DS0-001 Data Governance And Security Practice Test 2 — 15 Questions

Question 1

A company is using a cloud-based data lake. To satisfy data sovereignty requirements, they must ensure data remains in a specific region. How can this be enforced?

Accepted Answer

Regional Resource Policies. Cloud providers use resource location constraints and policy-based tags to restrict where data can be physically stored.

Answer

Database Load Balancing

Answer

Database Indexing

Answer

Data Compression

Question 2

Which action represents a 'Data Lifecycle' phase where data is safely removed?

Accepted Answer

Data Disposition. The 'Disposition' or 'Destruction' phase involves securely deleting data that is no longer required.

Answer

Data Profiling

Answer

Data Integration

Answer

Data Ingestion

Question 3

When decommissioning a legacy server, what is the most secure way to handle the hard drives containing sensitive data?

Accepted Answer

Physical Destruction or Cryptographic Erasure. Cryptographic erasure or physical destruction are the only ways to guarantee that data cannot be recovered from decommissioned media.

Answer

Quick Format

Answer

Moving drives to a dev environment

Answer

Deleting the Database Files

Question 4

A company needs to implement centralized identity management for all database administrators. Which service is appropriate?

Accepted Answer

LDAP/Active Directory Integration. LDAP or Active Directory integration allows for centralized management of authentication and authorization across multiple database instances.

Answer

Snapshotting

Answer

Database Aliases

Answer

Local Database Users

Question 5

To ensure non-repudiation in a database system, what must be captured for every transaction?

Accepted Answer

Audit Logs with Unique User IDs. Detailed audit logs including a timestamp, user ID, and the executed command provide the necessary evidence for non-repudiation.

Answer

Server Uptime

Answer

Data Compression

Answer

Database Versioning

Question 6

What is the first step in a Data Governance program?

Accepted Answer

Data Classification and Inventory. Identifying and classifying data assets is the prerequisite to applying any security controls.

Answer

Hiring a network engineer

Answer

Writing SQL queries

Answer

Purchasing storage hardware

Question 7

Which type of data is defined as 'sensitive' and usually requires enhanced protection?

Accepted Answer

Personally Identifiable Information (PII). Personally Identifiable Information (PII) is subject to strict regulatory requirements and must be protected.

Answer

Temporary cache files

Answer

Publicly available news data

Answer

Static CSS files

Question 8

An administrator needs to restrict a user's ability to see only rows where the 'Region' column is 'North'. What feature should be used?

Accepted Answer

Row-Level Security (RLS). Row-Level Security (RLS) allows for the definition of predicates that filter query results based on user metadata.

Answer

View creation

Answer

Stored Procedures

Answer

Column Masking

Question 9

A company requires that all database backups be immutable for 7 years to meet regulatory audits. How can this be achieved?

Accepted Answer

Immutable WORM Storage Policies. WORM (Write Once, Read Many) storage policies prevent files from being altered or deleted until the retention period expires.

Answer

Database Replication

Answer

Regular manual deletion

Answer

Standard RAID 10

Question 10

Which of the following is a common symptom of a broken access control mechanism in a database?

Accepted Answer

Insecure Direct Object Reference (IDOR). Insecure Direct Object References (IDOR) allow users to access resources they should not, indicating broken access control.

Answer

High CPU usage

Answer

Database fragmentation

Answer

Slow network speed

Question 11

Which regulatory act specifically governs the protection of healthcare-related data?

Accepted Answer

HIPAA. HIPAA sets the standard for protecting sensitive patient health information in the United States.

Answer

SOX

Answer

PCI DSS

Answer

GDPR

Question 12

An organization uses a 'bring your own key' (BYOK) model for database encryption. What is the primary benefit?

Accepted Answer

Increased control over encryption keys. BYOK allows the organization to retain full control over the encryption keys, preventing the cloud provider from accessing the data.

Answer

Easier database installation

Answer

Improved query performance

Answer

Lower storage costs

Question 13

When reviewing a database security configuration, which finding poses the highest risk?

Accepted Answer

Enabled default accounts with default passwords. Default accounts (like 'admin' or 'sa') with default passwords are the most common entry points for attackers.

Answer

Old server hardware

Answer

Lack of database documentation

Answer

Redundant indexes

Question 14

Which THREE actions should be performed during a data incident response procedure involving a potential PII leak?

Accepted Answer

Analyze access logs for suspicious activity. Incident response requires containment, investigation, and reporting to meet legal obligations like GDPR/CCPA.

Answer

Update the database schema

Answer

Delete all historical backups

Question 15

A security team is implementing an access management strategy. Which THREE of the following are considered essential components of an effective Identity and Access Management (IAM) framework?

Accepted Answer

Authentication mechanisms. IAM frameworks rely on Authentication (who you are), Authorization (what you can do), and Auditing (tracking what you did).

Answer

Network cabling standards

Answer

Database partitioning