Data and Database Security

DS0-002 · 57 questions

• Application servers connect to a database server across a shared network segment, and a packet capture shows query text and result sets in clear text. Which control addresses this exposure?
• A company stores sensitive customer fields in a managed cloud database. The security policy says neither the cloud provider nor the company's own DBAs may ever see these fields in plaintext. Which approach meets this requirement?
• A backup drive containing copies of a production database's data files and backup files is stolen from a courier vehicle. The data was not encrypted. Which control would have prevented the thief from reading the data?
• A company generates an encryption key in its own on-premises hardware security module and imports it into its cloud provider's key management service, which then uses it to encrypt the company's managed databases. Which key management model is this?
• A regulator requires that a bank's cloud-hosted database be encrypted with keys that remain exclusively in the bank's own hardware security module, so the cloud provider can never possess the key material. Which model satisfies this requirement?
• During a review, a DBA discovers that the master encryption key protecting a database's encrypted columns is stored in a file on the same server as the database. What is the best remediation?
• A healthcare analytics firm runs database workloads on shared cloud hardware. Its data is already encrypted at rest and in transit, but the firm must also protect data while it is being processed in memory from the host operator. Which technology addresses this requirement?
• Developers need a copy of the payments database with realistic-looking data for testing. Card numbers must keep their length and format so validation code still works, but developers must not see real card numbers. Which technique best fits this need?
• A hospital wants to share a dataset with outside university researchers. The agreement requires that no individual can ever be re-identified, even by the hospital. Which data protection technique meets this requirement?
• A public health report summarizes cases by town and age group. Some cells show counts of one or two people, which could reveal who has the condition in small towns. Which technique should be applied to those cells before publication?
• A company is retiring database servers whose disks held regulated customer data. The disks will not be reused. What is the most appropriate way to dispose of the data?
• A quarterly security audit finds that several database logins still belong to employees who left the company months ago. Some might be used by scheduled jobs. What should the DBA do?
• An auditor asks the DBA to demonstrate who connected to the production database, from which host or IP address, and when, including failed attempts. What should the DBA configure?
• Monitoring alerts show a database account exported large volumes of customer records overnight, and management suspects data theft that may lead to legal action. What should the DBA do first?
• During a code audit, a reviewer finds a login function that builds a query by concatenating the username and password typed by the user directly into a SQL string. Which remediation should the reviewer require?
• A scan of a source code repository finds application configuration files containing database connection strings with plaintext passwords, committed over several months. What is the best remediation?
• An investigation finds that employees regularly export customer lists from the CRM database and email them to personal accounts. Management wants sensitive data detected and blocked when it leaves through email and uploads. Which control best meets this goal?
• A company's customer database keeps every record indefinitely, including accounts closed many years ago, because staff think the data might be useful someday. What should the DBA recommend to governance stakeholders?
• A scheduled job purges customer records older than the retention period every month. The legal department has just placed a litigation hold on records for several customers involved in a lawsuit, some of which are due for purging this week. What should the DBA do?
• A European retailer stores customer data in a data center located in another country. Its legal team explains that the data remains subject to the privacy laws of the customers' home jurisdiction regardless of where it is stored. Which concept does this describe?
• A national regulation requires that citizens' records be stored only within the country. The primary database meets this, but an audit finds the cloud provider's geo-replicated read replica and automated backups are in a region abroad. What should the DBA do?
• A compliance analyst is preparing training for new DBAs on cloud data placement. Which statement correctly distinguishes data residency from data sovereignty?
• A customer table stores each person's full name, home address and national identification number. The team must classify these columns and decide on protection. Which classification and handling is most appropriate?
• A clinic's database stores patient names linked to diagnoses, treatment notes and insurance claim details. A new analyst requests full read access to build a scheduling dashboard. How should the DBA treat this data?
• An e-commerce company's order database stores customers' full primary account numbers (PANs) from payment cards so returning customers can check out faster. Which compliance obligation applies to this storage?
• A merchant currently stores full card numbers in several databases to support refunds and repeat purchases. The security team wants to reduce how many systems fall within PCI DSS scope while keeping those features. Which approach best achieves this?
• A customer in the European Union submits a request under the GDPR for the company to erase all personal data it holds about them. The data is spread across a CRM database, a data warehouse and nightly backups. What should the DBA do?
• A company's online newsletter signup form collects email address, date of birth, home address, phone number and employer, although the stated purpose is only to send a monthly newsletter. Which GDPR principle does this design violate?
• A new data platform is being designed. Stakeholders ask who should decide how long customer data is retained and which business roles may view it, and who should configure the database to enforce those decisions. Which split of responsibilities reflects sound data governance?
• Fifty financial analysts need identical read access to the same reporting tables, and an analyst's access must change automatically when they move to another job. What is the best way to grant this access?
• A review shows that a web application connects to its database with an account that has full administrative rights, although the application only reads and writes rows in six tables. What should the DBA do?
• A company requires that access to records depend on the user's department, the record's data classification and whether the request occurs during business hours. Which access control model best fits this requirement?
• An organization's RBAC design has grown to hundreds of roles such as Sales-EU-Confidential-ReadOnly, created for every combination of region, department and data sensitivity. Administration is becoming unmanageable. Which change best addresses this problem?
• Database administrators connect remotely to production database servers using only a username and password. After a phishing campaign targeted IT staff, the security team wants to make stolen passwords insufficient for privileged access. Which control should be required?
• Business users must remember separate passwords for the reporting portal, the analytics tool and two database web consoles, and the help desk is overwhelmed with reset requests. What solution best addresses this problem?
• Users on a Windows domain connect to a database server with integrated authentication. The security team wants clients to authenticate with time-limited tickets from the domain's key distribution center, with mutual authentication of the server and no password sent to it. Which protocol should be in use?
• After the database service was changed to run under a new domain service account, client connections that previously used Kerberos now fall back to NTLM, and double-hop delegation to a linked server fails. Which action most likely resolves this?
• A partner company's analysts need access to a shared reporting database. The partner manages its own user directory, and the DBA wants partner users to sign in with their existing partner credentials rather than receiving accounts in the company's directory. Which approach meets this requirement?
• A reporting application must call a company data API to pull a sales manager's own pipeline figures. Security requires that the application act on the manager's behalf with limited, revocable access and never see or store the manager's password. The application does not need to establish the manager's identity for its own sign-in. Which approach meets these requirements?
• A web application already uses an external provider's OAuth 2.0 flow to obtain API access tokens. The developers now need the application to verify who actually signed in and read basic profile claims such as name and email from a signed token issued by that same provider. Which technology adds this capability?
• After a DBA enabled TLS on a database server with a self-signed certificate whose subject is "localhost", every client connecting to db01.corp.example.com reports an untrusted certificate and a name mismatch. Security requires encrypted connections with server identity verification. What should the DBA do?
• At midnight every application connection to a production database began failing with TLS handshake errors. The DBA finds that the server certificate reached its expiry date, issues a replacement, and restores service. Which practice would best prevent a repeat of this outage?
• Three internal applications all connect to the same database using one shared login named appsvc. After rows were deleted from a payments table, the audit log shows only that appsvc ran the DELETE, so the team cannot tell which application did it. Which change restores accountability?
• An auditor finds that a branch office's database server sits in an unlocked supply closet. Anyone in the building can walk in, unplug the server, attach a USB device, or carry the chassis away. Which control most directly addresses the risk the auditor described?
• An external scan shows a production database server's listener port is reachable from any internet address. The database serves only two application servers in the same data center. Which change most directly reduces this exposure?
• A company is placing a three-tier application into a network with an internet-facing perimeter network (DMZ) and an internal network. The tiers are public web servers, application servers, and a database holding customer records. Which placement follows recommended practice for the database?
• During a hardening review, a DBA finds a new database server running with several default features enabled: a web-based management endpoint, a legacy remote-administration protocol, and an extra network listener. None of them are used by the applications or administrators. What should the DBA do?
• A company's database access policy states that any connection originating from the internal corporate network is trusted and may reach any database, while external connections must use a VPN. A security review recommends adopting a Zero Trust architecture. Which change reflects that model?
• A DBA team manages forty database servers across on-premises and cloud environments. Management wants a repeatable way to identify known weaknesses such as missing security patches, insecure default settings, and outdated components on every server. Which practice meets this requirement?
• A vulnerability scan flags a critical flaw in a database server's network listener. The vendor has published an advisory but no patch yet, and the database must stay in service for a customer-facing application. What is the most appropriate response?
• An inventory finds six test databases restored from production copies over the past two years, still online with real customer data and old login accounts. No project uses them and their owners have confirmed they are no longer needed. Which action best reduces the attack surface?
• A penetration tester types ' OR '1'='1 into the password field of an internal web application and is logged in as the first user in the table. The application builds its login query by concatenating the form values into a SQL string. What is this attack, and how should developers fix it?
• After a SQL injection finding, a team debates three controls for a customer search page: a maximum input length on the search box, a web application firewall in front of the site, and parameterized queries in the data-access code. Which statement describes how these controls should be used?
• A fraud-detection model starts approving obviously fraudulent transactions. Investigators find that an attacker with write access to the labeled training feed inserted thousands of fraudulent records marked as legitimate before the last retraining. What is this attack, and what response best addresses it?
• A ransomware infection on a database server encrypted the data files and also every backup file stored on a network share that the server's service account could write to. The team is redesigning its protections. Which preparation would most limit the damage from a repeat attack?
• A DBA receives an urgent call from someone who says they are a regional director traveling to a client meeting. The caller asks the DBA to reset the password on a production reporting login immediately and read the new password over the phone. What should the DBA do?
• A healthcare company is securing a database that stores patient records. The security architect insists on defense in depth rather than relying on one strong control. Which design best reflects that principle?