DBS-C01 Mock Exam 72 — 25 Questions

Question 1

A company is running a production Amazon Aurora MySQL database. The database performance has degraded over the past week. The DBA suspects an increase in lock waits. Which tool should be used to identify queries experiencing lock waits?

Accepted Answer

Amazon RDS Performance Insights. Option B is correct because Performance Insights shows wait events and SQL queries. Option A is wrong because CloudWatch Logs doesn't show lock waits directly. Option C is wrong because Enhanced Monitoring shows OS metrics. Option D is wrong because AWS Trusted Advisor is for best practices.

Answer

Amazon CloudWatch Logs

Answer

Amazon RDS Enhanced Monitoring

Answer

AWS Trusted Advisor

Question 2

A company is using an RDS for MySQL DB instance encrypted at rest with AWS KMS. The security team requires that all access to the database be logged, including queries that fail due to authentication errors. Which configuration meets this requirement?

Accepted Answer

Enable the RDS audit log by setting the 'audit_log_enabled' parameter to 1 in the DB parameter group and export logs to CloudWatch Logs.. Option C is correct because enabling RDS Enhanced Monitoring does not log queries; RDS does not have native query logging for authentication failures. The correct approach is to enable RDS audit logs by setting the 'audit_log_enabled' parameter to 1 in the DB parameter group, and enabling log exports to CloudWatch Logs. However, for MySQL, audit logs capture connection attempts and queries. But none of the options directly mention that. The best answer is to use AWS CloudTrail for RDS API calls and RDS audit logs for database-level logs. Option C enables audit logs and exports to CloudWatch Logs, which captures authentication failures. Option A is wrong because CloudTrail logs only control plane operations, not data plane queries. Option B is wrong because Enhanced Monitoring provides OS metrics, not query logs. Option D is wrong because storing logs in S3 requires enabling audit logs and exporting them. The correct answer is not listed perfectly, but C is closest.

Answer

Enable RDS Enhanced Monitoring and publish metrics to CloudWatch.

Answer

Enable AWS CloudTrail for the RDS instance and store logs in S3.

Answer

Use S3 server access logs to capture database connection attempts.

Question 3

A developer needs to allow an application running on an EC2 instance to read and write data to a DynamoDB table named 'Orders'. The EC2 instance is configured with an IAM role. Which IAM policy should be attached to the role?

Accepted Answer

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:GetItem", "dynamodb:PutItem" ], "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders" } ] }. Option B is correct because the policy grants dynamodb:GetItem and dynamodb:PutItem on the specified table. Option A is wrong because 'Allow' is misspelled as 'Allow' (typo) but also DynamoDB actions are not 'Ec2:*'. Option C is wrong because it grants full DynamoDB access to all tables. Option D is wrong because it uses s3:* instead of DynamoDB.

Answer

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "dynamodb:*", "Resource": "*" } ] }

Answer

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "ec2:*", "Resource": "*" } ] }

Answer

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "s3:*", "Resource": "arn:aws:s3:::example-bucket/*" } ] }

Question 4

A company's security team wants to encrypt data at rest for an existing RDS for PostgreSQL DB instance. The instance is currently unencrypted. Which steps should the team take to enable encryption with minimal downtime?

Accepted Answer

Take a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore a new DB instance from the encrypted snapshot.. Option D is correct because Amazon RDS does not support direct encryption of an existing unencrypted DB instance. The only way is to create a snapshot, copy it with encryption, and restore a new encrypted instance. Option A is wrong because you cannot enable encryption on an existing instance directly. Option B is wrong because modifying the DB instance does not allow enabling encryption. Option C is wrong because creating a read replica does not enable encryption.

Answer

Modify the DB instance and enable encryption in the RDS console.

Answer

Create a read replica of the DB instance and promote it to a standalone instance.

Answer

Create a new option group with encryption enabled and associate it with the DB instance.

Question 5

A company uses Amazon Redshift for data warehousing. The security team requires that all data loaded into the cluster be encrypted at rest using a customer-managed KMS key. The cluster is currently unencrypted. What is the most efficient way to achieve this requirement with minimal data loss?

Accepted Answer

Unload the data from the existing cluster to S3, create a new encrypted cluster using the KMS key, and reload the data from S3.. Option B is correct because you cannot enable encryption on an existing Redshift cluster. You must unload data from the existing cluster, create a new encrypted cluster, and reload the data. Option A is wrong because encryption can only be set at cluster creation. Option C is wrong because modifying the cluster does not enable encryption. Option D is wrong because Redshift does not support enabling encryption via parameter groups.

Answer

Change the cluster parameter group to enable encryption.

Answer

Modify the cluster and enable encryption in the Redshift console.

Answer

Take a snapshot of the cluster, copy the snapshot with encryption, and restore from the encrypted snapshot.

Question 6

A company has an RDS for SQL Server DB instance that stores sensitive data. The database administrator needs to ensure that all connections to the database use SSL/TLS encryption. What should the administrator do?

Accepted Answer

Set the 'rds.force_ssl' parameter to 1 in the DB parameter group.. Option C is correct because the 'rds.force_ssl' parameter forces all connections to use SSL. Option A is wrong because CloudTrail logs API calls, not connections. Option B is wrong because the security group controls network access, not encryption. Option D is wrong because deleting the DB instance is drastic.

Answer

Configure the security group to only allow traffic from specific IP addresses.

Answer

Enable AWS CloudTrail to monitor connections.

Answer

Delete the DB instance and create a new one with encryption enabled.

Question 7

A company uses Amazon DynamoDB with AWS KMS customer managed keys for encryption at rest. The security team wants to audit who is using the KMS key to encrypt and decrypt data. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. Option B is correct because CloudTrail logs all KMS API calls, including encrypt and decrypt. Option A is wrong because CloudWatch Logs can store logs but does not capture KMS API calls by itself. Option C is wrong because AWS Config tracks resource configuration changes, not API calls. Option D is wrong because S3 access logs are for S3.

Answer

Amazon S3 access logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 8

A company has a multi-AZ RDS for PostgreSQL DB instance. The security team wants to ensure that database audit logs are stored in CloudWatch Logs for real-time monitoring. The team enabled the 'pgaudit.log' parameter and set 'log_destination' to 'csvlog'. However, logs are not appearing in CloudWatch. What is the most likely cause?

Accepted Answer

The 'rds.logs_to_cloudwatch' parameter is not set to 1.. Option D is correct because RDS publishes logs to CloudWatch only if the 'rds.logs_to_cloudwatch' parameter is set to 1. Option A is wrong because the instance is multi-AZ, which does not affect log delivery. Option B is wrong because the parameter group is associated; the issue is the missing parameter. Option C is wrong because CloudTrail is not involved.

Answer

The DB instance is multi-AZ, which prevents log delivery to CloudWatch.

Answer

AWS CloudTrail is not enabled for the RDS instance.

Answer

The DB parameter group is not associated with the DB instance.

Question 9

A developer is writing an AWS Lambda function that needs to access a Secrets Manager secret to retrieve database credentials. The Lambda function has an IAM role. Which action must be allowed in the IAM policy?

Accepted Answer

secretsmanager:GetSecretValue. Option B is correct because 'secretsmanager:GetSecretValue' retrieves the secret. Option A is wrong because 'kms:Decrypt' may be needed if the secret is encrypted with a KMS key, but the primary action is GetSecretValue. Option C is wrong because 'secretsmanager:ListSecrets' only lists secrets, not retrieve values. Option D is wrong because 'secretsmanager:PutSecretValue' is for updating secrets.

Answer

kms:Decrypt

Answer

secretsmanager:PutSecretValue

Answer

secretsmanager:ListSecrets

Question 10

A company is using Amazon Aurora MySQL-Compatible Edition. The database administrator wants to restrict a specific user to only execute SELECT statements on a specific database. Which SQL command should the administrator use?

Accepted Answer

GRANT SELECT ON db_name.* TO 'user'@'%';. Option C is correct because GRANT SELECT ON db_name.* TO user grants SELECT on all tables in the database. Option A is wrong because REVOKE removes privileges. Option B is wrong because CREATE USER creates a user but does not grant privileges. Option D is wrong because ALTER USER modifies user attributes.

Answer

ALTER USER 'user'@'%' WITH GRANT OPTION;

Answer

CREATE USER 'user'@'%' IDENTIFIED BY 'password';

Answer

REVOKE ALL PRIVILEGES ON db_name.* FROM 'user'@'%';

Question 11

Which TWO actions should be taken to protect sensitive data in an Amazon RDS for Oracle DB instance? (Choose two.)

Accepted Answer

Use Oracle Transparent Data Encryption (TDE) for sensitive columns.. Options B and D are correct. Enabling encryption at rest protects data on disk, and enabling Transparent Data Encryption (TDE) provides additional encryption for specific columns. Option A is wrong because disabling automatic backups does not enhance security. Option C is wrong because setting a public IP address increases exposure. Option E is wrong because storing credentials in the application code is insecure.

Answer

Store database credentials in the application configuration file.

Answer

Disable automated backups to reduce storage costs.

Answer

Assign a public IP address to the DB instance for easier access.

Question 12

A company wants to encrypt data at rest for an existing Amazon RDS for Oracle DB instance. The database is currently unencrypted. What is the simplest way to enable encryption with minimal downtime?

Accepted Answer

Create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance.. Option B is correct because you cannot directly enable encryption on an existing unencrypted RDS instance. You must create a snapshot, copy it with encryption enabled, and then restore the snapshot to a new encrypted instance. You then redirect traffic to the new instance. Option A is wrong because modifying the DB instance does not support enabling encryption. Option C is wrong because enabling encryption on an existing instance is not supported. Option D is wrong because creating a read replica does not encrypt the master instance, and the replica can only be encrypted if the master is already encrypted.

Answer

Create an encrypted read replica and promote it to a standalone instance.

Answer

Modify the DB instance and enable encryption using the RDS console.

Answer

Enable encryption directly on the existing DB instance by modifying the DB instance settings.

Question 13

A company is using Amazon Aurora MySQL-Compatible Edition. The security team wants to ensure that database credentials are not stored in application configuration files. They decide to use AWS Secrets Manager to manage credentials. The application is hosted on Amazon EC2 instances that have an IAM role attached. What is the most secure way to grant the application access to the secret?

Accepted Answer

Grant the IAM role attached to the EC2 instance permissions to read the secret, and use the Secrets Manager API to retrieve it at runtime.. Option D is correct because the most secure approach is to grant the EC2 IAM role permission to read the secret using an IAM policy attached to the role, and then have the application call the Secrets Manager API to retrieve the secret at runtime. This avoids storing secrets in code or configuration files. Option A is wrong because hardcoding credentials defeats the purpose. Option B is wrong because storing the secret in a configuration file is not secure. Option C is wrong because you should not attach a resource-based policy to the EC2 instance; IAM roles are the correct mechanism.

Answer

Store the secret in the application code and rotate it periodically.

Answer

Attach a resource-based policy to the EC2 instance allowing access to the secret.

Answer

Store the secret in an encrypted S3 bucket and have the application download it at startup.

Question 14

A company is using Amazon DynamoDB to store sensitive customer data. They need to ensure that all data is encrypted at rest using a customer-managed AWS KMS key. The company also wants to rotate the KMS key every year. What is the simplest way to achieve key rotation?

Accepted Answer

Enable automatic key rotation in AWS KMS for the customer-managed key.. Option A is correct because AWS KMS supports automatic annual rotation for customer-managed keys when enabled. You can enable automatic rotation using the KMS console or API. Option B is wrong because creating a new key and updating the DynamoDB table requires manual effort and is more complex. Option C is wrong because AWS KMS does not support importing key material for symmetric keys; you can import key material for asymmetric keys but rotation is not automatic. Option D is wrong because manual rotation is not required and is more error-prone.

Answer

Create a new KMS key every year and update the DynamoDB table to use the new key.

Answer

Manually rotate the key by deleting and recreating the KMS key each year.

Answer

Import new key material into the existing KMS key every year.

Question 15

A company is migrating its on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all data at rest be encrypted using a customer-managed key stored in AWS KMS, and that the key be rotated automatically every year. The company also needs to ensure that only specific IAM roles can access the key. Which combination of steps should the database administrator take to meet these requirements?

Accepted Answer

Create the RDS instance with encryption enabled using a customer-managed KMS key, and configure the key policy to restrict access to the required IAM roles.. Option B is correct because enabling encryption on the RDS instance with a customer-managed KMS key allows rotation and access control via KMS key policies. Option A is wrong because RDS does not support manual encryption after creation. Option C is wrong because default service key does not allow custom rotation. Option D is wrong because CloudHSM is not needed for this scenario.

Answer

Create the RDS instance without encryption, then use the AWS Console to enable encryption after creation using a customer-managed key.

Answer

Create the RDS instance with encryption using the default AWS managed service key, and set up automatic key rotation in KMS.

Answer

Use AWS CloudHSM to generate and store the encryption key, and configure RDS to use the CloudHSM key for encryption.

Question 16

A company has an Amazon RDS for MySQL Multi-AZ DB instance that stores sensitive financial data. The security team has enabled encryption at rest using a KMS key. They also need to ensure that database audit logs are encrypted and stored in an S3 bucket. The logs must be accessible only by the security team via a VPC endpoint. The log data must be retained for 7 years. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Enable MySQL audit logs and publish them to Amazon CloudWatch Logs. Use a CloudWatch Logs subscription filter to stream logs to an S3 bucket encrypted with KMS, with a bucket policy that restricts access via VPC endpoint.. Option C is correct because enabling MySQL audit logs, pushing them to CloudWatch Logs, and using CloudWatch subscription filter to S3 with bucket policies restricting access via VPC endpoint and encryption with KMS is the least overhead. Option A is wrong because RDS doesn't directly push audit logs to S3. Option B is wrong because RDS for MySQL does not support sending audit logs to Firehose directly. Option D is wrong because it requires custom Lambda code and operational overhead.

Answer

Configure RDS to publish audit logs directly to an S3 bucket with a bucket policy that restricts access to the security team's IAM roles.

Answer

Install a custom audit plugin on the RDS instance that writes logs to a separate RDS table, then use AWS Lambda to export the table to S3 periodically.

Answer

Enable RDS audit logs and send them to Amazon Kinesis Data Firehose, which writes to an S3 bucket with encryption and VPC endpoint restrictions.

Question 17

Which THREE methods can be used to authenticate users to an Amazon RDS for MySQL DB instance? (Choose three.)

Accepted Answer

MySQL native password authentication.. Options A, B, and D are correct. MySQL native password authentication is standard. IAM database authentication allows IAM users and roles to authenticate. Kerberos authentication is supported for RDS for MySQL. Option C is wrong because RDS does not support Active Directory directly for MySQL (it is supported for SQL Server and Oracle). Option E is wrong because Lambda cannot be used for authentication.

Answer

AWS Managed Microsoft AD authentication.

Answer

AWS Lambda function authentication.

Question 18

A company uses Amazon RDS for SQL Server with Multi-AZ deployment. The security team has mandated that all connections to the database must use SSL/TLS. The database is accessed by multiple applications running on EC2 instances. Which configuration ensures that all connections use SSL/TLS?

Accepted Answer

Set the parameter rds.force_ssl to 1 in the DB parameter group and revoke permissions from users that do not use SSL.. Option D is correct because to enforce SSL/TLS for all connections, you need to set the rds.force_ssl parameter to 1 in the RDS parameter group, which forces all connections to use SSL. Additionally, you should revoke non-SSL permissions from the database users. Option A is wrong because modifying the DB instance to require SSL is not a direct setting; the parameter group controls this. Option B is wrong because using a certificate authority is not required; RDS provides a certificate. Option C is wrong because setting the parameter is the correct method, but you also need to revoke non-SSL permissions to fully enforce.

Answer

Modify the DB instance by enabling the 'Require SSL' option in the RDS console.

Answer

Set the parameter rds.force_ssl to 1 in the DB parameter group.

Answer

Configure the applications to use a certificate from a trusted certificate authority and connect using SSL.

Question 19

A company is using Amazon DynamoDB to store customer session data. The security team requires that all data is encrypted at rest using a customer-managed KMS key, and that access to the key is restricted to specific IAM roles. The company also wants to ensure that DynamoDB Accelerator (DAX) cluster is encrypted. Which steps should be taken to meet these requirements?

Accepted Answer

Create the DynamoDB table with encryption using a customer-managed KMS key. Create the DAX cluster and enable encryption at rest using the same KMS key.. Option A is correct because DynamoDB tables are encrypted by default with KMS, and you can specify a customer-managed key. DAX clusters also support encryption using the same KMS key. Option B is wrong because DAX does not support encryption at rest with a different key. Option C is wrong because DAX does not support encryption in transit separately. Option D is wrong because DynamoDB encryption cannot be enabled after table creation.

Answer

Create the DynamoDB table without encryption, then use the AWS CLI to enable encryption after creation.

Answer

Create the DynamoDB table with default encryption, and create the DAX cluster with a separate customer-managed KMS key.

Answer

Create the DynamoDB table with encryption using a customer-managed key, and enable encryption in transit on the DAX cluster using TLS.

Question 20

The security team reports that the database 'mydb' is not encrypted. However, the CLI output shows 'StorageEncrypted' is true. What is the MOST likely reason for the security team's concern?

Accepted Answer

The KMS key specified may have been disabled or deleted, causing the database to be inaccessible or not encrypted.. Option C is correct. The KMS key ID is in the output, but the security team might be concerned about the key being disabled or deleted. Option A is wrong because 'StorageEncrypted' is true. Option B is wrong because there is no HSM requirement. Option D is wrong because the key is specified.

Answer

The database is using a default AWS managed key instead of a customer-managed key.

Answer

The 'StorageEncrypted' field is false, but the CLI output shows true.

Answer

The database is not using a KMS key and is instead using a CloudHSM key.