S.A. ENGINEERINGCOLLEGE, CHENNAI-77.

(An Autonomous Institute Research-level, Affiliated to Anna University)

DEPARTMENT OF CSE (CYBER SECURITY)
QUESTIONBANK
Academic Year : 2024-2025(EVEN)
Year/ Sem : II/IV
Subject Code : CB3402
Subject Name : DATABASE MANAGEMENT SYSTEMS AND SECURITY (LAB
INTEFRATED)
Common to : CSE (CYBER SECURITY)

UNIT I RELATIONAL DATABASES 9

Data Models – Relational Data Models – Relational Algebra – Structured Query Language –
Entity Relationship Model – Distributed Databases - Data Fragmentation – Replication.

PART-A (2 MARKS)

1. What is a Data Model?

 A data model is a collection of concepts used to describe the structure of a database.

 It defines how data is stored, organized, and accessed.
 Data models also specify relationships and constraints.
 Examples include relational, hierarchical, and network models.

2. Define Relational Data Model.

 The relational data model represents data in the form of tables (relations).
 Each table consists of rows (tuples) and columns (attributes).
 It is based on mathematical relations and set theory.
 It ensures data integrity and simplicity.

3. What is a Relation in DBMS?

 A relation is a table with rows and columns in a relational database.

 Rows represent records and columns represent attributes.
 Each relation has a unique name.
 Duplicate rows are not allowed.

4. Define Relational Algebra.

 Relational algebra is a procedural query language.

 It consists of a set of operations to manipulate relations.
 It forms the theoretical foundation of SQL.
 Operations include select, project, union, and join.

5. What is the SELECT operation in Relational Algebra?

 SELECT operation retrieves rows from a relation based on a condition.

 It filters tuples that satisfy a given predicate.
 The structure of the relation remains unchanged.
  It is denoted by the symbol σ (sigma).

6. What is Structured Query Language (SQL)?

 SQL is a standard language used to interact with relational databases.

 It is used to create, retrieve, update, and delete data.
 SQL supports data definition and manipulation.
 It is widely used in commercial DBMSs.

7. What are DDL commands in SQL?

 DDL stands for Data Definition Language.

 It is used to define and modify database structures.
 Common commands include CREATE, ALTER, and DROP.
 They affect the schema of the database.

8. What are DML commands in SQL?

 DML stands for Data Manipulation Language.

 It is used to access and modify data in tables.
 Examples include INSERT, UPDATE, and DELETE.
 It operates on the data stored in relations.

9. Define Entity in ER Model.

 An entity is a real-world object distinguishable from others.

 It can be physical or conceptual.
 Each entity has a set of attributes.
 Example: Student, Employee, or Course.

10. What is an Attribute in ER Model?

 An attribute describes a property of an entity.

 It represents a characteristic or feature.
 Attributes can be simple, composite, or derived.
 Example: Roll number, name, and age.

11. Define Entity Relationship (ER) Model.

 ER model is a conceptual data model.

 It represents data using entities, attributes, and relationships.
 It is mainly used in database design.
 ER diagrams visually represent the database structure.

12. What is a Distributed Database?

 A distributed database is a collection of databases spread across multiple locations.

 They are connected via a network.
 Data is logically related but physically distributed.
 It improves reliability and performance.
 13. Define Data Fragmentation.

 Data fragmentation is the process of dividing a database into smaller parts.

 Each fragment stores a subset of the data.
 It improves efficiency and locality of access.
 Types include horizontal and vertical fragmentation.

14. What is Data Replication?

 Data replication involves copying data across multiple sites.

 It ensures high availability and fault tolerance.
 Replicas improve read performance.
 Consistency must be maintained among copies.

15. Differentiate Fragmentation and Replication.

 Fragmentation divides the database into smaller pieces.

 Replication creates copies of the same data.
 Fragmentation improves access efficiency.
 Replication improves availability and reliability.

UNIT II DATABASE DESIGN 9

Mapping ER Models to Relations – Functional Dependencies – Non-Loss Decomposition

Functional Dependencies – First Normal Form – Second Normal Form – Third Normal Form –
Dependency Preservation –Boyce/Codd Normal Form – Multi-Valued Dependencies and Fourth
Normal Form – Join Dependencies and Fifth Normal Form

PART-A (2 MARKS)

1. What is database design?

 Database design is the process of defining the structure of a database.

 It involves identifying entities, relationships, and constraints.
 Good design reduces redundancy and improves data integrity.
 It ensures efficient storage and retrieval of data.

2. What is ER to Relational Mapping?

 ER to relational mapping converts an ER model into tables.

 Entities are mapped to relations.
 Attributes become columns.
 Relationships are represented using foreign keys.

3. Define Functional Dependency.

 A functional dependency (FD) is a constraint between attributes.

 It is denoted as X → Y.
 If two tuples have the same X values, they must have the same Y values.
 FDs help in normalization.

4. What is a non-loss (lossless) decomposition?

  A decomposition is lossless if original data can be reconstructed.
 Joining decomposed tables gives the original relation.
 No information is lost during decomposition.
 It ensures data integrity.

5. Define normalization.

 Normalization is the process of organizing data to reduce redundancy.

 It divides large tables into smaller ones.
 It improves data consistency.
 Normalization is based on normal forms.

6. What is First Normal Form (1NF)?

 A relation is in 1NF if all attributes have atomic values.

 No repeating groups or multivalued attributes are allowed.
 Each field contains a single value.
 It is the basic level of normalization.

7. What is Second Normal Form (2NF)?

 A relation is in 2NF if it is in 1NF.

 There should be no partial dependency.
 Non-key attributes must depend on the whole primary key.
 It removes partial redundancy.

8. What is Third Normal Form (3NF)?

 A relation is in 3NF if it is in 2NF.

 There should be no transitive dependency.
 Non-key attributes must depend only on the primary key.
 It improves data consistency.

9. What is dependency preservation?

 Dependency preservation ensures that all functional dependencies are maintained.

 Constraints can be checked without joining relations.
 It simplifies database maintenance.
 It is important in decomposition.

10. Define Boyce–Codd Normal Form (BCNF).

 BCNF is a stronger version of 3NF.

 Every determinant must be a candidate key.
 It removes more redundancy than 3NF.
 It may not always preserve dependencies.

11. What is a multivalued dependency (MVD)?

 An MVD occurs when one attribute determines multiple independent values.

 It is denoted as X →→ Y.
 It causes redundancy in relations.
 Handled using 4NF.

12. What is Fourth Normal Form (4NF)?

  A relation is in 4NF if it is in BCNF.
 There should be no non-trivial multivalued dependencies.
 It eliminates redundancy due to MVDs.
 Used in complex data models.

13. What is a join dependency?

 A join dependency occurs when a relation can be reconstructed by joining smaller

relations.
 It generalizes multivalued dependencies.
 It leads to further normalization.
 Handled using 5NF.

14. What is Fifth Normal Form (5NF)?

 A relation is in 5NF if it has no join dependencies.

 It cannot be decomposed further without loss.
 Also called Project-Join Normal Form.
 Used in advanced database design.

15. Why is normalization important?

o Normalization reduces data redundancy.
o It improves data integrity.
o It minimizes update anomalies.
o It makes the database more efficient.

UNIT III TRANSACTION MANAGEMENT 9

Transaction Concepts – ACID Properties – Schedules – Serializability – Concurrency Control –

Need for Concurrency – Locking Protocols – Two Phase Locking – Deadlock – Transaction
Recovery - Save Points – Isolation Levels – SQL Facilities for Concurrency and Recovery

PART-A (2 MARKS)

1. What is a transaction?

 A transaction is a sequence of database operations.

 It performs a logical unit of work.
 A transaction must be fully completed or fully aborted.
 It maintains database consistency.

2. Define ACID properties.

 ACID stands for Atomicity, Consistency, Isolation, and Durability.

 Atomicity ensures all or nothing execution.
 Consistency preserves database integrity.
 Isolation avoids interference among transactions.
 Durability ensures committed data is permanent.

3. What is atomicity?

 Atomicity ensures that a transaction is indivisible.

 Either all operations are executed or none.
  Partial updates are not allowed.
 Rollback is used on failure.

4. What is a transaction schedule?

 A schedule is the order in which operations of transactions are executed.

 It shows interleaving of operations.
 Schedules can be serial or non-serial.
 Used to analyze concurrency.

5. Define serial schedule.

 A serial schedule executes transactions one after another.

 No interleaving of operations occurs.
 It is simple and free from conflicts.
 Performance is low compared to concurrent schedules.

6. What is serializability?

 Serializability ensures correctness of concurrent transactions.

 A schedule is serializable if it is equivalent to a serial schedule.
 It preserves database consistency.
 Used in concurrency control.

7. What is conflict serializability?

 A schedule is conflict serializable if it can be transformed into a serial schedule.

 Transformation is done by swapping non-conflicting operations.
 Conflicts occur on same data item.
 It is widely used in practice.

8. Why is concurrency control needed?

 Concurrency control ensures correctness when multiple transactions execute.

 It prevents problems like lost updates.
 It maintains consistency.
 It improves system performance.

9. What is locking in DBMS?

 Locking is a mechanism to control concurrent access.

 It restricts data access by transactions.
 Locks ensure isolation.
 Common types are shared and exclusive locks.

10. What are shared and exclusive locks?

 Shared lock allows read operations.

 Exclusive lock allows read and write operations.
 Only one exclusive lock is allowed at a time.
 They prevent conflicting access.
11. Define Two Phase Locking (2PL).

 Two Phase Locking is a concurrency control protocol.

 It has growing and shrinking phases.
 Locks are acquired in the growing phase.
 Locks are released in the shrinking phase.

12. What is deadlock?

 Deadlock occurs when transactions wait for each other indefinitely.

 Each transaction holds a resource needed by another.
 No transaction can proceed.
 It reduces system performance.

13. What is transaction recovery?

 Transaction recovery restores the database after failure.

 It ensures atomicity and durability.
 Uses logs and checkpoints.
 Rollback and redo operations are performed.

14. What is a savepoint?

 A savepoint is a marker within a transaction.

 It allows partial rollback.
 It avoids rolling back the entire transaction.
 Used in complex transactions.

15. What are isolation levels in SQL?

 Isolation levels define degree of transaction isolation.

 Common levels are Read Uncommitted, Read Committed, Repeatable Read, and
Serializable.
 They control visibility of changes.
 Higher isolation reduces concurrency issues.

16. What are SQL facilities for concurrency control?

 SQL provides LOCK, COMMIT, and ROLLBACK.

 Isolation levels control concurrency.
 Savepoints enable partial rollback.
 These ensure safe transaction execution.

17. What is durability?

 Durability ensures committed data is permanent.

 Data survives system failures.
 Recovery mechanisms support durability.
 Logs help in restoring data.
18. What is transaction commit?

 Commit makes all transaction changes permanent.

 It ends the transaction successfully.
 Data becomes visible to other transactions.
 Ensures durability.

19. What is transaction rollback?

 Rollback undoes all operations of a transaction.

 It restores the database to previous state.
 Used when errors occur.
 Maintains atomicity.

20. What is the need for savepoints?

 Savepoints allow partial undo of transactions.

 They improve transaction flexibility.
 Reduce overhead of full rollback.
 Used in nested operations.

UNIT IV DATABASE SECURITY 9

Database security – Common threats and challenges - Best practices and solutions - Data protection
tools and platforms - SQL Injection Attacks – The Injection Technique – SQLi Attack Avenues and
Types.

PART-A (2 MARKS)

1. What is database security?

 Database security refers to protecting databases from unauthorized access.

 It ensures confidentiality, integrity, and availability of data.

 Security measures include access control and encryption.
 It prevents data breaches and misuse.

2. What are common threats to database security?

 Common threats include unauthorized access and data theft.

 SQL injection and malware attacks are major risks.
 Insider threats also affect security.
 System vulnerabilities can be exploited by attackers.

3. Define confidentiality in database security.

 Confidentiality ensures data is accessed only by authorized users.

 It prevents disclosure of sensitive information.
 Encryption helps maintain confidentiality.
 Access control policies enforce it.

4. What is data integrity?

 Data integrity ensures accuracy and consistency of data.

 Data should not be altered without authorization.
  Constraints and validation maintain integrity.
 It protects against data corruption.

5. What is availability in database security?

 Availability ensures data is accessible when needed.

 It prevents service downtime.
 Backup and recovery mechanisms improve availability.
 Fault tolerance supports it.

6. What are best practices for database security?

 Using strong authentication is a best practice.

 Regular updates and patches are necessary.
 Data encryption should be applied.
 Audit logs help monitor activities.

7. What is data encryption?

 Encryption converts data into unreadable format.

 Only authorized users can decrypt it.
 It protects data at rest and in transit.
 Encryption keys are required for access.

8. What are data protection tools?

 Data protection tools secure and monitor databases.

 Examples include firewalls and intrusion detection systems.
 They prevent unauthorized access.
 They also provide audit and compliance features.

9. What is SQL Injection?

 SQL Injection is a code injection attack.

 Malicious SQL queries are inserted into input fields.
 It allows attackers to access or modify data.
 It exploits poor input validation.

10. What is the injection technique?

 Injection technique involves inserting malicious code.

 Attackers manipulate user inputs.
 The code gets executed by the database.
 It compromises security.

11. What are SQL injection attack avenues?

 User input fields are common attack avenues.

 Login forms and search boxes are targeted.
 URL parameters can be exploited.
 Stored procedures may also be attacked.

12. What are the types of SQL injection attacks?

 Types include in-band, blind, and out-of-band SQL injection.

  In-band uses same channel for attack and data retrieval.
 Blind SQLi relies on true/false responses.
 Out-of-band uses different channels.

13. What is in-band SQL injection?

 In-band SQL injection uses the same communication channel.

 It is the most common SQLi attack.
 Data is retrieved directly from the database.
 Includes error-based and union-based attacks.

14. What is blind SQL injection?

 Blind SQL injection does not show direct error messages.

 Attackers infer information using responses.
 It uses boolean or time-based techniques.
 It is harder to detect.

15. How can SQL injection attacks be prevented?

 Using prepared statements prevents SQLi.

 Input validation and sanitization are essential.
 Least privilege access reduces risk.
 Web application firewalls help protect databases.
UNIT V ACCESS CONTROL AND ENCRYPTION 9
Database Access Control – Types - Role-based access control - SQL based access definition –
Cascading Authorizations –– Database Inference problem – Types of inference attacks - storage
encryption

PART-A (2 MARKS)

1. What is database access control?

 Database access control regulates who can access database resources.

 It defines permissions for users and roles.
 It prevents unauthorized access.
 It ensures data confidentiality and integrity.

2. What are the types of database access control?

 The main types are discretionary, mandatory, and role-based access control.
 Discretionary access control is user-based.
 Mandatory access control uses security levels.
 Role-based access control assigns permissions to roles.

3. What is Discretionary Access Control (DAC)?

 DAC allows data owners to control access to their data.

 Permissions are granted or revoked by users.
 It is flexible but less secure.
 Commonly used in SQL databases.

4. What is Mandatory Access Control (MAC)?

 MAC enforces access using security classifications.

 Users cannot change permissions.
 It is used in high-security systems.
 Access depends on clearance levels.

5. What is Role-Based Access Control (RBAC)?

 RBAC assigns permissions to roles instead of users.

 Users are assigned roles based on responsibilities.
 It simplifies access management.
 It improves security and scalability.

6. What is SQL-based access definition?

 SQL provides commands to define access rights.

 GRANT and REVOKE are commonly used.
 Permissions include SELECT, INSERT, UPDATE, DELETE.
 They control user operations on database objects.

7. What is cascading authorization?

 Cascading authorization allows privileges to be passed to others.

  It uses the GRANT OPTION in SQL.
 Revoking privileges can affect dependent users.
 It simplifies permission delegation.

8. What is the database inference problem?

 Inference problem occurs when sensitive data is deduced indirectly.

 Attackers infer confidential information from query results.
 It happens even with authorized access.
 It threatens data confidentiality.

9. What are inference attacks?

 Inference attacks exploit legitimate queries.

 Attackers combine multiple results.
 They derive sensitive information.
 They bypass access control mechanisms.

10. What are the types of inference attacks?

 Types include aggregation and association attacks.

 Aggregation combines multiple queries.
 Association links related data.
 Both lead to data leakage.

11. What is aggregation attack?

 Aggregation attack gathers small data pieces.

 Individually harmless data becomes sensitive.
 It violates confidentiality.
 Common in statistical databases.

12. What is association attack?

 Association attack links related attributes.

 Sensitive information is inferred.
 Uses correlations among data.
 Difficult to detect.

13. What is storage encryption?

 Storage encryption protects data stored in databases.

 Data is encrypted at rest.
 Only authorized users can decrypt it.
 It prevents data theft from storage media.

14. What are the benefits of database encryption?

 Encryption protects sensitive data.

 It ensures confidentiality.
 It helps meet compliance requirements.
 It reduces impact of data breaches.
15. What is key management in encryption?

 Key management handles encryption keys securely.

 It includes key generation and storage.
 Proper management prevents unauthorized decryption.
 It is critical for encryption security.