CDS Security & Access Management 3 — Questions and Answers
Question 1: Which technique involves replacing sensitive data elements with a non-sensitive substitute that maintains a consistent reference, allowing data to be tracked across systems without exposing the original value?
- Data encryption
- Tokenization (Correct answer)
- Data anonymization
- Data aggregation
Correct answer: Tokenization
Tokenization replaces sensitive data with a token (surrogate value) that can be mapped back to the original in a secure token vault, unlike encryption it cannot be reversed without vault access.
Question 2: An organization wants to ensure that access to its most sensitive data requires both a password and a physical security key. Which security control does this represent?
- Single sign-on (SSO)
- Multi-factor authentication (MFA) (Correct answer)
- Privileged access management (PAM)
- Federated identity management
Correct answer: Multi-factor authentication (MFA)
MFA requires two or more verification factors from different categories (knowledge, possession, inherence), making unauthorized access significantly harder.
Question 3: When a data steward reviews a request to give an analyst read access to a production customer table, what is the FIRST question they should ask?
- What database platform is the table stored on?
- What is the business justification for this access? (Correct answer)
- How long has the analyst been employed at the company?
- Does the analyst have a security certification?
Correct answer: What is the business justification for this access?
The business justification establishes whether the access request aligns with need-to-know principles before any technical provisioning is considered.
Question 4: What is a 'data classification scheme' primarily used for in security and access management?
- Organizing data by alphabetical order for easy retrieval
- Categorizing data by sensitivity level to determine appropriate security controls (Correct answer)
- Grouping data by creation date to manage retention schedules
- Ranking data by business value for prioritizing backups
Correct answer: Categorizing data by sensitivity level to determine appropriate security controls
Data classification assigns sensitivity labels (e.g., Public, Internal, Confidential, Restricted) that drive which security controls, access restrictions, and handling procedures apply.
Question 5: A company's data steward notices that database administrators have full read access to all HR salary data, though their role requires only system maintenance. What principle is being violated?
- Data sovereignty
- Least privilege (Correct answer)
- Data integrity
- Chain of custody
Correct answer: Least privilege
The principle of least privilege states that users should have only the minimum access rights needed to perform their job functions — nothing more.
Question 6: Which of the following best describes 'privileged access management' (PAM)?
- Giving senior executives unrestricted access to all company data
- Controlling, monitoring, and auditing access for accounts with elevated system permissions (Correct answer)
- Managing employee benefits through a human resources portal
- Allowing customers to manage their own data preferences
Correct answer: Controlling, monitoring, and auditing access for accounts with elevated system permissions
PAM focuses on securing, controlling, and monitoring the use of privileged accounts (admins, service accounts) that have elevated permissions to critical systems.
Question 7: An organization implements a policy where all data access by third-party vendors must be logged and reviewed weekly. This is an example of which security practice?
- Data lineage tracking
- Third-party access governance (Correct answer)
- Data quality monitoring
- Capacity planning
Correct answer: Third-party access governance
Third-party access governance extends access controls and monitoring to external parties (vendors, contractors) who have been granted access to organizational data.
CDS Security & Access Management 3
Which technique involves replacing sensitive data elements with a non-sensitive substitute that maintains a consistent reference, allowing data to be tracked across systems without exposing the original value?