DS0-001 Data Governance And Security — 20 Questions

Question 1

To comply with CCPA, an organization must track the 'Right to Know' requests. Which component of a Data Governance Framework is most relevant?

Accepted Answer

Data Cataloging. Data Cataloging allows for the inventory and metadata management necessary to respond to data access requests.

Answer

Data Ingestion Pipeline

Answer

Load Balancing

Answer

Data Compression

Question 2

Which access control model should be implemented to ensure that a user can only access files based on their specific job role?

Accepted Answer

Role-Based Access Control (RBAC). Role-Based Access Control (RBAC) maps permissions to job functions rather than individual users.

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Answer

Network Access Control (NAC)

Question 3

An administrator needs to restrict access to a specific S3 bucket so that only the Finance team can view files. Which configuration is the most effective approach?

Accepted Answer

Configure an S3 Bucket Policy. IAM policies attached to the specific bucket (Bucket Policies) are the primary control for S3 access management.

Answer

Update the VPC Route Table

Answer

Enable Public Access Block

Answer

Enable S3 Versioning

Question 4

An organization is migrating sensitive financial records to a cloud environment. Which security control ensures that only authorized applications can decrypt the data?

Accepted Answer

Cloud Hardware Security Module (Cloud HSM). Hardware Security Modules (HSM) provide the root of trust for encryption keys required by applications to decrypt data.

Answer

Database Replication

Answer

Database Triggers

Answer

Shared Responsibility Model

Question 5

A company subject to GDPR needs to ensure that user data is deleted upon request across all distributed nodes in a NoSQL cluster. Which process is most critical to demonstrate compliance?

Accepted Answer

Automated Data Lineage and Lifecycle Tracking. Data lifecycle management, specifically mapping data lineage and retention policies, is required to prove that data was effectively purged from all replicas.

Answer

Snapshotting

Answer

Database Sharding

Answer

Cache clearing

Question 6

A data analyst discovers that raw log files contain unmasked social security numbers. Which data governance practice should be implemented immediately to remediate the risk?

Accepted Answer

Dynamic Data Masking (DDM). Data masking at the ingestion layer prevents sensitive data from being written to logs in clear text.

Answer

Partitioning

Answer

Database Mirroring

Answer

Database Indexing

Question 7

A database administrator needs to implement column-level encryption for sensitive PII in a SQL Server environment. Which tool should be used to ensure the encryption keys are managed outside the database engine?

Accepted Answer

SQL Server Always Encrypted with Azure Key Vault. Azure Key Vault is the industry-standard service for managing encryption keys independently of the database engine, ensuring separation of duties.

Answer

Database File Stream

Answer

Transparent Data Encryption (TDE)

Answer

SQL Server Data Masking

Question 8

A company needs to audit all administrative actions taken on their database server. Which feature should the DBA enable?

Accepted Answer

Database Audit Logging. Database Auditing logs all DDL and DML operations, providing the evidence needed for compliance reporting.

Answer

Data Partitioning

Answer

Query Optimization

Answer

Transaction Log Backup

Question 9

Which technology provides the best protection against data exfiltration from an on-premises database by a rogue administrator?

Accepted Answer

Database Activity Monitoring (DAM) with Firewall. A Database Firewall inspects incoming and outgoing SQL traffic to block unauthorized queries or data exports.

Answer

Database Clustering

Answer

Database Archiving

Answer

Database Sharding

Question 10

What is the primary purpose of a Data Protection Impact Assessment (DPIA) under GDPR?

Accepted Answer

Identify and mitigate data processing risks. A DPIA identifies and minimizes data protection risks associated with new data processing activities.

Answer

Backup the production database

Answer

Configure firewall rules

Answer

Accelerate database performance

Question 11

In a multi-tenant cloud database, which mechanism ensures that tenant A cannot see data belonging to tenant B?

Accepted Answer

Row-Level Security (RLS). Row-Level Security (RLS) restricts rows in a table based on user or application context, effectively enforcing logical isolation.

Answer

Data Replication

Answer

Schema Versioning

Answer

Database Encryption

Question 12

A developer wants to use a subset of production data for testing. Which method ensures the test data retains its structure while protecting privacy?

Accepted Answer

Data Masking/De-identification. Data masking or de-identification replaces real values with realistic but fake values, maintaining schema integrity.

Answer

Database Snapshotting

Answer

Database Migration

Answer

Full Database Clone

Question 13

Which document outlines the 'Data Owner' responsibilities in a data governance framework?

Accepted Answer

Data Governance Charter. A Data Governance Charter defines roles, responsibilities, and decision-making authority within the organization.

Answer

Server Inventory List

Answer

Database Schema

Answer

Network Topology Map

Question 14

Which protocol should be enforced for all data-in-transit between application servers and database instances?

Accepted Answer

TLS (Transport Layer Security). TLS (Transport Layer Security) is the industry standard for encrypting data while it travels over the network.

Answer

HTTP

Answer

SNMP

Answer

FTP

Question 15

An administrator needs to enforce password complexity on the database level. Where should this policy be configured?

Accepted Answer

Database Authentication Policy/IAM. Password policies for database users are typically managed via the database's built-in authentication provider or integrated identity management system.

Answer

Database Trigger

Answer

Backup Schedule

Answer

Stored Procedure

Question 16

A company is using a cloud-based data lake. To satisfy data sovereignty requirements, they must ensure data remains in a specific region. How can this be enforced?

Accepted Answer

Regional Resource Policies. Cloud providers use resource location constraints and policy-based tags to restrict where data can be physically stored.

Answer

Database Load Balancing

Answer

Database Indexing

Answer

Data Compression

Question 17

Which action represents a 'Data Lifecycle' phase where data is safely removed?

Accepted Answer

Data Disposition. The 'Disposition' or 'Destruction' phase involves securely deleting data that is no longer required.

Answer

Data Profiling

Answer

Data Integration

Answer

Data Ingestion

Question 18

When decommissioning a legacy server, what is the most secure way to handle the hard drives containing sensitive data?

Accepted Answer

Physical Destruction or Cryptographic Erasure. Cryptographic erasure or physical destruction are the only ways to guarantee that data cannot be recovered from decommissioned media.

Answer

Quick Format

Answer

Moving drives to a dev environment

Answer

Deleting the Database Files

Question 19

A company needs to implement centralized identity management for all database administrators. Which service is appropriate?

Accepted Answer

LDAP/Active Directory Integration. LDAP or Active Directory integration allows for centralized management of authentication and authorization across multiple database instances.

Answer

Snapshotting

Answer

Database Aliases

Answer

Local Database Users

Question 20

To ensure non-repudiation in a database system, what must be captured for every transaction?

Accepted Answer

Audit Logs with Unique User IDs. Detailed audit logs including a timestamp, user ID, and the executed command provide the necessary evidence for non-repudiation.

Answer

Server Uptime

Answer

Data Compression

Answer

Database Versioning