrelated Entra group remains denied. That result is evidence for another corrective change: Create scoped database users or groups and explicit role grants after configuring the instance Entra administrator. The alternative problem is: A SQL Managed Instance team assumes its Microsoft Entra administrator automatically grants every Entra group access to all databases. The current Keystone BioLabs issue is instead: A script creates a SQL login in the master database but never creates a usable user inside the application database. Its decisive acceptance evidence would be: The application identity establishes its intended database session and a second database remains inaccessible without a separate grant.

Combine approved credential revocation with session termination and verify connection-pool and token behavior for the selected SQL service. That relates to a separate SQL administration problem: An incident response team revokes a compromised login but long-running connections persist and the team assumes access was instantly terminated. The Silvercrest University requirement is instead: A script creates a SQL login in the master database but never creates a usable user inside the application database. That approach does not directly establish the required fix; the requested acceptance evidence is: The application identity establishes its intended database session and a second database remains inaccessible without a separate grant.

Grant narrowly scoped EXECUTE permission on the intended procedure or suitable custom role instead of db_owner. That relates to a separate SQL administration problem: An automation identity is made db_owner just to execute a read-only stored procedure, violating a documented least-privilege policy. The Silvercrest University requirement is instead: A script creates a SQL login in the master database but never creates a usable user inside the application database. That approach does not directly establish the required fix; the requested acceptance evidence is: The application identity establishes its intended database session and a second database remains inaccessible without a separate grant.

Create dedicated application identities with least privilege and enable audit attribution rather than sharing the high-privilege administrator. That relates to a separate SQL administration problem: An Azure SQL database uses a shared administrator account in every application connection string and operations cannot attribute individual changes. The Silvercrest University requirement is instead: A script creates a SQL login in the master database but never creates a usable user inside the application database. That approach does not directly establish the required fix; the requested acceptance evidence is: The application identity establishes its intended database session and a second database remains inaccessible without a separate grant.

A test domain account authenticates using the intended method and unsupported login paths remain disabled. That result is evidence for another corrective change: Configure the supported domain or Microsoft Entra authentication method for the SQL Server on Azure VM after checking version and platform prerequisites. The alternative problem is: An Azure-hosted SQL Server application needs domain-integrated Windows login behavior but its virtual machine is deployed without the required directory integration. The current Silvercrest University issue is instead: A script creates a SQL login in the master database but never creates a usable user inside the application database. Its decisive acceptance evidence would be: The application identity establishes its intended database session and a second database remains inaccessible without a separate grant.

The user can run the authorized report query but cannot change unrelated schemas or grant new rights. That result is evidence for another corrective change: Create or identify the database principal and grant the minimum required schema or object permissions rather than broad server administration. The alternative problem is: A reporting user can access an Azure SQL database but receives permission denied for a particular schema because a login was mistaken for data access. The current Silvercrest University issue is instead: A script creates a SQL login in the master database but never creates a usable user inside the application database. Its decisive acceptance evidence would be: The application identity establishes its intended database session and a second database remains inaccessible without a separate grant.

A test user reads the approved objects and receives permission denial on a restricted payroll table. That result is evidence for another corrective change: Create a custom database role and grant SELECT only on explicitly approved objects rather than all readable tables. The alternative problem is: A team assigns the fixed db_datareader role for an application that should read only one sensitive table and one approved view. The current Silvercrest University issue is instead: A script creates a SQL login in the master database but never creates a usable user inside the application database. Its decisive acceptance evidence would be: The application identity establishes its intended database session and a second database remains inaccessible without a separate grant.

Map the login to the appropriate database user or use a contained identity pattern supported by the chosen SQL service. That relates to a separate SQL administration problem: A script creates a SQL login in the master database but never creates a usable user inside the application database. The Silvercrest University requirement is instead: A team assigns the fixed db_datareader role for an application that should read only one sensitive table and one approved view. That approach does not directly establish the required fix; the requested acceptance evidence is: A test user reads the approved objects and receives permission denial on a restricted payroll table.

Create or identify the database principal and grant the minimum required schema or object permissions rather than broad server administration. That relates to a separate SQL administration problem: A reporting user can access an Azure SQL database but receives permission denied for a particular schema because a login was mistaken for data access. The Silvercrest University requirement is instead: A team assigns the fixed db_datareader role for an application that should read only one sensitive table and one approved view. That approach does not directly establish the required fix; the requested acceptance evidence is: A test user reads the approved objects and receives permission denial on a restricted payroll table.

Create dedicated application identities with least privilege and enable audit attribution rather than sharing the high-privilege administrator. That relates to a separate SQL administration problem: An Azure SQL database uses a shared administrator account in every application connection string and operations cannot attribute individual changes. The Silvercrest University requirement is instead: A team assigns the fixed db_datareader role for an application that should read only one sensitive table and one approved view. That approach does not directly establish the required fix; the requested acceptance evidence is: A test user reads the approved objects and receives permission denial on a restricted payroll table.

A member of a granted group performs only the specified database actions while an unrelated Entra group remains denied. That result is evidence for another corrective change: Create scoped database users or groups and explicit role grants after configuring the instance Entra administrator. The alternative problem is: A SQL Managed Instance team assumes its Microsoft Entra administrator automatically grants every Entra group access to all databases. The current Silvercrest University issue is instead: A team assigns the fixed db_datareader role for an application that should read only one sensitive table and one approved view. Its decisive acceptance evidence would be: A test user reads the approved objects and receives permission denial on a restricted payroll table.

A test domain account authenticates using the intended method and unsupported login paths remain disabled. That result is evidence for another corrective change: Configure the supported domain or Microsoft Entra authentication method for the SQL Server on Azure VM after checking version and platform prerequisites. The alternative problem is: An Azure-hosted SQL Server application needs domain-integrated Windows login behavior but its virtual machine is deployed without the required directory integration. The current Silvercrest University issue is instead: A team assigns the fixed db_datareader role for an application that should read only one sensitive table and one approved view. Its decisive acceptance evidence would be: A test user reads the approved objects and receives permission denial on a restricted payroll table.

A controlled execution reaches only authorized objects and fails a test query against a protected table outside the approved boundary. That result is evidence for another corrective change: Review module execution context and use signed modules or narrowly scoped permissions that avoid unnecessary privilege escalation. The alternative problem is: A SQL Server application uses EXECUTE AS OWNER for dynamic statements although the impersonation chain allows unintended access to other objects. The current Silvercrest University issue is instead: A team assigns the fixed db_datareader role for an application that should read only one sensitive table and one approved view. Its decisive acceptance evidence would be: A test user reads the approved objects and receives permission denial on a restricted payroll table.

Create or identify the database principal and grant the minimum required schema or object permissions rather than broad server administration. That relates to a separate SQL administration problem: A reporting user can access an Azure SQL database but receives permission denied for a particular schema because a login was mistaken for data access. The Oakridge Public Services requirement is instead: A team assigns the fixed db_datareader role for an application that should read only one sensitive table and one approved view. That approach does not directly establish the required fix; the requested acceptance evidence is: A test user reads the approved objects and receives permission denial on a restricted payroll table.

Review module execution context and use signed modules or narrowly scoped permissions that avoid unnecessary privilege escalation. That relates to a separate SQL administration problem: A SQL Server application uses EXECUTE AS OWNER for dynamic statements although the impersonation chain allows unintended access to other objects. The Oakridge Public Services requirement is instead: A team assigns the fixed db_datareader role for an application that should read only one sensitive table and one approved view. That approach does not directly establish the required fix; the requested acceptance evidence is: A test user reads the approved objects and receives permission denial on a restricted payroll table.

Grant narrowly scoped EXECUTE permission on the intended procedure or suitable custom role instead of db_owner. That relates to a separate SQL administration problem: An automation identity is made db_owner just to execute a read-only stored procedure, violating a documented least-privilege policy. The Oakridge Public Services requirement is instead: A team assigns the fixed db_datareader role for an application that should read only one sensitive table and one approved view. That approach does not directly establish the required fix; the requested acceptance evidence is: A test user reads the approved objects and receives permission denial on a restricted payroll table.

A test domain account authenticates using the intended method and unsupported login paths remain disabled. That result is evidence for another corrective change: Configure the supported domain or Microsoft Entra authentication method for the SQL Server on Azure VM after checking version and platform prerequisites. The alternative problem is: An Azure-hosted SQL Server application needs domain-integrated Windows login behavior but its virtual machine is deployed without the required directory integration. The current Oakridge Public Services issue is instead: A team assigns the fixed db_datareader role for an application that should read only one sensitive table and one approved view. Its decisive acceptance evidence would be: A test user reads the approved objects and receives permission denial on a restricted payroll table.

The intended managed identity connects and reads its allowed data while a separate unassigned identity receives an authorization denial. That result is evidence for another corrective change: Create the appropriate contained database users from Microsoft Entra identities and grant only their documented database roles. The alternative problem is: A SQL Managed Instance has Microsoft Entra authentication enabled but service identities lack database users and cannot read required tables. The current Oakridge Public Services issue is instead: A team assigns the fixed db_datareader role for an application that should read only one sensitive table and one approved view. Its decisive acceptance evidence would be: A test user reads the approved objects and receives permission denial on a restricted payroll table.

Removing a test user from the authorized group stops new authorized database access after documented token or session refresh. That result is evidence for another corrective change: Use Microsoft Entra group-based database access where supported and govern group membership and conditional access outside SQL. The alternative problem is: An application creates SQL logins for hundreds of human users and cannot promptly disable a terminated employee across several databases. The current Oakridge Public Services issue is instead: A team assigns the fixed db_datareader role for an application that should read only one sensitive table and one approved view. Its decisive acceptance evidence would be: A test user reads the approved objects and receives permission denial on a restricted payroll table.

Inspect effective permissions and explicit DENY precedence before removing or correcting the conflicting access policy with approval. That relates to a separate SQL administration problem: A database principal can log in but SELECT queries fail after an object-level DENY was added and administrators repeatedly add more GRANT statements. The Oakridge Public Services requirement is instead: A developer executes GRANT CONTROL at database scope to permit a single schema deployment and inadvertently grants broad management capability. That approach does not directly establish the required fix; the requested acceptance evidence is: The deployment identity performs the approved schema change while the runtime application identity cannot alter unrelated schemas.

Configure Microsoft Entra authentication and an appropriate administrator and database principals while removing hardcoded database passwords. That relates to a separate SQL administration problem: An Azure SQL Database application stores SQL user passwords in deployment scripts even though its users have centrally managed Microsoft Entra identities. The Oakridge Public Services requirement is instead: A developer executes GRANT CONTROL at database scope to permit a single schema deployment and inadvertently grants broad management capability. That approach does not directly establish the required fix; the requested acceptance evidence is: The deployment identity performs the approved schema change while the runtime application identity cannot alter unrelated schemas.

Create or identify the database principal and grant the minimum required schema or object permissions rather than broad server administration. That relates to a separate SQL administration problem: A reporting user can access an Azure SQL database but receives permission denied for a particular schema because a login was mistaken for data access. The Oakridge Public Services requirement is instead: A developer executes GRANT CONTROL at database scope to permit a single schema deployment and inadvertently grants broad management capability. That approach does not directly establish the required fix; the requested acceptance evidence is: The deployment identity performs the approved schema change while the runtime application identity cannot alter unrelated schemas.

The target principal reads precisely the intended objects and an access audit shows the offending DENY no longer masks the approved grant. That result is evidence for another corrective change: Inspect effective permissions and explicit DENY precedence before removing or correcting the conflicting access policy with approval. The alternative problem is: A database principal can log in but SELECT queries fail after an object-level DENY was added and administrators repeatedly add more GRANT statements. The current Oakridge Public Services issue is instead: A developer executes GRANT CONTROL at database scope to permit a single schema deployment and inadvertently grants broad management capability. Its decisive acceptance evidence would be: The deployment identity performs the approved schema change while the runtime application identity cannot alter unrelated schemas.

The intended managed identity connects and reads its allowed data while a separate unassigned identity receives an authorization denial. That result is evidence for another corrective change: Create the appropriate contained database users from Microsoft Entra identities and grant only their documented database roles. The alternative problem is: A SQL Managed Instance has Microsoft Entra authentication enabled but service identities lack database users and cannot read required tables. The current Oakridge Public Services issue is instead: A developer executes GRANT CONTROL at database scope to permit a single schema deployment and inadvertently grants broad management capability. Its decisive acceptance evidence would be: The deployment identity performs the approved schema change while the runtime application identity cannot alter unrelated schemas.

A member of a granted group performs only the specified database actions while an unrelated Entra group remains denied. That result is evidence for another corrective change: Create scoped database users or groups and explicit role grants after configuring the instance Entra administrator. The alternative problem is: A SQL Managed Instance team assumes its Microsoft Entra administrator automatically grants every Entra group access to all databases. The current Oakridge Public Services issue is instead: A developer executes GRANT CONTROL at database scope to permit a single schema deployment and inadvertently grants broad management capability. Its decisive acceptance evidence would be: The deployment identity performs the approved schema change while the runtime application identity cannot alter unrelated schemas.

Inspect effective permissions and explicit DENY precedence before removing or correcting the conflicting access policy with approval. That relates to a separate SQL administration problem: A database principal can log in but SELECT queries fail after an object-level DENY was added and administrators repeatedly add more GRANT statements. The Maplewood Schools requirement is instead: A developer executes GRANT CONTROL at database scope to permit a single schema deployment and inadvertently grants broad management capability. That approach does not directly establish the required fix; the requested acceptance evidence is: The deployment identity performs the approved schema change while the runtime application identity cannot alter unrelated schemas.

Differentiate Azure resource-management RBAC from SQL data-plane authentication and create the appropriate database principal and grants. That relates to a separate SQL administration problem: A service principal is assigned an Azure RBAC Contributor role and engineers assume this automatically grants SQL SELECT permission inside Azure SQL Database. The Maplewood Schools requirement is instead: A developer executes GRANT CONTROL at database scope to permit a single schema deployment and inadvertently grants broad management capability. That approach does not directly establish the required fix; the requested acceptance evidence is: The deployment identity performs the approved schema change while the runtime application identity cannot alter unrelated schemas.

Create or identify the database principal and grant the minimum required schema or object permissions rather than broad server administration. That relates to a separate SQL administration problem: A reporting user can access an Azure SQL database but receives permission denied for a particular schema because a login was mistaken for data access. The Maplewood Schools requirement is instead: A developer executes GRANT CONTROL at database scope to permit a single schema deployment and inadvertently grants broad management capability. That approach does not directly establish the required fix; the requested acceptance evidence is: The deployment identity performs the approved schema change while the runtime application identity cannot alter unrelated schemas.

A permitted Entra user signs in to Azure SQL and the retired application secret is absent from source control and deployment settings. That result is evidence for another corrective change: Configure Microsoft Entra authentication and an appropriate administrator and database principals while removing hardcoded database passwords. The alternative problem is: An Azure SQL Database application stores SQL user passwords in deployment scripts even though its users have centrally managed Microsoft Entra identities. The current Maplewood Schools issue is instead: A developer executes GRANT CONTROL at database scope to permit a single schema deployment and inadvertently grants broad management capability. Its decisive acceptance evidence would be: The deployment identity performs the approved schema change while the runtime application identity cannot alter unrelated schemas.

An authorization test executes the approved procedure while unrelated table modification and database ownership actions fail. That result is evidence for another corrective change: Grant narrowly scoped EXECUTE permission on the intended procedure or suitable custom role instead of db_owner. The alternative problem is: An automation identity is made db_owner just to execute a read-only stored procedure, violating a documented least-privilege policy. The current Maplewood Schools issue is instead: A developer executes GRANT CONTROL at database scope to permit a single schema deployment and inadvertently grants broad management capability. Its decisive acceptance evidence would be: The deployment identity performs the approved schema change while the runtime application identity cannot alter unrelated schemas.

The target principal reads precisely the intended objects and an access audit shows the offending DENY no longer masks the approved grant. That result is evidence for another corrective change: Inspect effective permissions and explicit DENY precedence before removing or correcting the conflicting access policy with approval. The alternative problem is: A database principal can log in but SELECT queries fail after an object-level DENY was added and administrators repeatedly add more GRANT statements. The current Maplewood Schools issue is instead: A developer executes GRANT CONTROL at database scope to permit a single schema deployment and inadvertently grants broad management capability. Its decisive acceptance evidence would be: The deployment identity performs the approved schema change while the runtime application identity cannot alter unrelated schemas.