AZ-120 · Question #271
You have an instance of SAP HANA on Azure (Large Instances). You plan to implement Azure Monitor for SAP Solutions. You need to configure a database user for the SAP HANA provider. The solution must…
The correct answer is D. MONITORING. MONITORING is the correct role because it grants only the read-only permissions needed for Azure Monitor to collect SAP HANA telemetry (system views, performance metrics), perfectly satisfying least privilege without exposing administrative capabilities. Why the others are…
Question
You have an instance of SAP HANA on Azure (Large Instances). You plan to implement Azure Monitor for SAP Solutions. You need to configure a database user for the SAP HANA provider. The solution must use the principle of least privilege. Which role should you assign to the user?
Options
- ARESTRICTED_USER_ODBC_ACCESS
- BCONTENT_ADMIN
- CPUBLIC
- DMONITORING
How the community answered
(13 responses)- C8% (1)
- D92% (12)
Explanation
MONITORING is the correct role because it grants only the read-only permissions needed for Azure Monitor to collect SAP HANA telemetry (system views, performance metrics), perfectly satisfying least privilege without exposing administrative capabilities.
Why the others are wrong:
- RESTRICTED_USER_ODBC_ACCESS (A) limits connectivity protocols but doesn't grant the monitoring-specific read permissions Azure Monitor requires.
- CONTENT_ADMIN (B) is an elevated role for managing information models and content - far more privilege than monitoring needs.
- PUBLIC (C) is the baseline role assigned to every user by default; it lacks the specific system-view access required for SAP HANA monitoring data collection.
Memory tip: Think "match the name to the job" - Azure Monitor needs to monitor, so assign the MONITORING role. Any role with broader names like "ADMIN" or "PUBLIC" should raise a least-privilege red flag on exam day.
Topics
Community Discussion
No community discussion yet for this question.