DBS-C01 Practice Test 15 — 15 Questions

Question 1

Arrange the steps to troubleshoot a connection timeout issue from an EC2 instance to an Amazon RDS for SQL Server DB instance in the correct order.

Accepted Answer

First, verify security group inbound rules. Second, check network ACLs. Third, verify EC2 network configuration. Finally, test connectivity using telnet.. Troubleshooting connectivity involves checking security groups, network ACLs, network configuration, and testing with telnet.

Answer

First, check network ACLs. Second, verify security group inbound rules. Third, test connectivity using telnet. Finally, verify EC2 network configuration.

Answer

First, test connectivity using telnet. Second, verify security group inbound rules. Third, check network ACLs. Finally, verify EC2 network configuration.

Answer

First, verify EC2 network configuration. Second, verify security group inbound rules. Third, check network ACLs. Finally, test connectivity using telnet.

Question 2

Refer to the exhibit. A security engineer has applied this key policy to a customer managed KMS key used to encrypt a Secrets Manager secret containing database credentials. An application running on an Amazon EC2 instance in the same account and region is unable to decrypt the secret. What is the MOST likely cause?

Accepted Answer

The condition kms:ViaService restricts the decryption to requests made via Secrets Manager, but the application is calling KMS directly.. The condition `kms:ViaService` in the key policy restricts the `Decrypt` permission to requests that originate specifically from the AWS Secrets Manager service. When the application on the EC2 instance calls KMS directly (e.g., via the `Decrypt` API) to decrypt the secret, the request does not come through Secrets Manager, so the condition is not satisfied and the request is denied. This is the most likely cause of the decryption failure.

Answer

The KMS key ARN in the resource field is incorrect.

Answer

The policy is missing an encryption context that matches the secret's encryption context.

Answer

The policy only allows Decrypt, but the application needs Encrypt permission.

Question 3

A company is migrating a 5 TB MySQL database to Amazon RDS for MySQL. They need to minimize downtime. Which approach should they use?

Accepted Answer

Use AWS DMS with full load and change data capture (CDC). AWS DMS with full load and change data capture (CDC) minimizes downtime by performing an initial full load of the 5 TB database while continuously replicating ongoing changes from the source. Once the full load completes and the target is nearly synchronized, you can cut over with minimal downtime, typically seconds to minutes. This approach is specifically designed for large-scale migrations with low downtime requirements.

Answer

Use Percona XtraBackup to take a backup and restore to RDS

Answer

Use mysqldump to export and import data

Answer

Use AWS DataSync to copy database files

Question 4

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database contains personally identifiable information (PII). The security team requires that the data be encrypted at rest using a customer-managed key stored in AWS KMS. Additionally, the team wants to ensure that the key can be rotated automatically every year. What should the company do to meet these requirements?

Accepted Answer

Create a customer-managed key in AWS KMS, enable automatic rotation, and enable encryption on the RDS instance using that key.. The correct approach is to create a customer-managed key in AWS KMS with automatic rotation enabled, then enable encryption on the RDS instance using that key. This meets the requirements for encryption at rest with a customer-managed key and automatic annual rotation. Option A is incorrect because AWS Secrets Manager is used for storing secrets, not encryption keys. Option C lacks automatic rotation. Option D uses an AWS managed key, not customer-managed, and requires a manual Lambda function, not automatic rotation.

Answer

Enable encryption on the RDS instance using the default RDS encryption and use AWS Secrets Manager to store the key.

Answer

Create a customer-managed key in AWS KMS without automatic rotation, and manually rotate the key using the RDS console.

Answer

Use an AWS managed key for RDS and create an AWS Lambda function to rotate the key manually each year.

Question 5

A company has an Amazon DynamoDB table that stores user sessions. The security team wants to ensure that only authorized applications can read and write to the table, and that all access is logged. Which THREE steps should the company take to meet these requirements?

Accepted Answer

Enable AWS CloudTrail to log DynamoDB API calls.. Options A, B, and C are correct. IAM roles with least privilege restrict access. AWS CloudTrail logs API calls for auditing. VPC endpoints ensure traffic stays within the AWS network and can be controlled via endpoint policies. Option D (encryption with KMS) is for data at rest encryption, not access control or logging. Option E (DynamoDB Streams) is for change data capture, not access control or logging.

Answer

Encrypt the table using a customer-managed KMS key.

Answer

Enable DynamoDB Streams and process events with Lambda.

Question 6

A company wants to ensure that an Amazon RDS for MySQL DB instance is encrypted at rest. Which action should be taken to enable encryption for the first time?

Accepted Answer

Create a new encrypted DB instance using AWS KMS.. Encryption at rest for Amazon RDS can only be enabled when creating a new DB instance. To enable encryption for the first time, you must create a new encrypted DB instance using AWS KMS. Option A is incorrect because encryption cannot be enabled on an existing DB instance via the AWS CLI; it requires creating a new instance. Option C is incorrect because there is no rds.encrypted parameter in a DB parameter group; encryption is set at instance creation, not via parameters. Option D is incorrect because modifying an existing DB instance does not allow enabling encryption; you must create a new encrypted instance.

Answer

Enable encryption on the existing DB instance using the AWS CLI.

Answer

Set the rds.encrypted parameter to true in the DB parameter group.

Answer

Modify the existing DB instance and enable encryption.

Question 7

A company is using Amazon RDS for PostgreSQL with a read replica. The security team wants to ensure that data in transit between the primary DB instance and the read replica is encrypted. What should be done?

Accepted Answer

Enable encryption at rest on the primary DB instance using AWS KMS.. Enabling encryption at rest on the primary DB instance using AWS KMS automatically encrypts the replication traffic between the primary and the read replica. Options A, B, and C are incorrect: A VPN is not required as RDS handles encryption in transit for replication when the primary is encrypted; using a different KMS key for the replica does not affect replication encryption; SSL/TLS is for client connections, not for replication traffic.

Answer

Set up a VPN connection between the primary and the replica.

Answer

Configure the read replica to use a different KMS key.

Answer

Enable SSL/TLS on the read replica and configure the primary to use it.

Question 8

A company is using an Amazon RDS for PostgreSQL database to store sensitive customer data. The security team requires that all data be encrypted at rest and in transit, and that access to the database is restricted to only specific applications. Currently, the database is encrypted at rest using AWS KMS, and connections are made over SSL. However, the security team wants to ensure that even if the database credentials are compromised, an attacker cannot access the database from unauthorized IP addresses. What should be done to meet this requirement?

Accepted Answer

Modify the security group associated with the RDS instance to allow inbound traffic only from the application's IP addresses.. Modifying the security group associated with the RDS instance to allow inbound traffic only from the application's IP addresses restricts network access at the instance level, preventing unauthorized IP addresses from connecting even if credentials are compromised. Option A (attaching a resource-based policy) does not restrict network access—it controls IAM permissions. Option B (creating a new RDS instance in a VPC with a network ACL) is unnecessarily complex and involves migrating data; the requirement can be met by modifying the existing security group without creating a new instance. Option D (enabling IAM database authentication) authenticates database users via IAM but does not restrict source IP addresses, so it does not meet the stated requirement.

Answer

Attach a resource-based policy to the RDS instance to allow only specific IAM roles.

Answer

Create a new RDS instance in a VPC with a network ACL that allows inbound traffic only from specific IP ranges, and migrate the data.

Answer

Enable IAM database authentication for the RDS instance.

Question 9

A security team is auditing an Amazon RDS for SQL Server DB instance. They notice that SSL connections are not enforced. Which configuration change will enforce SSL for all connections?

Accepted Answer

Set the 'rds.force_ssl' parameter to 1 in the DB parameter group.. For Amazon RDS for SQL Server, you can enforce SSL connections by setting the 'rds.force_ssl' parameter to 1 in the DB parameter group. This forces all connections to use SSL. Option A is incorrect because security groups control network access but do not enforce encryption. Option B is incorrect because the option group manages features such as Transparent Data Encryption (TDE) and native backup/restore, not SSL enforcement. Option D is incorrect because changing the subnet to public would expose the instance to the internet and does not enforce SSL.

Answer

Modify the security group to only allow inbound traffic on port 443.

Answer

Add the SQL Server SSL option to the option group.

Answer

Change the DB subnet group to a public subnet.

Question 10

A company is using Amazon Aurora MySQL and needs to audit database logins. Which of the following can be used to capture login events? (Choose TWO.)

Accepted Answer

Database Activity Streams. Options B and E are correct. Database Activity Streams (DAS) in Amazon Aurora capture login events and other database activities. Additionally, the Aurora MySQL audit plugin can be enabled to log connections, including login attempts. Option A (VPC Flow Logs) captures network traffic, not database logins. Option C (Enhanced Monitoring) captures OS-level metrics from the database host. Option D (AWS CloudTrail) records API calls made to AWS services, not database-level events.

Answer

VPC Flow Logs

Answer

Enhanced Monitoring

Answer

AWS CloudTrail

Question 11

A developer needs to grant an IAM user the ability to perform all operations on an Amazon RDS DB instance except the ability to delete it. Which IAM policy action should be explicitly denied?

Accepted Answer

rds:DeleteDBInstance. To prevent deletion, you must explicitly deny the rds:DeleteDBInstance action. Option A (rds:RebootDBInstance) is incorrect because it only reboots the instance. Option B (rds:StopDBInstance) is incorrect because it only stops the instance. Option C (rds:ModifyDBInstance) is incorrect because it only modifies the instance. Option D (rds:DeleteDBInstance) is the correct action to deny to prevent deletion.

Answer

rds:RebootDBInstance

Answer

rds:StopDBInstance

Answer

rds:ModifyDBInstance

Question 12

Refer to the exhibit. A developer created an IAM policy with the above command and attached it to a user. What is the security implication of this policy?

Accepted Answer

The policy grants full administrative access to all RDS resources in the account.. The policy allows all RDS actions on all resources, granting full administrative access to all RDS resources in the account. This is overly permissive and violates the principle of least privilege. Option A is wrong because the policy does not restrict to a specific region. Option B is wrong because it does not restrict to a specific region. Option D is wrong because it does not restrict to read-only access.

Answer

The policy restricts access to only one specific DB instance.

Answer

The policy allows only actions in the us-east-1 region.

Answer

The policy only allows read-only access to RDS.

Question 13

A company is designing a database for a global application that requires active-active replication across two AWS Regions. The database must support multi-master writes with conflict resolution. Which AWS database service should they use?

Accepted Answer

Amazon DynamoDB Global Tables. Amazon DynamoDB Global Tables provides fully managed, multi-Region, multi-master replication, enabling active-active writes across two AWS Regions with built-in conflict resolution using last-writer-wins (based on timestamp). This directly meets the requirement for multi-master writes and conflict resolution without custom code.

Answer

Amazon Aurora Global Database

Answer

Amazon Redshift

Answer

Amazon RDS for MySQL with Multi-AZ

Question 14

A company needs to comply with PCI DSS requirements for an Amazon RDS for Oracle DB instance. The requirements include encryption of sensitive data at rest and in transit, and automated key rotation. Which combination of services and configurations should be used? (Select THREE.)

Accepted Answer

Enable encryption at rest on the RDS instance using AWS KMS.. Options B, C, and D are correct. Option B: Enable encryption at rest on the RDS instance using AWS KMS. Option C: Use AWS Secrets Manager to automatically rotate database credentials. Option D: Enable SSL/TLS for connections to the database. Option A is incorrect because AWS CloudHSM is not required for key rotation; KMS can handle key rotation automatically. Option E is incorrect because VPC Flow Logs are for network traffic monitoring, not encryption.

Answer

Use AWS CloudHSM to generate and store encryption keys.

Answer

Enable VPC Flow Logs to audit database connections.

Question 15

A company uses Amazon Aurora MySQL for a SaaS application. Each tenant has a separate database. The company wants to implement a centralized monitoring solution that collects performance metrics from all tenant databases. The solution should be cost-effective and require minimal overhead. Which approach should be used?

Accepted Answer

Use Amazon CloudWatch Agent to collect custom metrics from each Aurora instance and aggregate in CloudWatch.. Amazon CloudWatch Agent can be installed on each Aurora instance to collect custom performance metrics (e.g., from performance_schema) and publish them as CloudWatch custom metrics. This approach is cost-effective because it uses CloudWatch’s pay-per-metric model and eliminates the need for a separate aggregation database or continuous data movement. It also requires minimal overhead as the agent handles collection and aggregation natively, with no additional infrastructure to manage.

Answer

Use AWS DMS to continuously replicate metrics to a central RDS instance.

Answer

Consolidate all tenants into a single RDS MySQL instance and use separate schemas.

Answer

Run an AWS Lambda function that queries each database's performance_schema every minute and stores results in S3.