Free CompTIA Data+ Sample Questions

Correct answer: B — Object storage

• A. Block storage is typically used for high-performance, low-latency storage directly attached to virtual machines or servers (e.g., SAN or Amazon EBS). It is not designed for petabyte-scale unstructured media storage or native internet-based access via REST APIs.
• B. Object storage is the standard for massive-scale unstructured data. It treats data as objects with comprehensive metadata, provides extremely high durability and scalability, and is natively accessed via RESTful APIs over the internet (HTTP/HTTPS), making it ideal for this requirement.
• C. File storage uses a hierarchical structure (folders and files) and is generally shared via protocols like NFS or SMB. It often faces scalability bottlenecks at the petabyte level for unstructured media and does not provide the same ease of internet-accessible REST API integration as object storage.
• D. Relational databases are designed for structured data using tables and schemas. They are not suitable for storing massive amounts of unstructured files like images and videos due to performance overhead, high cost at petabyte scales, and the lack of native RESTful delivery for web clients.

Correct answer: B — Network Attached Storage (NAS)

• A. Direct-Attached Storage (DAS) is connected directly to a single computer or server (such as an external hard drive). It does not provide the network accessibility required for multiple users to access and collaborate on files simultaneously over a local area network.
• B. Network Attached Storage (NAS) is a file-level storage server connected to a computer network. It provides a centralized location for storage and is designed specifically for file sharing and collaboration across different operating systems (Windows and macOS) using standard network protocols like SMB/CIFS or NFS.
• C. Block storage manages data as blocks within sectors and is typically used in high-performance environments like Storage Area Networks (SANs) or as backend storage for virtual machines. It is generally not used for direct end-user file sharing and collaboration in the manner described.
• D. A Relational Database Management System (RDBMS) is used for managing structured data in tables. It is not intended for the storage and retrieval of large, unstructured media files or documents for collaborative office workflows.

Correct answer: B — Data catalog

• A. A code repository (such as Git) is used for storing and managing source code, scripts, and version history. While scripts may contain references to data sources, it is not designed to catalog business data assets or visualize automated data lineage across an entire enterprise.
• B. A data catalog is the correct repository because it is specifically designed to inventory data assets, manage metadata, and provide searchable descriptions of tables and columns. It often includes data lineage features that show the origin and flow of data, making it the ideal tool for discovering specific tables in complex environments.
• C. A log repository stores system, application, or event logs. These are primarily used for performance monitoring, security auditing, and troubleshooting system errors rather than indexing business data tables or tracking data lineage.
• D. A document repository stores files such as PDFs, policies, and project documentation. While it might contain manual documentation about data schemas, it lacks the automated metadata harvesting, searchability, and lineage tracking capabilities provided by a dedicated data catalog.

Correct answers: A, C — IoT sensor logs; Relational database containing service histories

• A. IoT sensor logs are the primary source for telematics data. They provide the high-velocity, real-time measurements of engine temperature fluctuations and other operational metrics necessary to detect current anomalies and monitor the truck's immediate state.
• B. Web analytics data tracks user interactions with websites, such as clickstreams and traffic patterns. This data type is irrelevant to mechanical performance or vehicle maintenance and would not contribute to a predictive maintenance model.
• C. Relational databases are standard for storing structured historical data, such as service histories and repair records. Combining this historical context with real-time IoT data allows the model to identify patterns between specific sensor readings and subsequent mechanical failures.
• D. Social media web scraping yields unstructured data regarding public sentiment and trends. It is not a source for engine telemetry or internal maintenance records, making it useless for predicting mechanical issues in a delivery fleet.
• E. A document repository of employee handbooks contains HR policies, safety procedures, and organizational guidelines. It does not contain vehicle-specific telemetry or repair logs required for technical predictive modeling.

Correct answer: C — Graph

• A. Relational databases are designed for structured data and transactional workloads. While they can define relationships via tables and keys, traversing complex many-to-many connections across millions of users involves computationally expensive join operations, making them less efficient for deep relationship analysis.
• B. Key-value databases are optimized for simple, high-speed lookups based on a unique key. They are not built to handle the complex relationships and network traversal required to find connections between millions of interconnected data points.
• C. Graph databases are specifically designed to model and query relationships between entities (nodes and edges). They excel at traversing highly connected data, such as identifying friends-of-friends and finding patterns in social networks, making them the ideal choice for this use case.
• D. Columnar databases are optimized for analytical queries, aggregations, and reporting on large datasets by storing data in columns rather than rows. However, they are not suited for analyzing complex relationships or performing graph-based traversals.

Correct answer: B — Columnar

• A. Document databases store data in semi-structured formats (like JSON) and are optimized for storage flexibility and retrieving whole documents. They are not the most efficient choice for large-scale analytical aggregations targeting specific fields across billions of records.
• B. Columnar databases store data in columns rather than rows. This architecture is specifically designed for analytical workloads (OLAP) because it allows the system to read only the specific fields required for a query, significantly reducing I/O and increasing performance for aggregations across massive datasets.
• C. Key-value databases are optimized for simple, high-speed lookups and storage using a unique key. They lack the structure and query optimization needed to perform complex aggregations or scans of specific fields across billions of records.
• D. Relational databases are traditionally row-based, making them excellent for transactional processing (OLTP) where entire records are updated or retrieved. However, for analytical queries that access only a few fields across many records, row-based storage is less efficient than columnar storage.

Correct answer: B — Unsupervised clustering

• A. Supervised classification requires labeled training data with predefined categories to predict class membership for new data points. Since the business does not have predefined categories or segment labels, this approach is not suitable.
• B. Unsupervised clustering is ideal for this scenario because it groups data into clusters based on inherent similarities without the need for predefined categories or labels. This allows the algorithm to discover natural groupings in purchasing behavior, making it the standard method for customer segmentation when groups are unknown.
• C. Robotic process automation (RPA) is used to automate repetitive, rule-based business tasks and workflows. It does not involve data analysis, pattern discovery, or the creation of customer segments based on behavior.
• D. Natural language generation (NLG) is an AI technology used to produce human-like text from structured data or prompts. It is not an analytical method for grouping data or identifying patterns in customer purchasing behavior.

Correct answers: A, D — Automatically copying policyholder details from an email attachment into a CRM database.; Logging into a vendor portal to download daily transaction logs and saving them to a shared drive.

• A. Correct. RPA is highly effective for repetitive, rule-based tasks such as data entry or migration. Extracting structured data from an email attachment and entering it into a CRM follows a clear, predictable workflow with defined inputs and outputs.
• B. Incorrect. Predicting fraud requires pattern recognition, statistical modeling, and machine learning algorithms. RPA is deterministic and follows set rules, whereas this task requires analytical decision-making based on historical data.
• C. Incorrect. Handling complex customer complaints and generating personalized responses involves natural language understanding (NLU) and generation (NLG). This is a task for advanced AI or Generative AI, not basic RPA which lacks the ability to interpret nuance or context.
• D. Correct. Automating the process of logging into a web portal, downloading specific files, and moving them to a target directory is a classic RPA use case. It mimics human interactions with a user interface and follows a consistent, rule-based logic.
• E. Incorrect. Estimating repair costs from accident photos requires computer vision and image recognition technologies. While RPA could be used to route the image files, it lacks the cognitive ability to analyze visual content or make estimations based on images.

Correct answer: A — Jupyter Notebook

• A. Correct. Jupyter Notebook is an open-source web application specifically designed for combining executable code, rich text (using Markdown), and visual outputs in a single interactive document. It is the industry standard for exploratory data analysis (EDA) because stakeholders can review the narrative methodology, the Python implementation, and the resulting inline charts together in one cohesive flow.
• B. Incorrect. Tableau is a powerful business intelligence and data visualization tool used for creating interactive dashboards. While it can produce visualizations, it is not intended to display executable Python code alongside detailed narrative text in a sequential, document-style deliverable as described in the scenario.
• C. Incorrect. SQL Server Management Studio (SSMS) is used for managing SQL Server databases and executing SQL queries. It is a database administration tool and does not support the integration of Python code, rich narrative text, and inline visualizations into a shareable analysis document.
• D. Incorrect. Notepad++ is a lightweight text and source code editor. While it provides syntax highlighting, it lacks the ability to execute code, render rich narrative formatting, or display inline visualizations, making it unsuitable for a comprehensive data analysis report.

Correct answer: B — Row-level security (RLS)

• A. Data blending is the process of combining data from multiple distinct sources into a single view for analysis. While useful for joining disparate datasets, it does not provide the access control mechanisms required to restrict data visibility based on user identity.
• B. Row-level security (RLS) is a security feature that restricts data access at the row level based on user roles or attributes. This allows multiple users to access the same dashboard while ensuring they only see the specific records they are authorized to view, such as their specific hospital branch.
• C. Predictive forecasting uses historical data and statistical modeling to estimate future trends. It is an advanced analytics feature and does not function as a security or privacy control to limit user access to specific records.
• D. Exporting to PDF is a distribution method that converts a dashboard into a static document format. It does not address data privacy or security concerns and cannot dynamically filter data based on which administrator is viewing the file.

Correct answer: B — Left Join

• A. Incorrect. An Inner Join returns only rows where there is a match in both tables. Customers who have not placed an order would be excluded from the results.
• B. Correct. A Left Join (or Left Outer Join) preserves all records from the left table (in this case, `Customers`) and appends matching records from the right table (`Orders`). If a customer has no corresponding order, the order fields will simply contain NULL values, ensuring no customers are lost.
• C. Incorrect. A Right Join preserves all records from the right table and matching records from the left. Unless the tables were specifically swapped in the query, this would keep all orders but exclude customers without orders.
• D. Incorrect. A Full Outer Join keeps all records from both tables, including unmatched orders and unmatched customers. While it would include all customers, it also includes unnecessary data (such as orders with no valid customer ID) that was not requested.

Correct answer: A — Web scraping

• A. Web scraping is the process of programmatically reading HTML content from web pages and parsing it to extract data, which is often unstructured or semi-structured. It is a common method for data collection when no official API or structured feed is available.
• B. API (Application Programming Interface) integration retrieves data through defined, structured interfaces provided by an application. Unlike scraping, it does not involve parsing raw HTML, making it more reliable and structured.
• C. Database replication involves copying and synchronizing data from one database instance to another to ensure consistency, redundancy, or load balancing. It typically involves structured data and does not involve extracting content from web pages.
• D. Flat file ingestion is the process of importing data from local or remote files such as CSV, TXT, or Excel. This is a file-based data import method rather than a method for extracting data directly from web page HTML.

Correct answer: B — Incremental extraction

• A. Full extraction involves loading the entire dataset from the source system during every update cycle. In this scenario, that would mean reloading all 10 terabytes every night, which is highly inefficient and not what is described.
• B. Incremental extraction (or delta loading) retrieves only the records that have been added or modified since the last extraction. Using a 'last_modified_date' filter is a standard way to implement this method, which minimizes network load and processing time.
• C. Data virtualization provides a way to retrieve and view data without physically moving it into a data warehouse or local storage. Since the scenario involves extracting records for a warehouse update, it is a physical move, not virtualization.
• D. Master Data Management (MDM) is a methodology used to define and manage the critical data of an organization to provide a single point of reference. It is a data governance and quality strategy rather than a technical data acquisition method.

Correct answer: B — Formatting by applying a conversion rate calculation

• A. Parsing currency symbols helps identify the currency or format but does not perform the mathematical conversion needed to standardize values. It is often a preliminary step for identification rather than the transformation step that achieves data unification.
• B. Applying a conversion rate calculation is the necessary transformation to unify data into a single currency. By multiplying the local currency amount by the appropriate exchange rate, the analyst standardizes the revenue values into USD for consistent reporting.
• C. A UNION operation is used to combine rows from multiple datasets into a single table. While it can consolidate data sources, it does not change the underlying values or convert currencies, leaving the data non-standardized.
• D. Dropping non-USD rows is a filtering/cleansing step that would result in the loss of significant global sales data. The objective is to include all revenue by transforming it, not to exclude records that aren't already in the target currency.

Correct answer: C — Use linear interpolation

• A. Dropping the rows with missing data is not ideal for time-series analysis as it creates gaps in the timeline and removes continuous records. This can distort trends and reduce the overall utility of the dataset for time-based modeling.
• B. Replacing missing values with the overall dataset mean ignores the time-dependent nature of the data. Using a global summary statistic for a local gap in a time-series can introduce unrealistic jumps or artificial 'flat' spots that do not reflect the gradual progression of temperature.
• C. Linear interpolation is the most suitable method for small gaps in time-series data when values change gradually. It estimates the missing points by creating a straight line between the known values before and after the gap, thereby preserving the continuity and trend of the sequence.
• D. Replacing missing values with zero is mathematically incorrect and physically unrealistic for temperature data in this context. It would introduce significant outliers and errors into the analysis, as zero is not a reasonable estimate for a missing sensor reading unless specifically defined by the domain.

Correct answer: B — Drop the column entirely

• A. Incorrect. Replacing nearly all missing values with a placeholder string (like 'Unknown' or 'N/A') does not add meaningful information or signal to the dataset. For a field with 98% NULLs, this approach preserves a low-value column that will not improve model quality.
• B. Correct. When a column is overwhelmingly missing (high sparsity) and is unlikely to be a significant predictor for the model—such as a secondary contact field in a churn model—dropping the column is the most practical choice. This simplifies the dataset and prevents the model from processing noise.
• C. Incorrect. Imputing the mode is generally used for categorical fields when missingness is minimal. With 98% of data missing, imputing the mode would heavily distort the data distribution and create an artificial bias that provides no predictive value.
• D. Incorrect. Using a predictive model to guess missing contact information like fax numbers is unnecessarily complex and computationally expensive. Furthermore, secondary contact details are rarely high-signal features for predicting churn, making this effort impractical.

Correct answer: B — 95%

• A. Incorrect. According to the empirical rule, approximately 68% of the data falls within one standard deviation of the mean.
• B. Correct. The empirical rule (also known as the 68-95-99.7 rule) states that approximately 95% of the data in a normal distribution lies within two standard deviations of the mean.
• C. Incorrect. Approximately 99.7% of the data falls within three standard deviations of the mean in a normal distribution.
• D. Incorrect. A theoretical normal distribution is asymptotic, meaning the tails never touch the x-axis. Therefore, 100% of the data will never fall within a finite number of standard deviations.

Correct answer: C — Range

• A. Variance measures how spread out values are around the mean in squared units. It does not directly represent the difference between the absolute highest and lowest values, and its units (squared degrees) would be non-intuitive for reporting temperature fluctuation.
• B. Standard deviation measures the typical distance or dispersion of data points from the mean. While it is a common measure of variability, it does not represent the specific difference between the daily high and low readings.
• C. Range is calculated by subtracting the minimum value (daily low) from the maximum value (daily high). It is the most appropriate statistical measure to represent the total fluctuation or spread between the two extreme data points in a single day.
• D. The Interquartile Range (IQR) measures the spread of the middle 50% of data points (the difference between the third and first quartiles). Because it intentionally ignores outliers and extreme values, it would not capture the total daily fluctuation.

Correct answer: A — Extreme outliers (e.g., executive salaries) are skewing the mean.

• A. The arithmetic mean is highly sensitive to extreme values. A small number of very high salaries, such as executive compensation, can pull the mean upward significantly, making it unrepresentative of the typical employee's income. This creates a right-skewed distribution.
• B. Dividing by zero is a mathematical impossibility that results in an error message or a null value in data tools, not a specific, inflated numeric result like $150,000.
• C. Duplicate records could distort data, but they would only cause this specific discrepancy if the duplicates were exclusively for high-salary earners. Extreme outliers are a much more common and logical explanation for a skewed mean in payroll data.
• D. In a normal distribution, the mean, median, and mode are roughly equal. If 90% of employees earn around $50,000, the data is clearly skewed, which contradicts the characteristics of a normal distribution.

Correct answer: A — The regex does not account for special characters like the period (.) in the local part of the email.

• A. Correct. The regular expression provided uses the character class [a-zA-Z]+ for the local part (the part before the @ symbol), which only permits one or more alphabetic characters. Because it does not include the period (.), hyphen, or other special characters commonly used in email addresses, a string like 'john.doe' results in a validation failure.
• B. Incorrect. The regex specifically defines alphabetic character classes [a-zA-Z] for the domain and extension. It does not require or even allow numbers; if a domain contained a number, it would actually cause the validation to fail.
• C. Incorrect. The regex uses the '+' quantifier, which means 'one or more' occurrences. It does not specify a maximum length or character count constraint that would cause 'john.doe@email.com' to fail based on its size.
• D. Incorrect. The character class [a-zA-Z] explicitly includes both lowercase (a-z) and uppercase (A-Z) letters, so the regex is not restricted to uppercase letters only.

Correct answer: B — An executive summary highlighting key performance indicators (KPIs)

• A. Incorrect. An annotated Jupyter Notebook is designed for technical audiences who need to review code, logic, and data processing steps. C-suite executives typically require high-level summaries rather than granular technical documentation.
• B. Correct. An executive summary focusing on KPIs provides decision-makers with the most critical, high-level information quickly. It emphasizes business impact, trends, and actionable insights, which are essential for strategic decision-making.
• C. Incorrect. A raw CSV extract provides data without context, interpretation, or prioritization. Executives do not have the time to perform the data processing and analysis required to derive meaning from raw datasets.
• D. Incorrect. A detailed methodology report explaining statistical variances is too in-depth and technical for quick strategic decisions. Such reports are more appropriate for peer review or for stakeholders who need to validate the analysis process.

Correct answer: A — Variant B outperformed Variant A, and we are highly confident the results are not due to chance.

• A. This is the best choice for a non-technical audience because it translates the statistical concept of significance into plain language. By stating that the analyst is 'highly confident the results are not due to chance,' it conveys the meaning of a p-value < 0.05 without using technical jargon.
• B. While this statement is statistically accurate, 'null hypothesis' and 'p-value' are technical terms that may not be understood by a non-technical marketing team. Effective data communication requires tailoring the message to the audience's level of technical expertise.
• C. This option is overly technical and focuses on the underlying statistical procedure (alpha levels and test statistics) rather than the business impact or the actual finding of the test.
• D. This option is misleading in this context. While 'correlation does not imply causation' is a common data mantra, A/B tests are controlled experiments specifically designed to identify causal relationships. Bringing this up here might cause unnecessary confusion about the validity of the test results.

Correct answer: B — Histogram

• A. Bar charts are used to compare discrete categories rather than continuous numerical intervals. While they look similar to histograms, they are not the standard for representing frequency distributions of continuous data like age.
• B. A histogram is specifically designed to show the distribution of continuous data by grouping values into bins or intervals, such as 5-year age ranges. This allows the marketing team to see the frequency of customers within each interval.
• C. A scatter plot is used to display the relationship or correlation between two different continuous variables. It is not suitable for summarizing counts of a single variable within defined intervals.
• D. A waterfall chart is used to visualize how an initial value is affected by a series of intermediate positive and negative changes to reach a final value. It is not used for analyzing frequency distributions.

Correct answer: A — Heat map

• A. A heat map uses color intensity and gradients to represent the relative concentration or frequency of data points across a specific area or image. In web analytics, warmer colors typically indicate higher click volumes or user engagement on specific parts of a landing page.
• B. A choropleth map is a thematic map that uses color shading within predefined geographic boundaries, such as countries, states, or zip codes. It is used for regional data rather than representing click density on a webpage image.
• C. A symbol map uses icons, shapes, or markers placed at specific geographic coordinates to represent data points. It is not an appropriate tool for visualizing the density of interactions over a webpage layout.
• D. A bubble chart displays data points as circles on a Cartesian plane (X-Y axes) or map, where the size of the bubble represents a third quantitative variable. It does not provide a continuous color gradient overlay for analyzing spatial density on an image.

Correct answer: A — Apply data masking or remove the PII columns from the reporting dataset.

• A. Correct. Applying data masking or removing PII (Personally Identifiable Information) such as names and social security numbers ensures compliance with HIPAA regulations (specifically the Safe Harbor method for de-identification). This approach protects sensitive patient information while still allowing the analysis of aggregate trends.
• B. Incorrect. While encryption provides security for data in transit or at rest, it does not address the issue of exposing PII to the dashboard viewer. HIPAA compliance for reporting requires limiting or anonymizing unnecessary PII in the delivered content itself.
• C. Incorrect. Data-driven alerts are notifications for specific data thresholds and are used for operational monitoring. They do not address data privacy or HIPAA compliance concerns regarding the exposure of PII in the dataset.
• D. Incorrect. Changing the format to a static PDF does not inherently protect patient data. If the sensitive data is included when the report is generated, it will remain visible in the PDF, which does not satisfy privacy requirements.

Correct answer: B — Review the usage metrics and telemetry logs for the reporting portal.

• A. Sending a survey to employees is subjective and often yields incomplete or inaccurate results due to low response rates. It does not provide the objective data needed to identify actual report usage patterns.
• B. Reviewing usage metrics and telemetry logs provides objective, data-driven evidence of which reports are being accessed, how frequently they are used, and by whom. This is the industry standard for lifecycle management and identifying obsolete BI content.
• C. Data refresh frequency measures the currency of the data, not user engagement. A report might still be highly valuable even if the underlying data is updated infrequently (e.g., monthly or quarterly financial reports).
• D. Row-level security (RLS) is an access control feature, not an indicator of a report's utility. Reports without RLS may be intended for a wide, public audience and could be the most frequently used reports in the portal.

Correct answer: C — Time zone standardization

• A. Currency conversion rates affect the monetary valuation and display of sales figures across different regions, but they do not influence the temporal categorization or the date on which a transaction is recorded.
• B. Outer join conditions are used in SQL to determine how records from multiple tables are combined when there isn't a perfect match. While they can cause data to be missing if configured incorrectly, they would not consistently shift records to a different reporting day.
• C. Time zone standardization is the most likely cause. Because the report is generated at midnight EST, European sales occurring late in the evening (which would be the following morning in Europe) are being assigned to different business days depending on which time zone is used as the reference. Standardizing timestamps to a single format like UTC ensures consistent reporting across global regions.
• D. Data refresh schedules determine the frequency and timing of data ingestion or dashboard updates. While a slow refresh might delay data visibility, the specific issue of sales appearing on the 'following day's report' points to a date-cutoff logic error caused by time zone differences rather than the refresh frequency itself.

Correct answer: B — User Acceptance Testing (UAT)

• A. Unit testing is typically conducted by developers or analysts to ensure individual components of the report, such as specific calculations, filters, or data connections, function correctly on a technical level. It checks technical correctness rather than whether the report satisfies business users' real-world needs.
• B. User Acceptance Testing (UAT) is the phase where end-users or stakeholders review the report to confirm it aligns with their business requirements and accurately reflects their operational reality. This is the critical validation step used to gain approval before the report is moved into production.
• C. Peer review involves other analysts or developers reviewing the report for technical accuracy, logic, coding standards, and best practices. While it helps catch errors and ensures consistency, it does not specifically involve end-users validating against business requirements.
• D. Data profiling is the process of examining source data for quality, patterns, and consistency during the early stages of data analysis. While it ensures data readiness, it is a preliminary step and does not involve the validation of the final report interface or business logic by end-users.

Correct answer: B — Verifying that foreign key values in a child table have corresponding primary key values in a parent table.

• A. Incorrect. Regular expression checks validate that values follow a specific pattern or format, such as an email address or postal code. This is a form of pattern validation and does not verify relationships between records in different tables.
• B. Correct. Referential integrity is a property of data stating that all its references are valid. In the context of relational databases, it is maintained when each foreign key in a child table points to an existing primary key in a parent table, thereby preventing orphan records and ensuring relational consistency.
• C. Incorrect. Checking for NULL values in a mandatory column is a completeness or presence validation rule. It ensures that required data exists for a specific field, but it does not test table-to-table relationships.
• D. Incorrect. Confirming that data types match the target schema is a schema or type validation rule. It ensures structural consistency and data integrity at the field level, but it does not enforce referential integrity across multiple tables.

Correct answers: A, C, D — Completeness; Accuracy; Consistency

• A. Completeness is a key dimension of data quality that refers to whether all required data is present. It ensures there are no missing values or records that are necessary for analysis.
• B. Encryption is a security and privacy control used to protect data confidentiality by converting it into code. While critical for data governance, it is not an aspect of data quality.
• C. Accuracy refers to the degree to which data correctly reflects the real-world objects or events it represents. It is a fundamental pillar of data quality assurance.
• D. Consistency ensures that data values are uniform and do not conflict across different datasets, systems, or records. It is a vital dimension of quality in integrated environments.
• E. Redundancy refers to the duplication of data. While it can lead to quality issues (like inconsistency), it is a characteristic of data storage or database design rather than a dimension of data quality itself.
• F. Latency is a performance metric measuring the time delay in data processing or transmission. While related to availability and timeliness, it is primarily an infrastructure or system performance metric, not a core data quality dimension.

Correct answer: B — Dynamic data masking

• A. Static data masking involves creating a separate, masked copy of a dataset by permanently replacing sensitive values with fictional ones. It is typically used for non-production environments like development or testing and does not provide real-time obfuscation for live queries against the original source.
• B. Dynamic data masking provides real-time data obfuscation by masking sensitive information as it is queried or displayed, based on the user's role or permissions. The underlying source data remains unchanged, ensuring that only authorized users see the original values while others see masked data.
• C. Data anonymization involves irreversibly altering data to prevent the identification of individuals. While it is a privacy protection strategy, it is generally a batch transformation process rather than a real-time masking layer applied to live database queries.
• D. Transparent Data Encryption (TDE) protects data at rest by encrypting the database files or storage media. It prevents unauthorized physical access to the data but does not obfuscate specific fields for users who have the necessary permissions to query the database.

Correct answer: B — Symmetric encryption

• A. Pseudonymization replaces identifying fields with artificial identifiers (pseudonyms). While it allows for re-identification if a mapping key is available, it is a privacy technique rather than a key-based encryption method used to secure the data content itself.
• B. Symmetric encryption uses a single, shared key for both encryption and decryption. This is a strong protection strategy for safeguarding data at rest or in transit, as it ensures that only parties with the correct key can revert the ciphertext to its original, readable state.
• C. Anonymization permanently removes or alters personally identifiable information (PII) so that data can no longer be linked back to an individual. Unlike encryption, anonymization is designed to be irreversible.
• D. Dynamic data masking hides or obfuscates sensitive values in real-time as they are queried, based on user roles. While useful for limiting exposure in applications, it does not secure the underlying data using a key-based cryptographic process.

Correct answer: B — Remove or mask all 18 specific identifiers of Protected Health Information (PHI).

• A. While encrypting the database at rest using AES-256 is a critical security safeguard, it does not de-identify the data. Under HIPAA, the data must be properly de-identified before it can be used for secondary purposes like model training without specific patient authorization.
• B. To comply with HIPAA regulations while using data for analysis, the team should follow the Safe Harbor method of de-identification, which requires the removal or masking of 18 specific identifiers (e.g., names, social security numbers, and specific dates). This protects patient privacy while allowing the model to learn from the clinical conditions present in the records.
• C. Obtaining written consent from the Department of Health and Human Services (HHS) is not a requirement or a standard procedure for utilizing patient data. Compliance is typically handled through de-identification, internal authorization, or Business Associate Agreements (BAAs).
• D. The location of the training (on-premises vs. cloud) does not impact whether the data is HIPAA-compliant for research or modeling. Both environments can be compliant if proper safeguards and agreements are in place; the fundamental requirement is the protection or de-identification of the PHI itself.

Correct answer: B — Master data management

• A. Data lineage tracking documents the origin, movement, and transformations of data as it flows through systems. While it is essential for auditing, traceability, and impact analysis, it does not consolidate or reconcile records to create a single source of truth.
• B. Master data management (MDM) is the practice of creating and maintaining a single, authoritative source of truth (often called a golden record) for key business data. It reduces duplication and ensures consistency across disparate systems for core entities like customers and products.
• C. A version control system is used to manage changes to code, documents, or configuration files over time. It is vital for collaboration and rollback capabilities but is not used to govern enterprise master data records.
• D. A data dictionary is a repository of metadata that defines field names, data types, and business rules. Although it provides a common understanding of what data represents, it does not manage or synchronize the actual data records across multiple platforms.

Correct answer: B — A business glossary

• A. A data dictionary is a repository of technical metadata that describes the structure of a dataset, including field names, data types, constraints, and relationships. It is focused on the technical implementation of data rather than high-level business definitions.
• B. A business glossary defines business terms and concepts in clear, non-technical language to ensure consistency across the organization. It bridges the gap between technical data and business users by providing a shared vocabulary for all stakeholders.
• C. A data lineage map visualizes the lifecycle of data, showing its movement and transformations from the source to its final destination. It is used for auditing and understanding data flow, not for defining business terminology.
• D. A version control policy outlines the procedures for tracking and managing changes to files, such as code or documentation. While it helps manage the history of data assets, it does not serve as a repository for business definitions.