nerdexam
Microsoft

70-465 · Question #100

You administer a Microsoft SQL Server 2012 database that has multiple tables in the Sales schema. Some users must be prevented from deleting records in any of the tables in the Sales schema. You…

The correct answer is A. Create a custom database role that includes the users. To prevent users from deleting records in all tables within the Sales schema with minimal effort, a custom database role should be created to manage permissions.

Submitted by rachelw· Mar 5, 2026Design database security solutions

Question

You administer a Microsoft SQL Server 2012 database that has multiple tables in the Sales schema. Some users must be prevented from deleting records in any of the tables in the Sales schema. You need to manage users who are prevented from deleting records in the Sales schema. You need to achieve this goal by using the minimum amount of administrative effort. What should you do?

Options

  • ACreate a custom database role that includes the users.
  • BInclude the Sales schema as an owned schema for the db_denydatawriter role.
  • CDeny Delete permissions on each table in the Sales schema for each user.
  • DCreate a custom database role that includes the users.

How the community answered

(20 responses)
  • A
    75% (15)
  • B
    5% (1)
  • C
    5% (1)
  • D
    15% (3)

Why each option

To prevent users from deleting records in all tables within the Sales schema with minimal effort, a custom database role should be created to manage permissions.

ACreate a custom database role that includes the users.Correct

Creating a custom database role allows grouping users who require the same permissions, and then denying the DELETE permission on the entire 'Sales' schema to this role. This efficiently applies the restriction to all current and future tables within that schema for all role members, minimizing administrative overhead.

BInclude the Sales schema as an owned schema for the db_denydatawriter role.

Including a schema as an owned schema for the `db_denydatawriter` role is not the correct mechanism to selectively deny only DELETE permissions, as `db_denydatawriter` broadly denies INSERT, UPDATE, and DELETE permissions on all user tables in the database.

CDeny Delete permissions on each table in the Sales schema for each user.

Denying Delete permissions on each individual table for each individual user is highly inefficient and administratively intensive, failing to meet the requirement for minimum administrative effort.

DCreate a custom database role that includes the users.

This choice is a duplicate of Choice A, which describes the correct approach to managing permissions efficiently using a custom database role.

Concept tested: SQL Server Schema-level Permissions and Database Roles

Source: https://learn.microsoft.com/en-us/sql/relational-databases/security/securables

Topics

#Database roles#Permissions management#Schema permissions#SQL Server security

Community Discussion

No community discussion yet for this question.

Full 70-465 Practice