The correct answer is B. The rule set was configured to allow specific IP addresses. CompTIA DataSys+ materials emphasize the importance of network security controls, particularly firewall rules and access control lists (ACLs), in regulating remote database access. In this scenario, the database server is reachable by users in Brazil but not by users in Canada, which strongly indicates that access is being selectively permitted rather than globally blocked.
Firewall rule sets are often configured using IP-based allowlists, where only approved IP addresses or IP ranges are permitted to establish a connection. If the analyst allowed the IP address range associated with Brazil but did not include the IP range used by Canadian users, connections from Canada would fail while Brazilian users would still have access. This behavior aligns precisely with selective rule-based access control, a common best practice highlighted in DataSys+ for reducing attack surfaces.
Option A is incorrect because if the perimeter network were rejecting remote connections entirely, users in Brazil would also be unable to connect. Option C is incorrect for the same reason: a firewall rule denying all connections would block access from all locations, not just Canada. Option D, server port security being disabled, would typically prevent all inbound connections to the database service, again affecting all users regardless of geography.
CompTIA DataSys+ stresses that troubleshooting connectivity issues requires identifying whether failures are global or location-specific. Location-specific failures are most commonly caused by misconfigured firewall rules, IP filtering, or regional access restrictions. In database environments that support remote access, DBAs must ensure that firewall rules are consistently applied to all authorized networks.
Therefore, the most accurate and verified explanation is that the rule set was configured to allow specific IP addresses, and the Canadian users' IP range was not included. This makes option B the correct answer.

The ORM snippet that would return the ID, state, and country of all customers with the newest customers appearing first is option C. This snippet uses the select method to specify the columns to be returned, the order method to sort the results by ID in descending order, and the all method to fetch all the records. The other options either have syntax errors, use incorrect methods, or do not sort the results correctly. References: CompTIA DataSys+ Course Outline, Domain 1.0 Database Fundamentals, Objective
1.2 Given a scenario, execute database tasks using scripting and programming languages.

The correct answer is D. Envelope encryption. CompTIA DataSys+ describes envelope encryption as a key management and data protection method that combines the efficiency of symmetric encryption with the security and manageability of hierarchical key structures. In this approach, data is first encrypted using a data encryption key (DEK), and then the DEK itself is encrypted (or "wrapped") using a key encryption key (KEK), often referred to as a managed root key.
Envelope encryption is widely used in enterprise database systems and cloud platforms because it provides strong security while simplifying key rotation and management. Encrypting large volumes of data directly with a root or master key would be inefficient and risky. Instead, DataSys+ explains that symmetric DEKs are used for fast data encryption, while the root key is used only to protect the DEKs. If a root key must be rotated or compromised, only the wrapped DEKs need to be re-encrypted-not the underlying data.
Option A, asymmetric encryption, uses public and private key pairs but is computationally expensive and not typically used to encrypt large datasets directly. Option B, DEK-based encryption, is incomplete because it describes only the use of data encryption keys and does not account for the additional wrapping layer that defines envelope encryption. Option C, symmetric encryption, correctly describes how data is encrypted but does not include the managed key hierarchy required by the question.
CompTIA DataSys+ emphasizes envelope encryption as a best practice for data-at-rest protection, particularly in environments that require compliance, auditing, and centralized key management. It is commonly implemented using hardware security modules (HSMs) or cloud key management services.
Therefore, the method where data is encrypted with a DEK and then wrapped with a managed root key is envelope encryption, making option D the correct and fully verified answer.

The correct answer is D. When undo management with temporary undo is enabled, the undo data is stored in the temporary tablespace instead of the undo tablespace. The temporary tablespace is a tablespace that stores temporary data such as sort results or intermediate query results. The undo data is the data that records the changes made by transactions on the database. Undo data is used to roll back transactions in case of errors or failures, or to provide read consistency for concurrent queries. By storing undo data in the temporary tablespace, the database can reduce the space consumption and contention in the undo tablespace, and improve performance and scalability. The other options are either incorrect or irrelevant for this question. For example, the system global area is a memory area that stores information shared by all sessions connected to an instance; the undo tablespace is a tablespace that stores undo data by default; the SYSAUX tablespace is a tablespace that stores auxiliary information for various database features. References: CompTIA DataSys+ Course Outline, Domain 3.0 Database Management and Maintenance, Objective 3.1 Given a scenario, perform common database maintenance tasks.

The correct answer is C. View creation. CompTIA DataSys+ places strong emphasis on protecting personally identifiable information (PII) while still enabling developers and analysts to perform their required tasks. In environments such as financial institutions, direct access to tables containing sensitive data presents a significant security and compliance risk, especially for junior developers who do not require full visibility of production data.
Creating views is a best-practice solution that allows database administrators to expose only the necessary columns and rows while hiding or excluding sensitive fields such as Social Security numbers, account numbers, or personal contact details. Views act as a controlled abstraction layer over the underlying tables, enabling developers to work with realistic data structures without direct access to raw PII. DataSys+ highlights views as an effective method for enforcing the principle of least privilege while maintaining usability and performance.
Option A, role assignment, is important for access control but is too broad on its own. Assigning a role may still allow access to sensitive columns unless combined with views or column-level permissions. Option B, data masking, is often used for non-production environments or dynamic data protection, but it may not be the best solution when developers need structured access to table data for development or testing purposes.
Option D, policy enforcement, refers to governance and administrative controls but does not directly provide a technical mechanism for safe table access.
CompTIA DataSys+ stresses that database security should balance protection with operational efficiency.
Views allow DBAs to centrally manage what data is exposed, simplify auditing, and reduce the risk of accidental data leakage. They are especially valuable in regulated industries where compliance and data minimization are critical.
Therefore, the best option for providing junior developers with access while protecting PII is view creation, making option C the correct and fully verified answer.