Practice Questions DS7-029–DS7-042
For each: Your answer: ___ · Confidence: _/5 · Time: ___ sec · Review: ☐
DS7-029 — Excessive Privilege · Standard · Distinguish
A user is granted far more database rights than the job requires because granular entitlements are difficult to manage. What risk is this? - A. Abuse of excessive privilege. - B. Abuse of legitimate privilege. - C. Unauthorized privilege elevation. - D. SQL injection.
DS7-030 — Legitimate Privilege Abuse · Standard · Apply
A healthcare worker legitimately may view individual patient records but uses another tool to download the entire patient database for an unauthorized purpose. What fits best? - A. Excessive privilege only. - B. Abuse of legitimate privilege. - C. Default-password risk. - D. Backup-data abuse.
DS7-031 — Privilege Elevation · Difficult · Apply
A developer exploits a vulnerable database function to gain administrator privileges and disable auditing. What is this? - A. Shared-account abuse. - B. Platform patch delay. - C. Unauthorized privilege elevation. - D. Dynamic masking failure.
DS7-032 — Service vs Shared Accounts · Standard · Distinguish
Which statement best distinguishes a service account from a shared account? - A. Service account is always one named employee; shared account always vendor. - B. Service account cannot have elevated privileges; shared account can. - C. They are equivalent labels. - D. Service account is typically a process/batch ID for specific tasks; shared account is a generic ID used by multiple people.
DS7-033 — IDS vs IPS · Standard · Distinguish
Which tool is primarily designed to notify appropriate people when an inappropriate incident is detected? - A. Intrusion Detection System (IDS). - B. Intrusion Prevention System (IPS). - C. Role hierarchy. - D. CRUD matrix.
DS7-034 — SQL Injection · Difficult · Understand
What does Chapter 7 describe as the core mechanism of SQL injection? - A. User is tricked into sharing a password over the phone. - B. Unauthorized database statements are inserted into a vulnerable SQL data channel and executed as legitimate commands. - C. A worm consumes network bandwidth. - D. A backup file is stolen from off-site storage.
DS7-035 — Phishing · Standard · Distinguish
A message appears to come from a trusted organization and asks the recipient to confirm a password and account number. What is this? - A. Spyware. - B. Trojan horse. - C. Phishing. - D. Penetration testing.
DS7-036 — Virus vs Worm · Standard · Distinguish
Which statement correctly distinguishes a virus from a worm? - A. Virus always harmless; worm destructive. - B. Virus only mobile; worm only servers. - C. Virus is phishing; worm is spyware. - D. Virus needs to accompany another program/file; worm reproduces and spreads across a network by itself.
DS7-037 — Activity Sequence · Standard · Recall
Which sequence best reflects Chapter 7's activity flow? - A. Identify requirements → define policy → define standards → assess current risks → implement controls/procedures. - B. Implement controls → write requirements → model → define policy. - C. Define standards → ignore risk → outsource → audit once. - D. Purchase tools → classify later → eliminate business access.
DS7-038 — Business Requirements · Standard · Apply
What technique does Chapter 7 recommend for mapping business-process security touch points and guiding role-group permissions? - A. Data-quality scorecard. - B. Data-to-process and data-to-role relationship matrices. - C. Data-retention schedule only. - D. Network topology diagram only.
DS7-039 — Regulation Inventory · Standard · Apply
What should a central regulatory inventory connect together? - A. Only regulation name/publication date. - B. Only affected application server. - C. Regulation, affected data subject area, related security-policy links, and implemented controls. - D. Only responsible lawyer.
DS7-040 — Policy vs Standard · Difficult · Distinguish
A corporate rule says passwords must be “strong.” A separate document specifies minimum length, complexity, and measurable requirements. How is the second document classified? - A. Audit. - B. Entitlement. - C. Risk classification. - D. Standard.
DS7-041 — Data Security Policy · Standard · Recall
According to Chapter 7, who should review and approve the Data Security Policy? - A. Data Governance Council. - B. Only DBA team. - C. Only external auditors. - D. Each user individually.
DS7-042 — Role-Based Access · Standard · Apply
A large enterprise wants to reduce redundant individual permission assignments across thousands of employees. What approach does Chapter 7 favor? - A. Unique ad-hoc permissions with no grouping. - B. Role-based access control using role groups. - C. One shared account per department. - D. Broad read access for all, then monitor later.