DS0-001 Data Governance And Security Practice Test 3 — 15 Questions

Question 1

A company requires that all database backups be immutable for 7 years to meet regulatory audits. How can this be achieved?

Accepted Answer

Immutable WORM Storage Policies. Immutable WORM (Write Once, Read Many) storage policies enforce retention at the storage layer, preventing modification or deletion of backup objects for the configured period — commonly 7 years for regulatory compliance. This satisfies audit requirements because even administrators cannot alter or delete the data before the retention period expires.

Answer

Database Replication

Answer

Regular manual deletion

Answer

Standard RAID 10

Question 2

Which of the following is a common symptom of a broken access control mechanism in a database?

Accepted Answer

Insecure Direct Object Reference (IDOR). Insecure Direct Object Reference (IDOR) is a classic symptom of broken access control, where an application exposes internal object identifiers (like user IDs or file names) and fails to verify that the requesting user is authorized to access them. It directly reflects a failure in the access control mechanism.

Answer

High CPU usage

Answer

Database fragmentation

Answer

Slow network speed

Question 3

Which regulatory act specifically governs the protection of healthcare-related data?

Accepted Answer

HIPAA. HIPAA (Health Insurance Portability and Accountability Act) is the U.S. federal law that specifically governs the protection and privacy of protected health information (PHI). It sets standards for how healthcare data is stored, transmitted, and accessed. SOX, PCI DSS, and GDPR address financial reporting, payment cards, and general data privacy respectively.

Answer

SOX

Answer

PCI DSS

Answer

GDPR

Question 4

An organization uses a 'bring your own key' (BYOK) model for database encryption. What is the primary benefit?

Accepted Answer

Increased control over encryption keys. The primary benefit of BYOK is increased control over encryption keys: the organization generates and manages its own keys, which are used by the cloud provider for encryption at rest. This gives the organization greater security oversight, the ability to revoke access, and compliance with data sovereignty requirements.

Answer

Easier database installation

Answer

Improved query performance

Answer

Lower storage costs

Question 5

When reviewing a database security configuration, which finding poses the highest risk?

Accepted Answer

Enabled default accounts with default passwords. Enabled default accounts with default passwords pose the highest risk because they are publicly known credentials that attackers routinely scan for and exploit. Default accounts like 'sa', 'admin', or 'root' with unchanged passwords (e.g., 'password', 'admin') provide immediate, often privileged access to the database, enabling data theft, ransomware, or lateral movement. This is a critical vulnerability that violates every security baseline (CIS, OWASP, NIST).

Answer

Old server hardware

Answer

Lack of database documentation

Answer

Redundant indexes

Question 6

Which THREE actions should be performed during a data incident response procedure involving a potential PII leak?

Accepted Answer

Analyze access logs for suspicious activity. Option A is correct because analyzing access logs for suspicious activity is a core containment and investigation step that helps determine the scope, source, and timeline of a potential PII leak, which is essential for both remediation and breach-notification obligations. Option C is correct because PII leaks typically trigger mandatory breach-notification requirements under regulations such as GDPR, HIPAA, or CCPA, so notifying the relevant regulatory bodies within required timeframes is a required part of the incident response procedure. Option D is correct because isolating the affected data nodes limits the blast radius, prevents further exfiltration or lateral movement, and preserves the environment for forensic analysis. Option B is not appropriate because altering the database schema is a change-management task unrelated to containing or investigating a PII leak and could destroy evidence. Option E is not appropriate because deleting all historical backups destroys forensic evidence and may violate data-retention and legal-hold requirements, and backups are needed for recovery rather than deletion during an incident.

Answer

Update the database schema

Answer

Delete all historical backups

Question 7

A security team is implementing an access management strategy. Which THREE of the following are considered essential components of an effective Identity and Access Management (IAM) framework?

Accepted Answer

Authentication mechanisms. Authentication mechanisms (A) are essential because IAM must first verify a subject's claimed identity through credentials such as passwords, MFA, certificates, or biometrics before any access decision can be made. Authorization policies (D) are equally essential, as they define what an authenticated identity is permitted to do, typically expressed through role-based access control (RBAC), attribute-based access control (ABAC), or least-privilege rules. Centralized logging and auditing (C) are also core to IAM because they provide the accountability trail—recording authentication events, privilege changes, and access attempts—needed for compliance, forensic investigation, and continuous monitoring. Network cabling standards (B) belong to physical infrastructure design (e.g., Cat6, fiber) and are unrelated to identity or access management. Database partitioning (E) is a data storage and performance technique for splitting tables or schemas, not an IAM component.

Answer

Network cabling standards

Answer

Database partitioning

Question 8

A company is conducting a data governance audit. Which TWO of the following items should be verified to ensure proper data security?

Accepted Answer

User access rights are reviewed periodically. Option D is correct because periodic review of user access rights enforces the principle of least privilege and ensures that permissions are revoked when roles change or employees leave, which is a core access-control requirement in any data governance audit. Option E is correct because encryption-at-rest on all databases protects stored data from unauthorized disclosure if physical media or backups are compromised, directly satisfying data security and confidentiality controls. The remaining options do not belong: A concerns appliance energy efficiency, B concerns a secondary display for the database server, and C concerns power protection for a printer—none of these relate to protecting data confidentiality, integrity, or access control.

Answer

The breakroom refrigerator is energy efficient

Answer

The database server has a secondary monitor

Answer

The office printer is connected to a UPS

Question 9

Which THREE of the following are recognized data governance best practices?

Accepted Answer

Defining clear data ownership roles. Option C is correct because data governance best practice requires explicitly assigning accountability for data assets through defined ownership roles such as data owners, data stewards, and custodians, which establishes who is responsible for quality, access, and lifecycle decisions. Option D is correct because automated data quality checks enforce measurable rules (completeness, accuracy, consistency, timeliness) at ingestion and transformation points, enabling continuous monitoring and remediation rather than one-off manual reviews. Option E is correct because an enterprise data catalog provides the metadata inventory—data lineage, definitions, classifications, and ownership—that makes governance discoverable, auditable, and enforceable across the organization. Options A and B are not governance practices: standardizing on a single database vendor is a procurement or architecture decision that can even increase lock-in risk, and increasing storage capacity is a purely infrastructural scaling action that does nothing to define accountability, quality controls, or metadata management.

Answer

Using a single database vendor

Answer

Increasing database storage capacity

Question 10

Which TWO actions constitute good data lifecycle management?

Accepted Answer

Defining data retention policies. Option B is correct because defining data retention policies is a core element of data lifecycle management: it specifies how long each data category must be kept to satisfy legal, regulatory, and business requirements, and when it should be securely disposed of. Option E is correct because automated archiving of stale data moves infrequently accessed records to lower-cost storage tiers while preserving them for retention or compliance needs, reducing primary storage load and risk. The unmarked options do not belong: A violates least-privilege and confidentiality principles by exposing all data to all users, C merely raises logging verbosity (debug level) and increases log volume without governing data lifecycle, and D is a destructive blanket reformatting of drives that ignores retention requirements and would cause data loss.

Answer

Allowing all users access to all data

Answer

Increasing database logging level to debug

Answer

Reformatting all drives annually

Question 11

Which TWO technologies or methods are most effective at protecting sensitive data against insider threats?

Accepted Answer

Deploying Database DLP tools. Option A, deploying Database DLP (Data Loss Prevention) tools, is correct because DLP solutions monitor, detect, and block unauthorized access, exfiltration, or misuse of sensitive data by insiders, providing content-aware inspection and policy enforcement at the database layer. Option C, implementing separation of duties, is correct because it divides critical tasks and privileges among multiple users so that no single insider has enough access to compromise sensitive data alone, thereby reducing the risk of fraud or accidental leakage. Option B, using a custom UI theme, is incorrect because a theme only changes the visual appearance of an application and has no security control function. Option D, increasing server RAM, is incorrect because adding memory improves performance, not data protection against insider threats. Option E, enabling database mirroring, is incorrect because mirroring provides high availability and failover, not access control or data-loss prevention.

Answer

Using a custom UI theme

Answer

Increasing server RAM

Answer

Enabling database mirroring

Question 12

When assessing data privacy compliance, which THREE categories of data are typically protected under laws like CCPA or GDPR?

Accepted Answer

Biometric data. Biometric data (B) is explicitly classified as sensitive personal data under GDPR Article 9 and is protected under CCPA/CPRA as a sensitive personal information category, so it is a correct answer. Personally Identifiable Information (C) is the core category of protected data under both GDPR (personal data) and CCPA (personal information), covering identifiers like names, addresses, and email addresses. Financial account numbers (D) are protected under both regimes—GDPR treats financial data as personal data, and CCPA/CPRA specifically lists account numbers and financial information as protected personal information. Publicly listed company stock prices (A) are public market data, not personal data tied to an identifiable individual, so they fall outside these privacy laws. Internal server IP addresses (E) are not a protected data category per se; while an IP address can be personal data when linked to an individual, internal server IPs alone are infrastructure identifiers, not a regulated category under CCPA or GDPR.

Answer

Publicly listed company stock prices

Answer

Internal server IP addresses

Question 13

Which THREE of the following are valid methods for securing cloud-based data storage?

Accepted Answer

Configuring Virtual Private Cloud (VPC) endpoints. Option A is correct because configuring VPC endpoints (e.g., AWS PrivateLink gateway or interface endpoints for S3) keeps traffic to cloud storage on the private AWS network instead of traversing the public internet, reducing exposure and enabling endpoint policies. Option B is correct because enabling server-side encryption (SSE-S3, SSE-KMS, or SSE-C) ensures data at rest in the storage service is encrypted, protecting confidentiality if the underlying media is accessed. Option D is correct because enforcing IAM roles for storage access applies least-privilege, identity-based policies and temporary credentials, eliminating long-lived static keys and tightly scoping who can read or write objects. Option C is not valid because sharing storage URLs publicly exposes objects to anonymous access and is the opposite of securing storage. Option E is not valid because using a password for the root cloud account is a weak, non-scalable practice; root accounts should use MFA and be locked away, with IAM roles/users handling storage access instead.

Answer

Sharing storage URLs publicly

Answer

Using a password for the root cloud account

Question 14

Which TWO controls are necessary to maintain the integrity of a data warehouse?

Accepted Answer

Enforcing referential integrity constraints. Enforcing referential integrity constraints (A) is correct because it ensures that foreign keys in fact and dimension tables always reference valid primary keys, preventing orphaned or inconsistent records that would corrupt warehouse relationships and analytical results. Implementing data validation logic in ETL (C) is correct because validating, cleansing, and rejecting malformed or out-of-range data during extraction, transformation, and load stops bad data from entering the warehouse, directly preserving its accuracy and consistency. Increasing the number of database replicas (B) improves availability and read scalability, not data integrity, since replicas copy whatever data exists, including errors. Running backups every hour (D) supports recoverability and durability but does not prevent or detect inaccurate data. Using a specific naming convention for servers (E) is an administrative standardization that has no effect on the correctness or consistency of stored data.

Answer

Increasing the number of database replicas

Answer

Running backups every hour

Answer

Using a specific naming convention for servers

Question 15

Which THREE elements are essential when configuring Database Activity Monitoring (DAM)?

Accepted Answer

Identifying sensitive data objects. Database Activity Monitoring (DAM) requires knowing what to protect, so option B (identifying sensitive data objects) is essential because audit policies and monitoring scope must target the specific tables, columns, and schemas that contain regulated or high-value data. Option D (configuring alert thresholds) is correct because DAM generates alerts on suspicious activity, and thresholds define the conditions, severity, and volume of events that trigger notifications, preventing alert fatigue while ensuring real threats surface. Option E (defining audit rules for privileged users) is correct because privileged accounts such as DBAs and sysadmins often bypass application controls, so explicit audit rules capturing their SELECT, DML, DDL, and privilege changes are a core DAM requirement. Option A (upgrading the database server CPU) is not a DAM configuration element; it is a hardware capacity change unrelated to monitoring policy. Option C (installing extra network routers) is also irrelevant, as DAM relies on database-native auditing, network sniffing, or agent-based collection rather than additional routing infrastructure.

Answer

Upgrading the database server CPU

Answer

Installing extra network routers