70-465 Question #100: Real Exam Question with Answer & Explanation

Question

You administer a Microsoft SQL Server 2012 database that has multiple tables in the Sales schema. Some users must be prevented from deleting records in any of the tables in the Sales schema. You need to manage users who are prevented from deleting records in the Sales schema. You need to achieve this goal by using the minimum amount of administrative effort. What should you do?

Options

• ACreate a custom database role that includes the users.
• BInclude the Sales schema as an owned schema for the db_denydatawriter role.
• CDeny Delete permissions on each table in the Sales schema for each user.
• DCreate a custom database role that includes the users.

Explanation

To prevent users from deleting records in all tables within the Sales schema with minimal effort, a custom database role should be created to manage permissions.

Common mistakes.

• B. Including a schema as an owned schema for the db_denydatawriter role is not the correct mechanism to selectively deny only DELETE permissions, as db_denydatawriter broadly denies INSERT, UPDATE, and DELETE permissions on all user tables in the database.
• C. Denying Delete permissions on each individual table for each individual user is highly inefficient and administratively intensive, failing to meet the requirement for minimum administrative effort.
• D. This choice is a duplicate of Choice A, which describes the correct approach to managing permissions efficiently using a custom database role.

Concept tested. SQL Server Schema-level Permissions and Database Roles

Reference. https://learn.microsoft.com/en-us/sql/relational-databases/security/securables

No community discussion yet for this question.