Exam Bundle

Removing a test user from the authorized group stops new authorized database access after documented token or session refresh. That result is evidence for another corrective change: Use Microsoft Entra group-based database access where supported and govern group membership and conditional access outside SQL. The alternative problem is: An application creates SQL logins for hundreds of human users and cannot promptly disable a terminated employee across several databases. The current Alpine Healthcare issue is instead: A service principal is assigned an Azure RBAC Contributor role and engineers assume this automatically grants SQL SELECT permission inside Azure SQL Database. Its decisive acceptance evidence would be: The identity can manage only its approved Azure resources and SQL SELECT becomes possible only after explicit database permissions exist.

An authorization test executes the approved procedure while unrelated table modification and database ownership actions fail. That result is evidence for another corrective change: Grant narrowly scoped EXECUTE permission on the intended procedure or suitable custom role instead of db_owner. The alternative problem is: An automation identity is made db_owner just to execute a read-only stored procedure, violating a documented least-privilege policy. The current Alpine Healthcare issue is instead: A service principal is assigned an Azure RBAC Contributor role and engineers assume this automatically grants SQL SELECT permission inside Azure SQL Database. Its decisive acceptance evidence would be: The identity can manage only its approved Azure resources and SQL SELECT becomes possible only after explicit database permissions exist.

A member of a granted group performs only the specified database actions while an unrelated Entra group remains denied. That result is evidence for another corrective change: Create scoped database users or groups and explicit role grants after configuring the instance Entra administrator. The alternative problem is: A SQL Managed Instance team assumes its Microsoft Entra administrator automatically grants every Entra group access to all databases. The current Alpine Healthcare issue is instead: A service principal is assigned an Azure RBAC Contributor role and engineers assume this automatically grants SQL SELECT permission inside Azure SQL Database. Its decisive acceptance evidence would be: The identity can manage only its approved Azure resources and SQL SELECT becomes possible only after explicit database permissions exist.

Configure Microsoft Entra authentication and an appropriate administrator and database principals while removing hardcoded database passwords. That relates to a separate SQL administration problem: An Azure SQL Database application stores SQL user passwords in deployment scripts even though its users have centrally managed Microsoft Entra identities. The Granite SaaS requirement is instead: A service principal is assigned an Azure RBAC Contributor role and engineers assume this automatically grants SQL SELECT permission inside Azure SQL Database. That approach does not directly establish the required fix; the requested acceptance evidence is: The identity can manage only its approved Azure resources and SQL SELECT becomes possible only after explicit database permissions exist.

Create a custom database role and grant SELECT only on explicitly approved objects rather than all readable tables. That relates to a separate SQL administration problem: A team assigns the fixed db_datareader role for an application that should read only one sensitive table and one approved view. The Granite SaaS requirement is instead: A service principal is assigned an Azure RBAC Contributor role and engineers assume this automatically grants SQL SELECT permission inside Azure SQL Database. That approach does not directly establish the required fix; the requested acceptance evidence is: The identity can manage only its approved Azure resources and SQL SELECT becomes possible only after explicit database permissions exist.

Configure the supported domain or Microsoft Entra authentication method for the SQL Server on Azure VM after checking version and platform prerequisites. That relates to a separate SQL administration problem: An Azure-hosted SQL Server application needs domain-integrated Windows login behavior but its virtual machine is deployed without the required directory integration. The Granite SaaS requirement is instead: A service principal is assigned an Azure RBAC Contributor role and engineers assume this automatically grants SQL SELECT permission inside Azure SQL Database. That approach does not directly establish the required fix; the requested acceptance evidence is: The identity can manage only its approved Azure resources and SQL SELECT becomes possible only after explicit database permissions exist.

The target principal reads precisely the intended objects and an access audit shows the offending DENY no longer masks the approved grant. That result is evidence for another corrective change: Inspect effective permissions and explicit DENY precedence before removing or correcting the conflicting access policy with approval. The alternative problem is: A database principal can log in but SELECT queries fail after an object-level DENY was added and administrators repeatedly add more GRANT statements. The current Granite SaaS issue is instead: A service principal is assigned an Azure RBAC Contributor role and engineers assume this automatically grants SQL SELECT permission inside Azure SQL Database. Its decisive acceptance evidence would be: The identity can manage only its approved Azure resources and SQL SELECT becomes possible only after explicit database permissions exist.

The application identity establishes its intended database session and a second database remains inaccessible without a separate grant. That result is evidence for another corrective change: Map the login to the appropriate database user or use a contained identity pattern supported by the chosen SQL service. The alternative problem is: A script creates a SQL login in the master database but never creates a usable user inside the application database. The current Granite SaaS issue is instead: A service principal is assigned an Azure RBAC Contributor role and engineers assume this automatically grants SQL SELECT permission inside Azure SQL Database. Its decisive acceptance evidence would be: The identity can manage only its approved Azure resources and SQL SELECT becomes possible only after explicit database permissions exist.

A test user reads the approved objects and receives permission denial on a restricted payroll table. That result is evidence for another corrective change: Create a custom database role and grant SELECT only on explicitly approved objects rather than all readable tables. The alternative problem is: A team assigns the fixed db_datareader role for an application that should read only one sensitive table and one approved view. The current Granite SaaS issue is instead: A service principal is assigned an Azure RBAC Contributor role and engineers assume this automatically grants SQL SELECT permission inside Azure SQL Database. Its decisive acceptance evidence would be: The identity can manage only its approved Azure resources and SQL SELECT becomes possible only after explicit database permissions exist.

Create dedicated application identities with least privilege and enable audit attribution rather than sharing the high-privilege administrator. That relates to a separate SQL administration problem: An Azure SQL database uses a shared administrator account in every application connection string and operations cannot attribute individual changes. The Granite SaaS requirement is instead: A SQL Server application uses EXECUTE AS OWNER for dynamic statements although the impersonation chain allows unintended access to other objects. That approach does not directly establish the required fix; the requested acceptance evidence is: A controlled execution reaches only authorized objects and fails a test query against a protected table outside the approved boundary.

Create scoped database users or groups and explicit role grants after configuring the instance Entra administrator. That relates to a separate SQL administration problem: A SQL Managed Instance team assumes its Microsoft Entra administrator automatically grants every Entra group access to all databases. The Granite SaaS requirement is instead: A SQL Server application uses EXECUTE AS OWNER for dynamic statements although the impersonation chain allows unintended access to other objects. That approach does not directly establish the required fix; the requested acceptance evidence is: A controlled execution reaches only authorized objects and fails a test query against a protected table outside the approved boundary.

Separate deployment-time elevated operations from runtime accounts and scope required DDL permissions to the target schema. That relates to a separate SQL administration problem: A developer executes GRANT CONTROL at database scope to permit a single schema deployment and inadvertently grants broad management capability. The Granite SaaS requirement is instead: A SQL Server application uses EXECUTE AS OWNER for dynamic statements although the impersonation chain allows unintended access to other objects. That approach does not directly establish the required fix; the requested acceptance evidence is: A controlled execution reaches only authorized objects and fails a test query against a protected table outside the approved boundary.

A member of a granted group performs only the specified database actions while an unrelated Entra group remains denied. That result is evidence for another corrective change: Create scoped database users or groups and explicit role grants after configuring the instance Entra administrator. The alternative problem is: A SQL Managed Instance team assumes its Microsoft Entra administrator automatically grants every Entra group access to all databases. The current Granite SaaS issue is instead: A SQL Server application uses EXECUTE AS OWNER for dynamic statements although the impersonation chain allows unintended access to other objects. Its decisive acceptance evidence would be: A controlled execution reaches only authorized objects and fails a test query against a protected table outside the approved boundary.

A new connection with the revoked credential fails and the previously active unauthorized session no longer executes queries. That result is evidence for another corrective change: Combine approved credential revocation with session termination and verify connection-pool and token behavior for the selected SQL service. The alternative problem is: An incident response team revokes a compromised login but long-running connections persist and the team assumes access was instantly terminated. The current Granite SaaS issue is instead: A SQL Server application uses EXECUTE AS OWNER for dynamic statements although the impersonation chain allows unintended access to other objects. Its decisive acceptance evidence would be: A controlled execution reaches only authorized objects and fails a test query against a protected table outside the approved boundary.

A test user reads the approved objects and receives permission denial on a restricted payroll table. That result is evidence for another corrective change: Create a custom database role and grant SELECT only on explicitly approved objects rather than all readable tables. The alternative problem is: A team assigns the fixed db_datareader role for an application that should read only one sensitive table and one approved view. The current Granite SaaS issue is instead: A SQL Server application uses EXECUTE AS OWNER for dynamic statements although the impersonation chain allows unintended access to other objects. Its decisive acceptance evidence would be: A controlled execution reaches only authorized objects and fails a test query against a protected table outside the approved boundary.

Create or identify the database principal and grant the minimum required schema or object permissions rather than broad server administration. That relates to a separate SQL administration problem: A reporting user can access an Azure SQL database but receives permission denied for a particular schema because a login was mistaken for data access. The Keystone BioLabs requirement is instead: A SQL Server application uses EXECUTE AS OWNER for dynamic statements although the impersonation chain allows unintended access to other objects. That approach does not directly establish the required fix; the requested acceptance evidence is: A controlled execution reaches only authorized objects and fails a test query against a protected table outside the approved boundary.

Differentiate Azure resource-management RBAC from SQL data-plane authentication and create the appropriate database principal and grants. That relates to a separate SQL administration problem: A service principal is assigned an Azure RBAC Contributor role and engineers assume this automatically grants SQL SELECT permission inside Azure SQL Database. The Keystone BioLabs requirement is instead: A SQL Server application uses EXECUTE AS OWNER for dynamic statements although the impersonation chain allows unintended access to other objects. That approach does not directly establish the required fix; the requested acceptance evidence is: A controlled execution reaches only authorized objects and fails a test query against a protected table outside the approved boundary.

Create dedicated application identities with least privilege and enable audit attribution rather than sharing the high-privilege administrator. That relates to a separate SQL administration problem: An Azure SQL database uses a shared administrator account in every application connection string and operations cannot attribute individual changes. The Keystone BioLabs requirement is instead: A SQL Server application uses EXECUTE AS OWNER for dynamic statements although the impersonation chain allows unintended access to other objects. That approach does not directly establish the required fix; the requested acceptance evidence is: A controlled execution reaches only authorized objects and fails a test query against a protected table outside the approved boundary.

The deployment identity performs the approved schema change while the runtime application identity cannot alter unrelated schemas. That result is evidence for another corrective change: Separate deployment-time elevated operations from runtime accounts and scope required DDL permissions to the target schema. The alternative problem is: A developer executes GRANT CONTROL at database scope to permit a single schema deployment and inadvertently grants broad management capability. The current Keystone BioLabs issue is instead: A SQL Server application uses EXECUTE AS OWNER for dynamic statements although the impersonation chain allows unintended access to other objects. Its decisive acceptance evidence would be: A controlled execution reaches only authorized objects and fails a test query against a protected table outside the approved boundary.

Removing a test user from the authorized group stops new authorized database access after documented token or session refresh. That result is evidence for another corrective change: Use Microsoft Entra group-based database access where supported and govern group membership and conditional access outside SQL. The alternative problem is: An application creates SQL logins for hundreds of human users and cannot promptly disable a terminated employee across several databases. The current Keystone BioLabs issue is instead: A SQL Server application uses EXECUTE AS OWNER for dynamic statements although the impersonation chain allows unintended access to other objects. Its decisive acceptance evidence would be: A controlled execution reaches only authorized objects and fails a test query against a protected table outside the approved boundary.

The target principal reads precisely the intended objects and an access audit shows the offending DENY no longer masks the approved grant. That result is evidence for another corrective change: Inspect effective permissions and explicit DENY precedence before removing or correcting the conflicting access policy with approval. The alternative problem is: A database principal can log in but SELECT queries fail after an object-level DENY was added and administrators repeatedly add more GRANT statements. The current Keystone BioLabs issue is instead: A SQL Server application uses EXECUTE AS OWNER for dynamic statements although the impersonation chain allows unintended access to other objects. Its decisive acceptance evidence would be: A controlled execution reaches only authorized objects and fails a test query against a protected table outside the approved boundary.

Use Microsoft Entra group-based database access where supported and govern group membership and conditional access outside SQL. That relates to a separate SQL administration problem: An application creates SQL logins for hundreds of human users and cannot promptly disable a terminated employee across several databases. The Keystone BioLabs requirement is instead: An incident response team revokes a compromised login but long-running connections persist and the team assumes access was instantly terminated. That approach does not directly establish the required fix; the requested acceptance evidence is: A new connection with the revoked credential fails and the previously active unauthorized session no longer executes queries.

Create the appropriate contained database users from Microsoft Entra identities and grant only their documented database roles. That relates to a separate SQL administration problem: A SQL Managed Instance has Microsoft Entra authentication enabled but service identities lack database users and cannot read required tables. The Keystone BioLabs requirement is instead: An incident response team revokes a compromised login but long-running connections persist and the team assumes access was instantly terminated. That approach does not directly establish the required fix; the requested acceptance evidence is: A new connection with the revoked credential fails and the previously active unauthorized session no longer executes queries.

Create dedicated application identities with least privilege and enable audit attribution rather than sharing the high-privilege administrator. That relates to a separate SQL administration problem: An Azure SQL database uses a shared administrator account in every application connection string and operations cannot attribute individual changes. The Keystone BioLabs requirement is instead: An incident response team revokes a compromised login but long-running connections persist and the team assumes access was instantly terminated. That approach does not directly establish the required fix; the requested acceptance evidence is: A new connection with the revoked credential fails and the previously active unauthorized session no longer executes queries.

The user can run the authorized report query but cannot change unrelated schemas or grant new rights. That result is evidence for another corrective change: Create or identify the database principal and grant the minimum required schema or object permissions rather than broad server administration. The alternative problem is: A reporting user can access an Azure SQL database but receives permission denied for a particular schema because a login was mistaken for data access. The current Keystone BioLabs issue is instead: An incident response team revokes a compromised login but long-running connections persist and the team assumes access was instantly terminated. Its decisive acceptance evidence would be: A new connection with the revoked credential fails and the previously active unauthorized session no longer executes queries.

The target principal reads precisely the intended objects and an access audit shows the offending DENY no longer masks the approved grant. That result is evidence for another corrective change: Inspect effective permissions and explicit DENY precedence before removing or correcting the conflicting access policy with approval. The alternative problem is: A database principal can log in but SELECT queries fail after an object-level DENY was added and administrators repeatedly add more GRANT statements. The current Keystone BioLabs issue is instead: An incident response team revokes a compromised login but long-running connections persist and the team assumes access was instantly terminated. Its decisive acceptance evidence would be: A new connection with the revoked credential fails and the previously active unauthorized session no longer executes queries.

A test user reads the approved objects and receives permission denial on a restricted payroll table. That result is evidence for another corrective change: Create a custom database role and grant SELECT only on explicitly approved objects rather than all readable tables. The alternative problem is: A team assigns the fixed db_datareader role for an application that should read only one sensitive table and one approved view. The current Keystone BioLabs issue is instead: An incident response team revokes a compromised login but long-running connections persist and the team assumes access was instantly terminated. Its decisive acceptance evidence would be: A new connection with the revoked credential fails and the previously active unauthorized session no longer executes queries.

Differentiate Azure resource-management RBAC from SQL data-plane authentication and create the appropriate database principal and grants. That relates to a separate SQL administration problem: A service principal is assigned an Azure RBAC Contributor role and engineers assume this automatically grants SQL SELECT permission inside Azure SQL Database. The Silvercrest University requirement is instead: An incident response team revokes a compromised login but long-running connections persist and the team assumes access was instantly terminated. That approach does not directly establish the required fix; the requested acceptance evidence is: A new connection with the revoked credential fails and the previously active unauthorized session no longer executes queries.

Create dedicated application identities with least privilege and enable audit attribution rather than sharing the high-privilege administrator. That relates to a separate SQL administration problem: An Azure SQL database uses a shared administrator account in every application connection string and operations cannot attribute individual changes. The Silvercrest University requirement is instead: An incident response team revokes a compromised login but long-running connections persist and the team assumes access was instantly terminated. That approach does not directly establish the required fix; the requested acceptance evidence is: A new connection with the revoked credential fails and the previously active unauthorized session no longer executes queries.

Configure the supported domain or Microsoft Entra authentication method for the SQL Server on Azure VM after checking version and platform prerequisites. That relates to a separate SQL administration problem: An Azure-hosted SQL Server application needs domain-integrated Windows login behavior but its virtual machine is deployed without the required directory integration. The Silvercrest University requirement is instead: An incident response team revokes a compromised login but long-running connections persist and the team assumes access was instantly terminated. That approach does not directly establish the required fix; the requested acceptance evidence is: A new connection with the revoked credential fails and the previously active unauthorized session no longer executes queries.

Audited sessions identify the intended service principal and the administrator is no longer used for routine application traffic. That result is evidence for another corrective change: Create dedicated application identities with least privilege and enable audit attribution rather than sharing the high-privilege administrator. The alternative problem is: An Azure SQL database uses a shared administrator account in every application connection string and operations cannot attribute individual changes. The current Silvercrest University issue is instead: An incident response team revokes a compromised login but long-running connections persist and the team assumes access was instantly terminated. Its decisive acceptance evidence would be: A new connection with the revoked credential fails and the previously active unauthorized session no longer executes queries.

A permitted Entra user signs in to Azure SQL and the retired application secret is absent from source control and deployment settings. That result is evidence for another corrective change: Configure Microsoft Entra authentication and an appropriate administrator and database principals while removing hardcoded database passwords. The alternative problem is: An Azure SQL Database application stores SQL user passwords in deployment scripts even though its users have centrally managed Microsoft Entra identities. The current Silvercrest University issue is instead: An incident response team revokes a compromised login but long-running connections persist and the team assumes access was instantly terminated. Its decisive acceptance evidence would be: A new connection with the revoked credential fails and the previously active unauthorized session no longer executes queries.

A member of a granted group performs only the specified database actions while an unrelated Entra group remains denied. That result is evidence for another corrective change: Create scoped database users or groups and explicit role grants after configuring the instance Entra administrator. The alternative problem is: A SQL Managed Instance team assumes its Microsoft Entra administrator automatically grants every Entra group access to all databases. The current Silvercrest University issue is instead: An incident response team revokes a compromised login but long-running connections persist and the team assumes access was instantly terminated. Its decisive acceptance evidence would be: A new connection with the revoked credential fails and the previously active unauthorized session no longer executes queries.