Overview
Data and Database Security covers the controls a DBA owns or influences. Objective 4.1 explains data security concepts: encryption in transit and at rest, client-side and server-side encryption, data masking, data discovery, data destruction, security audits of expired accounts and connection requests, and code audits of SQL and credential storage. Objective 4.2 explains governance and compliance: data loss prevention (DLP), retention policies, classification, personally identifiable information (PII), protected health information (PHI), the Payment Card Industry Data Security Standard (PCI DSS), and global and regional regulations such as the General Data Protection Regulation (GDPR).
Objective 4.3 applies authentication and authorization: access controls, rights and privileges, least privilege, password policies, service accounts and identity and access management. Objective 4.4 covers physical and logical infrastructure security, and 4.5 describes attacks such as SQL injection, denial of service, on-path, brute force, phishing and ransomware. Domain 5 handles recovery when these defenses fail.
How it's tested
Domain 4 questions describe a risk, a finding or an incident and ask for the BEST control, the correct classification, or the attack being shown. The right answer usually addresses the specific threat in the stem at the right layer, rather than adding the most security overall. Watch for clues about who must not see data and where it travels.
-
Control for the threat
A risk is described, such as developers seeing card numbers in test or traffic crossing an untrusted network, and you choose masking, encryption in transit, least privilege or another targeted control.
-
Classify and comply
A data type or jurisdiction is given and you identify PII, PHI or cardholder data and the obligation it triggers, such as GDPR, PCI DSS, retention or DLP.
-
Name the attack
Log entries or symptoms are shown, such as quote characters in a login field, thousands of failed logins or encrypted files with a ransom note, and you identify the attack and its effect.
Support staff need to confirm a customer's identity using the last four digits of a card number, but must never see the full number. Options include full-disk encryption, TLS, dynamic data masking and a new firewall rule. Encryption at rest and in transit both decrypt for authorized queries, so staff would still see the full value. Masking returns a partially hidden value to that role, which matches the requirement.
Objectives 5
Official objectives from the CompTIA outline, in outline order.
4.1 Explain data security concepts.Encryption in transit and at rest, masking, discovery, destruction, security audits and code auditing.
- What it means
- Encryption protects data in transit (Transport Layer Security between client and server) and at rest (files, volumes or columns on disk); client-side encryption happens before data leaves the application, and server-side encryption happens when the database or storage service writes it. The objective also covers data masking, data discovery, data destruction, security audits of expired accounts and connection requests, and code audits of SQL and credential storage.
- What to understand
- Each control answers a different threat: in-transit encryption stops interception, at-rest encryption protects stolen disks and backups, client-side encryption keeps plaintext from the server and its administrators, and masking hides values from users who are allowed to query but not to see. Data discovery finds where sensitive data actually lives before you can protect it. Destruction must be verifiable, such as overwriting, degaussing, physical shredding, or destroying encryption keys.
- How it shows up
- A scenario states who must not see data, or how a storage device leaves the organization, and you choose the control that fits.
- Common confusion
- Treating encryption at rest as protection against an authorized but over-privileged user; the database decrypts transparently for anyone who can query.
4.2 Explain the purpose of governance and regulatory compliance.DLP, retention, classification, PII, PHI, PCI DSS, GDPR and regional regulations.
- What it means
- Governance sets rules for how data is classified, kept, shared and protected: data loss prevention (DLP) watches for sensitive data leaving approved channels, retention policies define how long records are kept and when they are disposed of, and classification labels data so the right controls apply. PII identifies a person, PHI is health information tied to a person, and PCI DSS sets requirements for cardholder data.
- What to understand
- Regulations follow the data subject and the data type: GDPR applies to personal data of people in the European Union regardless of where the processor sits, and regional laws add their own rules. PCI DSS is an industry standard enforced through card brand contracts rather than a government law. Retention cuts both ways: keep data long enough to meet legal duties, and dispose of it when no longer required.
- How it shows up
- A stem names a data type, a location or a disposal question and asks which obligation or control applies.
- Common confusion
- Calling PCI DSS a law, or assuming GDPR applies only to companies headquartered in the EU.
4.3 Given a scenario, implement policies and best practices related to authentication and authorization.Access controls, rights and privileges, least privilege, password policies, service accounts and IAM.
- What it means
- Authentication proves who a user or service is; authorization decides what it may do. The objective covers access controls, rights and privileges, least privilege, password policies, service accounts and identity and access management (IAM).
- What to understand
- Grant permissions to roles or groups rather than individuals, give each account only the rights its job needs, and review them when roles change. Service accounts run applications and jobs without a person; each should be dedicated to one purpose, denied interactive login, given minimal rights, and have its credential stored in a secrets manager and rotated. Password policies balance length, complexity, lockout and rotation, and IAM centralizes identities so leavers are disabled everywhere at once.
- How it shows up
- A scenario describes an application connecting as an administrator, a shared login or a former employee's active account, and you choose the corrective policy.
- Common confusion
- Using one high-privilege account for every application because it avoids permission errors.
4.4 Explain the purpose of database infrastructure security.Physical controls such as biometrics, surveillance, fire suppression and cooling, and logical controls such as firewalls, perimeter networks and port security.
- What it means
- Physical security protects the servers themselves with access control (badges, mantraps, biometrics), surveillance, fire suppression and cooling. Logical infrastructure security limits network reach with firewalls, a perimeter network for internet-facing systems, and port security.
- What to understand
- Defense in depth means a database is reachable only from approved application servers on the engine's port, sits behind the perimeter network, and lives in a room where entry is logged. Fire suppression for data centers commonly uses clean-agent gas systems to avoid water damage, and cooling failures cause hardware faults and outages, so both are availability controls. Disabling unused switch ports and services reduces the attack surface.
- How it shows up
- A scenario names a physical or network weakness and asks for the control category or the specific measure.
- Common confusion
- Seeing fire suppression and cooling as facilities issues unrelated to security; they protect availability, one of the three security goals.
4.5 Describe types of attacks and their effects on data systems.SQL injection, denial of service, on-path, brute force, phishing and malware including ransomware.
- What it means
- The listed attacks are SQL injection (input altering query logic), denial of service (DoS, exhausting resources so legitimate users cannot connect), on-path (intercepting or altering traffic between client and server), brute force (guessing credentials repeatedly), phishing (tricking people into revealing credentials or running malware) and malware, including ransomware that encrypts data and demands payment.
- What to understand
- Map each attack to its effect and primary defense: injection threatens confidentiality and integrity and is stopped by parameterized queries and input validation; DoS threatens availability and needs rate limiting and capacity; on-path is countered by TLS with certificate validation; brute force by lockout, strong passwords and multifactor authentication; phishing by training and multifactor authentication; ransomware by offline, tested backups and patching.
- How it shows up
- Logs or symptoms are described and you identify the attack, its impact, or the most effective mitigation.
- Common confusion
- Treating a web application firewall or input escaping as the main fix for SQL injection instead of parameterized queries.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Encryption in transit vs. at rest
In-transit encryption, typically TLS, protects data moving between client and server; at-rest encryption, such as transparent data encryption or volume encryption, protects data stored on disks, files and backups.
- Remember
- In transit stops interception; at rest stops reading stolen media.
- Tested as
- Control-selection questions specify where the data is when it is exposed.
- Trap
- Expecting at-rest encryption to stop an attacker sniffing network traffic.
-
Client-side vs. server-side encryption
Client-side encryption encrypts data in the application before sending it, so the server stores only ciphertext; server-side encryption lets the database or storage service encrypt on write and decrypt on read.
- Remember
- If the database administrators or cloud provider must never see plaintext, encrypt on the client and keep keys away from the server.
- Tested as
- Scenarios about untrusted hosting or separation of duties.
- Trap
- Assuming server-side encryption hides data from the people who administer the server.
-
Data masking
Masking replaces or hides part of a value, either statically in a copied data set or dynamically at query time for certain roles.
- Remember
- Masking controls what authorized users see; encryption controls who can read stored or moving data.
- Tested as
- Test-data and least-exposure scenarios.
- Trap
- Choosing encryption when the user is allowed to query but must not see the full value.
-
Data discovery
Data discovery scans databases and files to locate sensitive data such as PII, PHI and card numbers.
- Remember
- You cannot classify or protect data you have not found.
- Tested as
- Often the FIRST step in compliance or DLP scenarios.
- Trap
- Applying controls only to the tables people remember, missing copies in logs or exports.
-
Data destruction
Destruction makes data unrecoverable through overwriting, degaussing magnetic media, physical shredding, or destroying the encryption keys for encrypted data.
- Remember
- Deleting rows or formatting a disk does not destroy the data.
- Tested as
- Disposal and retention scenarios.
- Trap
- Treating a DELETE statement or a quick format as secure disposal.
-
PII vs. PHI vs. cardholder data
PII identifies a person, PHI is health information linked to a person, and cardholder data includes the primary account number covered by PCI DSS.
- Remember
- The data type decides the obligation.
- Tested as
- Classification questions describe a field and ask its category.
- Trap
- Classifying a diagnosis code linked to a patient name as only PII.
-
GDPR
The General Data Protection Regulation governs personal data of people in the European Union, including rights to access and erasure and limits on keeping data longer than needed.
- Remember
- Scope follows the data subject, not the company's headquarters.
- Tested as
- Jurisdiction and retention scenarios.
- Trap
- Assuming a US-based company is out of scope when it holds EU residents' data.
-
Data loss prevention (DLP)
DLP tools inspect data in use, in motion and at rest and block or alert when sensitive content leaves approved channels.
- Remember
- DLP detects and stops exfiltration; it does not encrypt the database.
- Tested as
- Scenarios about exports, email attachments or uploads containing sensitive data.
- Trap
- Choosing DLP to stop SQL injection, which is a different control.
-
Least privilege
Each user and service account receives only the permissions needed for its task, for only as long as needed.
- Remember
- An application that only reads should not connect with write or administrator rights.
- Tested as
- Access-control scenarios in 4.3.
- Trap
- Granting broad rights to avoid permission errors during deployment and never removing them.
-
Service accounts
Service accounts are non-human identities used by applications and scheduled jobs to connect to the database.
- Remember
- One account per purpose, no interactive login, minimal rights, credential in a vault, regular rotation.
- Tested as
- Code audit and credential storage findings.
- Trap
- Hard-coding the service account password in source code or sharing one account across systems.
-
SQL injection
SQL injection inserts crafted input that changes the structure of a dynamically built query, allowing data theft, modification or bypassed logins.
- Remember
- Parameterized queries and stored procedures without dynamic SQL are the primary fix, backed by least privilege and input validation.
- Tested as
- Log entries showing quotes, OR 1=1 or UNION SELECT in input fields.
- Trap
- Relying on escaping characters or a firewall alone.
-
On-path attack
An on-path attacker positions themselves between client and server to read or alter traffic.
- Remember
- TLS with certificate validation defeats it; unencrypted connections are exposed.
- Tested as
- Scenarios on unencrypted database connections over shared networks.
- Trap
- Thinking at-rest encryption helps against interception.
-
Ransomware
Ransomware is malware that encrypts or steals data and demands payment for its return.
- Remember
- Offline or immutable, tested backups are what make recovery possible without paying.
- Tested as
- Links attacks in 4.5 to backup practices in Domain 5.
- Trap
- Assuming online replicas protect you; they replicate the encrypted data too.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Encryption in transit vs. at rest vs. client-side vs. masking
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Encryption in transit | TLS protects data moving over the network | Stops interception and tampering in transit | Thinking it protects data stored on disk |
| Encryption at rest | Data encrypted on disks, files and backups | Protects stolen media; transparent to authorized queries | Expecting it to hide data from privileged users |
| Client-side encryption | Application encrypts before sending | Server and its admins see only ciphertext | Forgetting the server cannot then search or index plaintext values |
| Data masking | Hides part of a value from certain users | Controls what authorized viewers see | Treating it as a replacement for encryption |
Attack vs. effect vs. primary mitigation
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| SQL injection | Input changes query logic | Parameterized queries and least privilege | Relying on escaping or a firewall alone |
| Denial of service | Resources exhausted; availability lost | Rate limiting, capacity, upstream filtering | Treating it as a data breach |
| On-path | Traffic read or altered between endpoints | TLS with certificate validation | Assuming internal networks are safe from interception |
| Brute force | Repeated credential guessing | Lockout, strong passwords, multifactor authentication | Ignoring failed-login spikes in monitoring |
| Ransomware | Data encrypted for extortion | Offline, tested backups and patching | Relying on replicas that copy the damage |
PII vs. PHI vs. PCI DSS cardholder data
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| PII | Information that identifies a person | Triggers privacy laws such as GDPR and regional regulations | Missing indirect identifiers such as combined birth date and postcode |
| PHI | Health information linked to an individual | Adds health privacy obligations on top of PII rules | Classifying it only as PII |
| Cardholder data | Primary account number and related card data | Governed by the PCI DSS industry standard | Calling PCI DSS a government law |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Encrypt to hide from users
- What candidates pick
- Enable transparent data encryption so call-center staff cannot see full card numbers.
- Why it looks right
- Encryption is the strongest-sounding data protection.
- Why it's wrong
- At-rest encryption decrypts automatically for anyone allowed to query, so staff still see full values; masking limits what their role sees.
Clue to watch for The people involved are authorized to query but should see only part of the data.
-
One powerful service account
- What candidates pick
- Let every application connect with the same administrator-level account.
- Why it looks right
- It avoids permission errors and simplifies deployment.
- Why it's wrong
- A compromise of any application exposes everything, and audits cannot tell applications apart; least privilege calls for one minimal account per purpose.
Clue to watch for Code audit findings, shared credentials or applications that only read data.
-
Escape instead of parameterize
- What candidates pick
- Add a function that escapes quote characters in user input.
- Why it looks right
- It blocks the classic injection example.
- Why it's wrong
- Escaping is easy to bypass and inconsistent across dialects; parameterized queries separate code from data entirely.
Clue to watch for The question asks for the most effective or BEST remediation of SQL injection.
-
Delete equals destroy
- What candidates pick
- Run DELETE on the old records and decommission the drive.
- Why it looks right
- The rows are no longer visible.
- Why it's wrong
- Deleted data remains recoverable on disk and in backups; disposal requires overwriting, degaussing, shredding or key destruction, consistent with retention policy.
Clue to watch for Hardware leaving the organization or the end of a retention period.
-
GDPR does not apply here
- What candidates pick
- Ignore GDPR because the company is based outside the EU.
- Why it looks right
- Laws seem tied to where a company is located.
- Why it's wrong
- GDPR applies to processing personal data of people in the EU, so the data subjects decide scope.
Clue to watch for Customers, users or employees located in EU countries.
-
Replicas as ransomware protection
- What candidates pick
- Rely on a synchronized replica to recover from ransomware.
- Why it looks right
- Replicas provide a second copy of the data.
- Why it's wrong
- Replication copies the encrypted or corrupted data almost immediately; offline or immutable backups that have been restore-tested are what recover data.
Clue to watch for Malware that encrypts files, or a requirement to recover data to a point before the attack.
Answer framework
Use this sequence when a Domain 4 question asks for the best control, classification or response to a security risk.
- Name the asset and its classification, such as PII, PHI or cardholder data, and the regulation or standard it triggers.
- Identify the specific threat: interception, stolen media, an over-privileged insider, a crafted input, credential guessing, resource exhaustion or malware.
- Locate where the exposure happens: in transit, at rest, in use by an authorized user, in code, or at the physical or network perimeter.
- Choose the control that acts at that point, such as TLS, at-rest encryption, masking, least privilege, parameterized queries, lockout or firewall rules.
- Check that the choice also meets governance needs, including retention, audit logging, DLP and verifiable destruction.
Practice question
Want more like this? The CompTIA DataSys+ practice test has questions for every domain.
Checklist
0 of 14
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Begin with objective 4.5, because knowing the attacks makes every control in the other objectives easier to place. For each attack, write one line on its effect on confidentiality, integrity or availability and one line on its primary mitigation. Then try SQL injection safely in a local lab against a deliberately vulnerable query and fix it with parameters.
Next, study 4.1 with a single grid: rows for in-transit, at-rest, client-side and server-side encryption plus masking, and columns for what each protects against and who can still see plaintext. This grid answers most control-selection questions.
Candidates commonly underestimate 4.2 and 4.4. For 4.2, learn the difference between PII, PHI and cardholder data, the scope of GDPR, and why PCI DSS is a contractual standard. For 4.4, remember that cooling and fire suppression are availability controls.
For 4.3, create roles, a read-only service account and a password policy on a practice instance and review its permissions. Afterward, practice BEST-control questions and, for each miss, name the threat you overlooked. Then move to Domain 5, where backups and recovery handle what security cannot prevent.
FAQ
How much of DataSys+ DS0-001 is Data and Database Security?
CompTIA weights it at 23% across five objectives, the most objectives of any domain. CompTIA does not publish per-domain question counts, so any number for this domain is an estimate.
Do I need Security+ before DataSys+?
CompTIA lists no prerequisites for DataSys+. Security fundamentals help, but this domain focuses on controls a DBA applies to databases rather than broad security operations.
What is the difference between data masking and encryption?
Encryption makes stored or transmitted data unreadable without a key, but authorized queries see plaintext. Masking hides part of a value from specific users even though they are allowed to query it.
Is PCI DSS a law?
No. PCI DSS is an industry standard set by the payment card brands and enforced through contracts with merchants and processors. Laws such as GDPR and regional privacy regulations sit alongside it.
Which attacks should I know?
The objective lists SQL injection, denial of service, on-path, brute force, phishing and malware including ransomware. Know the symptoms, effect and primary mitigation of each.
How do service accounts differ from user accounts?
Service accounts are used by applications and jobs rather than people. They should be dedicated to one purpose, limited to the minimum rights, blocked from interactive login, and have credentials stored in a vault and rotated.
How does this domain connect to the others?
It secures the SQL and scripts from Domain 1, the network placement from Domain 2 and the monitoring from Domain 3, and it hands off to Domain 5 when an attack such as ransomware requires recovery from backups.
Other Data & Analytics certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
Test your Domain 4 knowledge
You have just matched encryption, masking, compliance rules, access policies and infrastructure controls to the attacks they stop. Check whether you choose the control that fits the stated threat rather than the strongest-sounding one.
Keep going
- Training Training Built on your Weak areas
- Practice test Questions by domain, with explanations
- Mock exam Full length, timed like the real exam
- Readiness test Find your weakest domain in minutes
- Cheat sheet Key terms and formulas on one page
- Ask the CompTIA DataSys+ AI tutor Get any concept explained your way