A data analyst discovers that raw log files contain unmasked social security numbers. Which data governance practice should be implemented immediately to remediate the risk?
Your organization uses Azure Active Directory for access management. You need to ensure that database administrators can only access a specific production Azure SQL instance during a scheduled 4-hour maintenance window. Which control is most appropriate?
A healthcare analytics team stores patient records in a relational database. A compliance officer requires that any user who queries the 'PatientRecords' table must not be able to view the 'Diagnosis' column unless they belong to the 'ClinicalStaff' role. The database supports column-level permissions. Which action should the data administrator take to meet this requirement?
A data steward at a healthcare analytics firm must ensure that analysts querying the patient encounters table cannot view the Social Security Number column, even though the column must remain intact for downstream billing ETL jobs. Which mechanism should the steward implement to satisfy both requirements?
A multinational corporation must comply with GDPR's data transfer restrictions. The company wants to transfer employee payroll data from its EU subsidiary to its US parent. Which mechanism is specifically designed to allow this transfer while providing appropriate safeguards?
A financial services firm stores account transaction records in an Oracle Database. A data governance policy requires that all modifications to the TRANSACTIONS table be traceable to the individual database user who performed them, and that those users be prevented from denying their actions. The security team has enabled unified auditing. Which Oracle Database feature should the team implement to meet these requirements?
A financial services firm uses Microsoft SQL Server to store customer account data. The security team needs to implement a control that records all SELECT, INSERT, UPDATE, and DELETE statements executed on a specific table, including the user, timestamp, and affected rows. Which SQL Server feature should they use?
A database administrator is configuring a new PostgreSQL database for a small business. The owner wants to ensure that only authorized employees can view customer credit card numbers, and that even database administrators cannot see the full numbers when running queries. Which PostgreSQL feature should be used?
An administrator needs to restrict access to a specific S3 bucket so that only the Finance team can view files. Which configuration is the most effective approach?
An organization is migrating sensitive financial records to a cloud environment. Which security control ensures that only authorized applications can decrypt the data?
A company subject to GDPR needs to ensure that user data is deleted upon request across all distributed nodes in a NoSQL cluster. Which process is most critical to demonstrate compliance?
A database administrator needs to implement column-level encryption for sensitive PII in a SQL Server environment. Which tool should be used to ensure the encryption keys are managed outside the database engine?
A company is using a cloud-based data lake. To satisfy data sovereignty requirements, they must ensure data remains in a specific region. How can this be enforced?
A security team is implementing an access management strategy. Which THREE of the following are considered essential components of an effective Identity and Access Management (IAM) framework?
An organization must ensure that PII in a legacy SQL Server database is masked before being accessed by the HR analytics team. Which SQL Server feature should the DBA implement to ensure the data is obscured at the query level without changing the underlying storage?
You are implementing a data governance framework. Which role is primarily responsible for ensuring that the data quality, security, and lifecycle policies are defined and adhered to for a specific business domain?
A company is migrating to a cloud data warehouse and must comply with CCPA requirements for data portability. Which action is necessary to ensure compliance regarding user access requests?
A data engineer is configuring an S3 bucket to comply with GDPR requirements regarding the 'Right to be Forgotten.' Which combination of configuration settings best automates the lifecycle of user-specific data objects that have reached the end of their retention period?
You are auditing data security controls. You find that raw sensitive data is being written to application logs by the ETL process. Which remediation step best aligns with the principle of 'Data Minimization'?
You are evaluating the data lifecycle of an organization's unstructured data. Which THREE actions should be included in a robust Data Retention and Disposal policy? (Select THREE)
As a Data Privacy Officer, you are reviewing technical controls for data security. Which TWO of the following are best practices to ensure 'Privacy by Design' in a new application? (Select TWO)
A healthcare analytics team stores patient records in a PostgreSQL database. Auditors require that any change to the 'diagnosis' column be traceable to a specific database user and timestamp, without relying on application-level logging. Which mechanism should the data engineer implement to meet this requirement?
A financial services firm must prove to regulators that its nightly ETL job loaded the same source data that was archived for a given business date, and that no record was altered after extraction. Which combination of practices best provides this non-repudiation evidence?
A healthcare analytics team stores patient records in a PostgreSQL database. A new analyst joins and must be able to query only the columns patient_id, visit_date, and diagnosis_code from the encounters table, but must be blocked from viewing patient_name and ssn. Which mechanism should the database administrator implement to meet this requirement?
A financial services firm is implementing a data governance program and must classify data assets. Which two characteristics are used to determine whether data should be classified as confidential under a typical data classification policy? (Choose two.)
A retail company's data governance team is defining roles for its new data stewardship program. The team needs to assign responsibility for day-to-day management of data quality, including resolving data issues and documenting business rules. Which role should be assigned this responsibility?
A financial institution is designing a data governance program. The Chief Data Officer wants to ensure that data quality issues are identified and resolved before data is used in regulatory reporting. The organization has multiple business units that each own their data. Which data governance component should be established to formally assign accountability for data quality and define escalation paths?
A multinational retailer stores customer loyalty data in a PostgreSQL cluster. Privacy counsel requires that EU customer records be purged automatically 30 days after account closure, while US records must be retained for seven years for tax purposes. Which data governance control best satisfies this requirement?
A retail company is implementing a new data classification policy. The security team needs to categorize data based on its sensitivity and the impact of unauthorized disclosure. Which data classification level typically requires the highest level of protection and is subject to the strictest access controls?
A healthcare analytics team stores patient records in a PostgreSQL database. An auditor requires that any change to a patient's diagnosis code be permanently recorded with the identity of the user who made the change, and that this record cannot be altered or deleted by that same user. Which mechanism should the database administrator implement?
A healthcare analytics team stores patient records in a PostgreSQL database. A new compliance mandate requires that the database administrator be prevented from reading the contents of the 'diagnosis' column in plaintext, while the application must still be able to query and filter on that column. Which mechanism should the team implement?
A financial services company is building a data governance program and must classify data assets so that protection controls map correctly to sensitivity. Which two actions are essential first steps in establishing data classification? (Choose two.)
A data governance team is implementing an audit trail for a data warehouse. The team must ensure that every query against sensitive tables is recorded with the user identity, timestamp, and SQL text, and that the logs cannot be altered by database users. Which approach best meets these requirements?
A multinational corporation is subject to the General Data Protection Regulation (GDPR). The data protection officer is reviewing the data lifecycle for customer personal data. Which two actions are required to comply with GDPR's data minimization and storage limitation principles? (Choose two.)
A retail company stores customer email addresses in a column named email_addr in an Oracle Database. A new privacy policy requires that analysts querying the table see a masked value such as j***@example.com, while the marketing application that sends campaigns must still read the real address. Which Oracle feature should the database administrator configure?
A retail company is classifying its data assets for a new governance program. The legal team asks which category of data, if disclosed, would most directly trigger notification obligations under state breach-notification laws because it can identify a specific individual. Which classification should be applied?
A cloud data platform team must prove to auditors that only approved personnel accessed a regulated dataset during a specific incident window. The platform uses role-based access control and stores query history in the warehouse. Which evidence source most directly demonstrates authorized access during that window?
A cloud-based SaaS provider stores customer data in a multi-tenant database. The provider wants to ensure that a customer's data is logically isolated from other customers' data, even though they share the same database schema. Which security control should be implemented to enforce this isolation?
A financial services firm is designing a new data warehouse that will hold account balances and transaction histories. The governance committee wants to formalize who owns each data domain, who is accountable for its quality, and how stewardship duties are delegated across business units. Which artifact should the data governance lead produce first to establish these assignments?
A new data engineer joins a team and needs read access to a production analytics database to troubleshoot a reporting issue. The security policy requires least privilege and time-bound access. Which approach best meets the policy?
A multinational bank must demonstrate that its data processing activities are lawful and documented. An auditor requests evidence that each processing purpose has a documented legal basis, defined retention, and identified data subjects. Which artifact should the data governance team produce?
A financial services firm allows analysts to query a data warehouse through a BI tool. Security policy requires that analysts see only customers in their assigned portfolio, even though all customer rows reside in one table. The warehouse supports session variables that carry the analyst's portfolio identifier. Which control should be implemented?
A data platform team is implementing encryption for a new MongoDB cluster that stores customer PII. The security policy requires protecting data at rest and ensuring that compromised credentials for one tenant cannot expose another tenant's data. Which two measures should the team implement to meet these requirements? (Choose two.)
A data governance committee is defining the requirements for a new master data management program covering customer records across four business units. Which two practices are essential to maintain trustworthy golden records? (Choose two.)
A municipal government agency must publish an open dataset of building permits. The governance policy requires that individual applicants not be re-identifiable from the published file, while aggregate statistics remain accurate. Which technique should the data steward apply before publication?
A multinational corporation is implementing a data governance program and needs to ensure compliance with the GDPR's data minimization principle. Which TWO practices should the data governance team enforce? (Choose two.)
A database administrator is asked to implement a mechanism that ensures data cannot be repudiated by a user who made changes to a financial ledger table. The mechanism must provide cryptographic proof of the origin and integrity of each transaction. Which approach should be used?