An internal security policy requires that every request for access to production databases be approved by the data owner and by the security team, with the approval recorded before any account is created. How should the DBA team operationalize this requirement?
Select an answer to reveal the explanation.
Short Explanation
A policy says what must happen; an SOP says exactly how your team makes it happen, every time. Without the SOP, approvals depend on who's on shift and whether they remember. The other documents describe data, not the process for granting access.
Full Explanation
Organizational compliance requirements, such as internal security policies, are put into practice through standard operating procedures that translate the policy into concrete, repeatable steps. An access-request SOP would define how requests are submitted, who must approve, in this case the data owner and the security team, where approvals are recorded, how the account is provisioned with least privilege once approval exists and how access is periodically reviewed and revoked. Because the procedure records each step, it also produces the evidence that internal auditors expect. A data dictionary documents data elements, and listing approved users there neither enforces the approval workflow nor captures who approved and when. An entity relationship diagram shows table relationships and perhaps ownership annotations, but it is a structural document and cannot implement or evidence an access process. An SLA turnaround target measures how quickly requests are handled; it says nothing about the required approvals and could even pressure staff to skip them. Exam caveat: the objectives distinguish organizational compliance, driven by internal policy, from third-party compliance, driven by external standards or regulators. Operational check: sample recent production access grants and confirm each one has recorded approvals from both the data owner and security before the account creation date.