Free DAMA CDMP Fundamentals Practice Questions: Data Security

Topic snapshot

Sample questions

These are original IT Mastery practice questions aligned to this topic area. They are not official exam questions, copied live-exam content, or exam dumps. Use them for self-assessment, scope review, and deciding what to drill next.

Question 1

Topic: Data Security

A marketing analytics team requests access to customer income data for a new segmentation campaign. The data set is already classified as confidential, role-based access can be granted after approval, masking rules exist for nonproduction use, and access logs are reviewed monthly. Company policy requires a named business data steward to approve any new use of confidential customer data before access is provisioned. What is the main issue to resolve?

Options:

• A. Authorization

• B. Monitoring

• C. Data classification

• D. Stewardship approval

Best answer: D

Explanation: The scenario separates several data security controls. Classification has already identified the data as confidential, and the technical authorization process can occur after approval. Monitoring is also in place through monthly log review. The unresolved requirement is that a business data steward must approve the new purpose before access is provisioned. In DAMA-aligned practice, stewardship approval helps ensure that access and use are appropriate for the business context, not merely technically possible. Authorization is the later act of granting access through roles or permissions.

• Data classification is not the issue because the data has already been classified as confidential.
• Authorization is premature because role-based access can be granted only after the required business approval.
• Monitoring does not address the policy gate because access logs are already reviewed and do not approve new use.

Question 2

Topic: Data Security

A company is reviewing controls after discovering that customer tax identifiers are stored in several reporting datasets. The servers are patched, the application passed penetration testing, and the data center access logs show no exceptions. The remaining unresolved risk is that analysts can query tax identifiers even when their role only requires aggregated customer counts. Which management activity most directly addresses this risk?

Options:

• A. Harden the database server operating system

• B. Retest the reporting application for injection flaws

• C. Classify the data and align access to business need

• D. Review badge access to the data center

Best answer: C

Explanation: Data security management focuses on protecting data according to its sensitivity, value, and permitted use throughout its lifecycle. In this scenario, infrastructure, application, and physical controls have already been checked, but the decisive risk remains excessive access to sensitive data elements. Classifying tax identifiers and enforcing access based on business need directly addresses who may view, use, or disclose that data. Server hardening, application testing, and facility access review can all be important security activities, but they do not resolve inappropriate access to a sensitive data attribute in reporting datasets. The key distinction is that data security starts with the data and its authorized use, not only the systems that store or process it.

• Server hardening reduces infrastructure compromise risk, but it does not decide whether analysts should see tax identifiers.
• Application retesting addresses software vulnerability risk, not excessive authorized access to sensitive data.
• Badge review addresses physical access risk, but the unresolved issue is logical access to classified data.

Question 3

Topic: Data Security

A sales analytics team needs customer purchase history for segmentation. They do not need direct identifiers such as national ID, full date of birth, phone number, or email address. Which response best supports the business need while avoiding unjustified exposure of sensitive attributes?

Options:

• A. Require analysts to sign a confidentiality acknowledgement

• B. Encrypt the database files at rest

• C. Grant read-only access to the full customer table

• D. Provide a masked analytical view with only needed attributes

Best answer: D

Explanation: Privacy protection and security governance should apply data minimization and least privilege. When business users need access for a valid purpose but do not need sensitive attributes, the better response is to provide a controlled view, extract, or dataset that omits, masks, generalizes, or tokenizes those attributes. This preserves business utility while reducing privacy and security risk. Read-only access, storage encryption, and confidentiality acknowledgements can be useful controls, but they do not by themselves prevent authorized users from seeing unnecessary sensitive data. The key distinction is limiting what data is exposed, not only limiting how it is stored or documented.

• Read-only access still exposes all sensitive fields, even if users cannot update them.
• Encryption at rest protects stored data from unauthorized access paths, but authorized query users may still see the clear values.
• Confidentiality acknowledgement supports accountability, but it does not enforce data minimization or attribute-level protection.

Question 4

Topic: Data Security

A regional health insurer is creating a shared analytics workspace for care-quality reporting. Analysts need member-level claims data to validate quality measures, but the workspace will also include protected health information. The governance policy requires role-based access, quarterly access reviews, and documented business justification for sensitive data use. Which action is the best professional decision?

Options:

• A. Mask all member identifiers for every user

• B. Grant analysts only the PHI fields required for validation

• C. Let project managers approve ad hoc access

• D. Give all analysts full claims-table access

Best answer: B

Explanation: Least privilege means users receive only the access necessary to perform an approved business activity. Need-to-know adds that sensitive or regulated data should be limited to people with a justified role in using it. In this case, analysts have a valid need to validate care-quality measures, but that does not justify unrestricted claims-table access. The appropriate control is role-based access to only the PHI fields needed, supported by documented justification and periodic review as required by policy.

Over-restricting all identifiers may prevent valid measure validation, while broad access or informal approval weakens governance and increases privacy risk.

• Full-table access fails because it exceeds the analysts’ stated need and exposes more regulated data than necessary.
• Universal masking may block legitimate validation work if member-level identifiers are required for the approved purpose.
• Ad hoc approval bypasses the required role-based process, business justification, and quarterly review controls.

Question 5

Topic: Data Security

A bank classifies customer tax identifiers as confidential. An audit finds that the identifiers are hidden in the core customer application but still appear in scheduled BI extracts, a partner integration feed, and analyst spreadsheets stored on a shared drive. Which remediation best addresses the data-security issue?

Options:

• A. Create a new business glossary definition for tax identifier

• B. Add reconciliation checks to the BI extract process

• C. Extend classification-based access controls and masking to downstream uses

• D. Consolidate customer records into a master data hub

Best answer: C

Explanation: Data classification and access control must apply across the data lifecycle. If confidential data is protected in the source system but exposed through reports, extracts, integration feeds, or unmanaged copies, the control boundary is too narrow. The appropriate remediation is to extend security controls to downstream consumption points, such as role-based access, masking or redaction, approved extract handling, and controls over shared-file storage. Metadata and lineage can help identify where sensitive data flows, but they do not by themselves prevent exposure. The key takeaway is that sensitive-data protections must travel with the data wherever it is used or replicated.

• Glossary definition may clarify meaning, but it does not restrict access to confidential values.
• Master data consolidation addresses duplicate or inconsistent customer records, not exposure through downstream outputs.
• Reconciliation checks improve completeness or consistency of extracts, but they do not prevent unauthorized visibility.

Question 6

Topic: Data Security

During an access review, a data steward finds that a shared analytics workspace contains a current customer extract with email addresses, dates of birth, and consent indicators. The workspace is open to contractors who are not covered by the approved campaign purpose, and no evidence shows business approval for this sharing. Which data-management consequence is most directly indicated?

Options:

• A. Loss of semantic consistency in reference data values

• B. Reduced storage availability for operational systems

• C. Duplicate customer master records across applications

• D. Privacy compliance exposure from unapproved personal-data sharing

Best answer: D

Explanation: A security control weakness becomes a data-management concern when it affects governed use, protection, and accountability for data. Here, personal data and consent indicators are available to people outside the approved business purpose, with no evidence of authorization. The main consequence is privacy and compliance exposure, because the organization may be unable to demonstrate appropriate purpose limitation, access control, and stewardship over sensitive customer data. This also weakens trust in governed data sharing, but the decisive issue is unauthorized exposure of personal data rather than a modelling, storage, or master-data problem.

• Reference data consistency does not fit because the issue is access to personal data, not conflicting code values or classifications.
• Storage availability is not indicated because no outage, capacity constraint, or operational performance impact is described.
• Duplicate master records would involve identity resolution or record consolidation, not unauthorized sharing of a customer extract.

Question 7

Topic: Data Security

A retailer is defining access controls for three datasets. Customer profiles contain email, phone number, and date of birth. Pricing strategy is marked internal confidential. A product availability feed has no personal or confidential fields but is essential to online checkout. Which access-control decision best reflects these classifications?

Options:

• A. Classify the availability feed as confidential because checkout depends on it

• B. Restrict or mask customer profiles, limit pricing access, and protect feed availability

• C. Give analysts full customer profiles because sales analysis has business value

• D. Apply the same access rule to all three datasets for consistency

Best answer: B

Explanation: Data classification guides the type and strength of access control. Personal data in customer profiles requires privacy-aware controls such as need-to-know access, masking, or minimization. Internal pricing strategy requires confidentiality controls because disclosure could harm the business. The product availability feed is business-critical, but the stated facts do not make it sensitive or confidential; its main control focus is reliable, authorized operational use, including integrity and availability. Business criticality can increase protection requirements, but it does not automatically mean the data should be treated as private or confidential.

• Business value alone does not justify broad access to personal data; analysis should use minimized or masked data where possible.
• Operational criticality affects availability and integrity needs, but it does not by itself create confidentiality classification.
• Uniform access rules ignore different sensitivity, privacy, confidentiality, and criticality drivers across datasets.

Question 8

Topic: Data Security

A data warehouse team is onboarding analysts who need to study customer purchasing trends by region and age band. The source table contains names, email addresses, full dates of birth, and account numbers, but the analysts do not need those sensitive attributes for their work. Which control best fits this need?

Options:

• A. Grant read-only access to the source table

• B. Encrypt the warehouse storage volume

• C. Rely on audit logs after access

• D. Publish a de-identified analytical view

Best answer: D

Explanation: Data classification and access control should align access with business need. When users need useful analytical data but not sensitive attributes, the preferred control is to provide a governed view, extract, or data product that removes, masks, tokenizes, or generalizes sensitive fields. In this case, names, emails, account numbers, and full dates of birth can be excluded or transformed while retaining region and age band for analysis. This supports least privilege and reduces exposure risk without blocking legitimate analytics. Encryption and logging are valuable controls, but they do not by themselves prevent authorized users from seeing sensitive values once access is granted.

• Granting read-only source access still exposes sensitive attributes the analysts do not need.
• Encrypting storage protects data at rest but does not limit what approved query users can view.
• Audit logging helps detect and investigate access but does not prevent unnecessary exposure.

Question 9

Topic: Data Security

A marketing team wants an external analytics partner to perform weekly churn analysis. The dataset contains customer identifiers, contact preferences, and complaint notes; it is classified as confidential and includes privacy-sensitive attributes. The operational CRM is business-critical for customer support, and policy allows third-party use only with data-owner approval and purpose-limited access. What is the best professional decision?

Options:

• A. Grant direct read access to the CRM after an NDA

• B. Provide a minimized, approved dataset in a controlled environment

• C. Deny all analytics use until the next classification review

• D. Email a password-protected full extract each week

Best answer: B

Explanation: Data classification and sensitivity should directly shape access controls. Confidential, privacy-sensitive customer data requires stronger controls than ordinary internal data: least privilege, purpose limitation, approval by the accountable data owner, and monitoring. Business criticality also matters because direct access to the operational CRM could create availability, integrity, or support risks. A minimized dataset in a controlled environment supports the marketing goal while reducing exposure of identifiers and sensitive complaint details. The decision should not rely only on a contract or password protection; controls must match the data’s classification, privacy impact, and operational importance.

• Direct CRM access overexposes a business-critical system and gives broader access than the stated analytics purpose requires.
• Weekly full extract increases privacy exposure and weakens control over copying, retention, and downstream use.
• Denying all use ignores the policy path that permits approved, purpose-limited third-party access.

Question 10

Topic: Data Security

A marketing analytics team requests access to a shared customer dataset that includes names, email addresses, purchase history, and consent status. The team needs to measure campaign response by customer segment, but it does not contact customers directly. Which access approach best applies least-privilege and need-to-know principles?

Options:

• A. Give individual customer contact details to the team lead only

• B. Grant full read access to the customer master file

• C. Provide de-identified segment-level data with consent attributes

• D. Allow access only after the campaign is complete

Best answer: C

Explanation: Least privilege gives users only the data access required for an approved business purpose. Need-to-know further limits access to data elements necessary for the specific task. Here, marketing analytics needs response measurement by segment, not direct customer contact, so names and email addresses are unnecessary. De-identified or aggregated segment data, while retaining relevant consent attributes, reduces privacy and regulatory exposure while still enabling the analysis. Full customer master access or named contact details would expose more sensitive data than the stated activity requires.

• Full master access exposes identifiers and operational customer details beyond the analytics purpose.
• Delayed access changes timing but does not address the data-minimization need.
• Team-lead-only identifiers still provides unnecessary personal data for a task that can be performed without contact details.

Continue in the web app

Use IT Mastery for interactive DAMA CDMP Data Management Fundamentals practice with mixed sets, timed mocks, topic drills, explanations, and progress tracking.

Try DAMA CDMP Data Management Fundamentals on Web

Related focused pages

• Free DAMA CDMP Data Management Fundamentals Full-Length Practice Exam
• Data Management Process
• Big Data
• Data Architecture
• Document and Content Management
• Data Ethics
• Data Governance
• Data Integration and Interoperability
• Master and Reference Data Management
• Data Modelling and Design
• Data Quality
• Data Storage and Operations
• Data Warehousing and Business Intelligence
• Metadata Management