CDS Security & Access Management 2 — Questions and Answers
Question 1: Which access control model assigns permissions based on a user's job function within an organization?
- Discretionary Access Control (DAC)
- Mandatory Access Control (MAC)
- Role-Based Access Control (RBAC) (Correct answer)
- Attribute-Based Access Control (ABAC)
Correct answer: Role-Based Access Control (RBAC)
RBAC grants access rights based on roles assigned to users according to their organizational function, simplifying permission management.
Question 2: A data steward discovers that a former employee's account still has active access to sensitive data repositories three months after termination. This is an example of failure in which process?
- Data classification
- Access recertification (Correct answer)
- User provisioning
- Data masking
Correct answer: Access recertification
Access recertification (periodic review and validation of user access rights) should have detected and removed the terminated employee's access.
Question 3: What is the primary purpose of data masking in a security context?
- Encrypting data in transit between systems
- Replacing sensitive data with realistic but fictitious values for non-production use (Correct answer)
- Preventing unauthorized users from logging into systems
- Auditing who accessed sensitive records
Correct answer: Replacing sensitive data with realistic but fictitious values for non-production use
Data masking substitutes real sensitive data with structurally similar but non-sensitive values, allowing development and testing without exposing real PII.
Question 4: Under the principle of separation of duties, which scenario represents a control violation?
- A DBA backs up the database and a separate analyst restores it for testing
- The same employee both approves data access requests and provisions those access rights (Correct answer)
- Two different teams maintain production and development environments
- An auditor reviews access logs that administrators generated
Correct answer: The same employee both approves data access requests and provisions those access rights
Separation of duties requires that no single individual can both authorize and implement a sensitive action, preventing fraud and errors.
Question 5: Which encryption approach is most appropriate for protecting data stored in a database at rest?
- TLS/SSL encryption
- Transparent Data Encryption (TDE) (Correct answer)
- Hashing with MD5
- VPN tunneling
Correct answer: Transparent Data Encryption (TDE)
TDE encrypts database files on disk transparently, protecting data at rest without requiring application-level changes.
Question 6: A data steward is asked to define a policy for how long access audit logs must be retained. Which factor should most heavily influence this decision?
- Available disk storage capacity
- Regulatory and legal requirements applicable to the organization (Correct answer)
- The frequency of user password changes
- Network bandwidth limitations
Correct answer: Regulatory and legal requirements applicable to the organization
Regulatory requirements (such as HIPAA, SOX, or GDPR) mandate specific audit log retention periods that organizations must follow.
Question 7: What does 'need-to-know' mean in the context of data access control?
- Users must be informed about all data the organization holds on them
- Access is granted only when a user requires data to perform a specific job function (Correct answer)
- All employees need to know the organization's data security policies
- Data owners must know who has access to their datasets at all times
Correct answer: Access is granted only when a user requires data to perform a specific job function
Need-to-know restricts access so individuals receive only the data required to perform their specific duties, limiting exposure of sensitive information.
CDS Security & Access Management 2
Which access control model assigns permissions based on a user's job function within an organization?