• quote:


    - In normal conversation, we don't talk about what rights the guest user has in master and msdb and tempdb when we're talking about what rights a particular login has ... Therefore, this login that I'm using has no explicit rights assigned to it. Again, it's really all wrapped up in the semantics. But consider it from this perspective: if you have a junior DBA and you need to get across to him who has access to @@VERSION, how are you going to explain it? If he/she doesn't have a lot of experience, you're probably just going to say, "If someone has a login to SQL Server, that someone can run SELECT @@VERSION."


    But the point is that semantics work both ways. I have three questions:

    1. What difference does it make if the rights are explicit? The user still requires them.

    2. How do you know how I would explain this to my junior DBAs? The fact is that I'm a verbose trainer and author <g> and I am a big believer in teaching somebody "how to fish." I think there's actually a very good chance that, if my junior staff asked about this, I would give a brief but fairly complete answer. I do *not* like to give people blow-off answers like "oh, it just magically works for anybody who can login." Why act like it's entirely outside the normal security model when it's really not? I mean, the fact that you can't REVOKE or DENY is different than the "normal" model, but the fact that GUEST access enables this is totally standard security stuff, and it is something I want all my DBAs to know.

    3. This one is most important: why do I either have to act like a "junior DBA" or be telepathic enough to guess the outcome of all these semantic points just to answer a simple question like this? The point is that the question does *not* reliably differentiate between a knowledgable DBA and a rookie, not because of the semantics, but because of wording that is not clear enough.

    Not to sound cocky, but I have a substantial background both in psychometrics (which involves, among other things, making sure tests are measuring what they say they are measuring) and exam writing (I've written or helped write about a dozen certification exams). Your points about normal conversation might carry more weight with me if we were talking about normal conversation, but I think most people regard this like a certification question - and on certification exams, you have to read every word carefully. Problem is, the words on this question were not put together carefully enough. You may disagree, but I don't see why. This one's no good. Throw it out.

    Edited by - chrisleonard on 07/14/2003 5:38:58 PM