XML Exam I10-003 Topic 5 Question 37 Discussion

Actual exam question for XML's I10-003 exam

Question #: 37
Topic #: 5

A certain store engages in Internet commerce, managing customer information via XMLDB. Customers register as a user through a webpage, and are allowed to view their own information so they can edit their information themselves through a webpage interface. The store's Web application saves the customer information in an XMLDB, and retrieves data from the XMLDB as necessary. The XML data including customer information is as shown in [CUSTOMER.xml] referenced in a separate window.

The XMLDB account when the Web application connects to the XMLDB is WEBAPP.

A person at the store is in charge of processing payments (access to all registered customer information), and this person's XMLDB account is COUNTER.

A person at the store is in charge of product shipments (access to all registered customer information except for payment information ("payment element")), and this person's XMLDB account is SHIPPER.

Do not consider XMLDB accounts other than those noted above.

Each account authorization in the XMLDB is presently configured as follows: The WEBAPP account has permission to update and view [CUSTOMER xml]

Other accounts have permission to view [CUSTOMER.xml]

Which is the most appropriate method in this situation regarding XMLDB account authorizations'?

Assume that this XMLDB has a view creation function (function to show only certain XML data in response to a certain query)

AWhen saving data into the XMLDB, all user element content should be encrypted, and all XMLDB accounts should be given permission for decryption

BWhen saving data into the XMLDB, all payment element content should be encrypted, and only the COUNTER account should be given permission for decryption

CYou should create a view (PAYMENT_VIEW) to show only payment element information, providing the COUNTER account with permission to view PAYMENT_VIEW

DYou should create a view (SHIP_V1EW) to show information other than payment element information, providing the SHIPPER account with permission to view SHIP_V1EW, and prohibiting the SHIPPER account from viewing [CUSTOMER.xml]

Show Suggested Answer

Suggested Answer: D

by Dorthy at Apr 14, 2024, 06:37 PM

Limited Time Offer

25%

8 months ago

This is a tricky question. We need to balance security and accessibility for different user roles. Encrypting all user data might be overkill, but we definitely need to protect the payment information.

upvoted 0 times

Kris

6 months ago

I agree, we should only give permission to decrypt payment information to the COUNTER account.

upvoted 0 times

...

Graciela

6 months ago

I think option B is the best choice.

upvoted 0 times

...