Security of application itself ensures absolute security of databases
-
Yes
-
No. Additional System Hardening is needed
-
No.Additional Database hardening is needed.
-
No. Additional Application hardening is needed.
Application security alone is NOT sufficient for database security. Databases require additional hardening measures like encryption at rest, access controls, auditing, parameterized queries, and least-privilege configurations. Option C correctly identifies that database-specific hardening is still necessary. Options B and D are partially correct but C is the most precise answer.
Securing the application layer alone doesn't guarantee the database itself is safe — the database needs its own hardening (patching, least-privilege database accounts, disabling unnecessary features/procedures, encryption at rest, etc.) independent of whatever protections exist in the application. Defense-in-depth means each layer of the stack needs its own security measures.