Question 300
At Lakeside Research, the science data operations team maintains a research experiment and analytics relational database with requirements for reproducible database workloads and protected experimental data. The acceptance review requires independent evidence for: A DBA enables SQL Extended Events with an unfiltered high-volume event collection on production and saturates its monitoring destination. Which observed result BEST proves the intended problem is corrected?
Explanation
Correct Answer
The targeted incident event is captured without excessive event loss, resource pressure or unrelated sensitive payload collection. That observable result supports resolution of: A DBA enables SQL Extended Events with an unfiltered high-volume event collection on production and saturates its monitoring destination. The corresponding corrective change is: Restrict event predicates, event payload and retention to diagnostic requirements and choose a supported target with low overhead. The Lakeside Research reviewer can distinguish demonstrated database behavior from an untested change claim.
Incorrect Answers
The collector still receives required operational observations but a test unauthorized DDL operation by that identity is denied. That result is evidence for another corrective change: Use the minimum supported monitoring permissions and separate observability identities from database administration roles. The alternative problem is: An Azure SQL Database watcher account has excessive permissions because an initial deployment granted full database ownership for simple monitoring. The current Lakeside Research issue is instead: A DBA enables SQL Extended Events with an unfiltered high-volume event collection on production and saturates its monitoring destination. Its decisive acceptance evidence would be: The targeted incident event is captured without excessive event loss, resource pressure or unrelated sensitive payload collection.
Authorized analysts retain the required performance signals while a test reader cannot access customer literals or expired traces. That result is evidence for another corrective change: Limit query and event collection to necessary data, restrict access and apply compliant retention and redaction policies. The alternative problem is: A team stores production query traces indefinitely with customer literals in an unrestricted workspace, exposing sensitive data during incident review. The current Lakeside Research issue is instead: A DBA enables SQL Extended Events with an unfiltered high-volume event collection on production and saturates its monitoring destination. Its decisive acceptance evidence would be: The targeted incident event is captured without excessive event loss, resource pressure or unrelated sensitive payload collection.
A controlled deadlock produces an analysable event file while ordinary Query Store query metrics remain unaffected. That result is evidence for another corrective change: Use an appropriately scoped Extended Events session to capture the needed deadlock or engine diagnostic information safely. The alternative problem is: An operations team assumes Query Store replaces every server-wide Extended Events diagnostic needed for deadlock investigation. The current Lakeside Research issue is instead: A DBA enables SQL Extended Events with an unfiltered high-volume event collection on production and saturates its monitoring destination. Its decisive acceptance evidence would be: The targeted incident event is captured without excessive event loss, resource pressure or unrelated sensitive payload collection.