70-465 · Question #103
You are the lead database administrator (DBA) of a Microsoft SQL Server 2012 environment. All DBAs are members of the DOMAIN\JrDBAs Active Directory group. You grant DOMAIN\JrDBAs access to the SQL…
The correct answer is B. ALTER SERVER ROLE [SpecialDBARole] ADD MEMBER [DOMAIN\JrDBAs]; C. CREATE SERVER ROLE [SpecialDBARole] AUTHORIZATION securityadmin; F. GRANT VIEW SERVER STATE, VIEW ANY DATABASE TO [SpecialDBARole]. This question tests the ability to create a least-privilege server role in SQL Server 2012 that can view databases, view server state, and manage login permissions. The correct approach uses securityadmin authorization and explicit permission grants.
Question
Options
- ACREATE SERVER ROLE [SpecialDBARole] AUTHORIZATION setupadmin;
- BALTER SERVER ROLE [SpecialDBARole] ADD MEMBER [DOMAIN\JrDBAs];
- CCREATE SERVER ROLE [SpecialDBARole] AUTHORIZATION securityadmin;
- DGRANT VIEW DEFINITION TO [SpecialDBARole];
- ECREATE SERVER ROLE [SpecialDBARole] AUTHORIZATION serveradmin;
- FGRANT VIEW SERVER STATE, VIEW ANY DATABASE TO [SpecialDBARole];
How the community answered
(44 responses)- A30% (13)
- B45% (20)
- D9% (4)
- E16% (7)
Why each option
This question tests the ability to create a least-privilege server role in SQL Server 2012 that can view databases, view server state, and manage login permissions. The correct approach uses securityadmin authorization and explicit permission grants.
AUTHORIZATION setupadmin is incorrect because setupadmin is the fixed server role for managing linked servers, not for managing login permissions, making it an inappropriate and irrelevant owner for this role.
ALTER SERVER ROLE [SpecialDBARole] ADD MEMBER [DOMAIN\JrDBAs] is the correct T-SQL syntax to add an existing login or group as a member of a user-defined server role in SQL Server 2012.
CREATE SERVER ROLE [SpecialDBARole] AUTHORIZATION securityadmin is correct because securityadmin is the fixed server role that owns permissions to manage logins, including GRANT, DENY, and REVOKE on logins, making it the appropriate and least-privilege owner for a role requiring login permission management.
GRANT VIEW DEFINITION TO [SpecialDBARole] grants the ability to view metadata of objects like stored procedures and views, but does not fulfill any of the three required permissions (view databases, view server state, or manage login permissions).
AUTHORIZATION serveradmin is incorrect because serveradmin is a highly privileged fixed server role with broad administrative capabilities such as shutting down the server, which violates the least-privilege requirement and is unrelated to managing login permissions.
GRANT VIEW SERVER STATE, VIEW ANY DATABASE TO [SpecialDBARole] directly satisfies two of the three requirements - viewing server state and viewing all databases - as granular, least-privilege permissions granted explicitly to the custom role without granting broader fixed server role memberships.
Concept tested: Creating least-privilege custom server roles in SQL Server
Source: https://learn.microsoft.com/en-us/sql/relational-databases/security/authentication-access/server-level-roles?view=sql-server-2017
Topics
Community Discussion
No community discussion yet for this question.