Scribd Logo
Upload

Welcome to Scribd!

  • 16 views

    CCF 3251 Database Security

    Uploaded by

    EG209/108489/21 ISAAC DUNCAN MWENDWA
    The document provides instructions and questions for a database security exam. It outlines 5 questions assessing database security roles, access controls, auditing, CIA principles, and common vulnerabilities. Students are asked to explain concepts like data mining, authentication vs authorization, and measures to address security issues.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    CCF 3251 Database Security

    Uploaded by

    EG209/108489/21 ISAAC DUNCAN MWENDWA
    16 views4 pages
    The document provides instructions and questions for a database security exam. It outlines 5 questions assessing database security roles, access controls, auditing, CIA principles, and common vulnerabilities. Students are asked to explain concepts like data mining, authentication vs authorization, and measures to address security issues.

    Original Description:

    Practical

    Original Title

    CCF-3251-DATABASE-SECURITY (1)

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document provides instructions and questions for a database security exam. It outlines 5 questions assessing database security roles, access controls, auditing, CIA principles, and common vulnerabilities. Students are asked to explain concepts like data mining, authentication vs authorization, and measures to address security issues.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    16 views4 pages

    CCF 3251 Database Security

    Uploaded by

    EG209/108489/21 ISAAC DUNCAN MWENDWA
    The document provides instructions and questions for a database security exam. It outlines 5 questions assessing database security roles, access controls, auditing, CIA principles, and common vulnerabilities. Students are asked to explain concepts like data mining, authentication vs authorization, and measures to address security issues.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 4

    MERU UNIVERSITY OF SCIENCE AND TECHNOLOGY

    P.O. Box 972-60200 – Meru-Kenya.


    Tel: +254 (0)799529958, +254 (0)799529959, +254 (0)712524293
    Website: www.must.ac.ke Email: [email protected]

    University Examinations 2022/2023

    SECOND YEAR, SECOND SEMESTER EXAMINATION FOR THE DEGREE OF BACHELOR


    OF SCIENCE IN COMPUTER SECURITY AND FORENSICS

    CCF 3251: DATABASE SECURITY

    DATE: APRIL 2023 TIME:2 HOURS

    INSTRUCTIONS: answer question one and any other two questions

    QUESTION ONE (30 MARKS)


    a) Outline five roles of a database administrator (DBA) in database security (5 Marks)
    b) Briefly describe any two major dimensions of a database audit (4 Marks)
    c) Describe how the 'least privilege' approach works to ensure database security (5 Marks)
    d) Availability is a key database security issue. State five security measures that a database
    administrator can put in place to ensure that databases are maximally available for the systems
    that require them. (5 Marks)
    e) State and briefly explain five security threats that affect databases that database administrators
    must protect against (5 Marks)
    f) Vendors such as Oracle, Microsoft and IBM know that security is a big concern for database
    systems. They create built in solutions such as: Password Controls, Data access based on roles
    and profiles, IP restrictions for offsite access, auditing capabilities of who has to run what reports
    and Security logging. State three Pros and three Cons of built in database security solutions.
    (6 Marks)

    Meru University of Science & Technology is ISO 9001:2015 Certified


    Foundation of Innovations Page 1
    QUESTION TWO (20 MARKS)
    a) Briefly outline the access control for the following database access and utilization actions
    i. Connection verification (5 marks)
    ii. Request verification (5 marks)
    b) Explain four activities of monitoring and auditing in ensuring database security (4 marks)
    c) State and briefly explain the three database security auditing levels (6 marks)

    QUESTION THREE (20 MARKS)


    a) Distinguish between the following terms as pertains to database security (6 marks)
    i) Authentication vs authorization
    ii) Physical vs logical controls
    iii) Data mart vs data warehousing
    b) Explain the concept of data mining and give an industry application (6 Marks)
    c) State two common audit issues each with respect to the following aspects of database
    management and use
    i. Password management (2 Marks)
    ii. Ownership of database objects (2 Marks)
    iii. Segregation of duties (2 Marks)
    d) What is a database schema? (2 Marks)

    QUESTION FOUR (20 MARKS)


    a) State and briefly explain the three roles and user accounts created automatically with the
    database (6 Marks)
    b) Define the term data masking (2 Marks)
    c) List four roles of uneducated users in compromising database security (4 Marks)
    d) Using a diagram briefly explain CIA as the main aspects of database security (4 Marks)
    e) State and explain two database security features in mySQL (4 Marks)

    Meru University of Science & Technology is ISO 9001:2015 Certified


    Foundation of Innovations Page 2
    QUESTION FIVE (20 MARKS)
    a) State two common audit issues each with respect to the following aspects of database
    management and use
    a. Password management (2 Marks)
    b. Ownership of database objects (2 Marks)
    c. Segregation of duties (2 Marks)
    d. Security policy
    b) Describe the impact of an exploit that takes advantage of each of the vulnerabilities listed above
    (6 Marks)
    i. An exploit that takes advantage of Unsecured remote access
    ii. An exploit that takes advantage of File privileges to all users
    iii. An exploit that takes advantage of Unrestricted access to log files
    c) Describe ways in which the above vulnerabilities can be addressed (6 Marks)

    Meru University of Science & Technology is ISO 9001:2015 Certified


    Foundation of Innovations Page 3
    Explain the concept of data mining and give an industry application (6 Marks)
    a) State two common audit issues each with respect to the following aspects of database
    management and use
    Password management (2 Marks)
    ii. Ownership of database objects (2 Marks) iii.
    Segregation of duties (2 Marks)
    c) What is a database schema ? (2 Marks)
    Question Four (20 Marks)
    a) State and briefly explain the three roles and user accounts created automatically with the
    database (6 Marks)
    b) Define the term data masking (2 Marks)
    c) List four roles of uneducated users in compromising database security (4 Marks)
    a) Using a diagram briefly explain CIA as the main aspects of database security (4 Marks)
    b) State and explain two database security features in Oracle (4 Marks)
    Question Five (20 Marks)
    d) State two common audit issues each with respect to the following aspects of database
    management and use
    i) Password management (2 Marks) Ownership
    of database objects (2 Marks)
    Segregation of duties (2 Marks)
    Security policy
    e) Describe the impact of an exploit that takes advantage of each of the vulnerabilities listed above
    (6 Marks)
    An exploit that takes advantage of Unsecured remote
    access ii. An exploit that takes advantage of File privileges to
    all users iii. An exploit that takes advantage of Unrestricted
    access to log files
    f) Describe ways in which the above vulnerabilities can be addressed (6 Marks)

    Meru University of Science & Technology is ISO 9001:2015 Certified


    Foundation of Innovations Page 4

    You might also like