I know, you guys are thinking that why we require DDL Trigger to track database changes in SQL Server.

SQL Server already has Changed Data Capture (CDC) and Audit option.
When we are talking about DDL Trigger, compare to other automated process this manual process is still preferred by SQL DBA because It is easy to use and manage.

A Database Administrator is also responsible for all different types of Database Security like: Database / Schema / Object level permission, Tracking object creation.

I have enabled SQL Server Audit for one of our production report server, but some time It does not work as per the expectation.

I have searched the alternate solution and found that we can create DDL trigger on a database to track the DDL operation of different objects.
We can also use DDL triggers to verify the result of SQL Server Audit.

Other take care points of DDL Trigger are:

Only SA or Admin user has to perform this stuff. The DBA should restrict other common database user to view or modify the DDL trigger.

It should be encrypted.

If our database is heavily loaded with tons of transaction, we should not create any type of DDL trigger on it.

Here, I am creating one encrypted DDL Trigger which tracks different types of object like:
Stored Procedure, Table, View, Function, Trigger, Sequence, Index.

Step to create Encrypted DDL Trigger:

First Create separate database:

CREATE DATABASE [DDLChanges]
GO

Create one table which will hold all event information:

CREATE TABLE [DDLChanges].[dbo].[tbl_TrackDDLChanges](
	[EventDate] [datetime] NOT NULL DEFAULT (getdate()),
	[EventType] [nvarchar](64) NULL,
	[EventDDL] [nvarchar](max) NULL,
	[LoginName] [nvarchar](255) NULL,
	[DatabaseName] [nvarchar](255) NULL,
	[SchemaName] [nvarchar](255) NULL,
	[ObjectName] [nvarchar](255) NULL,
	[HostName] [varchar](64) NULL,
	[IPAddress] [varchar](32) NULL,
	[ProgramName] [nvarchar](255) NULL,
	[EventXML] [xml] NULL
)
GO

SELECT your application Database and create below encrypted DDL trigger:

If you require to enable DDL trigger on multiple database, execute DDL trigger one by one on each require a database.

Please do not create a DDL Trigger on [DDLChanges] database, that we have created in the first step which is for tracking purposes.

Now, perform any DDL action on your database and check [DDLChanges].[dbo].[tbl_TrackDDLChanges] table where you can find important information like: which SQL Query, who created, which host, what time, on which database and other.

CREATE TRIGGER [trg_DDL_Changes]
ON DATABASE
WITH ENCRYPTION
FOR 
	CREATE_PROCEDURE
	,ALTER_PROCEDURE
	,DROP_PROCEDURE
	,CREATE_TABLE
	,ALTER_TABLE
	,DROP_TABLE
	,CREATE_VIEW
	,ALTER_VIEW
	,DROP_VIEW
	,CREATE_FUNCTION
	,ALTER_FUNCTION
	,DROP_FUNCTION
	,CREATE_TRIGGER
	,ALTER_TRIGGER
	,DROP_TRIGGER
	,CREATE_SEQUENCE
	,ALTER_SEQUENCE
	,DROP_SEQUENCE
	,CREATE_INDEX
	,ALTER_INDEX
	,DROP_INDEX
AS
BEGIN
    SET NOCOUNT ON;
    DECLARE
        @EventData XML = EVENTDATA(); 
    DECLARE 
        @ip VARCHAR(32) =
        (
            SELECT client_net_address
            FROM sys.dm_exec_connections
            WHERE session_id = @@SPID
        );
 
    INSERT DDLChanges.dbo.tbl_TrackDDLChanges
    (
        EventType
        ,EventDDL
	,LoginName        
        ,DatabaseName
        ,SchemaName
        ,ObjectName
        ,HostName
        ,IPAddress
        ,ProgramName        
	,EventXML
    )
    SELECT
        @EventData.value('(/EVENT_INSTANCE/EventType)[1]','NVARCHAR(100)')
        ,@EventData.value('(/EVENT_INSTANCE/TSQLCommand)[1]','NVARCHAR(MAX)')
	,SUSER_SNAME()        
        ,DB_NAME()
        ,@EventData.value('(/EVENT_INSTANCE/SchemaName)[1]','NVARCHAR(255)')
        ,@EventData.value('(/EVENT_INSTANCE/ObjectName)[1]','NVARCHAR(255)')
        ,HOST_NAME()
        ,@ip
        ,PROGRAM_NAME()        
	,@EventData
END
GO

How do you grant a SQL Server developer truncate table permission without giving them the ability to alter the table?

This is accomplished by a DBA creating a stored procedure with the TRUNCATE TABLE statements and then granting execute permission on the stored procedure to those who need it.

I have a table where some of the columns should not be queryable by all users. How can I filter the data appropriately, so that not everyone can select the data?

One of the easiest ways to do this is through the use of views.

If we can use a view, we can successfully filter the data and grant the users access to the view, we can present just the data we want the users to have access to.

however, there are two requirements for this:

• The users do not already have the ability to select data from the table.
• A view can be created where an ownership chain can be established with the table.

How to grant only few columns without creating views?

We can assign column list to table.

GRANT SELECT ON dbo.Employee (EmployeeID, FirstName, MiddleName, SurName) TO HR_Intern;

I can create Stored Procedure, but However, when I went to execute the stored procedure, SQL Server told me I didn’t have permission to do so. Is this a bug or did I do something wrong?

This is entirely possible if you have the ability to create a stored procedure in a schema you don’t own.

In this particular case we’ve created a role that has the ability to create stored procedures in the database and the ability to alter the dbo schema. By default, the dbo schema is owned by the database owner.

What do you know about the SQL Server 2016 Row Level Security?

SQL Server 2016 has introduced Row Level Security (RLS) which is a feature that enables fine grained control over access to rows in a table. RLS allows you to easily control which users can access which data with complete transparency to the application.This enables us to easily restrict the data based on the user identity or security context.

Row-Level Security enables customers to control access to rows in a database table based on the characteristics of the user executing a query.

Which are the different predicates support by Row Level Security?

RLS supports two types of security predicates.

Filter predicates silently filter the rows available to read operations (SELECT, UPDATE, and DELETE).

Block predicates explicitly block write operations (AFTER INSERT, AFTER UPDATE, BEFORE UPDATE, BEFORE DELETE) that violate the predicate.

What do you know about the Dynamic Data Masking?

Dynamic data masking limits sensitive data exposure by masking it to non-privileged users. Dynamic data masking helps prevent unauthorized access to sensitive data by enabling customers to designate how much of the sensitive data to reveal with minimal impact on the application layer. It’s a data protection feature that hides the sensitive data in the result set of a query over designated database fields, while the data in the database is not changed.

For example, a call center support person may identify callers by several digits of their social security number or credit card number, but those data items should not be fully exposed to the support person. A masking rule can be defined that masks all but the last four digits of any social security number or credit card number in the result set of any query.

What should be the characteristics for strong password?

• Is at least 8 characters long.
• Combines letters, numbers, and symbol characters within the password.
• Is not found in a dictionary.
• Is not the name of a command.
• Is not the name of a person.
• Is not the name of a user.
• Is not the name of a computer.
• Is changed regularly.
• Is significantly different from previous passwords.

How SQL Injection Works?

The primary form of SQL injection consists of direct insertion of code into user-input variables that are concatenated with SQL commands and executed. A less direct attack injects malicious code into strings that are destined for storage in a table or as metadata. When the stored strings are subsequently concatenated into a dynamic SQL command, the malicious code is executed.

The injection process works by prematurely terminating a text string and appending a new command. Because the inserted command may have additional strings appended to it before it is executed, the malefactor terminates the injected string with a comment mark “–“. Subsequent text is ignored at execution time.

What are your best practices to avoid SQL Injection?

• Validate all input.
• Use Type-Safe SQL Parameters.
• Use Parameterized Input with Stored Procedures.
• Wrapping Parameters with QUOTENAME() and REPLACE().
• Use the Parameters Collection with Dynamic SQL.

How Do You Determine What Data Are Confidential?

• We should to contact our legal department (if there is one), an attorney, or law professor, if in doubt about data.
• Ask about, What type of data should we be extra cautious about?
• Ask government officials or look at government websites on the industry we are in.
• We should think like a hacker.

Have you seen any performance hit using SQL Server Transparent Data Encryption (TDE)?

Given that you are performing more operations, there is some. One advantage to TDE is that the data is only encrypted in disk. So if it’s in SQL Server’s memory buffers, there’s no repeated decryption going on.

Any concerns about the SQL Server public database role?

Yes, the general recommendation is to avoid using the public role. Every database user is a member of public. As a result, any permissions assigned to it are also assigned to every database user.

What do you use to avoid the SQL Server fixed server roles?

The recommended practice is to create a role and assign explicit permissions.

A developer wants to execute a SQL Server stored procedure in debug mode. I believe SQL Server sysadmin level access required to use debug mode. I don’t want to give sysadmin access to the developer. Is there any I can handle this without giving sysadmin access?

Unfortunately, there is not. Debugging requires sysadmin role membership.

Is it possible to grant linked server permissions to Windows user group?

Yes: A Windows group is no different from any other login.

T-SQL Script to find mismatched between Database Login and Server Login.

SELECT d.[name] AS 'DB User', s.[name] AS 'Login', s.sid AS 'SID'
FROM sys.database_principals d
 JOIN sys.server_principals s
 ON d.sid = s.sid
WHERE d.[name] <> s.[name];

What is the main hierarchy of Permissions?
Please visit this Microsoft official documents:

What should be your common practice for SQL Server Security?

• SQL Server should be hardened after the installation.
• After the installation, use the SQL Server Configuration Manager tool in order to disable unnecessary features and services.
• Install only required components.
• Recent service packs and critical fixes should be installed for SQL Server and Windows.
• Windows Authentication mode is more secure than SQL Authentication.
• If there is still a need to use SQL Authentication – enforce strong password policy.
• Disable the SA account and rename it. Do not use this account for SQL server management.
• Change default SQL Server ports associated with the SQL Server installation to keep hackers from port scanning the server.
• Hide SQL Server instances or disable the SQL Server Browser service.
• Remove BUILDIN\Administrators group from the SQL Server Logins.
• Enable logging SQL Server login attempts (failed & successful).
• Defining Database Ownership to Increase Security.
• Disabling certain system stored procedures.

What do you know about the SQL Server Audit?

SQL Server Audit is used to track and log events (not data change) occurring on the SQL Server. SQL Server uses extended events to help create an audit. The audit can be server level or database level.

If you create an audit on a database table, SQL Server will only track the events that trigger the certain operations (SELECT/INSERT/UPDATE/DELETE) defined in the database audit specification.

What options are available to audit login activity?

• Custom solution with your application to log all logins into a centralized table
• Enable login auditing at the instance level in Management Studio
• Execute Profiler to capture logins into the instance
• Leverage a third party product

What is Audit in SQL Server?

Auditing an instance of the SQL Server Database Engine or an individual database involves tracking and logging events that occur on the Database Engine.

What is Server level Audit specification?

You can create one server audit specification per audit.

The server audit specification collects many server-level action groups raised by the Extended Events feature. You can include audit action groups in a server audit specification. Audit action groups are predefined groups of actions, which are atomic events occurring in the Database Engine.

What is Database level Audit specification?

You can create one database audit specification per SQL Server database per audit.

The database audit specification collects database-level audit actions raised by the Extended Events feature. You can add either audit action groups or audit events to a database audit specification.

Is it good to enable Audit only for SQL Server Login fails?

Yes:

Database administrators should enable login auditing feature of SQL Server on all instances which they manage. Once this feature is enabled SQL Server will write all the failed and successful login information in SQL Server Error Logs. It is always a best practice to auditing failed SQL Server logins.

Does SQL Server Audit require any additional permission?

Yes:

Each feature and command for SQL Server Audit has individual permission requirements.

Should we encrypt the SQL Server datatabase backups?

Yes:

We need to make sure the database backups are encrypted to avoid the misuse.

Why we should not use tha SA login for all the different SQL Server access?

Because, the sa login and password to all of your SQL Servers because auditing the sa login with a shared password is difficult without capturing the host name or some other personally identifiable data. We should migrate all SQL Server authentication to Windows based authentication.

Can I stop a System Admin from enabling SQL Server xp_cmdshell?

No:

T-SQL script to disable the SA login

ALTER LOGIN sa DISABLE;

T-SQL script to rename the SQ login.

ALTER LOGIN sa WITH NAME = [dbrnd_user];

Please do auto reset the SA password and disable it.

SQL Server has an undocumented system stored procedure named sp_SetAutoSAPasswordAndDisable. This procedure will do exactly as the name suggests: it will reset the password and then disable the ‘sa’ login.

EXEC sp_SetAutoSAPasswordAndDisable
GO

SELECT name,type_desc,create_date,modify_date,password_hash 
FROM sys.sql_logins 
WHERE PWDCOMPARE('mssqltips',password_hash)=1;

SELECT name,type_desc,create_date,modify_date,password_hash 
FROM sys.sql_logins 
WHERE PWDCOMPARE('',password_hash)=1;

SELECT name,type_desc,create_date,modify_date,password_hash 
FROM sys.sql_logins 
WHERE PWDCOMPARE(name,password_hash)=1;

GRANT:gives a user permission to perform certain tasks on database objects.
DENY:denies any access to a user to perform certain tasks on database objects.
REVOKE:removes a grant or deny permission from a user on certain database objects.

Sample T-SQL scripts for GRANT, DENY and REVOKE.

GRANT INSERT, UPDATE, SELECT ON Customers TO Joe, Mary;
DENY DELETE ON Customers to Joe, Mary;
REVOKE UPDATE ON Customers to Joe;

In our organization we have two teams that stored encrypted data in Microsoft SQL Server. The data is encrypted using symmetric keys and those keys are encrypted with passwords. However, we have a director who needs to be able to see the data for both teams, but we’d like it so that he only has to remember one password, preferably separate from the passwords used by the two teams. Is that possible?

Yes, it is. Microsoft SQL Server supports the ability for encryption keys to be encrypted via multiple mechanisms. For instance, a symmetric key can be encrypted with a password and an asymmetric key. If you have access to the symmetric key and at least one of those mechanisms, you can open the key.

What is hash function?

A hash function takes in data and returns back a fixed length block of bits such that any change to the data should result in a different block.

What do you know about the HASHBYTES()?

HASHBYTES(), as the name implies, is a function or algorithm that generates a hash from some input.

Which are the different hashing algorithms?

MD2, MD4, MD5, SHA-0, SHA-1, SHA-2

What is the main limitation of hasing function?

Since a hash function will return a fixed length block, obviously, there are a finite set of possibilities for the output. Therefore, there’s bound to be different inputs that will result in the same output. We call these situations collisions. What is of concern is if a collision can be engineered fairly quickly/cheaply. This is referred to as a collision attack.

What do you know about the Symmetric Encryption Algorithm?

This algorithm either take unencrypted data and return encrypted data, or they take encrypted data and return unencrypted data. In order to do so, they use a key, and the key is the same regardless of which direction you go. When it comes to encryption algorithms, symmetric encryption algorithms are substantially faster than asymmetric algorithms.

What are the different type of Symmetric Encryption Algorithms?

• DES (DES)
• Triple DES with 128 bit key (TRIPLE_DES)
• Triple DES with 192 bit key (DESX)
• RC2 (RC2)
• RC4 (RC4)
• RC4 with 128 bit key (RC4_128)
• AES with 128 bit key (AES_128)
• AES with 192 bit key (AES_192)
• AES with 256 bit key (AES_256)

What is your common practice with account SA?

• Set a hard to guess password.
• Rename sa.
• Disable sa.
• Ensure that no other accounts exist named sa.

A user asked how they could get an alert whenever a login failed due to the account being locked out?

• A SQL Server Agent alert, using the WMI event AUDIT_LOGIN_FAILED
• Event Notifications, also using AUDIT_LOGIN_FAILED
• Manually consuming the error log

How to hide your SQL Server code?

The WITH ENCRYPTION clause is used to encrypt the definition of SQL Server objects (views, stored procedures, functions ), so that no one may be able to view the definition/code of that specific object. Using the clause while creating an object is fairly easy.

What is the main disadvantage of WITH ENCRYPTION option to hide the SQL Server code?

The definition/code of object will not be available to anyone regardless of their permissions or access level. You can not customize the permissions for code/definition visibility.

Once an object has been created on the server using the WITH ENCRYPTION option, there is no standard method provided to get the definition/code back out of the encrypted object. You will need to keep a copy of the code outside of SQL Server.

What is the alternative of WITH ENCRYPTION oprtion to secure the SQL Server code?

The simple alternative is to granting or revoking View Definition rights.

If permission View Definition is denied for an object to any user then the user would not be able to view the object in SSMS or view.

What is a Salt?

It is basically something added to whatever we’re trying to encrypt to make it harder to decrypt the data (two way functions, like symmetric and asymmetric key functions) or find a collision (one way functions, AKA hash functions). The salt should be potentially different for every single piece of encrypted data. The salt should be randomly generated.

What will you do if you lost rights of your SQL Server instance?

• Dedicated Administrator Connection
• BUILIN\Administrator Group (Incase its rights are not revoked)
• Final Option is to change the registry value
• You can change authentication mode via registry

What is the difference between sysadmin and serveradmin server role?

sysadmin: Members of the sysadmin fixed server role can perform any activity in the server.

serveradmin: Members of the serveradmin fixed server role can change server-wide configuration options and shut down the server.

How to check SA login related information?

USE Master
GO
SELECT sid, [name], createdate, updatedate
FROM master.dbo.syslogins
WHERE [name] = 'sa'
GO

What do you know about the Change Data Capture (CDC)?

Change Data Capture (CDC) is used to track the changed data caused by common DML operations (INSERT/UPDATE/DEKLETE). The capture process reads the transaction log to pull out the data change information and then load the information into the associated change table.

How to disable change data capture (CDC) on a table?

USE Your_Database_Name
GO
EXEC sys.sp_cdc_disable_table
@source_schema = N'dbo',
@source_name = N'YourTableName',
@capture_instance = N'dbo_YourTableName'
GO

How to check if Change Data Capture is enabled or disabled on a SQL Server Database?

SELECT [name], is_cdc_enabled
FROM sys.databases where name = 'Database_Name'
/*
is_cdc_enabled = 0 -- CDC is disabled
is_cdc_enabled = 1 -- CDC is enabled
*/

How to Restore Database On Which Change Data Capture (CDC) Is Enabled?

When we restore a database from a CDC enabled database backup, it does not restore the CDC object automatically. Also if you try to look for some options for Restore with CDC object etc. in Database Restore Wizard, you would not find anything.

If we restore the database on the same SQL Server instance with same name, CDC objects will be restored and it will start working fine as CDC jobs are available on the server already.

If you try to restore with a different name or restore to different SQL Server instance, It will not restore CDC objects by default. In Restore Database statement, we have to include Keep_CDC.

What is the Guest user account in SQL Server?  What login is it mapped to it?

The Guest user account is created by default in all databases and is used when explicit permissions are not granted to access an object.  It is not mapped directly to any login, but can be used by any login.

How can SQL Server instances be hidden?

To hide a SQL Server instance, we need to make a change in SQL Server Configuration Manager. To do this launch SQL Server Configuration Manager and do the following: select the instance of SQL Server, right click and select Properties.

After selecting properties you will just set Hide Instance to “Yes” and click OK or Apply. After the change is made, you need to restart the instance of SQL Server to not expose the name of the instance.

Is it possible to disable SA, how?

Disable the SA Login

Disabling the SA account is a good option to prevent its use. When it is disabled no one can use it in any circumstance until it is enabled.

What is the difference between Authenticate and Authorization?

When you log on to a PC with a user name and password you are authenticating. Authorization is the process of verifying that you have access to something. Gaining access to a resource (e.g. directory on a hard disk) because the permissions configured on it allow you access is authorization.

Which one is highest privileged role out of SQLAgentUserRole, SQLAgentReaderRole, SQLAgentOperatorRole?

SQLAgentOperatorRole is the most privileged of the SQL Server Agent fixed database roles. It includes all the permissions of SQLAgentUserRole andSQLAgentReaderRole. Members of this role can also view properties for operators and proxies, and enumerate available proxies and alerts on the server.

What is the password policy for SQL Server Accounts?

• The password must contain uppercase & lowercase letters.
• The password must contain numbers & alphanumeric characters.
• The password must contain non-alphanumeric characters such as &, ^,%,*,$ etc.
• Do not use common known passwords that are easy to guess such as: admin, password, sa, administrator, sysadmin etc.
• Passwords should be long enough (at least 8 characters long).
• It does not allows blank password for the SA account.

What are the disadvantages of SQL Server Authentication Mode?

If a user is a Windows domain user who has a login and password for Windows, he must still provide another (SQL Server) login and password to connect. Keeping track of multiple names and passwords is difficult for many users. Having to provide SQL Server credentials every time that one connects to the database can be annoying.

SQL Server Authentication cannot use Kerberos security protocol.

Windows offers additional password policies that are not available for SQL Server logins.

The encrypted SQL Server Authentication login password, must be passed over the network at the time of the connection. Some applications that connect automatically will store the password at the client. These are additional attack points.

When CHECK_POLICY is ON, what kind of behavior occur?

CHECK_EXPIRATION is also set to ON unless it is explicitly set to OFF.

The password history is initialized with the value of the current password hash.

Account lockout duration, account lockout threshold, and reset account lockout counter after are also enabled.

What is What is TRUSTWORTHY database?

Applies To: SQL Server 2016.

The TRUSTWORTHY database property is used to indicate whether the instance of SQL Server trusts the database and the contents within it. By default, this setting is OFF, but can be set to ON by using the ALTER DATABASE statement.

This property can be used to reduce certain threats that can exist as a result of attaching a database.

Where are the places that I should not use the sa login?

• Embedded in management tools or application development tools
• Hard coded in application connection strings
• DTS or SSIS connection objects
• UDL files
• Batch files
• SQLCMD, OSQL or ISQL T-SQL scripts
• In casual conversation
• On sticky notes on your desk or monitor

What is the use of BUILTIN\Administrators Group in SQL Server?

Any Windows login in BUILTIN\Administrators group is by default a SQL Server system administrator. This single group can be used to manage administrators from a Windows and SQL Server perspective.

How to detect Orphaned Users in SQL Server?

SELECT dp.type_desc, dp.SID, dp.name AS user_name
FROM sys.database_principals AS dp
LEFT JOIN sys.server_principals AS sp
ON dp.SID = sp.SID
WHERE sp.SID IS NULL
AND authentication_type_desc = 'INSTANCE';