DBS-C01 Practice Test 35 — 15 Questions

Question 1

A company is using Amazon Aurora MySQL and needs to audit all database logins and query activity. Which feature should be enabled to meet this requirement?

Accepted Answer

Enable Advanced Auditing through the DB cluster parameter group by setting the server_audit_logging parameter and related parameters.. Amazon Aurora MySQL's Advanced Auditing feature, enabled by setting the server_audit_logging parameter and related parameters in the DB cluster parameter group, captures all database logins and query activity. Option A (audit_log_enabled) is a different, less detailed audit log feature, not the full advanced auditing. Option B (Enhanced Monitoring) monitors OS-level metrics, not database activity. Option C (CloudTrail) logs AWS API calls, not database queries.

Answer

Enable database audit logs by setting the audit_log_enabled parameter to 1.

Answer

Enable RDS Enhanced Monitoring.

Answer

Enable AWS CloudTrail to log database queries.

Question 2

A company is using Amazon RDS for MySQL and wants to restrict access to a specific database so that an application user can only perform SELECT and INSERT operations on tables within that database. The application user already exists. Which SQL statement should be executed?

Accepted Answer

GRANT SELECT, INSERT ON app_db.* TO 'app_user'@'%';. It grants exactly the required SELECT and INSERT privileges on all tables within the app_db database. Option A is incorrect because it only grants SELECT, missing INSERT. Option B is incorrect because it includes unnecessary DDL privileges (CREATE, ALTER) which are not needed and could be a security risk. Option D is incorrect because it grants ALL PRIVILEGES, which is too permissive for an application user.

Answer

GRANT SELECT ON app_db.* TO 'app_user'@'%';

Answer

GRANT CREATE, ALTER, SELECT, INSERT ON app_db.* TO 'app_user'@'%';

Answer

GRANT ALL PRIVILEGES ON app_db.* TO 'app_user'@'%';

Question 3

A company wants to audit all SQL statements executed on their Amazon Aurora MySQL database for compliance. Which AWS feature should be enabled?

Accepted Answer

Database Activity Streams. Database Activity Streams provide a stream of database activities including SQL queries. Option B is wrong because VPC Flow Logs capture network traffic, not SQL statements. Option C is wrong because CloudWatch Logs can store logs but the source should be Database Activity Streams; CloudWatch Logs alone does not audit SQL statements. Option D is wrong because CloudTrail logs API calls, not SQL statements.

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 4

A company is using Amazon DynamoDB with AWS Lambda to process data. The Lambda function needs to read and write items to a DynamoDB table. The security team wants to follow the principle of least privilege. Which IAM policy statement should be attached to the Lambda execution role?

Accepted Answer

{"Effect":"Allow","Action":["dynamodb:GetItem","dynamodb:PutItem","dynamodb:UpdateItem","dynamodb:DeleteItem"],"Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/MyTable"}. It grants only the necessary DynamoDB actions (GetItem, PutItem, UpdateItem, DeleteItem) on the specific table. Option A is wrong because it grants full DynamoDB access on all resources, which is too permissive. Option B is wrong because it only allows DescribeTable and ListTables on all tables, which does not provide the read/write permissions needed. Option D is wrong because it allows all DynamoDB actions on a specific table, which is overly permissive and violates least privilege.

Answer

{"Effect":"Allow","Action":"dynamodb:*","Resource":"*"}

Answer

{"Effect":"Allow","Action":["dynamodb:DescribeTable","dynamodb:ListTables"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":"dynamodb:*","Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/MyTable"}

Question 5

A company wants to store database credentials for an Amazon RDS instance securely. Which AWS service should be used to rotate the credentials automatically?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it can automatically rotate database credentials for Amazon RDS, simplifying credential management and improving security. AWS Systems Manager Parameter Store can store parameters but does not natively rotate RDS credentials. AWS IAM roles are used for authentication and authorization, not for storing credentials. AWS CloudHSM provides hardware security module (HSM) for encryption key management, not credential storage or rotation.

Answer

AWS CloudHSM

Answer

AWS Systems Manager Parameter Store

Answer

AWS IAM roles

Question 6

A developer needs to grant an IAM user permission to perform automated backups of an Amazon RDS DB instance. Which IAM action should be allowed?

Accepted Answer

rds:ModifyDBInstance. The question asks for the IAM action to perform automated backups of an Amazon RDS DB instance. Automated backups are managed by setting the backup retention period, which is configured using the ModifyDBInstance API call. Therefore, the correct IAM action is rds:ModifyDBInstance (option D). Option A (rds:BackupDBInstance) is not a valid IAM action. Option B (rds:CreateDBSnapshot) is for manual snapshots, not automated backups. Option C (rds:RestoreDBInstanceFromDBSnapshot) is for restoration.

Answer

rds:BackupDBInstance

Answer

rds:CreateDBSnapshot

Answer

rds:RestoreDBInstanceFromDBSnapshot

Question 7

A company needs to audit access to an Amazon DynamoDB table. The audit should capture which IAM user or role performed each action. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API calls made to DynamoDB and captures the IAM user or role that performed each action. VPC Flow Logs (Option A) capture network traffic metadata, not API calls. Amazon GuardDuty (Option C) is a threat detection service that monitors for malicious activity, not API auditing. AWS Config (Option D) tracks resource configuration changes, not API call details.

Answer

VPC Flow Logs

Answer

Amazon GuardDuty

Answer

AWS Config

Question 8

Which TWO actions will help protect an Amazon RDS for MySQL database from a SQL injection attack? (Select TWO.)

Accepted Answer

Use parameterized queries in the application code.. Using parameterized queries (prepared statements) prevents SQL injection. Also, restricting database user permissions to only necessary operations limits damage. Enabling encryption at rest does not prevent injection. Using a VPC does not prevent injection. Enabling auto minor version upgrade does not prevent injection.

Answer

Enable encryption at rest for the RDS instance.

Answer

Place the RDS instance in a private VPC subnet.

Answer

Enable auto minor version upgrade on the RDS instance.

Question 9

A company is using Amazon RDS for MySQL and needs to encrypt data at rest for an existing DB instance. Which approach meets this requirement with minimal downtime?

Accepted Answer

Take a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore from the encrypted snapshot.. To encrypt an existing unencrypted RDS MySQL DB instance, you cannot directly modify the instance. The standard approach is to take a snapshot, create an encrypted copy of the snapshot, and then restore that encrypted snapshot to a new DB instance. This method typically involves minimal downtime compared to other options. Option A correctly describes this process. Option B is incorrect because encryption cannot be enabled directly on an existing instance. Option C is incorrect because the AWS CLI modify-db-instance command does not support enabling encryption on an existing instance; the --storage-encrypted flag only applies to new instances. Option D is incorrect because creating a read replica with encryption does not encrypt the primary instance; you would still need to perform a snapshot restore for the primary's encryption.

Answer

Enable encryption directly on the existing DB instance by modifying it.

Answer

Use the AWS CLI command modify-db-instance with the --storage-encrypted flag.

Answer

Create a read replica of the DB instance with encryption enabled, then promote it.

Question 10

Which THREE components are required to set up IAM database authentication for an Amazon RDS for MySQL DB instance? (Choose three.)

Accepted Answer

An IAM role that the application can assume.. The three required components for setting up IAM database authentication for an Amazon RDS for MySQL DB instance are: (A) an IAM role that the application can assume to retrieve an authentication token from IAM; (C) a database user that is mapped to the IAM role in the RDS MySQL database; and (D) a DB parameter group with `require_secure_transport` set to ON to enforce SSL/TLS connections, which are mandatory for IAM authentication. Option B (AWS KMS key) is not required because the authentication token is signed by IAM, not encrypted with KMS. Option E (RDS Proxy) is optional and not a requirement; while it can provide connection pooling, it is not needed to set up IAM authentication itself.

Answer

An AWS KMS key to encrypt the authentication token.

Answer

An RDS Proxy to manage connections.

Question 11

A company is designing a security strategy for an Amazon RDS for MySQL instance that stores Personally Identifiable Information (PII). Which TWO measures should be implemented to protect the data at rest?

Accepted Answer

Enable automatic backups with encryption.. Options A and D are correct. Option A: Enabling automatic backups with encryption ensures that backup data is encrypted at rest. Option D: Enabling encryption at rest using AWS KMS encrypts the underlying storage of the DB instance. Option B is wrong because Amazon GuardDuty is a threat detection service, not for data at rest protection. Option C is wrong because deletion protection prevents accidental deletion but does not protect data at rest. Option E is wrong because encryption in transit (SSL/TLS) protects data in motion, not at rest.

Answer

Enable Amazon GuardDuty to monitor for suspicious activity.

Answer

Enable deletion protection on the DB instance.

Answer

Enable encryption in transit using SSL/TLS.

Question 12

A company uses Amazon RDS for PostgreSQL with Multi-AZ deployment. The security team wants to ensure that any access to the database is logged, including SELECT queries. What should be done to capture these logs?

Accepted Answer

Modify the DB parameter group to enable query logging and publish logs to Amazon CloudWatch Logs.. Enabling RDS Enhanced Monitoring does not capture query logs. Enabling automatic backups does not log queries. Enabling RDS Performance Insights does not log queries. To capture SELECT queries, you need to enable PostgreSQL query logging by setting the appropriate parameter group parameters (e.g., log_statement = 'all' or 'mod') and then export logs to CloudWatch Logs.

Answer

Enable automated backups and export logs to Amazon S3.

Answer

Enable RDS Performance Insights.

Answer

Enable RDS Enhanced Monitoring.

Question 13

A financial services company uses Amazon DynamoDB to store transaction records. The security team requires that all items be encrypted at rest using a customer-managed AWS KMS key. Additionally, the company must be able to audit key usage and rotation. What is the MOST secure and auditable approach?

Accepted Answer

Use SSE-KMS with a customer-managed key, enable automatic key rotation, and enable CloudTrail data events for the key.. Using a customer-managed KMS key with automatic annual rotation and enabling CloudTrail logging of key usage provides encryption control and auditing. Option A is wrong because SSE-S3 does not provide customer control or audit. Option B is wrong because manual rotation is less secure and auditable than automatic rotation. Option D is wrong because client-side encryption would require managing encryption keys on the client side, which does not leverage the AWS KMS infrastructure for automatic key rotation and auditing, and is not as integrated or auditable as server-side encryption with KMS.

Answer

Enable default encryption on the DynamoDB table using SSE-S3.

Answer

Use SSE-KMS with a customer-managed key and manually rotate the key every 90 days.

Answer

Use client-side encryption with the AWS Encryption SDK.

Question 14

A security team is auditing IAM policies for Amazon RDS. They want to ensure that all RDS snapshots shared with other AWS accounts are encrypted. Which IAM policy condition key should be used to enforce this?

Accepted Answer

rds:Encrypted. Rds:Encrypted. This condition key verifies that a snapshot is encrypted when sharing with other AWS accounts. Option B (rds:SnapshotEncrypted) is not a valid condition key. Option C (rds:StorageEncrypted) is used to check if the DB instance's storage is encrypted, not the snapshot. Option D (s3:x-amz-server-side-encryption) is an S3 condition key and not applicable to RDS snapshots.

Answer

rds:SnapshotEncrypted

Answer

rds:StorageEncrypted

Answer

s3:x-amz-server-side-encryption

Question 15

A company stores sensitive customer data in an Amazon S3 bucket. The data is accessed by an Amazon Redshift cluster using the COPY command. The security team wants to ensure that data is encrypted in transit between S3 and Redshift. Which configuration should be used?

Accepted Answer

Use the 'ENCRYPTED' option with the COPY command and ensure the S3 bucket policy requires HTTPS.. The COPY command supports encryption in transit via HTTPS when using the 'ENCRYPTED' option or using an S3 endpoint that enforces HTTPS. Option A is wrong because S3 supports HTTPS, and specifying 'ENCRYPTED' is needed. Option B is wrong because the COPY command does not use SSH; it uses HTTPS. Option D is wrong because S3 server-side encryption protects data at rest, not in transit.

Answer

Use a VPC endpoint for S3 with a bucket policy that denies HTTP.

Answer

Use the 'SSH' option in the COPY command to encrypt the transfer.

Answer

Enable S3 server-side encryption on the bucket.