MDM Security and Access Control 5 — Questions and Answers
Question 1: Which Informatica MDM API security mechanism requires callers to pass a session token obtained from an initial login call?
- OAuth 2.0 bearer tokens
- MDM Hub SIF session tokens (Correct answer)
- SAML assertions embedded in each call
- API keys in request headers
Correct answer: MDM Hub SIF session tokens
The MDM Hub Services Integration Framework (SIF) uses session tokens obtained via a login() call that must be passed with all subsequent API requests to authenticate the caller.
Question 2: A security audit finds that multiple MDM Hub users share the same login credentials. What is the primary risk this creates?
- Increased database connection pool exhaustion
- Loss of individual accountability in audit logs and inability to enforce per-user access controls (Correct answer)
- Higher likelihood of record merge conflicts
- Reduced cleanse function performance
Correct answer: Loss of individual accountability in audit logs and inability to enforce per-user access controls
Shared credentials prevent MDM audit logs from attributing changes to individual users and make it impossible to enforce per-user data filters or tailored privilege sets.
Question 3: In Informatica MDM, what security consideration applies when using the Bulk Data Manager for large-scale data loads?
- Bulk loads bypass all row-level security and data filters (Correct answer)
- Bulk load service accounts must be granted EXECUTE privilege on landing tables
- Bulk loads require Admin role to run regardless of data content
- Bulk Data Manager encrypts all data in transit automatically
Correct answer: Bulk loads bypass all row-level security and data filters
Bulk data operations in MDM Hub typically bypass row-level data filters, so organizations must ensure that bulk load service accounts are tightly restricted and audited.
Question 4: Which Informatica MDM security feature allows masking a field like date-of-birth so some users see the full value while others see only the year?
- Field-level trust settings
- Column masking with role-based unmasking policies
- Separate packages with different field projections (Correct answer)
- Data Director display rules
Correct answer: Separate packages with different field projections
Creating multiple packages — one with the full DOB field and one with only a partial or masked projection — and assigning package READ privileges to different roles achieves field-level access differentiation.
Question 5: When Informatica MDM is integrated with an external identity provider via LDAP groups, how are LDAP groups typically mapped to MDM security?
- LDAP groups are automatically converted to MDM roles with identical names
- LDAP group membership is mapped to MDM Hub roles through explicit configuration in the Hub Console (Correct answer)
- Each LDAP group creates a new ORS in MDM Hub
- LDAP groups control only workflow task assignment, not data access
Correct answer: LDAP group membership is mapped to MDM Hub roles through explicit configuration in the Hub Console
Administrators explicitly map LDAP groups to MDM Hub roles in the Hub Console security configuration, giving LDAP group members the privileges of the corresponding MDM role.
Question 6: In Informatica MDM, which security practice should be applied to the MDM Hub's database service account to minimize risk?
- Grant the service account DBA privileges for maximum compatibility
- Restrict the service account to only the specific schemas and operations MDM Hub requires (Correct answer)
- Use the same service account for both MDM Hub and the application server
- Store the database password directly in the hub-conf.xml file in plaintext
Correct answer: Restrict the service account to only the specific schemas and operations MDM Hub requires
The MDM Hub database service account should follow least-privilege principles, having only the permissions needed to access CMX_SYSTEM and ORS schemas with the specific operations MDM requires.
Question 7: What is the recommended approach for securing Informatica MDM SIF web service endpoints exposed to external consumers?
- Expose endpoints on the public internet without restriction and rely on MDM login() for security
- Place MDM SIF endpoints behind an API gateway or reverse proxy with TLS termination and network access controls (Correct answer)
- Disable SIF endpoints and use only file-based integration
- Grant external consumers the Admin role to simplify access
Correct answer: Place MDM SIF endpoints behind an API gateway or reverse proxy with TLS termination and network access controls
Best practice is to front MDM SIF endpoints with an API gateway or reverse proxy that enforces TLS, rate limiting, and network-level access controls in addition to MDM's own authentication.
MDM Security and Access Control 5
Which Informatica MDM API security mechanism requires callers to pass a session token obtained from an initial login call?