nerdexam
Microsoft

70-465 · Question #103

You are the lead database administrator (DBA) of a Microsoft SQL Server 2012 environment. All DBAs are members of the DOMAIN\JrDBAs Active Directory group. You grant DOMAIN\JrDBAs access to the SQL…

The correct answer is B. ALTER SERVER ROLE [SpecialDBARole] ADD MEMBER [DOMAIN\JrDBAs]; C. CREATE SERVER ROLE [SpecialDBARole] AUTHORIZATION securityadmin; F. GRANT VIEW SERVER STATE, VIEW ANY DATABASE TO [SpecialDBARole]. This question tests the ability to create a least-privilege server role in SQL Server 2012 that can view databases, view server state, and manage login permissions. The correct approach uses securityadmin authorization and explicit permission grants.

Submitted by salim_om· Mar 5, 2026Design database security solutions

Question

You are the lead database administrator (DBA) of a Microsoft SQL Server 2012 environment. All DBAs are members of the DOMAIN\JrDBAs Active Directory group. You grant DOMAIN\JrDBAs access to the SQL Server. You need to create a server role named SpecialDBARole that can perform the following functions: - View all databases. - View the server state. - Assign GRANT, DENY, and REVOKE permissions on logins. You need to add DOMAIN\JrDBAs to the server role. You also need to provide the least level of privileges necessary. Which SQL statement or statements should you use? Choose all that apply.

Options

  • ACREATE SERVER ROLE [SpecialDBARole] AUTHORIZATION setupadmin;
  • BALTER SERVER ROLE [SpecialDBARole] ADD MEMBER [DOMAIN\JrDBAs];
  • CCREATE SERVER ROLE [SpecialDBARole] AUTHORIZATION securityadmin;
  • DGRANT VIEW DEFINITION TO [SpecialDBARole];
  • ECREATE SERVER ROLE [SpecialDBARole] AUTHORIZATION serveradmin;
  • FGRANT VIEW SERVER STATE, VIEW ANY DATABASE TO [SpecialDBARole];

How the community answered

(44 responses)
  • A
    30% (13)
  • B
    45% (20)
  • D
    9% (4)
  • E
    16% (7)

Why each option

This question tests the ability to create a least-privilege server role in SQL Server 2012 that can view databases, view server state, and manage login permissions. The correct approach uses securityadmin authorization and explicit permission grants.

ACREATE SERVER ROLE [SpecialDBARole] AUTHORIZATION setupadmin;

AUTHORIZATION setupadmin is incorrect because setupadmin is the fixed server role for managing linked servers, not for managing login permissions, making it an inappropriate and irrelevant owner for this role.

BALTER SERVER ROLE [SpecialDBARole] ADD MEMBER [DOMAIN\JrDBAs];Correct

ALTER SERVER ROLE [SpecialDBARole] ADD MEMBER [DOMAIN\JrDBAs] is the correct T-SQL syntax to add an existing login or group as a member of a user-defined server role in SQL Server 2012.

CCREATE SERVER ROLE [SpecialDBARole] AUTHORIZATION securityadmin;Correct

CREATE SERVER ROLE [SpecialDBARole] AUTHORIZATION securityadmin is correct because securityadmin is the fixed server role that owns permissions to manage logins, including GRANT, DENY, and REVOKE on logins, making it the appropriate and least-privilege owner for a role requiring login permission management.

DGRANT VIEW DEFINITION TO [SpecialDBARole];

GRANT VIEW DEFINITION TO [SpecialDBARole] grants the ability to view metadata of objects like stored procedures and views, but does not fulfill any of the three required permissions (view databases, view server state, or manage login permissions).

ECREATE SERVER ROLE [SpecialDBARole] AUTHORIZATION serveradmin;

AUTHORIZATION serveradmin is incorrect because serveradmin is a highly privileged fixed server role with broad administrative capabilities such as shutting down the server, which violates the least-privilege requirement and is unrelated to managing login permissions.

FGRANT VIEW SERVER STATE, VIEW ANY DATABASE TO [SpecialDBARole];Correct

GRANT VIEW SERVER STATE, VIEW ANY DATABASE TO [SpecialDBARole] directly satisfies two of the three requirements - viewing server state and viewing all databases - as granular, least-privilege permissions granted explicitly to the custom role without granting broader fixed server role memberships.

Concept tested: Creating least-privilege custom server roles in SQL Server

Source: https://learn.microsoft.com/en-us/sql/relational-databases/security/authentication-access/server-level-roles?view=sql-server-2017

Topics

#Server roles#Permissions#Least privilege#SQL Server security#T-SQL security

Community Discussion

No community discussion yet for this question.

Full 70-465 Practice