Scenarios 01–06
Attempt the decision before reading the Expected reasoning line.
1 — Correct login, wrong data
Situation: payroll analyst logs in successfully but can see executive salary data not required by the job.
Decision: Which control decision is wrong?
Expected reasoning: Authentication succeeded; Authorization/Entitlement is wrong. Apply least privilege and redesign the role/entitlement.
2 — Production data copied to Test
Situation: test team wants an exact customer-PII copy in a weak non-production environment.
Decision: What should Data Management challenge?
Expected reasoning: reduce exposure. Keep Production data out where possible or use Persistent masking—preferably In-flight for a destination copy—while preserving test relationships.
3 — Call-center verification
Situation: representative needs only the last four digits of a national ID; database must retain full value.
Decision: Which masking approach?
Expected reasoning: Dynamic masking: protect the display without changing underlying Production data.
4 — Bulk patient export
Situation: employee legitimately may view one patient at a time but uses another tool to export the full population.
Decision: Which risk pattern?
Expected reasoning: legitimate-privilege abuse. The original entitlement can be valid while purpose/volume is not; use contextual/query/endpoint controls and monitoring.
5 — Developer becomes DBA
Situation: developer exploits a vulnerable stored function and gains administrator rights.
Decision: Which risk pattern?
Expected reasoning: unauthorized privilege elevation. Remediate the vulnerability and combine prevention/detection with least-privilege controls.
6 — Generic support login
Situation: ten support staff share one account because individual IDs cost more.
Decision: Why unsafe?
Expected reasoning: shared-account use destroys individual accountability and makes activity difficult to attribute.