Exam Bundle

A permitted Entra user signs in to Azure SQL and the retired application secret is absent from source control and deployment settings. That result is evidence for another corrective change: Configure Microsoft Entra authentication and an appropriate administrator and database principals while removing hardcoded database passwords. The alternative problem is: An Azure SQL Database application stores SQL user passwords in deployment scripts even though its users have centrally managed Microsoft Entra identities. The current Maplewood Schools issue is instead: A developer executes GRANT CONTROL at database scope to permit a single schema deployment and inadvertently grants broad management capability. Its decisive acceptance evidence would be: The deployment identity performs the approved schema change while the runtime application identity cannot alter unrelated schemas.

An authorization test executes the approved procedure while unrelated table modification and database ownership actions fail. That result is evidence for another corrective change: Grant narrowly scoped EXECUTE permission on the intended procedure or suitable custom role instead of db_owner. The alternative problem is: An automation identity is made db_owner just to execute a read-only stored procedure, violating a documented least-privilege policy. The current Maplewood Schools issue is instead: A developer executes GRANT CONTROL at database scope to permit a single schema deployment and inadvertently grants broad management capability. Its decisive acceptance evidence would be: The deployment identity performs the approved schema change while the runtime application identity cannot alter unrelated schemas.

The target principal reads precisely the intended objects and an access audit shows the offending DENY no longer masks the approved grant. That result is evidence for another corrective change: Inspect effective permissions and explicit DENY precedence before removing or correcting the conflicting access policy with approval. The alternative problem is: A database principal can log in but SELECT queries fail after an object-level DENY was added and administrators repeatedly add more GRANT statements. The current Maplewood Schools issue is instead: A developer executes GRANT CONTROL at database scope to permit a single schema deployment and inadvertently grants broad management capability. Its decisive acceptance evidence would be: The deployment identity performs the approved schema change while the runtime application identity cannot alter unrelated schemas.

Create or identify the database principal and grant the minimum required schema or object permissions rather than broad server administration. That relates to a separate SQL administration problem: A reporting user can access an Azure SQL database but receives permission denied for a particular schema because a login was mistaken for data access. The Maplewood Schools requirement is instead: An Azure SQL database uses a shared administrator account in every application connection string and operations cannot attribute individual changes. That approach does not directly establish the required fix; the requested acceptance evidence is: Audited sessions identify the intended service principal and the administrator is no longer used for routine application traffic.

Inspect effective permissions and explicit DENY precedence before removing or correcting the conflicting access policy with approval. That relates to a separate SQL administration problem: A database principal can log in but SELECT queries fail after an object-level DENY was added and administrators repeatedly add more GRANT statements. The Maplewood Schools requirement is instead: An Azure SQL database uses a shared administrator account in every application connection string and operations cannot attribute individual changes. That approach does not directly establish the required fix; the requested acceptance evidence is: Audited sessions identify the intended service principal and the administrator is no longer used for routine application traffic.

Differentiate Azure resource-management RBAC from SQL data-plane authentication and create the appropriate database principal and grants. That relates to a separate SQL administration problem: A service principal is assigned an Azure RBAC Contributor role and engineers assume this automatically grants SQL SELECT permission inside Azure SQL Database. The Maplewood Schools requirement is instead: An Azure SQL database uses a shared administrator account in every application connection string and operations cannot attribute individual changes. That approach does not directly establish the required fix; the requested acceptance evidence is: Audited sessions identify the intended service principal and the administrator is no longer used for routine application traffic.

A test user reads the approved objects and receives permission denial on a restricted payroll table. That result is evidence for another corrective change: Create a custom database role and grant SELECT only on explicitly approved objects rather than all readable tables. The alternative problem is: A team assigns the fixed db_datareader role for an application that should read only one sensitive table and one approved view. The current Maplewood Schools issue is instead: An Azure SQL database uses a shared administrator account in every application connection string and operations cannot attribute individual changes. Its decisive acceptance evidence would be: Audited sessions identify the intended service principal and the administrator is no longer used for routine application traffic.

The identity can manage only its approved Azure resources and SQL SELECT becomes possible only after explicit database permissions exist. That result is evidence for another corrective change: Differentiate Azure resource-management RBAC from SQL data-plane authentication and create the appropriate database principal and grants. The alternative problem is: A service principal is assigned an Azure RBAC Contributor role and engineers assume this automatically grants SQL SELECT permission inside Azure SQL Database. The current Maplewood Schools issue is instead: An Azure SQL database uses a shared administrator account in every application connection string and operations cannot attribute individual changes. Its decisive acceptance evidence would be: Audited sessions identify the intended service principal and the administrator is no longer used for routine application traffic.

A new connection with the revoked credential fails and the previously active unauthorized session no longer executes queries. That result is evidence for another corrective change: Combine approved credential revocation with session termination and verify connection-pool and token behavior for the selected SQL service. The alternative problem is: An incident response team revokes a compromised login but long-running connections persist and the team assumes access was instantly terminated. The current Maplewood Schools issue is instead: An Azure SQL database uses a shared administrator account in every application connection string and operations cannot attribute individual changes. Its decisive acceptance evidence would be: Audited sessions identify the intended service principal and the administrator is no longer used for routine application traffic.

Create scoped database users or groups and explicit role grants after configuring the instance Entra administrator. That relates to a separate SQL administration problem: A SQL Managed Instance team assumes its Microsoft Entra administrator automatically grants every Entra group access to all databases. The Meadowbrook Finance requirement is instead: An Azure SQL database uses a shared administrator account in every application connection string and operations cannot attribute individual changes. That approach does not directly establish the required fix; the requested acceptance evidence is: Audited sessions identify the intended service principal and the administrator is no longer used for routine application traffic.

Create or identify the database principal and grant the minimum required schema or object permissions rather than broad server administration. That relates to a separate SQL administration problem: A reporting user can access an Azure SQL database but receives permission denied for a particular schema because a login was mistaken for data access. The Meadowbrook Finance requirement is instead: An Azure SQL database uses a shared administrator account in every application connection string and operations cannot attribute individual changes. That approach does not directly establish the required fix; the requested acceptance evidence is: Audited sessions identify the intended service principal and the administrator is no longer used for routine application traffic.

Use Microsoft Entra group-based database access where supported and govern group membership and conditional access outside SQL. That relates to a separate SQL administration problem: An application creates SQL logins for hundreds of human users and cannot promptly disable a terminated employee across several databases. The Meadowbrook Finance requirement is instead: An Azure SQL database uses a shared administrator account in every application connection string and operations cannot attribute individual changes. That approach does not directly establish the required fix; the requested acceptance evidence is: Audited sessions identify the intended service principal and the administrator is no longer used for routine application traffic.

A controlled execution reaches only authorized objects and fails a test query against a protected table outside the approved boundary. That result is evidence for another corrective change: Review module execution context and use signed modules or narrowly scoped permissions that avoid unnecessary privilege escalation. The alternative problem is: A SQL Server application uses EXECUTE AS OWNER for dynamic statements although the impersonation chain allows unintended access to other objects. The current Meadowbrook Finance issue is instead: An Azure SQL database uses a shared administrator account in every application connection string and operations cannot attribute individual changes. Its decisive acceptance evidence would be: Audited sessions identify the intended service principal and the administrator is no longer used for routine application traffic.

A member of a granted group performs only the specified database actions while an unrelated Entra group remains denied. That result is evidence for another corrective change: Create scoped database users or groups and explicit role grants after configuring the instance Entra administrator. The alternative problem is: A SQL Managed Instance team assumes its Microsoft Entra administrator automatically grants every Entra group access to all databases. The current Meadowbrook Finance issue is instead: An Azure SQL database uses a shared administrator account in every application connection string and operations cannot attribute individual changes. Its decisive acceptance evidence would be: Audited sessions identify the intended service principal and the administrator is no longer used for routine application traffic.

Removing a test user from the authorized group stops new authorized database access after documented token or session refresh. That result is evidence for another corrective change: Use Microsoft Entra group-based database access where supported and govern group membership and conditional access outside SQL. The alternative problem is: An application creates SQL logins for hundreds of human users and cannot promptly disable a terminated employee across several databases. The current Meadowbrook Finance issue is instead: An Azure SQL database uses a shared administrator account in every application connection string and operations cannot attribute individual changes. Its decisive acceptance evidence would be: Audited sessions identify the intended service principal and the administrator is no longer used for routine application traffic.

Create a custom database role and grant SELECT only on explicitly approved objects rather than all readable tables. That relates to a separate SQL administration problem: A team assigns the fixed db_datareader role for an application that should read only one sensitive table and one approved view. The Meadowbrook Finance requirement is instead: A SQL Managed Instance team assumes its Microsoft Entra administrator automatically grants every Entra group access to all databases. That approach does not directly establish the required fix; the requested acceptance evidence is: A member of a granted group performs only the specified database actions while an unrelated Entra group remains denied.

Combine approved credential revocation with session termination and verify connection-pool and token behavior for the selected SQL service. That relates to a separate SQL administration problem: An incident response team revokes a compromised login but long-running connections persist and the team assumes access was instantly terminated. The Meadowbrook Finance requirement is instead: A SQL Managed Instance team assumes its Microsoft Entra administrator automatically grants every Entra group access to all databases. That approach does not directly establish the required fix; the requested acceptance evidence is: A member of a granted group performs only the specified database actions while an unrelated Entra group remains denied.

Create dedicated application identities with least privilege and enable audit attribution rather than sharing the high-privilege administrator. That relates to a separate SQL administration problem: An Azure SQL database uses a shared administrator account in every application connection string and operations cannot attribute individual changes. The Meadowbrook Finance requirement is instead: A SQL Managed Instance team assumes its Microsoft Entra administrator automatically grants every Entra group access to all databases. That approach does not directly establish the required fix; the requested acceptance evidence is: A member of a granted group performs only the specified database actions while an unrelated Entra group remains denied.

A controlled execution reaches only authorized objects and fails a test query against a protected table outside the approved boundary. That result is evidence for another corrective change: Review module execution context and use signed modules or narrowly scoped permissions that avoid unnecessary privilege escalation. The alternative problem is: A SQL Server application uses EXECUTE AS OWNER for dynamic statements although the impersonation chain allows unintended access to other objects. The current Meadowbrook Finance issue is instead: A SQL Managed Instance team assumes its Microsoft Entra administrator automatically grants every Entra group access to all databases. Its decisive acceptance evidence would be: A member of a granted group performs only the specified database actions while an unrelated Entra group remains denied.

Removing a test user from the authorized group stops new authorized database access after documented token or session refresh. That result is evidence for another corrective change: Use Microsoft Entra group-based database access where supported and govern group membership and conditional access outside SQL. The alternative problem is: An application creates SQL logins for hundreds of human users and cannot promptly disable a terminated employee across several databases. The current Meadowbrook Finance issue is instead: A SQL Managed Instance team assumes its Microsoft Entra administrator automatically grants every Entra group access to all databases. Its decisive acceptance evidence would be: A member of a granted group performs only the specified database actions while an unrelated Entra group remains denied.

An authorization test executes the approved procedure while unrelated table modification and database ownership actions fail. That result is evidence for another corrective change: Grant narrowly scoped EXECUTE permission on the intended procedure or suitable custom role instead of db_owner. The alternative problem is: An automation identity is made db_owner just to execute a read-only stored procedure, violating a documented least-privilege policy. The current Meadowbrook Finance issue is instead: A SQL Managed Instance team assumes its Microsoft Entra administrator automatically grants every Entra group access to all databases. Its decisive acceptance evidence would be: A member of a granted group performs only the specified database actions while an unrelated Entra group remains denied.

Configure the supported domain or Microsoft Entra authentication method for the SQL Server on Azure VM after checking version and platform prerequisites. That relates to a separate SQL administration problem: An Azure-hosted SQL Server application needs domain-integrated Windows login behavior but its virtual machine is deployed without the required directory integration. The Alpine Healthcare requirement is instead: A SQL Managed Instance team assumes its Microsoft Entra administrator automatically grants every Entra group access to all databases. That approach does not directly establish the required fix; the requested acceptance evidence is: A member of a granted group performs only the specified database actions while an unrelated Entra group remains denied.

Create or identify the database principal and grant the minimum required schema or object permissions rather than broad server administration. That relates to a separate SQL administration problem: A reporting user can access an Azure SQL database but receives permission denied for a particular schema because a login was mistaken for data access. The Alpine Healthcare requirement is instead: A SQL Managed Instance team assumes its Microsoft Entra administrator automatically grants every Entra group access to all databases. That approach does not directly establish the required fix; the requested acceptance evidence is: A member of a granted group performs only the specified database actions while an unrelated Entra group remains denied.

Create dedicated application identities with least privilege and enable audit attribution rather than sharing the high-privilege administrator. That relates to a separate SQL administration problem: An Azure SQL database uses a shared administrator account in every application connection string and operations cannot attribute individual changes. The Alpine Healthcare requirement is instead: A SQL Managed Instance team assumes its Microsoft Entra administrator automatically grants every Entra group access to all databases. That approach does not directly establish the required fix; the requested acceptance evidence is: A member of a granted group performs only the specified database actions while an unrelated Entra group remains denied.

Removing a test user from the authorized group stops new authorized database access after documented token or session refresh. That result is evidence for another corrective change: Use Microsoft Entra group-based database access where supported and govern group membership and conditional access outside SQL. The alternative problem is: An application creates SQL logins for hundreds of human users and cannot promptly disable a terminated employee across several databases. The current Alpine Healthcare issue is instead: A SQL Managed Instance team assumes its Microsoft Entra administrator automatically grants every Entra group access to all databases. Its decisive acceptance evidence would be: A member of a granted group performs only the specified database actions while an unrelated Entra group remains denied.

A new connection with the revoked credential fails and the previously active unauthorized session no longer executes queries. That result is evidence for another corrective change: Combine approved credential revocation with session termination and verify connection-pool and token behavior for the selected SQL service. The alternative problem is: An incident response team revokes a compromised login but long-running connections persist and the team assumes access was instantly terminated. The current Alpine Healthcare issue is instead: A SQL Managed Instance team assumes its Microsoft Entra administrator automatically grants every Entra group access to all databases. Its decisive acceptance evidence would be: A member of a granted group performs only the specified database actions while an unrelated Entra group remains denied.

The application identity establishes its intended database session and a second database remains inaccessible without a separate grant. That result is evidence for another corrective change: Map the login to the appropriate database user or use a contained identity pattern supported by the chosen SQL service. The alternative problem is: A script creates a SQL login in the master database but never creates a usable user inside the application database. The current Alpine Healthcare issue is instead: A SQL Managed Instance team assumes its Microsoft Entra administrator automatically grants every Entra group access to all databases. Its decisive acceptance evidence would be: A member of a granted group performs only the specified database actions while an unrelated Entra group remains denied.

Create a custom database role and grant SELECT only on explicitly approved objects rather than all readable tables. That relates to a separate SQL administration problem: A team assigns the fixed db_datareader role for an application that should read only one sensitive table and one approved view. The Alpine Healthcare requirement is instead: A service principal is assigned an Azure RBAC Contributor role and engineers assume this automatically grants SQL SELECT permission inside Azure SQL Database. That approach does not directly establish the required fix; the requested acceptance evidence is: The identity can manage only its approved Azure resources and SQL SELECT becomes possible only after explicit database permissions exist.

Create or identify the database principal and grant the minimum required schema or object permissions rather than broad server administration. That relates to a separate SQL administration problem: A reporting user can access an Azure SQL database but receives permission denied for a particular schema because a login was mistaken for data access. The Alpine Healthcare requirement is instead: A service principal is assigned an Azure RBAC Contributor role and engineers assume this automatically grants SQL SELECT permission inside Azure SQL Database. That approach does not directly establish the required fix; the requested acceptance evidence is: The identity can manage only its approved Azure resources and SQL SELECT becomes possible only after explicit database permissions exist.

Create scoped database users or groups and explicit role grants after configuring the instance Entra administrator. That relates to a separate SQL administration problem: A SQL Managed Instance team assumes its Microsoft Entra administrator automatically grants every Entra group access to all databases. The Alpine Healthcare requirement is instead: A service principal is assigned an Azure RBAC Contributor role and engineers assume this automatically grants SQL SELECT permission inside Azure SQL Database. That approach does not directly establish the required fix; the requested acceptance evidence is: The identity can manage only its approved Azure resources and SQL SELECT becomes possible only after explicit database permissions exist.

Removing a test user from the authorized group stops new authorized database access after documented token or session refresh. That result is evidence for another corrective change: Use Microsoft Entra group-based database access where supported and govern group membership and conditional access outside SQL. The alternative problem is: An application creates SQL logins for hundreds of human users and cannot promptly disable a terminated employee across several databases. The current Alpine Healthcare issue is instead: A service principal is assigned an Azure RBAC Contributor role and engineers assume this automatically grants SQL SELECT permission inside Azure SQL Database. Its decisive acceptance evidence would be: The identity can manage only its approved Azure resources and SQL SELECT becomes possible only after explicit database permissions exist.

An authorization test executes the approved procedure while unrelated table modification and database ownership actions fail. That result is evidence for another corrective change: Grant narrowly scoped EXECUTE permission on the intended procedure or suitable custom role instead of db_owner. The alternative problem is: An automation identity is made db_owner just to execute a read-only stored procedure, violating a documented least-privilege policy. The current Alpine Healthcare issue is instead: A service principal is assigned an Azure RBAC Contributor role and engineers assume this automatically grants SQL SELECT permission inside Azure SQL Database. Its decisive acceptance evidence would be: The identity can manage only its approved Azure resources and SQL SELECT becomes possible only after explicit database permissions exist.

A member of a granted group performs only the specified database actions while an unrelated Entra group remains denied. That result is evidence for another corrective change: Create scoped database users or groups and explicit role grants after configuring the instance Entra administrator. The alternative problem is: A SQL Managed Instance team assumes its Microsoft Entra administrator automatically grants every Entra group access to all databases. The current Alpine Healthcare issue is instead: A service principal is assigned an Azure RBAC Contributor role and engineers assume this automatically grants SQL SELECT permission inside Azure SQL Database. Its decisive acceptance evidence would be: The identity can manage only its approved Azure resources and SQL SELECT becomes possible only after explicit database permissions exist.