DBS-C01 Practice Test 49 — 15 Questions

Question 1

A company is using Amazon Redshift for data warehousing. The security team requires that all data be encrypted at rest using a customer-managed AWS KMS key. Additionally, the team wants to ensure that the key must be used only for this specific Redshift cluster. Which configuration should be applied?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a new KMS key with a key policy that grants access only to the Redshift cluster's IAM role.. To enforce encryption at rest with a customer-managed AWS KMS key and restrict key usage to a specific Redshift cluster, you create a new KMS key and configure its key policy to grant encrypt/decrypt permissions only to the IAM role associated with the Redshift cluster. This ensures the key is only used by that cluster. Option A is incorrect because associating a key with a subnet group does not limit usage to the cluster; key policies control access. Option C is incorrect because the default AWS managed key is not customer-managed. Option D is incorrect because CloudHSM keys are not directly used with Redshift; KMS is the required service for integration.

Answer

Create a new KMS key and associate it with the Redshift cluster's subnet group.

Answer

Use the default AWS managed KMS key for Redshift.

Answer

Use an HSM-backed key from CloudHSM.

Question 2

A company has a requirement to automatically rotate the password for an Amazon RDS for MySQL DB instance every 90 days. The password is stored in AWS Secrets Manager. Which combination of steps will meet this requirement?

Accepted Answer

Store the password in Secrets Manager and configure automatic rotation with a Lambda function that updates the RDS password every 90 days.. AWS Secrets Manager provides built-in support for automatic rotation of RDS database passwords using a custom or pre-built AWS Lambda rotation function. You can configure the rotation interval to 90 days to meet the requirement. Option A is incorrect because IAM database authentication does not rotate passwords; it uses IAM roles and credentials, not password rotation. Option B is incorrect because AWS Systems Manager Parameter Store does not have native rotation capabilities for RDS passwords; it requires a custom solution. Option D is incorrect while it describes a manual approach via Lambda and CloudWatch Events, it does not leverage Secrets Manager's automatic rotation feature, which is the recommended and simplest method.

Answer

Enable IAM database authentication for the RDS instance and rotate the IAM keys every 90 days.

Answer

Store the password in AWS Systems Manager Parameter Store and configure a scheduled AWS Lambda function to update the parameter and the RDS password.

Answer

Use an AWS Lambda function to manually update the RDS password and store the new password in Secrets Manager, triggered by a CloudWatch Events rule every 90 days.

Question 3

A security engineer reviews the IAM policy attached to a user. The user is unable to modify any RDS DB instance, even when MFA is enabled. What is the most likely cause?

Accepted Answer

The user does not have MFA enabled, or the instance name does not match the allowed prefixes.. The scenario states that the user cannot modify any RDS DB instance even when MFA is enabled. This suggests that the IAM policy likely includes a condition requiring MFA or a specific resource prefix (e.g., 'prod-*' or 'dev-*'). If MFA is not actually enabled on the user's account, or if the instance name does not match the allowed prefixes, the condition would fail, denying all ModifyDBInstance actions. Option A is incorrect because EC2 permissions are irrelevant to RDS. Option B is incorrect because the absence of a Deny statement does not cause failure; the issue is an Allow condition not being met. Option D is incorrect because the console versus API distinction does not explain the inability to modify any instance.

Answer

The policy is missing the ec2:ModifyInstance permission.

Answer

The policy does not include a Deny statement for RDS actions.

Answer

The user is trying to use the RDS console, but the policy only allows API calls.

Question 4

A company is using Amazon RDS for SQL Server with Multi-AZ deployment. The security team wants to ensure that database audit logs are stored in a secure S3 bucket for long-term retention. The audit logs are currently stored on the RDS instance. Which approach should be used to export the audit logs to S3?

Accepted Answer

Modify the RDS instance to use the 'SQLSERVER_AUDIT' option and specify an S3 bucket as the audit destination.. RDS for SQL Server provides the 'SQLSERVER_AUDIT' option to export audit logs directly to an S3 bucket. This option is configured in the RDS option group and allows specifying the S3 bucket as the destination. Option A is incorrect because it refers to Oracle's 'Audit' feature, not SQL Server. Option C is incorrect because the 'General Log' is for MySQL/MariaDB and does not apply to SQL Server audit logs. Option D, while feasible, is not the most direct or recommended approach for exporting audit logs to S3; exporting via CloudWatch Logs adds complexity and latency compared to the native 'SQLSERVER_AUDIT' option.

Answer

Use the Amazon RDS for Oracle 'Audit' feature and specify an S3 bucket as the audit trail destination.

Answer

Enable the 'General Log' option in the RDS parameter group and configure the log destination as S3.

Answer

Configure the RDS instance to publish logs to CloudWatch Logs, and then export CloudWatch Logs to S3 using a subscription filter.

Question 5

A company uses Amazon RDS for PostgreSQL to store customer data. The security team wants to audit all SQL queries executed against the database, including SELECT statements. Which TWO actions should be taken to achieve this?

Accepted Answer

Install the pgaudit extension in the DB instance.. To audit SQL queries on Amazon RDS for PostgreSQL, the pgaudit extension must be installed (Option A). Then, the 'pgaudit.log' parameter must be set to include 'read' and 'write' statements to capture SELECT and DML operations (Option C). Option B enables connection logging but not query auditing. Option D ('audit_log_enabled') is for MySQL, not PostgreSQL. Option E (Database Activity Streams) provides a different auditing mechanism that may not capture all SQL queries and requires additional setup.

Answer

Enable the 'log_connections' and 'log_disconnections' parameters.

Answer

Set the 'audit_log_enabled' parameter to 1 in the DB parameter group.

Answer

Enable Database Activity Streams on the DB instance.

Question 6

An IAM policy is attached to a user. What is the effect of this policy on the user's ability to delete the DB instance named prod-db?

The policy is:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "rds:DeleteDBInstance",
      "Resource": "arn:aws:rds:us-east-1:123456789012:db:prod-db"
    },
    {
      "Effect": "Allow",
      "Action": "rds:*",
      "Resource": "*"
    }
  ]
}
```

Accepted Answer

The user cannot delete the DB instance because the Deny statement explicitly denies it.. In IAM policy evaluation, an explicit Deny overrides any Allow. The policy explicitly denies the `rds:DeleteDBInstance` action on the `prod-db` resource, so the user cannot delete the DB instance, regardless of the Allow statement granting all RDS actions.

Answer

The user can delete the DB instance only after creating a final snapshot.

Answer

The user can delete the DB instance because the Allow statement grants all actions.

Answer

The user can delete the DB instance because the Allow statement is broader and applies to all resources.

Question 7

A company is using an Amazon RDS for MySQL DB instance. The security team requires that all database connections be encrypted in transit. Which configuration step ensures this requirement is met?

Accepted Answer

Set the 'require_secure_transport' parameter to 1 in the DB parameter group.. Setting the 'require_secure_transport' parameter to 1 in the DB parameter group forces clients to use TLS/SSL for connections, ensuring encryption in transit. Option A is incorrect because enabling encryption at rest (RDS encryption) secures data on disk but does not enforce encryption of data in transit. Option B is incorrect because storing passwords in AWS Secrets Manager manages credentials but does not enforce encrypted connections. Option C is incorrect because modifying a network ACL to allow traffic on port 3306 controls network access but does not enforce encryption of the data transmitted over that port.

Answer

Enable encryption at rest for the RDS instance.

Answer

Store the database password in AWS Secrets Manager.

Answer

Modify the network ACL to only allow traffic on port 3306.

Question 8

A company uses an Amazon RDS for MySQL DB instance that needs to be accessed by a Lambda function. Which TWO steps should be taken to ensure secure access?

Accepted Answer

Create an IAM role for the Lambda function with permissions to use RDS IAM database authentication.. Options A and B are correct. Creating an IAM role for the Lambda function with permissions to use RDS IAM database authentication (A) avoids hardcoding credentials and enables secure, temporary authentication. Placing the Lambda function in the same VPC as the RDS instance (B) ensures traffic stays within the AWS network without traversing the internet. Option C is wrong because storing credentials in Lambda environment variables is insecure and exposes them. Option D is wrong because using the database master user account violates least privilege and is insecure. Option E is wrong because a NAT gateway is not needed for RDS access within the same VPC.

Answer

Store the database credentials in the Lambda environment variables.

Answer

Use the database master user account for the Lambda function.

Answer

Attach a NAT gateway to the Lambda function's VPC for outbound internet access.

Question 9

A company uses Amazon DynamoDB to store sensitive user data. The security team wants to ensure that all data is encrypted at rest using a customer-managed AWS KMS key. The DynamoDB table was created with the default AWS managed key. What is the required action to change the encryption key?

Accepted Answer

Create a new DynamoDB table with the desired KMS key, export data from the old table, and import into the new table.. DynamoDB does not allow changing the encryption key on an existing table. To use a customer-managed KMS key, you must create a new table with the desired key, export data from the old table, and import it into the new table. Option A is incorrect because the UpdateTable API does not support changing the encryption key. Option C is incorrect because enabling automatic key rotation on the existing KMS key does not change the key used by DynamoDB; it rotates the key material but the table still uses the same key ID. Option D is incorrect because deleting the default AWS managed key would break encryption for any tables using it, and it does not allow you to change the key for the existing table.

Answer

Use the UpdateTable API to specify the new KMS key.

Answer

Enable automatic key rotation on the existing KMS key.

Answer

Delete the default AWS managed key and create a new customer managed key.

Question 10

A developer is checking the encryption status of an RDS MySQL instance. The CLI output shows StorageEncrypted is true. What does this indicate?

Accepted Answer

The database is encrypted at rest using a KMS key.. When StorageEncrypted is true, it indicates that the RDS MySQL instance is encrypted at rest using a KMS key. Option A is incorrect because StorageEncrypted does not relate to encryption in transit. Option B is incorrect because it can be either AWS managed or customer managed KMS key. Option C is incorrect because StorageEncrypted: true means encryption at rest is enabled.

Answer

Connections to the database are encrypted in transit.

Answer

The database is encrypted using the AWS managed key for RDS.

Answer

The database does not have encryption at rest enabled.

Question 11

A company is designing a multi-tenant application using Amazon Aurora MySQL. Each tenant's data must be isolated from others. They need to encrypt data at rest with a unique AWS KMS key per tenant. How can this be achieved?

Accepted Answer

Launch separate Aurora clusters for each tenant, each with its own KMS key for encryption at rest.. Aurora MySQL encryption at rest is applied at the cluster level using a single AWS KMS key. You cannot assign different KMS keys to individual databases or tables within the same cluster. Therefore, the only way to achieve unique per-tenant encryption keys is to use separate Aurora clusters, each with its own KMS key. Option A is incorrect because RDS encryption is cluster-wide, not per-database. Option B implements client-side encryption, not encryption at rest. Option C is not supported by Aurora MySQL, as there is no row-level encryption with per-tenant KMS keys. Thus, Option D is correct.

Answer

Create separate databases within the same Aurora cluster and assign a different KMS key to each database.

Answer

Use client-side encryption with different KMS keys per tenant before inserting data into the database.

Answer

Use a single Aurora cluster with row-level encryption using different KMS keys per tenant.

Question 12

An application uses an Amazon RDS for MySQL database. The security team requires that all traffic to the database be encrypted in transit. Which configuration ensures this?

Accepted Answer

Create a custom DB parameter group with the require_secure_transport parameter set to ON.. Setting require_secure_transport to ON in a custom DB parameter group enforces SSL/TLS for all connections to the RDS MySQL database, ensuring encryption in transit. Option A is wrong because the default parameter group does not enforce SSL. Option C is wrong because security groups control network access at the port level, not encryption. Option D is wrong because network ACLs are stateless and do not enforce encryption.

Answer

Use the default RDS parameter group.

Answer

Configure the security group to allow only port 3306 from the application.

Answer

Use a network ACL to restrict inbound traffic to port 3306.

Question 13

A database specialist is troubleshooting a performance issue on an Amazon RDS for MySQL DB instance. The CPU utilization is consistently above 90%, but the IOPS and memory metrics are well within limits. Which tool should the specialist use to identify the root cause?

Accepted Answer

Use Amazon RDS Performance Insights to identify the top SQL queries by CPU usage.. Amazon RDS Performance Insights provides a database performance tuning and monitoring feature that visualizes database load and helps identify the top SQL queries consuming the most CPU. Since the CPU is consistently above 90% while IOPS and memory are normal, Performance Insights can directly correlate high CPU usage to specific SQL statements, enabling the specialist to pinpoint the root cause efficiently.

Answer

Enable AWS CloudTrail to log database queries.

Answer

Use Amazon RDS Enhanced Monitoring to view OS-level metrics.

Answer

Check RDS events in the AWS Management Console.

Question 14

A company is using Amazon RDS for PostgreSQL to store application data. The security team wants to ensure that database audit logs are stored securely and cannot be modified after creation. Which AWS service should be used to meet this requirement?

Accepted Answer

Amazon CloudWatch Logs. Amazon RDS for PostgreSQL can publish database audit logs to Amazon CloudWatch Logs. CloudWatch Logs provides immutability through IAM policies that prevent log modification and deletion, combined with log group encryption using AWS KMS. Option D is correct. Option A (AWS KMS) is wrong because KMS manages encryption keys, not log storage. Option B (AWS CloudTrail) is wrong because CloudTrail records API activity, not database audit logs. Option C (Amazon S3) can store logs, but enabling immutability requires additional configuration like S3 Object Lock, making CloudWatch Logs the more straightforward and recommended service for this requirement.

Answer

AWS Key Management Service (KMS)

Answer

AWS CloudTrail

Answer

Amazon S3

Question 15

Refer to the exhibit. The output is from the AWS CLI for an RDS instance. The security team suspects that the encryption key used for this DB instance has been compromised. What is the required action to re-encrypt the instance with a new key?

Accepted Answer

Create a snapshot of the DB instance, copy the snapshot with a new KMS key, and restore the DB instance from the copied snapshot.. RDS does not allow changing the encryption key of an existing encrypted DB instance directly. The correct method is to create a snapshot of the DB instance, copy the snapshot with a new KMS key, and then restore the DB instance from the copied snapshot. Option B is incorrect because modifying the DB instance does not allow changing the KMS key. Option C is incorrect because restoring to a point in time uses the same encryption key as the original instance. Option D is incorrect because this instance is already encrypted; to use a new key, a snapshot copy and restore is required.

Answer

Modify the DB instance to use a new KMS key.

Answer

Restore the DB instance to a point in time and specify a new KMS key.

Answer

Enable encryption on a new DB instance and migrate the data.