DBS-C01 Practice Test 50 — 15 Questions

Question 1

A company uses Amazon DynamoDB to store session data. The security team has enabled DynamoDB Accelerator (DAX) for performance. However, they are concerned about data encryption at rest. DAX encrypts data at rest by default. The security team wants to use a customer managed key (CMK) in AWS KMS. How can this be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a DAX cluster and specify the KMS key ID of a symmetric customer managed key during creation.. DAX supports encryption at rest using a KMS key. You must specify a symmetric customer managed key (CMK) at cluster creation time; encryption configuration cannot be modified after creation. Option A is wrong because DAX does support encryption with a CMK, and asymmetric keys are not supported for DAX; only symmetric keys are allowed. Option B is wrong because DAX does allow the use of customer managed keys; it is not limited to AWS managed keys. Option C is wrong because encryption cannot be enabled after cluster creation; it must be configured during creation.

Answer

Use an asymmetric customer managed key because it provides better security.

Answer

DAX does not support encryption at rest with a customer managed key; only AWS managed keys are supported.

Answer

Enable encryption at rest on the DAX cluster after creation by modifying the cluster settings.

Question 2

A company runs an Amazon RDS for MySQL DB instance in a VPC. Security requirements mandate that only specific EC2 instances in the same VPC can connect to the database. The security group attached to the RDS instance currently allows inbound traffic on port 3306 from 0.0.0.0/0. Which combination of steps should a database specialist take to meet the security requirement without impacting existing application connectivity? (Choose two.)

Accepted Answer

Remove the inbound rule for 0.0.0.0/0 on the RDS security group.. Removing the overly permissive inbound rule for 0.0.0.0/0 on the RDS security group eliminates unrestricted access, which is a direct violation of the security requirement. Option C is correct because adding an inbound rule that references the security group ID of the EC2 instances allows traffic only from those instances, leveraging security group referencing for granular, stateful access control within the same VPC.

Answer

Modify the network ACL for the DB subnet to allow inbound port 3306 from the EC2 instance's private IP.

Answer

Modify the DB subnet group to place the RDS instance in a public subnet with a route to the EC2 instance.

Answer

Add an inbound rule to the RDS security group allowing traffic from the VPC CIDR on port 3306.

Question 3

A company uses Amazon DynamoDB with global tables for a multi-region application. The application writes to the table in us-east-1. A developer notices that updates made in us-east-1 are not appearing in the replica in eu-west-1 after several minutes. Which action should be taken to diagnose the issue?

Accepted Answer

Review the CloudWatch metrics for ReplicationLatency and PendingReplicationCount for the global table.. CloudWatch metrics ReplicationLatency (the time lag between when an item is written to one replica and when it appears in another) and PendingReplicationCount (the number of items waiting to be replicated) directly help diagnose replication delays in DynamoDB global tables. Option B is incorrect because writes should continue to the local region (us-east-1); using the eu-west-1 endpoint would not resolve replication latency and could cause consistency issues. Option C is incorrect because DynamoDB Streams is automatically enabled for global tables with NEW_AND_OLD_IMAGES (not KEYS_ONLY) to replicate updates; checking the stream specification is not a diagnostic step for delays. Option D is incorrect because TTL (Time to Live) is for automatic item expiration, not related to replication performance or delays.

Answer

Modify the application to use the eu-west-1 endpoint for writes.

Answer

Check that the table has an active DynamoDB Streams stream with StreamSpecification set to KEYS_ONLY.

Answer

Verify that the TTL attribute on the table is correctly configured.

Question 4

A company uses Amazon DynamoDB with a global secondary index (GSI) and client-side encryption using the AWS Encryption SDK. The security team requires that the partition key and sort key be searchable by the application but not stored in plaintext in the table. Which approach should be taken?

Accepted Answer

Encrypt the entire item client-side and use a secondary index on the encrypted keys.. The requirement is to prevent partition and sort keys from being stored in plaintext while still allowing the application to search by them. Option A achieves this by using client-side deterministic encryption (supported by the AWS Encryption SDK) for the entire item, which encrypts the keys. Because the encryption is deterministic, the same plaintext key always produces the same ciphertext, so a global secondary index can be built on the encrypted key attributes. The application encrypts the search key and queries the GSI using that encrypted value, enabling search without exposing plaintext keys. Option C leaves keys in plaintext, violating the requirement. Options B and D do not address client-side encryption and cannot prevent plaintext key storage in the database.

Answer

Use server-side encryption with a KMS key and enable DynamoDB Streams to decrypt on read.

Answer

Use client-side encryption to encrypt only the non-key attributes, leaving the partition and sort keys in plaintext.

Answer

Use DynamoDB encryption at rest with a customer-managed KMS key.

Question 5

A company is using Amazon RDS for PostgreSQL and needs to ensure that all connections to the database use encryption in transit. The database is accessible over the internet. Which configuration is required?

Accepted Answer

Set the rds.force_ssl parameter to 1 and configure the client to use the AWS RDS SSL certificate.. To enforce encryption in transit for Amazon RDS for PostgreSQL, you must set the `rds.force_ssl` parameter to 1 in the DB parameter group. Additionally, clients need to be configured to use the AWS RDS SSL certificate (downloaded from AWS) to establish a secure connection. Option A is incorrect because security groups only control network traffic based on IP addresses, they do not enforce encryption. Option B is incorrect because changing the port to 443 does not enforce SSL; SSL is enforced through parameter settings and client configuration. Option D is incorrect because while a self-signed certificate could technically be used, the recommended and simpler method is to use the AWS-provided SSL certificate, especially since clients need to trust the certificate authority.

Answer

Restrict the security group to only allow traffic from trusted IP addresses.

Answer

Modify the DB instance to use a custom port 443 instead of 5432.

Answer

Use a self-signed certificate on the server and configure the client to trust it.

Question 6

A company has an Amazon RDS for PostgreSQL DB instance that needs to be accessed by an application running on an Amazon EC2 instance. Both resources are in the same VPC. The security team insists that all traffic between the application and the database be encrypted in transit. Which configuration ensures this?

Accepted Answer

Enable SSL/TLS on the RDS instance and configure the application to connect using SSL.. Enabling SSL/TLS on the RDS for PostgreSQL DB instance and configuring the application to connect using SSL ensures encryption in transit. Option A is incorrect because security group rules control access (firewall), not encryption. Option B is incorrect because a Site-to-Site VPN is used for on-premises to VPC connectivity, not for same-VPC communication. Option D is incorrect because VPC peering is for connecting separate VPCs, and both resources are already in the same VPC.

Answer

Add a security group rule that allows traffic only from the EC2 instance's private IP.

Answer

Create an AWS Site-to-Site VPN connection between the EC2 instance and the RDS instance.

Answer

Set up VPC peering between the EC2 instance's VPC and the RDS instance's VPC.

Question 7

A developer is troubleshooting an issue where an IAM user cannot perform a 'DescribeTable' action on a DynamoDB table. The IAM policy attached to the user is: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["dynamodb:GetItem","dynamodb:PutItem"],"Resource":"*"}]}. What is the most likely reason for the failure?

Accepted Answer

The policy does not include the 'dynamodb:DescribeTable' action.. The IAM policy only includes the actions 'dynamodb:GetItem' and 'dynamodb:PutItem', but does not include 'dynamodb:DescribeTable'. Therefore, the IAM user is denied the DescribeTable action by default. Option A is incorrect because although action names are case-sensitive, the policy uses the correct lowercase 'dynamodb' and the actions are properly cased. Option B is incorrect because there is no implicit Deny; the policy grants access to GetItem and PutItem, and DescribeTable is simply not allowed. Service control policies could apply, but they are not the most likely reason given the policy's explicit lack of the required action. Option D is incorrect because the resource '*' does include all tables; the problem is the missing action, not the resource specification.

Answer

The policy uses lowercase 'dynamodb' but the action is case-sensitive.

Answer

There is an implicit Deny for DescribeTable due to a service control policy.

Answer

The resource specified in the policy is '*' which does not include the table.

Question 8

A company is migrating a 2 TB SQL Server database to Amazon RDS for SQL Server. They need to minimize downtime and are using AWS DMS with CDC. The migration is taking longer than expected during the full load phase. Which change would most likely improve the full load performance?

Accepted Answer

Increase the number of parallel load tasks in the DMS task settings. Increasing the number of parallel load tasks in the DMS task settings allows the full load to be split into multiple concurrent threads, each handling a subset of tables or partitions. This directly improves throughput by utilizing more of the available source and target resources, which is the most effective way to accelerate a slow full load phase when using AWS DMS with CDC.

Answer

Disable CDC to focus on full load only

Answer

Use AWS Schema Conversion Tool to optimize schema

Answer

Use a larger RDS instance class for the target

Question 9

A company runs a customer relationship management (CRM) application on Amazon RDS for PostgreSQL. The application has a table 'customers' with columns: id (primary key), name, email, signup_date, and status. The table has 10 million rows. The application frequently queries by email address. The company also needs to run analytical queries that aggregate customers by signup_date and status. The DBA notices that the index on email is heavily used and causes high write latency. The company wants to improve write performance without sacrificing read performance for email queries. Which THREE actions should the database specialist take? (Choose THREE.)

Accepted Answer

Create a BRIN index on signup_date.. A BRIN (Block Range INdex) index on signup_date is ideal for large tables where data is naturally ordered by insertion time. BRIN indexes are much smaller and have lower write overhead than B-tree indexes, making them suitable for analytical queries on signup_date without significantly impacting write performance.

Answer

Remove the index on email to reduce write latency.

Answer

Create a GIN index on email.

Question 10

A security engineer is designing a disaster recovery plan for an Amazon DynamoDB table that contains sensitive data. The table is encrypted using an AWS KMS customer managed key (CMK). The engineer needs to ensure that the table can be restored in a different AWS Region. Which TWO actions must be taken to enable cross-region restores with the same encryption? (Choose TWO.)

Accepted Answer

Enable point-in-time recovery (PITR) on the table.. To enable cross-region restores of an encrypted DynamoDB table, you need to have the table's backups available in the destination region. Cross-region restores require point-in-time recovery (PITR) to be enabled on the source table (Option A). Additionally, because the table uses a customer managed KMS key, you must create a multi-Region KMS key (or replicate the key) in the destination region so that DynamoDB can use it to decrypt the backup during restore (Option D). Option B (global tables) is for live replication, not for backup/restore scenarios. Option C (export to S3 and copy) does not preserve the same encryption because the exported data is not encrypted with the KMS key. Option E (CloudHSM) is not supported for DynamoDB encryption.

Answer

Enable DynamoDB global tables.

Answer

Export the table to S3 and copy the S3 objects to the destination Region.

Answer

Create a CloudHSM key and use it for encryption.

Question 11

A company runs a document management system using Amazon DocumentDB (with MongoDB compatibility). The application stores large documents (up to 5 MB each) and frequently fetches them by document ID. The team notices increased latency during peak hours. They need to reduce read latency. Which action is MOST effective?

Accepted Answer

Add read replicas to the cluster. Adding read replicas to the DocumentDB cluster is the most effective action because it offloads read traffic from the primary instance, directly reducing read latency during peak hours. DocumentDB supports up to 15 read replicas that are kept in sync via the cluster's replication mechanism, and the application's frequent fetches by document ID are read-heavy operations that benefit from distributing the load across multiple replicas.

Answer

Shard the collection across multiple DocumentDB clusters

Answer

Implement Amazon ElastiCache for Redis in front of DocumentDB

Answer

Increase the instance class of the primary instance

Question 12

Refer to the exhibit. An IAM policy is attached to a user. The user attempts to delete a DB instance named 'prod-db'. What will happen?

Accepted Answer

The delete will fail because of the explicit Deny statement.. The Deny statement explicitly denies delete on any instance matching 'prod-*'. Since an explicit deny overrides any allow, the delete will fail. Therefore, the correct answer is C. Option A is incorrect because the deny overrides the allow. Option B is incorrect because the resource 'prod-db' does match the deny pattern 'prod-*'. Option D is incorrect because the policy does not require MFA in this context, and even with MFA, the explicit deny would still apply.

Answer

The delete will succeed because the Allow statement grants modify permission.

Answer

The delete will succeed because the resource is 'prod-db' which does not match the deny pattern.

Answer

The delete will succeed only if the user has MFA enabled.

Question 13

A security engineer runs the commands shown in the exhibit for an RDS MySQL DB instance. The engineer wants to enforce SSL connections to the database. What should the engineer do?

Accepted Answer

Create a custom DB parameter group with require_secure_transport set to ON, associate it with the DB instance, and reboot the instance.. Enforcing SSL for MySQL requires setting require_secure_transport to ON in a custom DB parameter group, then associating it with the DB instance and rebooting. Option A is wrong because the default parameter group cannot be modified. Option B is wrong because there is no --require-ssl-transport flag; the setting is a parameter group parameter, not an instance-level flag. Option D is wrong because IAM database authentication does not enforce SSL connections.

Answer

Modify the default.mysql8.0 parameter group to set require_secure_transport to ON and reboot the instance.

Answer

Run the modify-db-instance command with --require-ssl-transport.

Answer

Modify the DB instance and set the --enable-iam-database-authentication flag.

Question 14

A company uses Amazon RDS for SQL Server with Multi-AZ deployment. The security team wants to ensure that all data at rest is encrypted using a customer-managed KMS key in both the primary and standby instances. Which THREE actions are required?

Accepted Answer

Specify a customer-managed KMS key during creation.. Options B, D, and E are correct. To encrypt data at rest with a customer-managed KMS key, you must specify the KMS key during DB instance creation (B). Multi-AZ with encryption enabled (D) ensures both primary and standby instances are encrypted. Encryption at rest must be enabled when creating the DB instance (E); it cannot be added later. Option A is wrong because a separate KMS key is not required—the same key encrypts both instances. Option C is wrong because Transparent Data Encryption (TDE) is a SQL Server feature for encrypting the database files, but RDS handles encryption at the storage layer using KMS, not TDE. TDE is not applicable when using RDS encryption with KMS.

Answer

Create a separate KMS key for the standby instance.

Answer

Enable Transparent Data Encryption (TDE) on the instance.

Question 15

A company wants to audit all API calls made to its Amazon RDS DB instances. Which AWS service should be used to capture these API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls made to AWS services, including RDS, providing an audit trail of actions taken. Option B is incorrect because AWS Config tracks resource configuration changes and compliance, not API calls. Option C is incorrect because Amazon GuardDuty is a threat detection service that monitors for malicious activity, not an API audit tool. Option D is incorrect because Amazon Inspector is a vulnerability assessment service that scans for security issues, not an audit trail of API calls.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

Amazon Inspector