DBS-C01 Practice Test 2 — 25 Questions

Question 1

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all data be encrypted at rest using a customer-managed KMS key. Additionally, the database should be accessible only from a specific VPC. Which THREE steps should the database specialist take to meet these requirements? (Choose three.)

Accepted Answer

Configure the security group for the RDS instance to allow inbound traffic only from the application security group.. Option A is correct because security groups act as a virtual firewall for RDS instances. By configuring the security group to allow inbound traffic only from the application security group, you restrict database access to specific application servers, meeting the requirement that the database be accessible only from a specific VPC.

Answer

Create a VPC endpoint for RDS and associate it with the DB instance.

Answer

Store the encryption key in Amazon S3 and configure RDS to use it.

Question 2

A company is designing a multi-tier application that uses Amazon RDS for PostgreSQL. The application must encrypt data at rest and in transit. Which combination of steps should be taken to meet these requirements? (Choose the single best answer.)

Accepted Answer

Enable encryption at rest when launching the RDS instance, and configure the DB parameter group to require SSL connections.. Option B is correct because Amazon RDS for PostgreSQL supports encryption at rest only when enabled at instance launch, and SSL/TLS encryption in transit is enforced by configuring the DB parameter group to require SSL connections (e.g., setting `rds.force_ssl=1`). Encryption at rest cannot be added after creation, and SSL ensures data is encrypted between the application and the database.

Answer

Use client-side encryption for data before sending to RDS, and enable encryption at rest after the instance is created.

Answer

Launch the RDS instance without encryption, then enable encryption at rest using the AWS Console.

Answer

Use AWS KMS to encrypt the connection between the application and RDS.

Question 3

A security engineer is troubleshooting an issue where an application using IAM role 'app-role' with a trust policy to assume the 'app-user' user is unable to decrypt an RDS database that uses a customer-managed KMS key. The above key policy is attached to the KMS key. What is the likely cause of the failure?

Accepted Answer

The principal in the policy is 'app-user', but the application uses an IAM role that does not have the necessary permissions.. Option C is correct because the KMS key policy specifies the principal as 'app-user', which is an IAM user. However, the application uses an IAM role 'app-role' to make the decryption requests. Since the principal in the key policy does not include the role or its associated permissions, the KMS key policy denies access to the role, causing the decryption failure. The trust policy on the role allows the user to assume it, but that does not grant the role any KMS permissions unless explicitly added.

Answer

The 'kms:ViaService' condition requires the request to come from RDS, but the application is making KMS API calls directly.

Answer

The policy has a missing 'Effect': 'Deny' statement that is blocking access.

Answer

The condition 'kms:ViaService' restricts the key to be used only with RDS, but the application is using a different service.

Question 4

A company is using Amazon RDS for MySQL to power a web application. The database contains sensitive data, and the security team requires that all connections to the database use SSL/TLS. The team has enabled 'require_secure_transport' parameter in the DB parameter group. However, a developer reports that they are able to connect to the database using a MySQL client without specifying SSL options. What could be the reason?

Accepted Answer

The 'require_secure_transport' parameter is not set to '1' in the DB parameter group.. The correct answer is C. Enabling the 'require_secure_transport' parameter in the DB parameter group requires explicitly setting it to '1'. By default, this parameter is '0' (disabled). Even if the parameter group is associated with the RDS instance, if the parameter value is not set to '1', the database will still accept non-SSL connections. After setting it to '1', the instance must be rebooted for the change to take effect. Option A is incorrect because 'require_secure_transport', when properly configured, rejects non-SSL connections. Option B is incorrect because the MySQL client does not automatically upgrade to SSL; it only uses SSL if explicitly requested or if the client defaults to SSL (which depends on client configuration). Option D is incorrect because connections from within the same VPC are still subject to the database's SSL enforcement settings.

Answer

The RDS instance is configured to accept both SSL and non-SSL connections by default.

Answer

The MySQL client automatically upgrades to SSL when the server requires it.

Answer

The developer is connecting from an EC2 instance in the same VPC, which bypasses SSL enforcement.

Question 5

A security administrator is setting up a new Amazon RDS for SQL Server database. The company requires that all data be encrypted at rest and in transit. Additionally, the database must be accessible only from a specific CIDR range. Which TWO actions should the administrator take? (Choose TWO.)

Accepted Answer

Enable encryption at rest using AWS KMS.. Option A: Enabling encryption at rest using AWS KMS is a straightforward way to meet the encryption-at-rest requirement for RDS. Option B: Configuring a security group to allow inbound traffic from the specific CIDR range restricts network access to the database. Option C is incorrect because encryption in transit is handled by the database engine (e.g., SSL/TLS) and is not an RDS option group feature; you enable it on the client side or by modifying the DB parameter group. Option D is incorrect because DB parameter groups do not control network access; they manage database engine parameters. Option E is incorrect because AWS KMS is the default service for RDS encryption at rest; CloudHSM is an alternative for key management but not required.

Answer

Enable encryption in transit by modifying the RDS option group to include SSL.

Answer

Modify the DB parameter group to restrict network access.

Answer

Use AWS CloudHSM to manage encryption keys for the database.

Question 6

A database specialist needs to capture SQL queries executed against an Amazon Aurora MySQL DB cluster for performance analysis. The capture should have minimal performance impact and be stored in Amazon CloudWatch Logs. Which feature should the specialist use?

Accepted Answer

Enable Performance Insights and configure the Performance Insights log export to CloudWatch Logs.. Performance Insights captures SQL queries with minimal overhead by sampling the database engine's internal wait states and query activity, then exports this data to CloudWatch Logs for analysis. This approach is designed for performance monitoring without the significant performance impact of enabling full logging (like the general log), making it ideal for capturing queries for performance analysis.

Answer

Enable the slow query log and export to CloudWatch Logs.

Answer

Enable database audit logs and export to CloudWatch Logs.

Answer

Enable the general log and publish to CloudWatch Logs.

Question 7

A company has a compliance requirement to encrypt all RDS snapshots at rest using a customer-managed KMS key. The RDS instance is already encrypted with an AWS-managed key. What is the correct procedure to ensure snapshots use the customer-managed key?

Accepted Answer

Take a snapshot of the RDS instance, copy the snapshot specifying the customer-managed KMS key, and restore from the copied snapshot.. To encrypt RDS snapshots with a customer-managed KMS key, you must first take a snapshot of the existing instance (which uses an AWS-managed key). Then, copy that snapshot and specify the customer-managed KMS key during the copy operation. Finally, restore from the copied snapshot to create a new instance encrypted with the customer-managed key. Option A is incorrect because you cannot change the encryption key of an existing instance; you must copy the snapshot. Option B is correct and describes the proper procedure. Option C is incorrect because the default KMS key for the account does not affect existing instance snapshots. Option D is incorrect because you cannot modify an existing RDS instance to use a different encryption key directly; the encryption key is set at creation.

Answer

Create a new RDS instance with the customer-managed KMS key and migrate data using DMS.

Answer

Change the default KMS key for the AWS account to the customer-managed key.

Answer

Modify the RDS instance to use the customer-managed KMS key directly.

Question 8

A security engineer runs the AWS CLI command shown in the exhibit. The engineer wants to ensure that all RDS DB instances in the account are encrypted at rest. What should the engineer do to remediate the unencrypted read replica?

Accepted Answer

Delete the unencrypted read replica and create a new read replica from the encrypted source, enabling encryption on the new replica.. To encrypt an unencrypted read replica that is sourced from an encrypted DB instance, you cannot directly enable encryption on an existing read replica or modify it. Instead, you must delete the unencrypted read replica and create a new read replica from the encrypted source, enabling encryption on the new replica. This is because encryption at rest can only be enabled during instance creation, and read replicas inherit encryption settings from the source at creation time. Option A is incorrect because the StorageEncrypted parameter cannot be modified on an existing instance. Option C is incorrect because enabling encryption on the source does not encrypt existing replicas; it only affects new replicas. Option D is incorrect because creating a snapshot of the unencrypted replica and restoring it as a new encrypted instance is not the standard procedure for encrypting a read replica; the correct approach is to recreate the read replica from the encrypted source with encryption enabled.

Answer

Modify the read replica by setting the StorageEncrypted parameter to true.

Answer

Enable encryption on the source DB instance and the read replica will automatically become encrypted.

Answer

Create a snapshot of the read replica, encrypt the snapshot, and restore it as a new instance.

Question 9

A company runs a critical e-commerce application on Amazon RDS for MySQL with Multi-AZ enabled. The database is 2 TB and uses General Purpose (gp2) storage. Recently, during peak hours, the application experienced a 5-minute outage. The CloudWatch logs show that the primary DB instance failed and an automatic failover occurred. However, the failover took 3 minutes, which is longer than the expected 1-2 minutes. The 'ReadLatency' and 'WriteLatency' metrics were elevated before the failure. The 'BurstBalance' metric was at 0% for the hour before the failure. The team suspects the issue is related to storage performance. What should the team do to prevent this issue in the future?

Accepted Answer

Change the storage type to Provisioned IOPS (io1).. Option B is correct because the BurstBalance at 0% indicates the gp2 volume exhausted its burst credits, causing I/O throttling and increased latency, which likely contributed to the failover delay. Switching to Provisioned IOPS (io1) provides consistent performance and avoids burst credit exhaustion. Option A is wrong because increasing the DB instance class addresses compute capacity, not storage I/O. Option C is wrong because backup retention period does not affect storage performance. Option D is wrong because read replicas offload read traffic but do not improve write performance on the primary instance.

Answer

Increase the DB instance class to a larger size.

Answer

Increase the backup retention period to 35 days.

Answer

Create a read replica to offload read traffic.

Question 10

A developer is configuring an Amazon RDS for PostgreSQL DB instance. The application connects using IAM database authentication. Which setting must be enabled on the DB instance for IAM authentication to work?

Accepted Answer

Set the 'rds.force_ssl' parameter to 1.. IAM database authentication for Amazon RDS PostgreSQL requires an encrypted connection to protect the authentication token. Setting the 'rds.force_ssl' parameter to 1 enforces TLS/SSL connections between the client and the database, which is a prerequisite for IAM authentication. Option A is incorrect because the port (default 5432) does not need to change for IAM. Option C is incorrect because the DB instance can be private within a VPC; IAM authentication works over private or public connections as long as TLS is enforced. Option D is incorrect because the master username is not changed; IAM authentication uses database users that are mapped to IAM identities.

Answer

Set the database port to 5432.

Answer

Ensure the DB instance is publicly accessible.

Answer

Change the master username to 'iam_user'.

Question 11

A database administrator runs the AWS CLI command shown in the exhibit. The administrator wants to enable encryption at rest for the RDS instance. What should the administrator do?

Accepted Answer

Take a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore a new instance.. The correct answer is D. To enable encryption on an unencrypted RDS instance, you must take a snapshot, copy the snapshot with encryption enabled, and restore a new encrypted instance. You cannot enable encryption on an existing instance (Option A is incorrect). Creating a new KMS key does not enable encryption on the existing instance (Option B is incorrect). Encryption is not controlled by a DB parameter group (Option C is incorrect). Only D is correct.

Answer

Modify the DB instance and set StorageEncrypted to true.

Answer

Create a new KMS key and associate it with the DB instance.

Answer

Create a new DB parameter group with encryption enabled.

Question 12

A company runs an OLTP workload on an RDS for MySQL instance. The database has a table with 50 million rows. The application frequently runs queries that join this table with a small lookup table (1000 rows) using a foreign key. The queries are slow. Which design change would most improve performance?

Accepted Answer

Add an index on the foreign key column in the large table.. The query joins a large table (50M rows) with a small lookup table (1000 rows) on a foreign key column. Without an index on the foreign key column in the large table, MySQL must perform a full table scan for each join, leading to slow performance. Adding an index on that column allows MySQL to use an index lookup (e.g., B-tree) to quickly locate matching rows, dramatically reducing query time.

Answer

Partition the large table by the foreign key column.

Answer

Scale up the RDS instance to a larger size.

Answer

Create a read replica and direct all read queries to it.

Question 13

A company is migrating a 500 GB SQL Server database to Amazon RDS for SQL Server. The migration must minimize downtime and support ongoing replication. Which TWO AWS services should be used together?

Accepted Answer

AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) is the correct choice because it supports ongoing replication (change data capture) from a source SQL Server database to Amazon RDS for SQL Server with minimal downtime. DMS can perform a full load followed by continuous replication of changes, allowing the source to remain operational during migration.

Answer

AWS Lambda

Answer

AWS Snowball Edge

Answer

AWS RDS SQL Server native backup and restore

Question 14

Which THREE considerations are important when designing a database for a global, multi-Region application using Amazon DynamoDB Global Tables? (Select THREE.)

Accepted Answer

Application tolerance for eventually consistent reads. Option C is correct because Amazon DynamoDB Global Tables use an eventually consistent model for cross-region replication. Applications must tolerate eventual consistency, as updates made in one region are propagated to other regions asynchronously, typically within one second or less. This design trade-off enables high availability and low-latency writes across multiple regions.

Answer

Using a single write region to avoid conflicts

Answer

Strongly consistent reads across regions

Question 15

A company is using Amazon Redshift for data warehousing. They need to ensure that data is encrypted at rest using a customer-managed AWS KMS key. The cluster is currently unencrypted. What is the simplest way to enable encryption?

Accepted Answer

Create a new Redshift cluster with encryption enabled and migrate the data.. You cannot enable encryption on an existing Amazon Redshift cluster. The simplest approach is to create a new cluster with encryption enabled using a customer-managed AWS KMS key, then migrate the data from the old cluster to the new one using tools such as UNLOAD/COPY or AWS DMS. Option C (snapshot and restore) is also valid, but it is not the simplest because it requires creating a snapshot and then restoring it to a new encrypted cluster, which involves extra steps. Therefore, option A is correct.

Answer

Enable encryption directly on the existing cluster using AWS CLI.

Answer

Create a snapshot of the existing cluster and restore it to a new encrypted cluster.

Answer

Modify the existing cluster and enable encryption using the Redshift console.

Question 16

Which TWO of the following are methods to control access to an Amazon RDS DB instance? (Select TWO.)

Accepted Answer

VPC security groups. Options A and B are correct. VPC security groups control network access to the RDS instance at the instance level, acting as a virtual firewall. IAM policies can control who can perform administrative actions on the RDS instance via the AWS API, such as creating, modifying, or deleting the instance. Option C is incorrect because CloudWatch alarms monitor performance metrics and trigger actions, but do not control access. Option D is incorrect because database passwords are a form of authentication for users connecting to the database, not a method to control access to the RDS instance itself. Option E is incorrect because S3 bucket policies control access to Amazon S3 resources, not RDS.

Answer

Amazon CloudWatch alarms

Answer

Database passwords

Answer

Amazon S3 bucket policies

Question 17

A database administrator runs the above CLI command. The output shows that 'mydb' is a read replica of 'mydb-source'. The administrator wants to promote 'mydb' to a standalone instance with no downtime. Which action should be taken?

Accepted Answer

Use the promote-read-replica CLI command.. The `promote-read-replica` CLI command is the correct action because it transitions the read replica from a replication slave to a standalone primary DB instance without requiring any downtime. During promotion, RDS stops replication and makes the replica writable, but the instance remains available throughout the process. This is the only method that achieves zero downtime promotion directly.

Answer

Modify the DB instance to enable Multi-AZ, which automatically promotes it.

Answer

Create a snapshot of the read replica and restore it as a new DB instance.

Answer

Modify the DB instance class to a larger size to force promotion.

Question 18

A developer runs the AWS CLI command shown in the exhibit. What is the output indicating?

Accepted Answer

The secret contains a username and password in JSON format.. The correct answer is D because the `aws secretsmanager get-secret-value` command returns the secret's value in the `SecretString` field, which typically contains a JSON object with the username and password. Option A is incorrect because the command succeeded, indicating the secret is accessible. Option B is incorrect because secrets are encrypted at rest by default. Option C is incorrect because the output includes the version ID but does not indicate rotation.

Answer

The secret value is not accessible.

Answer

The secret is not encrypted.

Answer

The secret has been rotated.

Question 19

A company uses Amazon DynamoDB with AWS KMS-managed encryption at rest. The security team requires that all access to a particular DynamoDB table be logged for audit purposes. Which solution meets this requirement?

Accepted Answer

Enable CloudTrail data events for the DynamoDB table.. Option C is correct because AWS CloudTrail logs all DynamoDB API calls, including data plane operations, when data events are enabled. Option A is wrong because VPC Flow Logs capture network traffic, not API calls. Option B is wrong because AWS Config records resource configuration changes, not API calls. Option D is wrong because Amazon GuardDuty is a threat detection service, not a logging service.

Answer

Enable VPC Flow Logs for the VPC where the DynamoDB endpoint is accessed.

Answer

Enable AWS Config rules for DynamoDB.

Answer

Enable Amazon GuardDuty with DynamoDB protection.

Question 20

A company uses Amazon ElastiCache for Redis and needs to encrypt data in transit between the application and the cache cluster. Which feature should be enabled?

Accepted Answer

Enable encryption in transit on the replication group.. Option A is correct because Amazon ElastiCache for Redis supports encryption in transit using TLS (Transport Layer Security) when enabled on the replication group. This ensures data is encrypted between the application and the cache cluster. Option B is incorrect because encryption at rest protects data stored on disk, not data in transit. Option C is incorrect because AWS KMS customer master keys are used for encryption at rest, not for transit encryption. Option D is incorrect because VPC security groups control network access at the IP/port level, not encryption; allowing HTTPS traffic does not enable encryption for ElastiCache communication.

Answer

Enable encryption at rest.

Answer

Use AWS KMS customer master keys.

Answer

Configure the VPC security group to allow only HTTPS traffic.