DBS-C01 Mock Exam 73 — 25 Questions

Question 1

A company has an Amazon RDS for SQL Server Multi-AZ DB instance with a standby replica in a different AWS Region. The database is encrypted with a KMS key. The company needs to implement automated backups that are also encrypted and stored in a cross-region S3 bucket. The backups must be retained for 3 years. Which solution meets these requirements with the LEAST administrative effort?

Accepted Answer

Enable automated backups on the RDS instance, configure cross-Region backup copy to a destination Region, and store the backups in an S3 bucket with S3 Object Lock enabled for retention.. Option D is correct because enabling automated backups with cross-region copy to an S3 bucket with S3 Object Lock (which supports retention) is the least effort. Option A is wrong because RDS does not directly back up to S3. Option B is wrong because manual backups require operational overhead. Option C is wrong because DMS is not designed for this purpose.

Answer

Configure RDS to send automated backups directly to the cross-region S3 bucket using the AWS Backup service.

Answer

Use AWS Database Migration Service (DMS) to continuously replicate the database to an S3 bucket in the target region.

Answer

Create manual snapshots of the RDS instance, copy them to the cross-region S3 bucket using AWS CLI, and set a lifecycle policy for retention.

Question 2

An IAM policy is attached to an IAM user. The user wants to connect to an RDS MySQL database using IAM database authentication. What does this policy allow?

Accepted Answer

Allows the user to connect to the RDS instance with the database user name 'db_user1'.. Option A is correct. The policy allows the user to connect to the specified database as user 'db_user1'. Option B is wrong because it only allows connecting to one database user. Option C is wrong because it allows only one database user. Option D is wrong because the resource is specific to a database instance and user.

Answer

Allows the user to connect to any database on the RDS instance as any user.

Answer

Allows the user to manage the RDS instance.

Answer

Allows the user to connect to the RDS instance with any database user name.

Question 3

A company is designing a security strategy for Amazon RDS for SQL Server. Which TWO actions should be taken to encrypt data at rest? (Choose TWO.)

Accepted Answer

Enable Transparent Data Encryption (TDE) on the SQL Server database.. Option A is correct because enabling RDS encryption at rest uses KMS. Option C is correct because Transparent Data Encryption (TDE) is supported by SQL Server and can be used. Option B is wrong because SSL encrypts in transit. Option D is wrong because EBS encryption is not applicable to RDS instances (RDS manages storage). Option E is wrong because CloudHSM is not required for RDS encryption.

Answer

Enable Amazon EBS encryption on the underlying volumes.

Answer

Use AWS CloudHSM to store encryption keys.

Answer

Enable SSL/TLS for connections.

Question 4

A company is using Amazon RDS for SQL Server with Multi-AZ deployment. The security team requires that all database activity be monitored for suspicious queries. The database specialist enabled RDS Database Activity Streams and configured AWS Lambda to process the stream. However, the Lambda function fails to process some events when the database fails over to the standby instance. What is the most likely cause?

Accepted Answer

The Lambda function does not re-establish the stream session after a failover event.. Option D is correct because after failover, the stream session may be interrupted and the application must reconnect. Option A is wrong because the KMS key is used for encryption, not for connectivity. Option B is wrong because the security group applies to the RDS endpoint, which remains the same after failover. Option C is wrong because the parameter group is applied to both instances.

Answer

The security group does not allow the Lambda function to connect to the new primary instance.

Answer

The parameter group for the standby instance does not have the activity stream enabled.

Answer

The KMS key used to encrypt the activity stream is not available in the standby instance's Region.

Question 5

A company has an Amazon Redshift cluster that contains sensitive data. The security team requires that data be encrypted at rest using a customer-managed AWS KMS key. The cluster was initially launched without encryption. How can the company enable encryption with minimal downtime?

Accepted Answer

Unload the data to Amazon S3, create a new encrypted cluster, and reload the data from S3.. Option B is correct. To enable encryption on an existing unencrypted Redshift cluster, you must unload the data to Amazon S3, create a new encrypted cluster, and reload the data. Option A is incorrect because Redshift does not support enabling encryption on an existing cluster directly. Option C is incorrect because snapshots preserve encryption status; restoring an unencrypted snapshot to an encrypted cluster is not possible. Option D is incorrect because modifying the cluster does not support enabling encryption.

Answer

Use the AWS CLI to update the cluster encryption setting.

Answer

Take a snapshot of the cluster and restore it to a new cluster with encryption enabled.

Answer

Modify the cluster and enable encryption using the AWS Management Console.

Question 6

A database administrator runs the AWS CLI command shown in the exhibit. The administrator wants to enable encryption at rest for the RDS instance. What should the administrator do?

Accepted Answer

Take a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore a new instance.. Option C is correct because the output shows the instance is unencrypted. To enable encryption, you must create a snapshot, copy it with encryption, and restore a new encrypted instance. Option A is wrong because encryption cannot be enabled on an existing instance. Option B is wrong because modifying the instance does not allow encryption. Option D is wrong because the KMS key is null, but that's because encryption is not enabled.

Answer

Modify the DB instance and set StorageEncrypted to true.

Answer

Create a new KMS key and associate it with the DB instance.

Answer

Create a new DB parameter group with encryption enabled.

Question 7

A company is using Amazon RDS for MySQL. They want to audit all database logins and failed login attempts. Which option should they enable?

Accepted Answer

Set the parameter audit_log = 'ON' in the DB parameter group.. Option A is correct because setting the parameter audit_log = 'ON' enables audit logging for MySQL, which logs connections and disconnections, including failed login attempts. Option B is wrong because general_log logs all queries, not just logins. Option C is wrong because slow_query_log logs only slow queries. Option D is wrong because log_queries_not_using_indexes logs queries that do not use indexes, not login attempts.

Answer

Set the parameter log_queries_not_using_indexes = 'ON' in the DB parameter group.

Answer

Set the parameter general_log = 'ON' in the DB parameter group.

Answer

Set the parameter slow_query_log = 'ON' in the DB parameter group.

Question 8

A company is using Amazon Redshift for data warehousing. The security team requires that all data is encrypted at rest using a hardware security module (HSM). Additionally, the team wants to ensure that only specific IAM roles can access the database. Which configuration will meet these requirements?

Accepted Answer

Create the Redshift cluster with encryption enabled using an HSM, and attach an IAM role to the cluster to control access.. Option B is correct because Redshift supports HSM for encryption at rest, and IAM roles can be attached to the cluster for access control. Option A is wrong because HSM and KMS are mutually exclusive. Option C is wrong because KMS does not meet the HSM requirement. Option D is wrong because encryption cannot be enabled after cluster creation.

Answer

Create the Redshift cluster with encryption enabled using a KMS key, and configure the cluster to use an HSM for key storage.

Answer

Create the Redshift cluster without encryption, then use the AWS CLI to enable encryption using a KMS key.

Answer

Create the Redshift cluster with encryption using a KMS key, and then import the HSM certificate into the cluster.

Question 9

A company is migrating its on-premises Oracle database to Amazon RDS for Oracle. As part of the migration, they need to ensure that all sensitive data is encrypted at rest using AWS Key Management Service (AWS KMS). Which configuration step is required to achieve this?

Accepted Answer

Create a new encrypted DB instance by enabling encryption and specifying a KMS key.. Option C is correct because Amazon RDS for Oracle supports encryption at rest using AWS KMS by enabling encryption when creating the DB instance. Option A is wrong because enabling encryption on an existing unencrypted DB instance requires a snapshot restore, not a direct modification. Option B is wrong because AWS CloudHSM is not required; AWS KMS is sufficient. Option D is wrong because SSL/TLS encrypts data in transit, not at rest.

Answer

Modify the existing DB instance to enable encryption.

Answer

Configure SSL/TLS on the DB instance to encrypt data at rest.

Answer

Use AWS CloudHSM to generate and store the encryption keys.

Question 10

A company is using Amazon Redshift and needs to comply with regulatory requirements that mandate encryption of all data at rest and control of the encryption keys. Which THREE steps should be taken? (Choose THREE.)

Accepted Answer

Enable automatic key rotation for the KMS key.. Option A is correct because encrypting the cluster at creation with a KMS key is required. Option C is correct because enabling KMS automatic key rotation meets key control requirements. Option D is correct because configuring the cluster to use a customer-managed key provides key control. Option B is wrong because CloudHSM is not required. Option E is wrong because encryption at rest cannot be enabled after cluster creation without restoring from a snapshot.

Answer

Use AWS CloudHSM to generate and manage encryption keys.

Answer

Enable encryption on the cluster after creation by modifying the cluster.

Question 11

A company is using Amazon Aurora MySQL-Compatible Edition. The security team wants to restrict access to the database so that only specific applications running on Amazon EC2 instances can connect. The EC2 instances are in the same VPC as the Aurora cluster. Which combination of steps should be taken to enforce this restriction?

Accepted Answer

Configure the Aurora cluster's security group to allow inbound traffic from the EC2 instances' security group.. Option A is correct because security groups can be used to allow traffic only from specific security groups (e.g., EC2 security group). Option B is wrong because IAM database authentication controls user authentication, not network access. Option C is wrong because NACLs are stateless and less granular. Option D is wrong because subnet group does not restrict access.

Answer

Enable IAM database authentication and create database users for each application.

Answer

Modify the DB subnet group to include only subnets where the EC2 instances reside.

Answer

Use a network ACL to allow traffic only from the EC2 instances' IP addresses.

Question 12

A company wants to ensure that only specific IAM users can perform certain operations on an Amazon RDS DB instance, such as creating snapshots or modifying the instance. Which AWS feature should be used to define these permissions?

Accepted Answer

IAM policies. Option D is correct. IAM policies are used to grant permissions to IAM users, groups, or roles for specific AWS resources, including RDS. Options A, B, and C are not used for access control: Security groups control network traffic, DB subnet groups define network subnets, and parameter groups configure database engine settings.

Answer

VPC security groups

Answer

DB parameter groups

Answer

DB subnet groups

Question 13

A financial services company stores sensitive data in an Amazon DynamoDB table. The security team requires that all data at rest be encrypted with a customer-managed key that is rotated automatically every 12 months. The company also needs to audit key usage. Which solution meets these requirements?

Accepted Answer

Enable encryption at rest using an AWS KMS customer-managed CMK. Configure automatic key rotation with a 12-month period. Use AWS CloudTrail to audit key usage.. DynamoDB supports encryption at rest with AWS KMS customer-managed CMKs. Automatic key rotation every 12 months is a feature of KMS for CMKs. CloudTrail logs KMS API calls for auditing. Option B uses the default AWS-managed key, which cannot be rotated manually but rotates automatically every 3 years, not 12 months; also, auditing is possible but the key is not customer-managed. Option C uses SSE-S3, which is for S3, not DynamoDB. Option D uses CloudHSM, which provides HSMs but does not automatically rotate keys every 12 months.

Answer

Use server-side encryption with S3-managed keys (SSE-S3) for the DynamoDB table.

Answer

Use AWS CloudHSM to generate and store the encryption key. Configure the application to encrypt data before writing to DynamoDB.

Answer

Enable encryption at rest using the default DynamoDB encryption option (AWS owned key). Use AWS CloudTrail to audit key usage.

Question 14

A security engineer creates the IAM policy shown in the exhibit and attaches it to an IAM user. What is the effect of this policy?

Accepted Answer

The user can modify 'prod-db' but cannot delete it.. Option D is correct because the policy allows DescribeDBInstances and ModifyDBInstance on all resources, but explicitly denies DeleteDBInstance on the specific database 'prod-db'. Since an explicit deny overrides any allow, the user cannot delete that database. However, the user can modify all databases including 'prod-db'. Option A is wrong because the deny is only for DeleteDBInstance. Option B is wrong because the user can modify all databases. Option C is wrong because the user can describe all databases.

Answer

The user can delete any database except 'prod-db'.

Answer

The user can describe all databases except 'prod-db'.

Answer

The user can modify any database except 'prod-db'.

Question 15

A company uses Amazon DynamoDB with a global secondary index (GSI) on a table that contains sensitive data. The security team requires that the GSI be encrypted with a different AWS KMS key than the base table. Can this be achieved, and if so, how?

Accepted Answer

No, DynamoDB encrypts the entire table and all its indexes with the same KMS key.. Option C is correct because DynamoDB encrypts all data at rest using a single KMS key per table. The base table and all of its GSIs are encrypted with the same key. It is not possible to use a different KMS key for a GSI. Option A is wrong because the GSI cannot have a separate key. Option B is wrong because KMS key policies do not allow per-index encryption. Option D is wrong because the table and its GSIs always use the same key.

Answer

Yes, by using a custom KMS key policy that differentiates between table and index.

Answer

Yes, by specifying a different KMS key ID when creating the GSI.

Answer

No, but you can use a different KMS key for the table and then the GSI will automatically use a different key.

Question 16

A company is using Amazon Aurora MySQL-Compatible Edition. The security team wants to audit all database login attempts and store the logs in Amazon S3 for 90 days. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Enable the Aurora audit log and publish logs to Amazon CloudWatch Logs. Create a CloudWatch Logs subscription filter to stream the logs to an Amazon S3 bucket.. Option D is correct because Aurora can publish audit logs to CloudWatch Logs, which can then be streamed to S3 via a subscription filter. Option A is wrong because Aurora does not directly write logs to S3. Option B is wrong because third-party tools add operational overhead. Option C is wrong because RDS does not send logs to Kinesis directly.

Answer

Enable the Aurora audit log and configure the DB cluster to publish logs directly to an S3 bucket.

Answer

Install a custom audit plugin on the Aurora cluster that writes logs to a file, then use an AWS Lambda function to upload the file to S3.

Answer

Enable the Aurora audit log and use Amazon Kinesis Data Firehose to stream the logs to S3.

Question 17

A company uses Amazon DynamoDB with AWS KMS-managed encryption at rest. The security team requires that all access to a particular DynamoDB table be logged for audit purposes. Which solution meets this requirement?

Accepted Answer

Enable CloudTrail data events for the DynamoDB table.. Option B is correct because AWS CloudTrail logs all DynamoDB API calls, including data plane operations, when data events are enabled. Option A is wrong because VPC Flow Logs capture network traffic, not API calls. Option C is wrong because Amazon GuardDuty is a threat detection service, not a logging service. Option D is wrong because AWS Config records resource configuration changes, not API calls.

Answer

Enable VPC Flow Logs for the VPC where the DynamoDB endpoint is accessed.

Answer

Enable AWS Config rules for DynamoDB.

Answer

Enable Amazon GuardDuty with DynamoDB protection.

Question 18

A company uses Amazon DynamoDB and wants to audit access to a table. Which TWO services can be used together to log and monitor data plane operations? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Logs. Option B is correct because CloudTrail logs data events for DynamoDB. Option C is correct because Amazon CloudWatch Logs can be used to store and monitor the logs. Option A is wrong because VPC Flow Logs capture network traffic. Option D is wrong because AWS Config records configuration changes. Option E is wrong because S3 access logs log access to S3, not DynamoDB.

Answer

S3 access logs

Answer

VPC Flow Logs

Answer

AWS Config

Question 19

A company is using Amazon DynamoDB with encryption at rest using a customer-managed KMS key. The security team wants to audit every use of this KMS key. Which TWO steps should be taken to meet this requirement?

Accepted Answer

Turn on KMS key auditing in the key's advanced configuration.. Option A and D are correct. CloudTrail logs all KMS API calls; enabling CloudTrail and KMS key auditing (via CloudTrail) provides the audit. Option B is wrong because CloudWatch Logs is for log storage, not for enabling KMS audit. Option C is wrong because Config records resource changes, not API calls. Option E is wrong because VPC Flow Logs capture network traffic, not KMS usage.

Answer

Send KMS audit logs to Amazon CloudWatch Logs.

Answer

Enable AWS Config to record KMS key configuration changes.

Answer

Enable VPC Flow Logs for the DynamoDB VPC endpoint.

Question 20

A company is using Amazon Aurora MySQL-Compatible Edition. The security team requires that all connections to the database use SSL/TLS. The application currently connects using a standard JDBC connection string without SSL. What changes are needed to enforce SSL connections?

Accepted Answer

Modify the DB cluster parameter group to set require_secure_transport to ON and update the application connection string to use SSL parameters.. Option D is correct. To enforce SSL for all connections, you must configure the DB cluster parameter group to set require_secure_transport to ON and update the application connection string to use SSL parameters. Option A is incomplete because modifying the parameter group alone does not enforce SSL for existing connections. Option B is incorrect because modifying the security group does not enforce SSL. Option C is incorrect because using an IAM role does not enforce SSL.

Answer

Modify the DB cluster parameter group to set require_secure_transport to ON.

Answer

Modify the security group to only allow traffic on port 3306 with the SSL flag.

Answer

Create an IAM role that requires SSL for database access and assign it to the application.