Which statement accurately reflects usage of database access and application IDs?

Which statement accurately reflects usage of database access and application IDs?

• A. Direct User Logins To The Database Are Allowed For Routine Queries
• B. Application IDs May Be Shared Among Multiple Applications
• C. Database Access For Users Must Be Through Programmatic Methods, And Application IDs Must Be Used Only By Applications
• D. All Database Access Must Be Done Via Individual DBAs With Direct User Credentials

Answer: (C)

The idea being tested is that access to the database should be controlled through the application layer, with distinct identities for applications rather than direct human access to the database. This ensures accountability and access control are enforced by the system, not by individual users reaching into the database. Database access for users should flow through programmatic methods, such as the application's code or API calls, rather than end users signing directly into the database. This keeps business logic, security checks, and least-privilege policies centralized in the application. In tandem, application IDs should be used to identify and authorize actions, and these IDs must be used by applications—not shared or used by humans. This provides clear traceability: every action in the data layer can be attributed to a specific app, which is essential for auditing and enforcing permissions. Direct user logins to the database for routine queries undermine accountability and make it hard to enforce least privilege or track actions. Sharing an application ID among multiple applications defeats the purpose of having a unique identity for each app, reducing traceability. Requiring all database access to go through individual DBAs with direct credentials contradicts the goal of scalable, auditable, application-driven access control. So the statement aligns with best practices: users access data via the application’s programmatic interfaces, and application IDs are used exclusively by applications.

The idea being tested is that access to the database should be controlled through the application layer, with distinct identities for applications rather than direct human access to the database. This ensures accountability and access control are enforced by the system, not by individual users reaching into the database.

Database access for users should flow through programmatic methods, such as the application's code or API calls, rather than end users signing directly into the database. This keeps business logic, security checks, and least-privilege policies centralized in the application. In tandem, application IDs should be used to identify and authorize actions, and these IDs must be used by applications—not shared or used by humans. This provides clear traceability: every action in the data layer can be attributed to a specific app, which is essential for auditing and enforcing permissions.

Direct user logins to the database for routine queries undermine accountability and make it hard to enforce least privilege or track actions. Sharing an application ID among multiple applications defeats the purpose of having a unique identity for each app, reducing traceability. Requiring all database access to go through individual DBAs with direct credentials contradicts the goal of scalable, auditable, application-driven access control.

So the statement aligns with best practices: users access data via the application’s programmatic interfaces, and application IDs are used exclusively by applications.