49 questions · Data Governance And Security · All types, answers revealed
Which access control model should be implemented to ensure that a user can only access files based on their specific job role?
RBAC is the standard for role-centric access management.
Why this answer
Role-Based Access Control (RBAC) maps permissions to job functions rather than individual users.
A developer wants to use a subset of production data for testing. Which method ensures the test data retains its structure while protecting privacy?
Masking creates safe data for testing that looks like real data.
Why this answer
Data masking or de-identification replaces real values with realistic but fake values, maintaining schema integrity.
Your organization uses Azure Active Directory for access management. You need to ensure that database administrators can only access a specific production Azure SQL instance during a scheduled 4-hour maintenance window. Which control is most appropriate?
PIM allows for time-bound and approval-based access elevation.
Why this answer
Privileged Identity Management (PIM) provides just-in-time access, which is ideal for time-bound administrative access.
A company subject to GDPR needs to ensure that user data is deleted upon request across all distributed nodes in a NoSQL cluster. Which process is most critical to demonstrate compliance?
Data lineage ensures the organization knows where all copies of PII reside.
Why this answer
Data lifecycle management, specifically mapping data lineage and retention policies, is required to prove that data was effectively purged from all replicas.
Which TWO of the following are recognized components of a mature Data Governance framework? (Select TWO)
Ensuring data is accurate and consistent is a core pillar.
Why this answer
Data Cataloging and Data Quality standards are fundamental components of a governance framework.
An organization is migrating sensitive financial records to a cloud environment. Which security control ensures that only authorized applications can decrypt the data?
Cloud HSMs provide high-assurance storage for keys used by authorized applications.
Why this answer
Hardware Security Modules (HSM) provide the root of trust for encryption keys required by applications to decrypt data.
A company is conducting a data governance audit. Which TWO of the following items should be verified to ensure proper data security?
Regular reviews ensure the principle of least privilege.
Why this answer
Audits verify the implementation of technical controls like encryption and the existence of administrative processes like access reviews.
Which regulatory act specifically governs the protection of healthcare-related data?
HIPAA is the primary regulation for healthcare data privacy.
Why this answer
HIPAA sets the standard for protecting sensitive patient health information in the United States.
You are implementing a data governance framework. Which role is primarily responsible for ensuring that the data quality, security, and lifecycle policies are defined and adhered to for a specific business domain?
Data Stewards act as the bridge between governance policy and data application.
Why this answer
A Data Steward is responsible for the day-to-day management and quality of data within a business domain.
An administrator needs to restrict a user's ability to see only rows where the 'Region' column is 'North'. What feature should be used?
RLS dynamically filters rows based on a defined policy.
Why this answer
Row-Level Security (RLS) allows for the definition of predicates that filter query results based on user metadata.
An organization must ensure that PII in a legacy SQL Server database is masked before being accessed by the HR analytics team. Which SQL Server feature should the DBA implement to ensure the data is obscured at the query level without changing the underlying storage?
DDM provides a non-permanent way to obscure sensitive data for specific users.
Why this answer
Dynamic Data Masking (DDM) limits sensitive data exposure by masking it to non-privileged users in the result set of a query.
Which protocol should be enforced for all data-in-transit between application servers and database instances?
TLS provides secure, encrypted communication channels.
Why this answer
TLS (Transport Layer Security) is the industry standard for encrypting data while it travels over the network.
A company requires that all database backups be immutable for 7 years to meet regulatory audits. How can this be achieved?
WORM policies ensure data cannot be tampered with.
Why this answer
WORM (Write Once, Read Many) storage policies prevent files from being altered or deleted until the retention period expires.
A company needs to implement centralized identity management for all database administrators. Which service is appropriate?
Centralized directories simplify identity lifecycle management.
Why this answer
LDAP or Active Directory integration allows for centralized management of authentication and authorization across multiple database instances.
A data engineer is configuring an S3 bucket to comply with GDPR requirements regarding the 'Right to be Forgotten.' Which combination of configuration settings best automates the lifecycle of user-specific data objects that have reached the end of their retention period?
Lifecycle rules provide an automated mechanism to transition or expire objects based on age.
Why this answer
S3 Lifecycle policies allow for the automated deletion of objects based on expiration rules after a specific time period.
When decommissioning a legacy server, what is the most secure way to handle the hard drives containing sensitive data?
These are the only methods considered secure for sensitive data disposal.
Why this answer
Cryptographic erasure or physical destruction are the only ways to guarantee that data cannot be recovered from decommissioned media.
Which TWO controls are necessary to maintain the integrity of a data warehouse?
Constraints maintain the logical consistency of relationships.
Why this answer
Integrity is maintained through data validation during the ETL process and by enforcing referential integrity in the database schema.
Which THREE actions should be performed during a data incident response procedure involving a potential PII leak?
Investigation identifies the scope and root cause.
Why this answer
Incident response requires containment, investigation, and reporting to meet legal obligations like GDPR/CCPA.
When assessing data privacy compliance, which THREE categories of data are typically protected under laws like CCPA or GDPR?
Biometric information is considered highly sensitive.
Why this answer
PII, sensitive biometric data, and financial account information are primary targets for privacy regulation.
Which THREE of the following are valid methods for securing cloud-based data storage?
VPC endpoints keep traffic on the private cloud network.
Why this answer
Securing cloud storage requires a combination of IAM, encryption, and secure network configuration.
A company is migrating to a cloud data warehouse and must comply with CCPA requirements for data portability. Which action is necessary to ensure compliance regarding user access requests?
Providing a machine-readable export satisfies the portability requirement.
Why this answer
Data portability under CCPA requires that the organization can export user data in a readily usable format.
A database administrator needs to implement column-level encryption for sensitive PII in a SQL Server environment. Which tool should be used to ensure the encryption keys are managed outside the database engine?
This feature allows for column-level encryption where the key resides in a secure external HSM.
Why this answer
Azure Key Vault is the industry-standard service for managing encryption keys independently of the database engine, ensuring separation of duties.
A company needs to audit all administrative actions taken on their database server. Which feature should the DBA enable?
Enabling audit logs captures the who, what, and when of database interactions.
Why this answer
Database Auditing logs all DDL and DML operations, providing the evidence needed for compliance reporting.
Which TWO actions constitute good data lifecycle management?
Policies dictate how long data should be kept.
Why this answer
Data lifecycle management includes defining retention periods and identifying when to archive vs. destroy data.
Which TWO of the following are common administrative tasks in a Data Governance program?
The catalog must be updated as new data is added.
Why this answer
Governance administrators manage the metadata catalog and oversee the access request/approval process.
Which type of data is defined as 'sensitive' and usually requires enhanced protection?
PII is highly regulated and requires specific controls.
Why this answer
Personally Identifiable Information (PII) is subject to strict regulatory requirements and must be protected.
Which THREE elements are essential when configuring Database Activity Monitoring (DAM)?
Focusing monitoring on PII/sensitive data is more effective.
Why this answer
DAM requires defining the scope (what to monitor), the sensitivity of the data, and the alerting rules for suspicious activity.
A data analyst discovers that raw log files contain unmasked social security numbers. Which data governance practice should be implemented immediately to remediate the risk?
DDM obscures sensitive data from unauthorized users at the query layer.
Why this answer
Data masking at the ingestion layer prevents sensitive data from being written to logs in clear text.
Which technology provides the best protection against data exfiltration from an on-premises database by a rogue administrator?
DAM and firewalls can block queries that indicate bulk exfiltration.
Why this answer
A Database Firewall inspects incoming and outgoing SQL traffic to block unauthorized queries or data exports.
An administrator needs to restrict access to a specific S3 bucket so that only the Finance team can view files. Which configuration is the most effective approach?
Bucket policies allow for fine-grained resource-based access control.
Why this answer
IAM policies attached to the specific bucket (Bucket Policies) are the primary control for S3 access management.
Which THREE of the following are recognized data governance best practices?
Owners are responsible for the security and quality of their data.
Why this answer
Effective governance includes defining data ownership, maintaining a metadata catalog, and ensuring data quality.
Which document is essential to establish the legal basis for processing personal data under GDPR between a controller and a processor?
The DPA outlines the processing obligations and security standards.
Why this answer
A Data Processing Agreement (DPA) is a mandatory contract under GDPR that specifies the responsibilities of the data controller and the data processor.
As a Data Privacy Officer, you are reviewing technical controls for data security. Which TWO of the following are best practices to ensure 'Privacy by Design' in a new application? (Select TWO)
Restrictive defaults ensure that users are protected until they choose to change settings.
Why this answer
Privacy by Design requires embedding privacy controls like pseudonymization and default data settings into the development lifecycle.
When reviewing a database security configuration, which finding poses the highest risk?
Default credentials are a critical security vulnerability.
Why this answer
Default accounts (like 'admin' or 'sa') with default passwords are the most common entry points for attackers.
Which action represents a 'Data Lifecycle' phase where data is safely removed?
Disposition is the final stage of the lifecycle.
Why this answer
The 'Disposition' or 'Destruction' phase involves securely deleting data that is no longer required.
To ensure non-repudiation in a database system, what must be captured for every transaction?
Unique IDs linked to actions ensure accountability.
Why this answer
Detailed audit logs including a timestamp, user ID, and the executed command provide the necessary evidence for non-repudiation.
What is the first step in a Data Governance program?
You cannot govern what you haven't identified.
Why this answer
Identifying and classifying data assets is the prerequisite to applying any security controls.
What is the primary purpose of a Data Protection Impact Assessment (DPIA) under GDPR?
DPIA is a formal process for risk assessment in data projects.
Why this answer
A DPIA identifies and minimizes data protection risks associated with new data processing activities.
You are evaluating the data lifecycle of an organization's unstructured data. Which THREE actions should be included in a robust Data Retention and Disposal policy? (Select THREE)
Classification determines how long data must be kept.
Why this answer
Retention policies must define how data is stored, categorized by sensitivity, and securely destroyed.
In a multi-tenant cloud database, which mechanism ensures that tenant A cannot see data belonging to tenant B?
RLS enforces data isolation at the record level.
Why this answer
Row-Level Security (RLS) restricts rows in a table based on user or application context, effectively enforcing logical isolation.
Which of the following is a common symptom of a broken access control mechanism in a database?
IDOR occurs when a user can manipulate an input to access another user's data.
Why this answer
Insecure Direct Object References (IDOR) allow users to access resources they should not, indicating broken access control.
A security team is implementing an access management strategy. Which THREE of the following are considered essential components of an effective Identity and Access Management (IAM) framework?
Verifies the user's identity.
Why this answer
IAM frameworks rely on Authentication (who you are), Authorization (what you can do), and Auditing (tracking what you did).
An organization uses a 'bring your own key' (BYOK) model for database encryption. What is the primary benefit?
BYOK ensures the data owner manages the lifecycle of the key.
Why this answer
BYOK allows the organization to retain full control over the encryption keys, preventing the cloud provider from accessing the data.
Which TWO technologies or methods are most effective at protecting sensitive data against insider threats?
DLP monitors and blocks data exfiltration attempts.
Why this answer
Separation of duties and Data Loss Prevention (DLP) tools are the most effective ways to mitigate the risk posed by users with elevated privileges.
Which document outlines the 'Data Owner' responsibilities in a data governance framework?
The charter defines the governance framework and roles.
Why this answer
A Data Governance Charter defines roles, responsibilities, and decision-making authority within the organization.
A company is using a cloud-based data lake. To satisfy data sovereignty requirements, they must ensure data remains in a specific region. How can this be enforced?
Resource policies prevent the creation of assets outside allowed regions.
Why this answer
Cloud providers use resource location constraints and policy-based tags to restrict where data can be physically stored.
You are auditing data security controls. You find that raw sensitive data is being written to application logs by the ETL process. Which remediation step best aligns with the principle of 'Data Minimization'?
Redaction prevents sensitive data from ever reaching the logs, upholding minimization.
Why this answer
Data minimization dictates that you should only collect and process the data strictly necessary for the purpose, which includes removing sensitive data from logs.
To comply with CCPA, an organization must track the 'Right to Know' requests. Which component of a Data Governance Framework is most relevant?
Catalogs map data assets to owners and sensitivity levels.
Why this answer
Data Cataloging allows for the inventory and metadata management necessary to respond to data access requests.
An administrator needs to enforce password complexity on the database level. Where should this policy be configured?
Authentication policies define the requirements for user credentials.
Why this answer
Password policies for database users are typically managed via the database's built-in authentication provider or integrated identity management system.
Ready to test yourself?
Try a timed practice session using only Data Governance And Security questions.