CV0-002 · Question #396
Which of the following security controls should be implemented to discover an employee with elevated access rights copying information from a cloud database?
The correct answer is B. Periodic review of database logs. To discover an employee copying information from a cloud database, periodic review of database logs is the most effective security control for detecting such activity.
Question
Which of the following security controls should be implemented to discover an employee with elevated access rights copying information from a cloud database?
Options
- APeriodic review of user accounts
- BPeriodic review of database logs
- CAcceptable use policy training
- DEmployee training around appropriate access usage
How the community answered
(34 responses)- A9% (3)
- B82% (28)
- C6% (2)
- D3% (1)
Why each option
To discover an employee copying information from a cloud database, periodic review of database logs is the most effective security control for detecting such activity.
Periodic review of user accounts primarily focuses on managing and validating access rights, not on actively monitoring for specific data exfiltration events once access is granted.
Periodic review of database logs is the correct control because database logs record all operations performed on the database, including data access, queries, and potential data export activities. By analyzing these logs, security personnel can identify unauthorized data copying by employees, even those with elevated access rights.
Concept tested: Data exfiltration detection via log review
Source: https://learn.microsoft.com/en-us/azure/azure-sql/database/audit-overview?view=azuresql
Topics
Community Discussion
No community discussion yet for this question.