View Full CompTIA DataSys+ DS0-001 Exam Dumps and Practice Test Dumps

 

Question 381.

A database administrator discovers that a production database contains several undocumented configuration changes that differ from the approved security baseline. What should the administrator do FIRST?

1. Compare the current configuration with approved change records and determine whether the differences are authorized
2. Reinstall the database immediately
3. Disable all auditing
4. Delete the baseline documentation

Correct Answer: 1. Compare the current configuration with approved change records and determine whether the differences are authorized

Explanation:

Configuration differences are not automatically evidence of compromise because legitimate maintenance or troubleshooting may have introduced approved changes. The administrator should first compare the detected drift with change-management records, deployment history, maintenance tickets, and authorized exceptions. Any unexplained differences should then be investigated as possible unauthorized changes or operational mistakes. If a configuration creates immediate security or availability risk, containment may be necessary while the investigation continues. The approved baseline provides the reference point for determining expected settings, so deleting it would remove useful evidence. Auditing should generally remain enabled to preserve accountability. A controlled review of configuration drift helps distinguish intended changes from accidental or malicious modifications and supports accurate remediation without unnecessarily disrupting production service.

Question 382.

A database administrator wants to verify whether a recently created database account has more privileges than required for its job function. Which principle should guide the review?

1. Maximum availability
2. Least privilege
3. Data compression
4. Horizontal scaling

Correct Answer: 2. Least privilege

Explanation:

Least privilege means granting an account only the permissions necessary to perform its assigned tasks and no more. The administrator should review direct permissions, inherited role membership, object-level access, administrative capabilities, and any temporary privileges that may have become permanent. Excessive permissions increase the impact of credential compromise, application defects, or accidental commands. For example, a reporting account may require SELECT access but should not automatically receive INSERT, DELETE, schema modification, or database-owner privileges. Periodic access reviews help detect privilege accumulation as employees and applications change responsibilities over time. Availability, compression, and scaling are important database concerns but do not determine whether an identity has appropriate authorization.

Question 383.

A database contains a table named Employees with a DepartmentID foreign key. The company wants to prevent deletion of a department while employees still reference it. Which referential action BEST supports this requirement?

1. CASCADE DELETE
2. SET NULL automatically for every employee
3. RESTRICT or NO ACTION on the parent deletion
4. Disable the foreign key

Correct Answer: 3. RESTRICT or NO ACTION on the parent deletion

Explanation:

RESTRICT or NO ACTION prevents deletion of a parent row when dependent child rows still reference it, depending on the database platform’s implementation. This protects referential integrity by ensuring employees cannot be left pointing to a department that no longer exists. CASCADE DELETE would automatically delete related employee rows, which is inappropriate when the business wants to preserve them. SET NULL might be valid in some data models but would intentionally remove the department relationship and requires the foreign key column to permit NULL. Disabling the constraint eliminates an important integrity control. Referential actions should reflect business rules rather than convenience because automatic delete or update behavior can have significant consequences for data consistency.

Question 384.

A database table uses ON DELETE CASCADE between Orders and OrderItems. What happens when a qualifying parent order is deleted?

1. Only indexes are removed
2. The database becomes read-only
3. The parent row cannot be deleted under any circumstances
4. Related child OrderItems are automatically deleted**

Correct Answer: 4. Related child OrderItems are automatically deleted

Explanation:

ON DELETE CASCADE instructs the database to automatically remove dependent child rows when the referenced parent row is deleted. In an Orders and OrderItems relationship, deleting an order can therefore remove its associated order-line records without requiring separate DELETE statements. This behavior can preserve referential consistency and simplify application logic, but it must be used carefully. A mistaken parent deletion can remove a large number of child records quickly, so permissions, backups, auditing, and application safeguards remain important. Cascade behavior should be documented and tested so administrators understand the impact of parent-table operations. It is not the same as preventing deletion; RESTRICT or NO ACTION would be more appropriate when the parent must remain while child rows exist.

Question 385.

Which SQL command is MOST appropriate for removing a user’s permission to SELECT from a sensitive table?

1. REVOKE
2. COMMIT
3. INSERT
4. CREATE

Correct Answer: 1. REVOKE

Explanation:

REVOKE removes previously granted privileges from a user or role. If an account no longer requires access to a sensitive table, the administrator can revoke the relevant SELECT permission directly or remove the user from a role that provides it. Permission changes should follow organizational authorization and change-management procedures, especially for production systems. The administrator should also verify whether the user retains access through another role or inherited permission path. COMMIT controls transaction completion, INSERT adds data, and CREATE defines objects. Effective access management requires understanding both direct and indirect privileges so revoked access is actually removed in practice.

Question 386.

Which SQL command is used to assign a database permission such as SELECT or EXECUTE to a user or role?

1. ROLLBACK
2. GRANT
3. DROP
4. TRUNCATE

Correct Answer: 2. GRANT

Explanation:

GRANT provides a user or role with specific database privileges, such as SELECT on a table or EXECUTE on a stored procedure. Administrators should grant permissions according to least privilege and preferably use roles when multiple users require the same access pattern. Role-based permissions are generally easier to maintain and review than large numbers of individual grants. Permissions should also be documented and periodically reassessed because employees, applications, and business requirements change. ROLLBACK reverses uncommitted transaction changes, DROP removes objects, and TRUNCATE removes table rows. Authorization commands should be treated as security-sensitive changes and included in appropriate auditing and approval processes.

Question 387.

A database administrator wants to reduce SQL injection risk in a stored procedure that accepts user input. Which design is BEST?

1. Concatenate raw user input directly into dynamic SQL
2. Give the application database-owner privileges
3. Use parameterized statements and validate input where appropriate
4. Disable query logging

Correct Answer: 3. Use parameterized statements and validate input where appropriate

Explanation:

Parameterized statements keep user-supplied values separate from executable SQL syntax, reducing the likelihood that malicious input will alter the intended command structure. Stored procedures are not automatically safe from SQL injection if they build dynamic SQL by concatenating untrusted strings. Input validation can provide an additional layer of defense by confirming expected formats, ranges, and allowed values. The application account should also follow least privilege so a successful injection attempt cannot perform unrestricted administrative actions. Disabling logging weakens detection and investigation. Secure query construction, limited permissions, input controls, and monitoring work together to reduce both the likelihood and impact of injection attacks.

Question 388.

A database administrator discovers that application developers have stored plaintext database passwords in a source-code repository. What is the BEST corrective action?

1. Leave the passwords because the repository is private
2. Rename the files containing the passwords
3. Encode the passwords with Base64 and commit them again
4. Remove the exposed credentials, rotate them, and move secrets to an approved secrets-management system**

Correct Answer: 4. Remove the exposed credentials, rotate them, and move secrets to an approved secrets-management system

Explanation:

Once credentials have been committed to source control, they should be treated as potentially exposed because repository history, backups, forks, developer systems, or integrations may retain copies. Simply deleting the current file does not invalidate the credential. The administrator should rotate the database password or token, remove unnecessary copies where practical, and migrate secret storage to an approved vault or secrets-management platform. Access to the repository history may also need review. Base64 is only encoding and provides no meaningful protection. Even private repositories can be compromised or accessed by more users than the database itself. Credential rotation combined with least privilege and secure secret distribution provides a stronger long-term solution.

Question 389.

A database administrator needs to ensure that passwords stored for application users cannot be recovered in plaintext from the database. Which approach is MOST appropriate?

1. Store passwords using a strong, salted password-hashing algorithm
2. Store passwords in a readable text column
3. Encrypt every password with one hard-coded application key only
4. Store passwords in database comments

Correct Answer: 1. Store passwords using a strong, salted password-hashing algorithm

Explanation:

User passwords generally should not be stored in reversible form when the application only needs to verify whether a supplied password is correct. A purpose-built password-hashing algorithm with unique salts makes offline cracking more difficult and prevents identical passwords from producing identical stored representations. The exact approved algorithm and work factor should follow current organizational and security guidance. General-purpose fast hashing functions alone are usually not sufficient for password storage. Reversible encryption may be appropriate for some secrets that must later be recovered, but user authentication passwords normally do not require plaintext recovery. Hard-coded keys create additional compromise risk. Proper password handling should also include secure transport, rate limiting, multifactor authentication where appropriate, and protection of reset mechanisms.

Question 390.

A database administrator wants to protect individual highly sensitive columns even if someone gains access to the underlying database files. Which control is MOST directly applicable?

1. Query pagination
2. Column-level encryption
3. Table partitioning
4. Index reorganization

Correct Answer: 2. Column-level encryption

Explanation:

Column-level encryption protects selected sensitive fields such as account numbers, government identifiers, or other confidential values. It can provide more granular protection than encrypting an entire storage volume or database file, although it also introduces application, indexing, key-management, and query-design complexity. Access to encryption keys must be tightly controlled because anyone who can obtain both the encrypted data and the keys may be able to recover plaintext. Depending on the database platform, encryption and decryption may occur in the application, database engine, or dedicated security component. Pagination, partitioning, and index maintenance address performance or manageability rather than confidentiality of specific stored fields.

Question 391.

A database administrator wants to confirm that encrypted backups will remain recoverable after an encryption-key rotation. What should be done?

1. Delete all older keys immediately
2. Disable backup encryption before rotating keys
3. Retain required historical keys securely and perform restore testing
4. Rename encrypted backup files

Correct Answer: 3. Retain required historical keys securely and perform restore testing

Explanation:

Key rotation improves security, but older encrypted backups may still depend on historical keys or certificates. If those keys are destroyed before all dependent backups expire, the organization may lose the ability to restore otherwise valid recovery copies. Key-management procedures should therefore map key versions to backup retention periods and preserve historical material securely for as long as required. Access should remain tightly controlled and audited. Test restores after rotation can confirm that key retrieval, certificate chains, backup files, and recovery documentation all work correctly. Disabling encryption would weaken confidentiality, while renaming files provides no assurance that the data can be decrypted.

Question 392.

A database administrator needs to allow analysts to query production-like information without exposing real customer identifiers. Which technique is MOST appropriate?

1. Grant analysts full production access
2. Disable authentication on the analytical database
3. Copy production data unchanged to a shared server
4. Use masking, tokenization, anonymization, or synthetic data appropriate to the use case**

Correct Answer: 4. Use masking, tokenization, anonymization, or synthetic data appropriate to the use case

Explanation:

Non-production and analytical environments should expose only the level of sensitive information required for the task. Masking can replace sensitive values with realistic substitutes, tokenization can substitute controlled tokens, anonymization can reduce or remove the ability to identify individuals, and synthetic data can avoid using real customer records entirely. The correct technique depends on testing, analytical, privacy, and reidentification requirements. Simply copying production data expands the number of systems and people that can access sensitive information. Lower environments may also have weaker monitoring or security controls, increasing risk. Data minimization and least privilege should therefore be incorporated into dataset preparation rather than relying solely on trust in individual users.

Question 393.

A database administrator observes that audit logs record successful logins but not failed administrator login attempts. Why is this a security concern?

1. Failed login activity can help identify brute-force attacks, misconfiguration, or unauthorized access attempts
2. Failed logins always indicate database corruption
3. Failed logins automatically delete backups
4. Failed logins reduce index selectivity

Correct Answer: 1. Failed login activity can help identify brute-force attacks, misconfiguration, or unauthorized access attempts

Explanation:

Failed authentication attempts can provide valuable evidence of password guessing, credential-stuffing attacks, stale service credentials, configuration errors, or unauthorized access attempts. If only successful logins are captured, security teams may miss the early indicators of an attack or be unable to reconstruct how an attacker attempted to gain access. Audit policies should capture events that are meaningful for the organization’s risk profile without producing unmanageable noise. Repeated failures against privileged accounts may warrant higher-severity alerts. Logs should include useful context such as account, timestamp, source, and result while avoiding unnecessary sensitive data. Failed logins do not directly cause corruption, backup deletion, or index changes.

Question 394.

A database administrator wants to prevent audit logs from being altered by the same privileged account being monitored. Which design is BEST?

1. Store the only audit copy in a table that the administrator can freely edit
2. Forward audit events to a protected external logging system with restricted modification rights
3. Disable auditing for privileged accounts
4. Keep logs only in application memory

Correct Answer: 2. Forward audit events to a protected external logging system with restricted modification rights

Explanation:

Audit records should be protected from the identities whose actions they are intended to monitor. Forwarding events to a centralized logging or security monitoring platform can separate log administration from database administration and make unauthorized deletion or modification more difficult. Access controls, append-oriented storage, retention policies, encryption, integrity mechanisms, and time synchronization can further strengthen audit reliability. Keeping the only copy inside the database may allow a sufficiently privileged account to alter or delete evidence. Disabling privileged-account auditing removes visibility into the highest-impact activity. Memory-only logs can disappear during restarts or failures. Separation of duties improves trust in the evidence produced by database monitoring.

Question 395.

A database administrator notices that default vendor accounts are still enabled even though they are not required. What is the BEST action?

1. Disable or remove unnecessary default accounts according to vendor guidance and organizational policy
2. Grant the default accounts administrator privileges
3. Publish the default passwords for support staff
4. Ignore the accounts because nobody is currently using them

Correct Answer: 1. Disable or remove unnecessary default accounts according to vendor guidance and organizational policy

Explanation:

Unused default accounts increase the attack surface because their names may be widely known and their configuration may be overlooked during normal access reviews. If an account is not required, it should be disabled or removed in accordance with vendor recommendations and organizational hardening standards. Required default or service accounts should have secure credentials, appropriate permissions, monitoring, and documented ownership. Administrators should also review sample databases, unnecessary services, default network listeners, and other vendor-installed features as part of system hardening. An account does not become safe merely because legitimate users do not currently use it. Attackers specifically look for forgotten identities and default configurations that may provide easy entry into a system.

Question 396.

A database server is running several optional features and services that the organization does not use. Which security-hardening principle applies?

1. Enable every available feature for future flexibility
2. Reduce the attack surface by disabling unnecessary services and components
3. Give all users access to optional features
4. Remove all monitoring before disabling services

Correct Answer: 2. Reduce the attack surface by disabling unnecessary services and components

Explanation:

Every enabled service, protocol, extension, listener, or optional database feature can introduce additional code paths, permissions, configuration settings, and potential vulnerabilities. If a component is not required for business functionality, disabling or removing it can reduce the attack surface and simplify patching and monitoring. Administrators should first confirm dependencies and follow approved change procedures so they do not accidentally disrupt applications. The hardened configuration should then be documented as part of the database security baseline. Enabling every feature increases complexity and risk, while broad user access violates least privilege. Monitoring should remain in place so the team can verify that hardening changes have not caused unexpected availability or security issues.

Question 397.

A database administrator must apply a critical security patch, but the database supports an essential service that cannot tolerate unplanned downtime. Which approach is BEST?

1. Review vendor guidance, test the patch, verify backups and rollback, then deploy through the approved high-availability or maintenance process
2. Ignore the vulnerability permanently
3. Install the patch immediately on every node simultaneously without testing
4. Disable backups to shorten maintenance time

Correct Answer: 1. Review vendor guidance, test the patch, verify backups and rollback, then deploy through the approved high-availability or maintenance process

Explanation:

Critical security vulnerabilities should be remediated promptly, but production patching still requires disciplined preparation. Administrators should confirm that the installed version is affected, review vendor advisories and known issues, test the update against representative applications, verify recoverability, and prepare rollback procedures. In a redundant cluster, rolling maintenance may permit one node to be patched while another continues serving the workload, depending on platform support. Monitoring should verify replication, service health, and application performance throughout the process. Ignoring a critical vulnerability leaves the organization exposed, while patching every node simultaneously can create unnecessary outage risk. Disabling backups removes a safety mechanism precisely when a significant system change is occurring.

Question 398.

A database administrator wants to determine whether servers are missing security patches or running unsupported versions. Which operational process is MOST useful?

1. Query pagination
2. Data deduplication
3. Patch and vulnerability management based on an accurate asset inventory
4. Index compression

Correct Answer: 3. Patch and vulnerability management based on an accurate asset inventory

Explanation:

Patch and vulnerability management depends on knowing which database products, operating systems, versions, extensions, and supporting components are actually deployed. An accurate asset inventory allows administrators to compare installed versions with vendor support policies, security advisories, and required patch levels. Unsupported software may no longer receive fixes and should be upgraded, migrated, or retired through controlled lifecycle planning. Vulnerability findings should be prioritized according to severity, exposure, exploitability, business criticality, and available compensating controls. Pagination, deduplication, and compression are useful database techniques but do not identify outdated software. Asset management and patching should be continuous processes rather than one-time activities performed only after a public security incident.

Question 399.

A security review finds that a database account has not been used for 18 months but still has administrator privileges. What is the BEST response?

1. Review the account’s ownership and business need, then disable or remove it if no longer required
2. Increase the account’s privileges
3. Share the account with new administrators
4. Exclude the account from future audits

Correct Answer: 1. Review the account’s ownership and business need, then disable or remove it if no longer required

Explanation:

Dormant privileged accounts are particularly risky because they may be forgotten while still retaining powerful permissions. The administrator should identify the owner, confirm whether the account has a legitimate current purpose, and disable or remove it if unnecessary. If retention is required for historical attribution, audit records can be preserved without leaving the login active. Privileged identities should be reviewed more frequently than ordinary accounts and should use strong authentication, controlled elevation, and individual accountability wherever possible. Sharing dormant accounts would make attribution more difficult and expand exposure. Excluding such accounts from audits would hide precisely the type of excessive privilege that access reviews are intended to detect.

Question 400.

Which statement BEST describes a comprehensive database security program?

1. Database security is achieved once strong passwords are configured
2. Security is primarily the responsibility of the network firewall
3. Backups eliminate the need for access controls and auditing
4. Comprehensive security combines identity management, least privilege, secure configuration, encryption, patching, network controls, auditing, data protection, backup security, monitoring, governance, and continuous review**

Correct Answer: 4. Comprehensive security combines identity management, least privilege, secure configuration, encryption, patching, network controls, auditing, data protection, backup security, monitoring, governance, and continuous review

Explanation:

Database security requires multiple complementary controls because no single mechanism addresses every risk. Identity management and strong authentication determine who can connect, while least privilege limits what authenticated users can do. Secure configuration reduces unnecessary exposure, encryption protects sensitive data, network controls restrict access paths, and patching addresses known vulnerabilities. Auditing and monitoring provide accountability and help detect suspicious behavior. Backup security ensures recovery copies do not become an easier path to sensitive information, while masking or anonymization can reduce exposure in non-production environments. Governance establishes ownership, classification, retention, and accountability across the data lifecycle. These controls must be reviewed continuously as software versions, workloads, threats, users, and business requirements change. A mature security program therefore treats protection as an ongoing operational discipline rather than a one-time configuration exercise.