MDM Security and Access Control 3 — Questions and Answers
Question 1: In Informatica MDM, which database schema stores the security metadata including user roles and privileges?
- Operational Reference Store (ORS)
- CMX_SYSTEM schema (Correct answer)
- Landing schema
- Staging schema
Correct answer: CMX_SYSTEM schema
The CMX_SYSTEM schema is the MDM Hub's administrative database that stores system-level metadata including security configuration like roles and privileges.
Question 2: What happens in Informatica MDM when a user belongs to multiple roles that have conflicting privileges on the same secure resource?
- The most restrictive privilege always wins
- The least restrictive privilege always wins (Correct answer)
- MDM throws an access denied error
- The system uses the last applied role
Correct answer: The least restrictive privilege always wins
Informatica MDM uses a permissive privilege model where the effective permission is the union of all privileges granted across all assigned roles.
Question 3: Which Informatica MDM security feature controls whether a user can see the change history (cross-reference records) of a master object?
- Package privileges
- Cross-reference read privilege (Correct answer)
- Audit log access
- Trust framework settings
Correct answer: Cross-reference read privilege
The cross-reference read privilege specifically controls a user's ability to view the source system contributions and history of a master record.
Question 4: An Informatica MDM implementation uses Hierarchy Manager. Which additional security element must be configured to restrict access to specific hierarchy nodes?
- ORS-level data filters
- Hierarchy Manager subject areas
- HM relationship base object privileges (Correct answer)
- Secure view definitions
Correct answer: HM relationship base object privileges
Hierarchy Manager relationship base object privileges control which hierarchy relationships and nodes a user can view or modify within the Hierarchy Manager.
Question 5: In Informatica MDM, what is the effect of granting a role the EXECUTE privilege on a Cleanse function?
- The role can run data quality cleansing on records
- The role can invoke the cleanse function via API calls (Correct answer)
- The role can modify the cleanse function definition
- The role gains access to all records processed by that function
Correct answer: The role can invoke the cleanse function via API calls
The EXECUTE privilege on a cleanse function allows the assigned role to invoke that function through API or batch operations.
Question 6: Which Informatica MDM security practice ensures that service accounts used by ETL processes follow least-privilege principles?
- Assigning service accounts to the Admin role
- Creating dedicated roles with only the specific base object and package privileges needed (Correct answer)
- Using shared user credentials for all ETL jobs
- Granting MERGE privilege to enable all data operations
Correct answer: Creating dedicated roles with only the specific base object and package privileges needed
Least-privilege for ETL service accounts means creating custom roles that grant only the specific READ, CREATE, or UPDATE privileges required for those integration processes.
Question 7: When Informatica MDM is deployed in a multi-tenant environment, what isolates the security configurations of each tenant?
- Separate Hub Servers per tenant
- Separate ORS databases with distinct role configurations (Correct answer)
- VLAN-level network separation
- Different Process Server instances
Correct answer: Separate ORS databases with distinct role configurations
In multi-tenant MDM deployments, each tenant typically has its own Operational Reference Store with its own isolated set of roles, users, and privilege assignments.
MDM Security and Access Control 3
In Informatica MDM, which database schema stores the security metadata including user roles and privileges?