DBS-C01 Practice Test 34 — 15 Questions

Question 1

A company is using Amazon DynamoDB and wants to restrict access to a specific table so that only users in a particular IAM group can perform read and write operations. Which THREE steps should be taken to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an IAM policy that allows dynamodb:GetItem, dynamodb:PutItem, etc. on the specific table ARN.. The correct answers are A, B, and D. To restrict access to a specific DynamoDB table, you create an IAM policy that allows the required DynamoDB actions on that table's ARN (A). You then attach that policy to an IAM group (B), and add the users who need access to that group (D). Options C and E are incorrect because DynamoDB does not support resource-based policies, and IAM roles are not directly assigned to tables for access control.

Answer

Attach a resource-based policy to the DynamoDB table allowing access from the group.

Answer

Create an IAM role and assign it to the table.

Question 2

A company is using Amazon RDS for MySQL and needs to comply with PCI DSS requirements. Which TWO actions should the company take to secure the database? (Choose TWO.)

Accepted Answer

Enable encryption at rest using AWS KMS.. Options A and C are correct. Enabling encryption at rest using AWS KMS protects data on disk, which is a PCI DSS requirement. Enabling audit logging helps track database activities for compliance. Options B and D are incorrect: writing audit logs directly to an S3 bucket is not supported; RDS audit logs are sent to CloudWatch Logs. Enabling public accessibility would violate security requirements. Option E is incorrect because changing the default port is not a PCI DSS requirement and may complicate management without adding meaningful security.

Answer

Configure the database to write audit logs directly to an S3 bucket.

Answer

Enable public accessibility on the RDS instance to allow access from anywhere.

Answer

Change the default database port to a non-standard port.

Question 3

Which THREE of the following are best practices for securing an Amazon DynamoDB table? (Select THREE.)

Accepted Answer

Enable point-in-time recovery (PITR) to protect against accidental writes or deletes.. Options A, B, and D are correct. Point-in-time recovery (PITR) protects against accidental writes or deletes by allowing you to restore the table to any point within the last 35 days. Encryption at rest using AWS KMS secures data at rest. IAM policies based on least privilege restrict access to only necessary actions and resources. Option C (public access) is not a best practice; DynamoDB tables are private by default and should not be exposed publicly. Option E (limiting item size) is a performance consideration, not a security best practice.

Answer

Enable public access to the table to allow easy data sharing.

Answer

Limit the maximum item size to 100 KB to reduce storage costs.

Question 4

A company is using Amazon DynamoDB and wants to ensure that only authorized users can access a specific table. Which AWS service should be used to manage access control?

Accepted Answer

AWS Identity and Access Management (IAM).. AWS Identity and Access Management (IAM) is the service used to manage access control for DynamoDB tables by creating policies that grant or deny permissions. Option A (CloudHSM) provides hardware security modules for encryption keys, not access control. Option B (KMS) manages encryption keys but does not handle access control. Option C (VPC security groups) control network traffic at the instance level, not database-level access control.

Answer

AWS CloudHSM.

Answer

AWS Key Management Service (KMS).

Answer

Amazon VPC security groups.

Question 5

A company has an Amazon RDS for Oracle DB instance that stores sensitive data. The security team wants to audit all SQL queries that read or modify specific columns containing personally identifiable information (PII). The audit logs must be stored for 5 years. Which solution should the database specialist implement?

Accepted Answer

Use Oracle fine-grained auditing to create an audit policy on the specific columns and store logs in a custom table.. Amazon RDS for Oracle supports fine-grained auditing (FGA) to create audit policies on specific columns, and audit logs can be stored in a custom table with the desired retention period. Option B is incorrect because database activity streams capture all database activities and do not filter by specific columns, and they integrate with CloudWatch Logs where retention must be set separately. Option C is incorrect because RDS Enhanced Monitoring is for OS-level metrics, not SQL auditing. Option D is incorrect because Oracle Audit Vault and Database Firewall are not supported on Amazon RDS for Oracle.

Answer

Enable database activity streams and send logs to Amazon CloudWatch Logs with a retention of 5 years.

Answer

Enable RDS Enhanced Monitoring and enable SQL auditing in the parameter group.

Answer

Enable Oracle Audit Vault and Database Firewall.

Question 6

Which TWO of the following are methods to encrypt data at rest for an Amazon RDS for Oracle DB instance? (Select TWO.)

Accepted Answer

Enable encryption at rest using AWS KMS when creating the DB instance.. Options A and B are correct. Amazon RDS for Oracle supports encryption at rest via two methods: enabling encryption using AWS KMS when creating the DB instance (Option A) or using Oracle Transparent Data Encryption (TDE) with a customer-managed Oracle wallet (Option B). Option C (SSL/TLS) encrypts data in transit, not at rest. Option D (S3 SSE) is irrelevant as S3 is not used for RDS storage. Option E (client-side encryption) is an application-level approach and not a native RDS encryption method.

Answer

Enable SSL/TLS for the DB instance.

Answer

Configure Amazon S3 server-side encryption on the DB instance's storage.

Answer

Use client-side encryption in the application before sending data to RDS.

Question 7

A database administrator needs to audit all SQL statements executed on an Amazon RDS for PostgreSQL DB instance. Which service should be used to capture and log the SQL statements?

Accepted Answer

Amazon RDS for PostgreSQL database activity streams. Amazon RDS for PostgreSQL supports database activity streams, which can be integrated with services like Amazon CloudWatch and AWS CloudTrail to provide a near real-time stream of database activities. The other options do not capture SQL statements: CloudTrail records API calls to RDS, Config records resource configuration changes, and Inspector is for vulnerability assessment.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon Inspector

Question 8

An IAM policy is attached to a role used by an application to access an Amazon RDS for MySQL DB instance. The DB instance is encrypted with a customer-managed KMS key. The application is unable to create a snapshot of the encrypted DB instance. Which missing permission is the most likely cause?

Accepted Answer

kms:CreateGrant. To create a snapshot of an encrypted RDS DB instance, the IAM role must have the kms:CreateGrant permission on the customer-managed KMS key. This permission allows RDS to create a grant that enables it to use the key for encrypting the snapshot. Without kms:CreateGrant, the snapshot creation fails. Options A (kms:ReEncrypt), B (kms:DescribeKey), and D (kms:Encrypt) are not required for this operation.

Answer

kms:ReEncrypt

Answer

kms:DescribeKey

Answer

kms:Encrypt

Question 9

A company has an Amazon Redshift cluster that contains sensitive data. The security team wants to ensure that all data is encrypted at rest and that the encryption keys are managed by AWS. Which configuration should be used?

Accepted Answer

Enable encryption at rest using the default AWS-managed KMS key for Redshift.. Amazon Redshift supports encryption at rest using AWS KMS. When you enable encryption, you can choose to use the default AWS-managed key (aws/redshift) or a customer-managed key. The default key is managed by AWS, meeting the requirement that keys are managed by AWS. Option A is incorrect because CloudHSM is used for customer-managed keys, not AWS-managed keys. Option B is incorrect because SSE-S3 is for S3 objects, not Redshift clusters. Option D is incorrect because client-side encryption is not supported for Redshift at rest.

Answer

Use AWS CloudHSM to generate and store encryption keys.

Answer

Use server-side encryption with S3-managed keys (SSE-S3) for the Redshift cluster.

Answer

Use client-side encryption with the AWS Encryption SDK.

Question 10

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The security team wants to audit all database logins and queries. Which TWO actions should be taken to enable auditing?

Accepted Answer

Publish MySQL logs to Amazon CloudWatch Logs.. Options C and D are correct. Setting the general_log parameter to 1 (D) captures all queries, and publishing MySQL logs to CloudWatch Logs (C) allows analysis. Option A is wrong because AWS CloudTrail data events capture API calls to RDS, not database queries. Option B is wrong because event notifications are for instance events, not queries. Option E is wrong because Enhanced Monitoring provides OS-level metrics, not query logs.

Answer

Enable AWS CloudTrail data events for RDS.

Answer

Create an RDS event notification subscription.

Answer

Enable Enhanced Monitoring.

Question 11

A company has an Amazon S3 bucket that stores database backup files. The backups are encrypted using server-side encryption with AWS KMS (SSE-KMS). The security team wants to ensure that only a specific IAM role can decrypt the backups when restoring the database. Which policy should be attached to the KMS key to achieve this?

Accepted Answer

A KMS key policy that grants kms:Decrypt to the IAM role.. A KMS key policy can grant the kms:Decrypt permission to a specific IAM role, ensuring only that role can decrypt the backups. Option A is incorrect because an S3 bucket policy cannot grant kms:Decrypt; KMS permissions are controlled via KMS key policies or IAM policies. Option B is incorrect because s3:GetObject alone does not enable decryption of SSE-KMS encrypted objects; decryption also requires kms:Decrypt. Option C is incorrect because an IAM policy attached to the role that grants kms:Decrypt is not sufficient unless the KMS key policy also allows the role to use the key; the key policy must explicitly grant permission to the role or the root account.

Answer

An S3 bucket policy that grants kms:Decrypt to the IAM role.

Answer

An S3 bucket policy that grants s3:GetObject to the IAM role.

Answer

An IAM policy attached to the role that grants kms:Decrypt.

Question 12

A database administrator has the IAM policy shown in the exhibit. Which action will be allowed by this policy?

Accepted Answer

Create a snapshot of the prod-db instance.. The policy explicitly allows CreateDBSnapshot on the resource. Option A is denied. Option C is not in the policy. Option D is not in the policy.

Answer

Modify the prod-db instance.

Answer

Delete the prod-db instance.

Answer

Describe all DB instances in the account.

Question 13

A security engineer needs to ensure that all access to an Amazon DynamoDB table is encrypted in transit. Which configuration achieves this?

Accepted Answer

Ensure all client applications use the DynamoDB HTTPS endpoint.. DynamoDB uses HTTPS for all API calls by default, ensuring encryption in transit. Option A is incorrect because configuring a VPC endpoint does not enable encryption; it provides private connectivity, but encryption in transit is already handled by HTTPS. Option C is incorrect because placing DynamoDB behind CloudFront is not a valid configuration; CloudFront is a CDN for content delivery, not for securing database access. Option D is incorrect because DynamoDB does not have an 'ssl_enabled' parameter; encryption in transit is always enforced via HTTPS.

Answer

Configure a VPC endpoint for DynamoDB and enable encryption.

Answer

Place the DynamoDB table behind Amazon CloudFront.

Answer

Enable SSL on the DynamoDB table by setting the 'ssl_enabled' parameter.

Question 14

A developer wants to grant an IAM user read-only access to an Amazon DynamoDB table named 'Orders' in the 'us-east-1' region. Which IAM policy should be attached to the user?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["dynamodb:GetItem","dynamodb:Query","dynamodb:Scan"],"Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/Orders"}]}. It grants only the read-only actions GetItem, Query, and Scan on the specified DynamoDB table. Option B is incorrect because it grants full DynamoDB access (dynamodb:*) to the table, allowing write and delete operations. Option C is incorrect because it includes PutItem and UpdateItem, which are write operations. Option D is incorrect because it uses a Deny effect for write operations, but an explicit deny is not necessary and could conflict with other policies; additionally, it does not explicitly allow read actions, so the user would have no access.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["dynamodb:*"],"Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/Orders"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["dynamodb:GetItem","dynamodb:PutItem","dynamodb:UpdateItem"],"Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/Orders"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":["dynamodb:PutItem","dynamodb:UpdateItem","dynamodb:DeleteItem"],"Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/Orders"}]}

Question 15

A developer accidentally exposed an Amazon RDS snapshot to the public. What is the quickest way to remediate this issue?

Accepted Answer

Modify the snapshot permissions to set it to private.. The quickest remediation is to modify the snapshot permissions to make it private. This immediately revokes public access. Option A is incorrect because deleting the snapshot would remove the backup entirely, which is unnecessary and could risk data loss if no other backup exists. Option B is incorrect because copying the snapshot does not change the original's permissions; the original remains public. Option C is incorrect because sharing with a specific account does not revoke public access; it only adds an additional permission. Therefore, modifying the snapshot to private is the direct and fastest fix.

Answer

Delete the snapshot and create a new one from the source DB instance.

Answer

Copy the snapshot to a new snapshot and delete the original.

Answer

Share the snapshot with only the required AWS account.