XML Exam I10-003 Topic 9 Question 43 Discussion

Actual exam question for XML's I10-003 exam

Question #: 43
Topic #: 9

A certain store engages in Internet commerce, managing customer information via XMLDB. Customers register as a user through a webpage, and are allowed to view their own information so they can edit their information themselves through a webpage interface. The store's Web application saves the customer information in an XMLDB, and retrieves data from the XMLDB as necessary. The XML data including customer information is as shown in [CUSTOMER.xml] referenced in a separate window.

The XMLDB account when the Web application connects to the XMLDB is WEBAPP.

A person at the store is in charge of processing payments (access to all registered customer information), and this person's XMLDB account is COUNTER.

A person at the store is in charge of product shipments (access to all registered customer information except for payment information ("payment element")), and this person's XMLDB account is SHIPPER.

Do not consider XMLDB accounts other than those noted above.

Each account authorization in the XMLDB is presently configured as follows: The WEBAPP account has permission to update and view [CUSTOMER xml]

Other accounts have permission to view [CUSTOMER.xml]

Which is the most appropriate method in this situation regarding XMLDB account authorizations'?

Assume that this XMLDB has a view creation function (function to show only certain XML data in response to a certain query)

AWhen saving data into the XMLDB, all user element content should be encrypted, and all XMLDB accounts should be given permission for decryption

BWhen saving data into the XMLDB, all payment element content should be encrypted, and only the COUNTER account should be given permission for decryption

CYou should create a view (PAYMENT_VIEW) to show only payment element information, providing the COUNTER account with permission to view PAYMENT_VIEW

DYou should create a view (SHIP_V1EW) to show information other than payment element information, providing the SHIPPER account with permission to view SHIP_V1EW, and prohibiting the SHIPPER account from viewing [CUSTOMER.xml]

Show Suggested Answer

Suggested Answer: D

by Janna at Jun 23, 2024, 03:58 PM

Limited Time Offer

25%

Off

Get Premium I10-003 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Tamar

4 months ago

I'm going with option C. It's the most targeted approach to controlling access to the sensitive payment data.

upvoted 0 times

...

6 months ago

I think option C is the most appropriate. Creating a view for payment information and giving the COUNTER account access to it is a good way to control access to sensitive data.

upvoted 0 times