C1000-197 IBM Guardium Data Protection v12.x Administrator Practice Exam

A DBA team at Stockbridge Savings needs Guardium to capture database activity directly on the database hosts, streaming that activity to a collector. Which Guardium v12.x deployment fits?

1. Install S-TAP agents on the database hosts so Guardium collects activity at the source and streams it to a collector
2. Rely solely on each database’s own native audit log
3. Have DBAs email weekly activity summaries to the security team
4. Disable monitoring on the busiest databases to reduce load

A sizing review at Pendleton Energy finds a single Guardium collector overloaded at peak traffic. Which scaling approach fits?

1. Keep the single collector and accept that some events will be dropped
2. Add additional collectors, distribute S-TAPs across them, and add an aggregator to consolidate reporting
3. Move the Guardium collector onto a developer laptop for testing
4. Turn off activity monitoring during peak windows

A Guardium deployment at Cresthaven Bank must keep monitoring running even if one appliance node is lost. Which design approach fits?

1. Run a single appliance and rely on nightly tape backups only
2. Deploy two standalone appliances with no synchronization between them
3. Configure a highly available appliance pair with data replication and run periodic failover tests
4. Accept an outage whenever the single appliance fails

A policy at Tattersall Insurance must alert whenever a privileged user runs a SELECT against a sensitive table, but must not fire on routine reads by named service accounts. Which policy design fits?

1. An access-policy rule scoped to the privileged-user group and sensitive tables, with exceptions for the named service accounts
2. A rule that alerts on every SELECT from every user against every table
3. No policy at all — rely on periodic manual review of logs
4. A rule that alerts only on writes and ignores all reads

A data-exfiltration concern at Bramley Retail calls for a policy that flags result sets returning an unusually large number of rows from customer-PII tables. Which rule type fits?

1. An access rule that inspects only the queries sent to the database
2. An extrusion rule that inspects returned result sets and row counts, alerting above a threshold
3. A performance-tuning rule with no security effect
4. No rule — rely on the DBA noticing unusual activity

A Guardium admin at Fenwick Finance needs to locate which tables across dozens of databases contain PII. Which Guardium capability fits the discovery task?

1. Ask developers to list every PII table from memory
2. Run data classification scans with PII pattern rules to discover tables and columns holding sensitive data, then align audit policy to the findings
3. Audit every table uniformly without any classification step
4. Assume PII is wherever the schema names suggest it might be

An entitlement review at Holloway Trust suspects some users hold over-broad privileges on sensitive tables. Which Guardium capability surfaces those privileges for right-sizing?

1. Ask each user what privileges they believe they have
2. Revoke all privileges first and restore them only when someone complains
3. Run database entitlement reports that enumerate user and role privileges on sensitive objects, then work with the DBA team to right-size access
4. Ignore entitlements and focus only on live activity monitoring

A SOC analyst at Quayside Bank needs to search Guardium’s monitored activity for a specific SQL fragment across the whole environment. Which Guardium capability fits the investigation?

1. Manually grep the filesystem on each collector, one at a time
2. Use the Investigation Dashboard / search to query activity across collectors for the SQL fragment and related sessions
3. Ask DBAs to try to recall who might have run that query
4. Skip the search and hope it was benign

Compliance at Yewtree Insurance needs a standard monthly report of privileged-user activity, delivered automatically to the compliance team for audit. Which Guardium capability fits?

1. Screenshot the UI each month and paste the images into an email
2. Rely on the auditor to remember what happened during the month
3. Use built-in or custom compliance reports within an audit process, scheduled for automatic monthly delivery to the compliance team
4. Provide no report and address findings only if an auditor asks

A Guardium admin at Whitemere Utilities must bring the appliance up to the latest v12.x fix pack safely. Which practice fits?

1. Take a configuration backup, apply the patch in a maintenance window per the release notes, then verify collectors and agents after patching
2. Apply the patch at peak hours without taking a backup first
3. Skip the patch because the appliance seems to work today
4. Patch only the collectors and skip the central manager