You administer a Windows Azure SQL Database database named Human_Resources. The database contains
2 tables named Employees and SalaryDetails. You add two Windows groups as logins for the server:
CORP\\Employees – All company employeesCORP\\HRAdmins – HR administrators only
HR Administrators are also company employees.
You need to grant users access according to the following requirements:
CORP\\Employees should have SELECT access to the Employees table. Only users in CORP\\HRAdmins
should have SELECT access to the SalaryDetails table.
Logins are based only on Windows security groups.
What should you do?

A.
Create a database role called Employees.
Add CORP\\Employees to the db_datareader role.
Add all company employees except HR administrators to the Employees role.
Deny SELECT access to the SalaryDetails table to the Employees role.

B.
Create a database role called HRAdmins.
Add all company employees except HR administrators to the db_datareader role.
Add all HR administrators to the HRAdmins role.
Grant SELECT access to the SalaryDetails table to the HRAdmins role.
Deny SELECT access to the SalaryDetails table to the db_datareader role.

C.
Create two database roles: Employees and HRAdmins.
Add all company employees to the Employees role.
Add HR administrators to the HRAdmins role.
Grant SELECT access to all tables except SalaryDetails to the Employees role.
Grant SELECT access to the SalaryDetails table to the HRAdmins role.
Deny SELECT access to the SalaryDetails table to the Employees role.

D.
Create a database role called Employees.
Add all HR administrators to the db_datareader role.
Add all company employees to the Employees role.
Grant SELECT access to all tables except the SalaryDetails table to the Employees role.
Deny SELECT access to the SalaryDetails table to the Employees role.

Explanation:
Members of the db_datareader fixed database role can run a SELECT statement against any table or view in
the database.
https://technet.microsoft.com/en-us/library/ms188629(v=sql.90).aspx