DBS-C01 Mock Exam 74 — 25 Questions

Question 1

A company is running an Amazon RDS for MySQL DB instance in a VPC. The security team requires that all connections to the database use SSL/TLS. The DBA has enabled 'require_secure_transport' parameter in the DB parameter group. However, after applying the change and rebooting, some applications that were previously connecting successfully are now failing. What is the most likely cause?

Accepted Answer

The application is not configured to connect using SSL/TLS.. Option C is correct because enabling require_secure_transport forces the server to accept only SSL connections. If the application does not use SSL, the connection will be rejected. Option A is wrong because the DB subnet group does not affect SSL enforcement. Option B is wrong because the security group controls network access, not SSL. Option D is wrong because the option group is irrelevant for this setting.

Answer

The security group inbound rule for the database port is missing.

Answer

The option group does not have the SSL option enabled.

Answer

The DB subnet group does not include the application's subnet.

Question 2

A company is migrating an on-premises MongoDB database to Amazon DocumentDB (with MongoDB compatibility). The security team requires that data be encrypted at rest and in transit. Additionally, the team wants to use IAM roles to authenticate applications. Which THREE steps should the database specialist take to meet these requirements?

Accepted Answer

Use IAM roles to authenticate applications to the DocumentDB cluster.. Options A, B, and E are correct. Encryption at rest is enabled by default; in-transit encryption is enabled via TLS; IAM authentication is supported through IAM roles. Option C is wrong because DocumentDB uses TLS, not SSL/TLS with custom certificates. Option D is wrong because DocumentDB does not support VPC endpoints for encryption; encryption at rest is cluster-level.

Answer

Use a custom certificate authority for SSL/TLS.

Answer

Create a VPC endpoint for DocumentDB to enforce encryption.

Question 3

A company stores sensitive data in an Amazon S3 bucket that is accessed by an Amazon Redshift cluster. The security team requires that the data in transit between Redshift and S3 be encrypted. Which configuration ensures this?

Accepted Answer

Ensure that the Redshift cluster has SSL enabled, which encrypts data in transit by default for COPY/UNLOAD operations to S3.. Option B is correct. Redshift automatically uses SSL encryption for data in transit when moving data to and from S3 using COPY/UNLOAD commands. Option A is incorrect because server-side encryption (SSE-S3) encrypts data at rest, not in transit. Option C is incorrect because client-side encryption encrypts data before sending, but Redshift handles this automatically with SSL. Option D is incorrect because VPC endpoints do not encrypt data in transit; they provide private connectivity.

Answer

Enable server-side encryption (SSE-S3) on the S3 bucket.

Answer

Configure a VPC endpoint for S3.

Answer

Use client-side encryption on the data before uploading to S3.

Question 4

A company has an Amazon RDS for Oracle DB instance that stores Personally Identifiable Information (PII). The security team requires that the data be transparently encrypted at rest using a key stored in AWS CloudHSM. What should the database administrator do to meet this requirement?

Accepted Answer

Enable TDE and use AWS KMS as the key manager by integrating with the Oracle TDE keystore.. Oracle Transparent Data Encryption (TDE) can use an external hardware security module (HSM) via the Oracle Key Vault or direct integration. However, AWS CloudHSM is not directly supported by RDS for Oracle TDE. RDS Oracle supports TDE using the Oracle wallet or AWS KMS (for integrated TDE). To use CloudHSM, you would need to run Oracle on EC2, not RDS. Option A is not supported; Option B is for KMS; Option D is incorrect because RDS does not allow custom init scripts. The correct approach is to use AWS KMS, which is the only supported method for TDE key management in RDS Oracle.

Answer

Use Oracle Data Pump to export the data, encrypt it using CloudHSM, and import it back into RDS.

Answer

Enable TDE and configure the Oracle wallet to point to the CloudHSM key.

Answer

Create a custom DB engine using a custom AMI that includes CloudHSM integration.

Question 5

A company is using Amazon RDS for MySQL with encryption at rest enabled. The security team requires that all access to the database be authenticated using IAM database authentication. Which combination of steps must the company take to meet this requirement?

Accepted Answer

Create an IAM policy that allows the rds-db:connect action and map the IAM role to a database user created with the AWSAuthenticationPlugin.. Option C is correct because IAM database authentication for RDS MySQL requires creating an IAM role with a policy that allows the rds-db:connect action, then mapping that role to a database user using the CREATE USER statement with the AWSAuthenticationPlugin. Option A is wrong because SSL is not required for IAM auth, though recommended. Option B is wrong because the policy must include rds-db:connect, not rds:connect. Option D is wrong because the database user must be created with AWSAuthenticationPlugin, not with a password.

Answer

Create an IAM role with a policy that allows rds:Connect and attach it to the RDS instance.

Answer

Create a database user with a password and attach an IAM role that allows rds-db:connect to the database user.

Answer

Enable SSL on the RDS instance and create an IAM policy that allows rds:Connect.

Question 6

A company uses Amazon Aurora MySQL-Compatible Edition. The security team wants to implement database activity streams to monitor database activity. Which THREE statements are true about Aurora database activity streams?

Accepted Answer

Activity streams can be started and stopped without restarting the database.. Options A, B, and C are correct. Activity streams can be started and stopped without database restart (A). They send logs to Amazon CloudWatch Logs and Amazon Kinesis Firehose (B). Data is encrypted using a KMS key (C). Option D is wrong because activity streams capture all SQL queries, not just DDL. Option E is wrong because activity streams do not capture data masking; they capture actual queries.

Answer

Activity streams automatically mask sensitive data in the logs.

Answer

Activity streams only capture DDL statements, not DML or SELECT.

Question 7

A company is using Amazon RDS for PostgreSQL and needs to implement column-level encryption for sensitive data. The application must be able to encrypt and decrypt data transparently. Which approach should be taken?

Accepted Answer

Install the pgcrypto extension on the RDS instance and use its functions to encrypt data at the column level.. Option A is correct because pgcrypto is a PostgreSQL extension that provides column-level encryption functions. Option B is wrong because RDS encryption is at rest, not column-level. Option C is wrong because Lambda would require application changes. Option D is wrong because KMS is not directly used for column-level encryption in RDS.

Answer

Enable RDS encryption at rest using a KMS key, which will automatically encrypt all columns.

Answer

Use AWS Lambda to encrypt data before writing to the database and decrypt after reading.

Answer

Use the AWS KMS Encrypt and Decrypt APIs directly in the application code.

Question 8

A company has an Amazon Redshift cluster that stores sensitive financial data. The security team requires that all data be encrypted at rest and that the encryption keys be rotated annually. Which solution meets these requirements?

Accepted Answer

Use AWS KMS with automatic key rotation to encrypt the Redshift cluster.. Option D is correct because Redshift supports encryption at rest with AWS KMS, and KMS keys can be rotated automatically or manually yearly. Option A is wrong because Redshift does not allow you to change the encryption key type after the cluster is created. Option B is wrong because enabling encryption on an existing unencrypted cluster is not possible without a snapshot restore. Option C is wrong because CloudHSM is not required and does not provide automatic key rotation.

Answer

Create the cluster with AWS CloudHSM-backed encryption and rotate the key annually.

Answer

Enable encryption on the existing cluster by modifying the cluster settings.

Answer

Create a new encrypted cluster with a KMS key and configure automatic key rotation.

Question 9

A financial services company is using Amazon DynamoDB to store customer transaction data. The compliance team requires that all data be encrypted at rest using a customer-managed AWS KMS key, and that access to the key be auditable via AWS CloudTrail. Additionally, the security team wants to ensure that DynamoDB can only be accessed from within the VPC using a VPC endpoint. Which combination of steps should the company take to meet these requirements?

Accepted Answer

Enable server-side encryption with a customer-managed KMS key and create an interface VPC endpoint for DynamoDB.. Option D is correct because DynamoDB uses KMS for encryption; an interface VPC endpoint (AWS PrivateLink) is used for private access. Option A is wrong because gateway endpoints are for S3 and DynamoDB, but DynamoDB supports both, however interface endpoint is recommended for private access with security groups. Option B is wrong because using a NAT gateway is not secure and does not enforce VPC-only access. Option C is wrong because CloudHSM is not needed for encryption; KMS is sufficient.

Answer

Use a CloudHSM key for encryption and create a VPC peering connection to DynamoDB.

Answer

Enable server-side encryption with a customer-managed KMS key and route all traffic through a NAT gateway.

Answer

Use AWS managed KMS key and a gateway VPC endpoint for DynamoDB.

Question 10

A company is using Amazon RDS for MySQL to host a web application. The security team has identified that the application is vulnerable to SQL injection attacks. The team wants to implement a defense-in-depth strategy to protect the database. Which THREE measures should be taken to mitigate SQL injection risks?

Accepted Answer

Grant the minimum required permissions to the database user used by the application.. Options A, B, and D are correct. Prepared statements prevent SQL injection; least privilege reduces impact; WAF filters malicious input. Option C is wrong because stored procedures do not inherently prevent injection if not used with parameters. Option E is wrong because encryption does not prevent injection.

Answer

Move all SQL logic into stored procedures.

Answer

Enable encryption at rest for the RDS instance.

Question 11

Which TWO of the following are valid methods to control network access to an Amazon RDS DB instance? (Select TWO.)

Accepted Answer

VPC security groups. Options B and D are correct. Security groups control inbound and outbound traffic to RDS instances. DB subnet groups define which subnets the DB instance can be placed in, but they indirectly control network access. Option A (IAM policies) control API-level permissions, not network access. Option C (DB parameter groups) control database engine settings. Option E (AWS WAF) is for web application firewalls, not network-level access to RDS.

Answer

AWS WAF

Answer

IAM policies

Answer

DB parameter groups

Question 12

A company uses Amazon DynamoDB with fine-grained access control based on user identity. The IAM policy for a user includes a condition that restricts access to items where the 'department' attribute equals 'engineering'. However, the user is receiving an 'AccessDeniedException' when trying to query items. What is the most likely cause?

Accepted Answer

The 'department' attribute is not the partition key of the table.. Fine-grained access control in DynamoDB uses IAM policy conditions with the 'dynamodb:LeadingKeys' or 'dynamodb:Attributes' condition keys. The 'department' attribute must be the partition key of the table for 'LeadingKeys' to work. If 'department' is not the partition key, the condition cannot be evaluated for the query. Option A is possible but less likely if the user is using the correct role. Option C is wrong because DynamoDB does not require SSL for all operations. Option D is wrong because Condition check is exactly how it works.

Answer

The user is not using the correct IAM role.

Answer

The DynamoDB table is not configured to require SSL.

Answer

The IAM policy is missing a 'Condition' block.

Question 13

A financial services company runs a critical application on Amazon RDS for PostgreSQL. They must ensure that database activity logs are sent to Amazon CloudWatch Logs for real-time monitoring. The logs must include all SQL queries, including SELECT statements. Which configuration will meet these requirements?

Accepted Answer

Set log_statement = 'all' and log_min_duration_statement = 0 in the DB parameter group. Enable CloudWatch Logs export.. Option D is correct because to log all SQL queries including SELECT statements, you need to set the RDS parameter group parameters log_statement = 'all' and log_min_duration_statement = 0, and then enable exporting logs to CloudWatch Logs in the RDS console. Option A is wrong because pgAudit is needed if you want audit logs, but the requirement is for general query logs. Option B is wrong because setting log_statement = 'ddl' only logs DDL statements, not SELECT. Option C is wrong because log_min_duration_statement = -1 disables logging of all statements.

Answer

Install the pgAudit extension and configure it to log all statements. Enable CloudWatch Logs export in the RDS console.

Answer

Set the parameter log_statement = 'ddl' in the DB parameter group. Enable CloudWatch Logs export.

Answer

Set log_min_duration_statement = -1 in the DB parameter group. Enable CloudWatch Logs export.

Question 14

A company is using Amazon DynamoDB and wants to restrict access to a specific table so that only users in a particular IAM group can perform read and write operations. Which THREE steps should be taken to achieve this?

Accepted Answer

Create an IAM policy that allows dynamodb:GetItem, dynamodb:PutItem, etc. on the specific table ARN.. Options A, B, and D are correct. You create an IAM policy that grants DynamoDB actions on the specific table (A). You attach that policy to the IAM group (B). You then add users to that group (D). Option C is wrong because the policy should be attached to the group, not the table. Option E is wrong because resource-based policies on the table are not the primary method; IAM policies are used.

Answer

Attach a resource-based policy to the DynamoDB table allowing access from the group.

Answer

Create an IAM role and assign it to the table.

Question 15

A company is using Amazon RDS for MySQL and needs to comply with PCI DSS requirements. Which TWO actions should the company take to secure the database? (Choose TWO.)

Accepted Answer

Enable encryption at rest using AWS KMS.. Options B and D are correct. Enabling encryption at rest protects data on disk, and enabling audit logging helps track access. Option A is wrong because public access should be disabled for security. Option C is wrong because default port is fine; changing it is not a security requirement. Option E is wrong because S3 is not used for RDS audit logs; CloudWatch Logs is used.

Answer

Configure the database to write audit logs directly to an S3 bucket.

Answer

Enable public accessibility on the RDS instance to allow access from anywhere.

Answer

Change the default database port to a non-standard port.

Question 16

A company uses Amazon Aurora MySQL-Compatible Edition and needs to audit all SQL statements executed by database users. Which feature should be enabled?

Accepted Answer

Enable the database engine audit logs (advanced auditing).. Option A is correct because Aurora MySQL supports advanced auditing through database engine audit logs. Option B is wrong because CloudTrail logs API calls, not SQL queries. Option C is wrong because RDS Enhanced Monitoring provides OS metrics, not SQL audit. Option D is wrong because database activity streams capture activity in near real-time but are designed for monitoring and not primarily for SQL audit logging; however, they can be used, but the most direct answer is advanced auditing.

Answer

Enable AWS CloudTrail data events for the DB instance.

Answer

Enable database activity streams.

Answer

Enable RDS Enhanced Monitoring.

Question 17

A developer needs to securely store database credentials for an application that runs on Amazon EC2 and connects to an Amazon RDS for PostgreSQL database. The credentials must be automatically rotated every 90 days. Which AWS service should the developer use to meet these requirements?

Accepted Answer

AWS Secrets Manager. Option B is correct because AWS Secrets Manager supports automatic rotation of database credentials. Option A is wrong because SSM Parameter Store can store secrets but does not natively rotate RDS credentials. Option C is wrong because CloudHSM is for hardware security modules, not credential storage. Option D is wrong because IAM Roles can be used for EC2 to access RDS but do not store credentials; also RDS PostgreSQL does not support IAM authentication by default.

Answer

AWS Systems Manager Parameter Store

Answer

AWS CloudHSM

Answer

AWS Identity and Access Management (IAM) roles

Question 18

A company has an Amazon RDS for MySQL DB instance that stores sensitive customer data. The security team requires that all data at rest be encrypted using a customer-managed AWS KMS key. The DB instance was originally launched without encryption. Which combination of steps will meet the requirement with the least downtime?

Accepted Answer

Take a snapshot of the DB instance, copy the snapshot with encryption enabled using the desired KMS key, and restore the encrypted snapshot to a new DB instance.. Option D is correct because you must create a snapshot of the unencrypted DB instance, copy the snapshot with encryption enabled using the desired KMS key, and then restore the encrypted snapshot to a new DB instance. This process results in some downtime but is the standard method for enabling encryption on an existing unencrypted RDS instance. Option A is incorrect because modifying the DB instance directly does not support enabling encryption. Option B is incorrect because enabling encryption on a snapshot copy is the correct approach, but you cannot restore an encrypted snapshot to the same instance; you must create a new instance. Option C is incorrect because RDS does not support enabling encryption via a read replica.

Answer

Create a read replica of the DB instance with encryption enabled, and then promote the read replica to become the primary instance.

Answer

Modify the DB instance and enable encryption using the AWS Management Console.

Answer

Take a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the encrypted snapshot to the same DB instance ID.

Question 19

Which THREE of the following are best practices for securing an Amazon DynamoDB table? (Select THREE.)

Accepted Answer

Enable point-in-time recovery (PITR) to protect against accidental writes or deletes.. Options A, C, and D are correct. IAM policies should be used to grant least privilege. DynamoDB supports encryption at rest with KMS. Point-in-time recovery (PITR) is a security best practice for data protection. Option B (public access) is not a security best practice; DynamoDB tables are private by default. Option E (limiting item size) is a performance consideration, not a security best practice.

Answer

Enable public access to the table to allow easy data sharing.

Answer

Limit the maximum item size to 100 KB to reduce storage costs.

Question 20

A company is using Amazon RDS for PostgreSQL. The security team wants to ensure that all connections to the database are encrypted in transit. Currently, applications connect using the PostgreSQL native encryption (SSL/TLS). What is the MOST secure way to enforce encrypted connections?

Accepted Answer

Modify the DB parameter group to set 'ssl' to 'on' and 'require_ssl' to 'on', then reboot the instance.. Option C is correct because modifying the DB parameter group to set 'ssl' to 'on' and 'require_ssl' to 'on' forces all connections to use SSL. Option A is wrong because just enabling 'force_ssl' in the parameter group is not a valid parameter. Option B is wrong because the default security group does not enforce encryption. Option D is wrong because the database port does not affect encryption.

Answer

Configure the security group to only allow traffic on port 5432 from trusted IP addresses.

Answer

Enable the 'force_ssl' parameter in the DB parameter group and restart the instance.

Answer

Use a custom database port that is not commonly used, such as 5433, to avoid unencrypted traffic.