DS0-001 Data Governance And Security — 25 Questions

Question 1

A data analyst discovers that raw log files contain unmasked social security numbers. Which data governance practice should be implemented immediately to remediate the risk?

Accepted Answer

Dynamic Data Masking (DDM). Dynamic Data Masking (DDM) masks sensitive data such as SSNs in query results in real time, without altering the stored data, so unauthorized users see masked values while privileged users see the real ones. It is the fastest remediation because it can be applied via policy or ALTER TABLE ... ADD MASKED WITH without a data migration. This directly addresses the risk of unmasked SSNs being exposed to analysts.

Answer

Partitioning

Answer

Database Mirroring

Answer

Database Indexing

Question 2

Your organization uses Azure Active Directory for access management. You need to ensure that database administrators can only access a specific production Azure SQL instance during a scheduled 4-hour maintenance window. Which control is most appropriate?

Accepted Answer

Azure AD Privileged Identity Management (PIM). Microsoft Entra Privileged Identity Management (PIM) is designed specifically for just-in-time privileged access with time-bound activation. It allows DBAs to be eligible for a role but requires them to activate it for a defined window (e.g., 4 hours), after which access is automatically revoked. This directly satisfies the requirement of limiting access to a scheduled maintenance window without permanent standing privileges.

Answer

IP Firewall rules on the SQL Server

Answer

Service Principals with managed identity

Answer

Azure RBAC with Conditional Access policies

Answer

SQL Server Audit logs

Question 3

A healthcare analytics team stores patient records in a relational database. A compliance officer requires that any user who queries the 'PatientRecords' table must not be able to view the 'Diagnosis' column unless they belong to the 'ClinicalStaff' role. The database supports column-level permissions. Which action should the data administrator take to meet this requirement?

Accepted Answer

Create a view that excludes the 'Diagnosis' column and grant SELECT on that view to all non-clinical users while revoking direct table access.. The correct approach is to use a view that excludes the sensitive column and revoke direct table access for non-clinical users. This enforces column-level security by ensuring that users without the 'ClinicalStaff' role cannot access the 'Diagnosis' column through any path. It follows the principle of least privilege and is a common technique in relational databases when native column-level permissions are not granular enough or when additional row filtering is needed.

Answer

Grant SELECT on the 'PatientRecords' table to all users but create a database trigger that logs any query referencing the 'Diagnosis' column and alerts the compliance officer.

Answer

Implement row-level security policies that filter rows based on the user's role, ensuring only 'ClinicalStaff' can see any rows containing a diagnosis.

Answer

Encrypt the 'Diagnosis' column with a symmetric key and grant the decryption key only to the 'ClinicalStaff' role.

Question 4

A data steward at a healthcare analytics firm must ensure that analysts querying the patient encounters table cannot view the Social Security Number column, even though the column must remain intact for downstream billing ETL jobs. Which mechanism should the steward implement to satisfy both requirements?

Accepted Answer

Create a view that excludes the Social Security Number column and grant the analysts SELECT only on that view.. Restricting access by object removes the sensitive column from the analysts' reachable schema while leaving the base table unchanged for billing ETL. A view that omits the Social Security Number column, combined with SELECT granted only on that view, enforces least privilege at the query layer and keeps the data available where it is legitimately needed.

Answer

Revoke the analysts' SELECT privilege on the patient encounters table and require them to use a stored procedure that returns only approved columns.

Answer

Apply dynamic data masking to the Social Security Number column so analysts see masked values while ETL reads real values.

Answer

Encrypt the Social Security Number column with a column-level key and share the decryption key only with the billing ETL service account.

Question 5

A multinational corporation must comply with GDPR's data transfer restrictions. The company wants to transfer employee payroll data from its EU subsidiary to its US parent. Which mechanism is specifically designed to allow this transfer while providing appropriate safeguards?

Accepted Answer

Standard Contractual Clauses (SCCs) approved by the European Commission. Standard Contractual Clauses are European Commission-approved contract terms that bind the data importer to GDPR-level protections, making them a purpose-built transfer mechanism for EU-to-US data flows. Consent and adequacy decisions are either impractical or outside the company's control for routine payroll transfers.

Answer

Binding Corporate Rules (BCRs) for the entire corporate group

Answer

Explicit consent from each employee for the transfer

Answer

Adequacy decision by the European Commission for the United States

Question 6

A financial services firm stores account transaction records in an Oracle Database. A data governance policy requires that all modifications to the TRANSACTIONS table be traceable to the individual database user who performed them, and that those users be prevented from denying their actions. The security team has enabled unified auditing. Which Oracle Database feature should the team implement to meet these requirements?

Accepted Answer

Unified Auditing with audit policies. The requirement is to trace modifications to individual users and prevent them from denying their actions. Unified Auditing with audit policies captures detailed audit records for specific tables and operations, linking each change to the authenticated database user. This provides the necessary non-repudiation and accountability. Other options address access control, encryption, or centralized monitoring but do not provide the same level of user-specific traceability.

Answer

Oracle Transparent Data Encryption (TDE)

Answer

Oracle Audit Vault and Database Firewall

Answer

Oracle Database Vault

Question 7

A financial services firm uses Microsoft SQL Server to store customer account data. The security team needs to implement a control that records all SELECT, INSERT, UPDATE, and DELETE statements executed on a specific table, including the user, timestamp, and affected rows. Which SQL Server feature should they use?

Accepted Answer

SQL Server Audit with an audit specification on the table. SQL Server Audit is designed to track and log security-relevant events, including DML operations on specific tables. By creating an audit specification that includes SELECT, INSERT, UPDATE, and DELETE actions on the table, the firm can capture user, timestamp, and affected rows. This satisfies the need for a detailed audit trail for compliance.

Answer

Dynamic Data Masking

Answer

Change Data Capture (CDC)

Answer

SQL Server Profiler trace

Question 8

A database administrator is configuring a new PostgreSQL database for a small business. The owner wants to ensure that only authorized employees can view customer credit card numbers, and that even database administrators cannot see the full numbers when running queries. Which PostgreSQL feature should be used?

Accepted Answer

Views with column masking functions. Using views with masking functions on sensitive columns allows the business to control what data is exposed. By granting access only to the views and not the base tables, even administrators who query the views see masked data. This leverages built-in PostgreSQL features without additional extensions, meeting the requirement to hide full credit card numbers.

Answer

Column-level encryption using pgcrypto

Answer

Dynamic data masking with the anon extension

Answer

Row-level security (RLS)

Question 9

To comply with CCPA, an organization must track the 'Right to Know' requests. Which component of a Data Governance Framework is most relevant?

Accepted Answer

Data Cataloging. Data Cataloging is the component of a Data Governance Framework that inventories data assets, records their location, lineage, and classification, and enables organizations to locate and track personal information subject to CCPA 'Right to Know' requests. Without a catalog, an organization cannot reliably determine what personal data it holds or where it resides.

Answer

Data Ingestion Pipeline

Answer

Load Balancing

Answer

Data Compression

Question 10

Which access control model should be implemented to ensure that a user can only access files based on their specific job role?

Accepted Answer

Role-Based Access Control (RBAC). RBAC assigns permissions to roles (e.g., 'HR Analyst', 'Finance Approver') rather than to individual users, and users inherit permissions by being assigned to a role. This directly satisfies the requirement that access be driven by job role, and it scales cleanly when employees change positions — you swap roles rather than re-editing per-file ACLs.

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Answer

Network Access Control (NAC)

Question 11

An administrator needs to restrict access to a specific S3 bucket so that only the Finance team can view files. Which configuration is the most effective approach?

Accepted Answer

Configure an S3 Bucket Policy. An S3 Bucket Policy is a resource-based IAM policy attached directly to the bucket that defines who can access it and under what conditions. By specifying the Finance team's IAM principals and granting only them s3:GetObject permissions, the administrator can effectively restrict access to the bucket.

Answer

Update the VPC Route Table

Answer

Enable Public Access Block

Answer

Enable S3 Versioning

Question 12

An organization is migrating sensitive financial records to a cloud environment. Which security control ensures that only authorized applications can decrypt the data?

Accepted Answer

Cloud Hardware Security Module (Cloud HSM). A Cloud Hardware Security Module (Cloud HSM) is a FIPS 140-2/3 validated appliance that stores cryptographic keys in tamper-resistant hardware and performs encryption/decryption operations inside the module. Because keys never leave the HSM in plaintext, only applications authorized to call the HSM's key operations can decrypt the data — satisfying the requirement that decryption be restricted to authorized applications.

Answer

Database Replication

Answer

Database Triggers

Answer

Shared Responsibility Model

Question 13

A company subject to GDPR needs to ensure that user data is deleted upon request across all distributed nodes in a NoSQL cluster. Which process is most critical to demonstrate compliance?

Accepted Answer

Automated Data Lineage and Lifecycle Tracking. GDPR's right to erasure (Article 17) requires that personal data be deleted across all systems where it resides, including replicas, shards, caches, and backups. Automated Data Lineage and Lifecycle Tracking is the only option that provides the visibility needed to locate every copy of a data subject's records across a distributed NoSQL cluster and enforce deletion policies consistently. Without lineage, you cannot prove to a regulator that deletion was complete.

Answer

Snapshotting

Answer

Database Sharding

Answer

Cache clearing

Question 14

A database administrator needs to implement column-level encryption for sensitive PII in a SQL Server environment. Which tool should be used to ensure the encryption keys are managed outside the database engine?

Accepted Answer

SQL Server Always Encrypted with Azure Key Vault. SQL Server Always Encrypted with Azure Key Vault stores encryption keys outside the database engine, ensuring even DBAs cannot see plaintext PII. Column-level encryption is applied at the client driver, so the database only ever handles ciphertext. Azure Key Vault provides centralized, hardware-backed key management with auditing and access policies.

Answer

Database File Stream

Answer

Transparent Data Encryption (TDE)

Answer

SQL Server Data Masking

Question 15

A company needs to audit all administrative actions taken on their database server. Which feature should the DBA enable?

Accepted Answer

Database Audit Logging. Database Audit Logging captures administrative and user actions — such as logins, privilege changes, schema modifications, and DDL/DML operations — providing the audit trail required to review who did what and when. It is the specific feature designed for compliance, forensic, and security auditing on a database server.

Answer

Data Partitioning

Answer

Query Optimization

Answer

Transaction Log Backup

Question 16

Which technology provides the best protection against data exfiltration from an on-premises database by a rogue administrator?

Accepted Answer

Database Activity Monitoring (DAM) with Firewall. A Database Firewall inspects incoming and outgoing SQL traffic to block unauthorized queries or data exports.

Answer

Database Clustering

Answer

Database Archiving

Answer

Database Sharding

Question 17

What is the primary purpose of a Data Protection Impact Assessment (DPIA) under GDPR?

Accepted Answer

Identify and mitigate data processing risks. A DPIA under GDPR is a structured assessment required when processing is likely to result in a high risk to the rights and freedoms of natural persons. Its primary purpose is to identify those risks and determine the measures needed to mitigate them before processing begins. It is a proactive risk-management and accountability tool, not an operational IT task.

Answer

Backup the production database

Answer

Configure firewall rules

Answer

Accelerate database performance

Question 18

In a multi-tenant cloud database, which mechanism ensures that tenant A cannot see data belonging to tenant B?

Accepted Answer

Row-Level Security (RLS). Row-Level Security (RLS) enforces tenant isolation at the database engine level by attaching predicates to every query based on the caller's identity (e.g., a session variable or JWT claim), so tenant A's queries are automatically filtered to only rows where tenant_id matches. This makes isolation a property of the data access layer itself rather than something the application must remember to do, preventing cross-tenant leakage even if a developer forgets a WHERE clause.

Answer

Data Replication

Answer

Schema Versioning

Answer

Database Encryption

Question 19

A developer wants to use a subset of production data for testing. Which method ensures the test data retains its structure while protecting privacy?

Accepted Answer

Data Masking/De-identification. Data masking (de-identification) replaces sensitive values with realistic but fictitious data while preserving the schema, data types, and referential relationships. This lets developers test against production-like structures without exposing real PII, satisfying both usability and privacy requirements.

Answer

Database Snapshotting

Answer

Database Migration

Answer

Full Database Clone

Question 20

Which document outlines the 'Data Owner' responsibilities in a data governance framework?

Accepted Answer

Data Governance Charter. The Data Governance Charter is the foundational document that defines the data governance framework, including roles and responsibilities such as the Data Owner, Data Steward, and Data Custodian. It establishes accountability, decision rights, and the operating model for data management across the organization.

Answer

Server Inventory List

Answer

Database Schema

Answer

Network Topology Map