Exam Bundle

Audited sessions identify the intended service principal and the administrator is no longer used for routine application traffic. That result is evidence for another corrective change: Create dedicated application identities with least privilege and enable audit attribution rather than sharing the high-privilege administrator. The alternative problem is: An Azure SQL database uses a shared administrator account in every application connection string and operations cannot attribute individual changes. The current Silvercrest University issue is instead: An incident response team revokes a compromised login but long-running connections persist and the team assumes access was instantly terminated. Its decisive acceptance evidence would be: A new connection with the revoked credential fails and the previously active unauthorized session no longer executes queries.

A permitted Entra user signs in to Azure SQL and the retired application secret is absent from source control and deployment settings. That result is evidence for another corrective change: Configure Microsoft Entra authentication and an appropriate administrator and database principals while removing hardcoded database passwords. The alternative problem is: An Azure SQL Database application stores SQL user passwords in deployment scripts even though its users have centrally managed Microsoft Entra identities. The current Silvercrest University issue is instead: An incident response team revokes a compromised login but long-running connections persist and the team assumes access was instantly terminated. Its decisive acceptance evidence would be: A new connection with the revoked credential fails and the previously active unauthorized session no longer executes queries.

A member of a granted group performs only the specified database actions while an unrelated Entra group remains denied. That result is evidence for another corrective change: Create scoped database users or groups and explicit role grants after configuring the instance Entra administrator. The alternative problem is: A SQL Managed Instance team assumes its Microsoft Entra administrator automatically grants every Entra group access to all databases. The current Silvercrest University issue is instead: An incident response team revokes a compromised login but long-running connections persist and the team assumes access was instantly terminated. Its decisive acceptance evidence would be: A new connection with the revoked credential fails and the previously active unauthorized session no longer executes queries.

Require supported encrypted SQL connections and validate server certificates and client driver encryption settings. That relates to a separate SQL administration problem: An application attempts to connect to Azure SQL by unencrypted TDS because it assumes VPN transport replaces all database-layer TLS requirements. The Granite SaaS requirement is instead: A regulated Azure SQL Database uses default platform-managed encryption keys but requires customer-controlled key rotation and revocation evidence. That approach does not directly establish the required fix; the requested acceptance evidence is: The database reports the intended TDE protector and a controlled key-rotation test completes without application data exposure.

Use Always Encrypted for suitable columns with keys managed outside the database engine and supported client-side encryption. That relates to a separate SQL administration problem: A team wants an administrator who can run queries to be unable to see highly sensitive column values, but proposes only transparent data encryption. The Granite SaaS requirement is instead: A regulated Azure SQL Database uses default platform-managed encryption keys but requires customer-controlled key rotation and revocation evidence. That approach does not directly establish the required fix; the requested acceptance evidence is: The database reports the intended TDE protector and a controlled key-rotation test completes without application data exposure.

Replace broad access with the narrow approved client range or private connectivity and remove expired rules after testing. That relates to a separate SQL administration problem: A team allows the Azure SQL server-wide firewall rule for every address just to support one temporary developer laptop. The Granite SaaS requirement is instead: A regulated Azure SQL Database uses default platform-managed encryption keys but requires customer-controlled key rotation and revocation evidence. That approach does not directly establish the required fix; the requested acceptance evidence is: The database reports the intended TDE protector and a controlled key-rotation test completes without application data exposure.

The approved client reaches the database and a separate outside-IP test is rejected by the Azure SQL network access policy. That result is evidence for another corrective change: Replace broad access with the narrow approved client range or private connectivity and remove expired rules after testing. The alternative problem is: A team allows the Azure SQL server-wide firewall rule for every address just to support one temporary developer laptop. The current Granite SaaS issue is instead: A regulated Azure SQL Database uses default platform-managed encryption keys but requires customer-controlled key rotation and revocation evidence. Its decisive acceptance evidence would be: The database reports the intended TDE protector and a controlled key-rotation test completes without application data exposure.

Only the approved service returns plaintext from the test column and unauthorized SQL readers cannot recover its sensitive values. That result is evidence for another corrective change: Use a suitably governed column or application encryption design with key management and limited decrypt permissions. The alternative problem is: A database stores customer payment tokens in reversible plaintext even though only a small service needs to decrypt selected fields. The current Granite SaaS issue is instead: A regulated Azure SQL Database uses default platform-managed encryption keys but requires customer-controlled key rotation and revocation evidence. Its decisive acceptance evidence would be: The database reports the intended TDE protector and a controlled key-rotation test completes without application data exposure.

A test connection negotiates the required TLS channel and a deliberately noncompliant client connection is denied. That result is evidence for another corrective change: Require supported encrypted SQL connections and validate server certificates and client driver encryption settings. The alternative problem is: An application attempts to connect to Azure SQL by unencrypted TDS because it assumes VPN transport replaces all database-layer TLS requirements. The current Granite SaaS issue is instead: A regulated Azure SQL Database uses default platform-managed encryption keys but requires customer-controlled key rotation and revocation evidence. Its decisive acceptance evidence would be: The database reports the intended TDE protector and a controlled key-rotation test completes without application data exposure.

Move encryption key material to a supported external key store and apply controlled identity access and rotation procedures. That relates to a separate SQL administration problem: An application uses Always Encrypted but stores column master key secrets inside the same plaintext application configuration repository. The Oakridge Public Services requirement is instead: A regulated Azure SQL Database uses default platform-managed encryption keys but requires customer-controlled key rotation and revocation evidence. That approach does not directly establish the required fix; the requested acceptance evidence is: The database reports the intended TDE protector and a controlled key-rotation test completes without application data exposure.

Configure the managed instance's supported private connectivity, name resolution and narrow network security group access. That relates to a separate SQL administration problem: An organization opens all inbound traffic to SQL Managed Instance because internal client DNS and subnet routing were never configured. The Oakridge Public Services requirement is instead: A regulated Azure SQL Database uses default platform-managed encryption keys but requires customer-controlled key rotation and revocation evidence. That approach does not directly establish the required fix; the requested acceptance evidence is: The database reports the intended TDE protector and a controlled key-rotation test completes without application data exposure.

Grant the supported least-privilege key permissions or role assignments for the database encryption protector identity. That relates to a separate SQL administration problem: A customer-managed TDE deployment points at an Azure Key Vault key but the SQL service identity lacks the required key operations. The Oakridge Public Services requirement is instead: A regulated Azure SQL Database uses default platform-managed encryption keys but requires customer-controlled key rotation and revocation evidence. That approach does not directly establish the required fix; the requested acceptance evidence is: The database reports the intended TDE protector and a controlled key-rotation test completes without application data exposure.

A client resolves the expected private endpoint DNS chain and reaches the service over the permitted private route. That result is evidence for another corrective change: Distinguish service endpoints from Private Link and select private endpoints when private-address access and public exposure reduction are required. The alternative problem is: A security team assumes a service endpoint automatically gives a database a private IP address inside the application's subnet. The current Oakridge Public Services issue is instead: A regulated Azure SQL Database uses default platform-managed encryption keys but requires customer-controlled key rotation and revocation evidence. Its decisive acceptance evidence would be: The database reports the intended TDE protector and a controlled key-rotation test completes without application data exposure.

An authorized application decrypts a test value while a database administrator query sees ciphertext rather than plaintext. That result is evidence for another corrective change: Use Always Encrypted for suitable columns with keys managed outside the database engine and supported client-side encryption. The alternative problem is: A team wants an administrator who can run queries to be unable to see highly sensitive column values, but proposes only transparent data encryption. The current Oakridge Public Services issue is instead: A regulated Azure SQL Database uses default platform-managed encryption keys but requires customer-controlled key rotation and revocation evidence. Its decisive acceptance evidence would be: The database reports the intended TDE protector and a controlled key-rotation test completes without application data exposure.

The authorized private application resolves and connects on permitted ports while a forbidden subnet cannot establish a SQL session. That result is evidence for another corrective change: Configure the managed instance's supported private connectivity, name resolution and narrow network security group access. The alternative problem is: An organization opens all inbound traffic to SQL Managed Instance because internal client DNS and subnet routing were never configured. The current Oakridge Public Services issue is instead: A regulated Azure SQL Database uses default platform-managed encryption keys but requires customer-controlled key rotation and revocation evidence. Its decisive acceptance evidence would be: The database reports the intended TDE protector and a controlled key-rotation test completes without application data exposure.

Evaluate Always Encrypted with secure enclaves and the required hardware, driver and database feature support for the intended computations. That relates to a separate SQL administration problem: An application requires supported computations on encrypted database columns but is deployed with Always Encrypted columns without enclave capability. The Oakridge Public Services requirement is instead: A team wants an administrator who can run queries to be unable to see highly sensitive column values, but proposes only transparent data encryption. That approach does not directly establish the required fix; the requested acceptance evidence is: An authorized application decrypts a test value while a database administrator query sees ciphertext rather than plaintext.

Configure the managed instance's supported private connectivity, name resolution and narrow network security group access. That relates to a separate SQL administration problem: An organization opens all inbound traffic to SQL Managed Instance because internal client DNS and subnet routing were never configured. The Oakridge Public Services requirement is instead: A team wants an administrator who can run queries to be unable to see highly sensitive column values, but proposes only transparent data encryption. That approach does not directly establish the required fix; the requested acceptance evidence is: An authorized application decrypts a test value while a database administrator query sees ciphertext rather than plaintext.

Configure transparent data encryption with an eligible customer-managed key in Azure Key Vault or managed HSM according to the service rules. That relates to a separate SQL administration problem: A regulated Azure SQL Database uses default platform-managed encryption keys but requires customer-controlled key rotation and revocation evidence. The Oakridge Public Services requirement is instead: A team wants an administrator who can run queries to be unable to see highly sensitive column values, but proposes only transparent data encryption. That approach does not directly establish the required fix; the requested acceptance evidence is: An authorized application decrypts a test value while a database administrator query sees ciphertext rather than plaintext.

A test connection negotiates the required TLS channel and a deliberately noncompliant client connection is denied. That result is evidence for another corrective change: Require supported encrypted SQL connections and validate server certificates and client driver encryption settings. The alternative problem is: An application attempts to connect to Azure SQL by unencrypted TDS because it assumes VPN transport replaces all database-layer TLS requirements. The current Oakridge Public Services issue is instead: A team wants an administrator who can run queries to be unable to see highly sensitive column values, but proposes only transparent data encryption. Its decisive acceptance evidence would be: An authorized application decrypts a test value while a database administrator query sees ciphertext rather than plaintext.

The TDE protector becomes operational and a test key rotation completes without key-access or database-availability errors. That result is evidence for another corrective change: Grant the supported least-privilege key permissions or role assignments for the database encryption protector identity. The alternative problem is: A customer-managed TDE deployment points at an Azure Key Vault key but the SQL service identity lacks the required key operations. The current Oakridge Public Services issue is instead: A team wants an administrator who can run queries to be unable to see highly sensitive column values, but proposes only transparent data encryption. Its decisive acceptance evidence would be: An authorized application decrypts a test value while a database administrator query sees ciphertext rather than plaintext.

The database reports the intended TDE protector and a controlled key-rotation test completes without application data exposure. That result is evidence for another corrective change: Configure transparent data encryption with an eligible customer-managed key in Azure Key Vault or managed HSM according to the service rules. The alternative problem is: A regulated Azure SQL Database uses default platform-managed encryption keys but requires customer-controlled key rotation and revocation evidence. The current Oakridge Public Services issue is instead: A team wants an administrator who can run queries to be unable to see highly sensitive column values, but proposes only transparent data encryption. Its decisive acceptance evidence would be: An authorized application decrypts a test value while a database administrator query sees ciphertext rather than plaintext.

Replace broad access with the narrow approved client range or private connectivity and remove expired rules after testing. That relates to a separate SQL administration problem: A team allows the Azure SQL server-wide firewall rule for every address just to support one temporary developer laptop. The Meadowbrook Finance requirement is instead: A team wants an administrator who can run queries to be unable to see highly sensitive column values, but proposes only transparent data encryption. That approach does not directly establish the required fix; the requested acceptance evidence is: An authorized application decrypts a test value while a database administrator query sees ciphertext rather than plaintext.

Configure the managed instance's supported private connectivity, name resolution and narrow network security group access. That relates to a separate SQL administration problem: An organization opens all inbound traffic to SQL Managed Instance because internal client DNS and subnet routing were never configured. The Meadowbrook Finance requirement is instead: A team wants an administrator who can run queries to be unable to see highly sensitive column values, but proposes only transparent data encryption. That approach does not directly establish the required fix; the requested acceptance evidence is: An authorized application decrypts a test value while a database administrator query sees ciphertext rather than plaintext.

Require supported encrypted SQL connections and validate server certificates and client driver encryption settings. That relates to a separate SQL administration problem: An application attempts to connect to Azure SQL by unencrypted TDS because it assumes VPN transport replaces all database-layer TLS requirements. The Meadowbrook Finance requirement is instead: A team wants an administrator who can run queries to be unable to see highly sensitive column values, but proposes only transparent data encryption. That approach does not directly establish the required fix; the requested acceptance evidence is: An authorized application decrypts a test value while a database administrator query sees ciphertext rather than plaintext.

The database reports the intended TDE protector and a controlled key-rotation test completes without application data exposure. That result is evidence for another corrective change: Configure transparent data encryption with an eligible customer-managed key in Azure Key Vault or managed HSM according to the service rules. The alternative problem is: A regulated Azure SQL Database uses default platform-managed encryption keys but requires customer-controlled key rotation and revocation evidence. The current Meadowbrook Finance issue is instead: A team wants an administrator who can run queries to be unable to see highly sensitive column values, but proposes only transparent data encryption. Its decisive acceptance evidence would be: An authorized application decrypts a test value while a database administrator query sees ciphertext rather than plaintext.

The application decrypts through its authorized key store and the configuration repository contains no recoverable master keys. That result is evidence for another corrective change: Move encryption key material to a supported external key store and apply controlled identity access and rotation procedures. The alternative problem is: An application uses Always Encrypted but stores column master key secrets inside the same plaintext application configuration repository. The current Meadowbrook Finance issue is instead: A team wants an administrator who can run queries to be unable to see highly sensitive column values, but proposes only transparent data encryption. Its decisive acceptance evidence would be: An authorized application decrypts a test value while a database administrator query sees ciphertext rather than plaintext.

Only the approved service returns plaintext from the test column and unauthorized SQL readers cannot recover its sensitive values. That result is evidence for another corrective change: Use a suitably governed column or application encryption design with key management and limited decrypt permissions. The alternative problem is: A database stores customer payment tokens in reversible plaintext even though only a small service needs to decrypt selected fields. The current Meadowbrook Finance issue is instead: A team wants an administrator who can run queries to be unable to see highly sensitive column values, but proposes only transparent data encryption. Its decisive acceptance evidence would be: An authorized application decrypts a test value while a database administrator query sees ciphertext rather than plaintext.

Configure the managed instance's supported private connectivity, name resolution and narrow network security group access. That relates to a separate SQL administration problem: An organization opens all inbound traffic to SQL Managed Instance because internal client DNS and subnet routing were never configured. The Meadowbrook Finance requirement is instead: An application requires supported computations on encrypted database columns but is deployed with Always Encrypted columns without enclave capability. That approach does not directly establish the required fix; the requested acceptance evidence is: A supported query performs the approved confidential operation with enclave attestation while plaintext keys remain outside ordinary engine access.

Configure transparent data encryption with an eligible customer-managed key in Azure Key Vault or managed HSM according to the service rules. That relates to a separate SQL administration problem: A regulated Azure SQL Database uses default platform-managed encryption keys but requires customer-controlled key rotation and revocation evidence. The Meadowbrook Finance requirement is instead: An application requires supported computations on encrypted database columns but is deployed with Always Encrypted columns without enclave capability. That approach does not directly establish the required fix; the requested acceptance evidence is: A supported query performs the approved confidential operation with enclave attestation while plaintext keys remain outside ordinary engine access.

Configure the correct private DNS zone linkage or conditional forwarding for the Azure SQL private endpoint hostname. That relates to a separate SQL administration problem: A network migration replaces a database's public hostname with a private endpoint but client DNS still resolves the old public address. The Meadowbrook Finance requirement is instead: An application requires supported computations on encrypted database columns but is deployed with Always Encrypted columns without enclave capability. That approach does not directly establish the required fix; the requested acceptance evidence is: A supported query performs the approved confidential operation with enclave attestation while plaintext keys remain outside ordinary engine access.

An authorized application decrypts a test value while a database administrator query sees ciphertext rather than plaintext. That result is evidence for another corrective change: Use Always Encrypted for suitable columns with keys managed outside the database engine and supported client-side encryption. The alternative problem is: A team wants an administrator who can run queries to be unable to see highly sensitive column values, but proposes only transparent data encryption. The current Meadowbrook Finance issue is instead: An application requires supported computations on encrypted database columns but is deployed with Always Encrypted columns without enclave capability. Its decisive acceptance evidence would be: A supported query performs the approved confidential operation with enclave attestation while plaintext keys remain outside ordinary engine access.

Only the approved service returns plaintext from the test column and unauthorized SQL readers cannot recover its sensitive values. That result is evidence for another corrective change: Use a suitably governed column or application encryption design with key management and limited decrypt permissions. The alternative problem is: A database stores customer payment tokens in reversible plaintext even though only a small service needs to decrypt selected fields. The current Meadowbrook Finance issue is instead: An application requires supported computations on encrypted database columns but is deployed with Always Encrypted columns without enclave capability. Its decisive acceptance evidence would be: A supported query performs the approved confidential operation with enclave attestation while plaintext keys remain outside ordinary engine access.

DNS queries from approved clients resolve the private endpoint address and the SQL login succeeds without public routing. That result is evidence for another corrective change: Configure the correct private DNS zone linkage or conditional forwarding for the Azure SQL private endpoint hostname. The alternative problem is: A network migration replaces a database's public hostname with a private endpoint but client DNS still resolves the old public address. The current Meadowbrook Finance issue is instead: An application requires supported computations on encrypted database columns but is deployed with Always Encrypted columns without enclave capability. Its decisive acceptance evidence would be: A supported query performs the approved confidential operation with enclave attestation while plaintext keys remain outside ordinary engine access.