Which permission should you grant?

You are the database administrator for a company that hosts Microsoft SQL Server. You manage both onpremisesand Microsoft Azure SQL Database environments.

You plan to delegate encryption operations to a user.

You need to grant the user permission to implement cell-level encryption while following the principle of leastprivilege.

Which permission should you grant?
A . DDLAdmin
B . db_datawriter
C . dbcreator
D . dbo
E . View Database State
F . View ServerState
G . View Definition
H . sysadmin

View Answer

Answer: G

Explanation:

The following permissions are necessary to perform column-level encryption, or cell-level encryption.

CONTROL permission on the database.

CREATE CERTIFICATE permission on the database. Only Windows logins, SQL Server logins, andapplication roles can own certificates. Groups and roles cannot own certificates.

ALTER permission on the table.

Some permission on the key and must not have been denied VIEW DEFINITION permission.

References: https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/encrypt-a-columnof-data