DBS-C01 Mock Exam 75 — 25 Questions

Question 1

A company is designing a security architecture for Amazon DynamoDB. They need to ensure that only authorized applications can access the data, and that data in transit is encrypted. Which THREE steps should be taken? (Choose THREE.)

Accepted Answer

Attach an IAM policy that grants access only to specific IAM roles or users.. Options A, B, and D are correct. Using VPC endpoints keeps traffic within AWS network, IAM policies control access, and DynamoDB encrypts data in transit automatically. Option C is wrong because security groups are not used for DynamoDB (they are for VPC endpoints). Option E is wrong because KMS is for encryption at rest, not in transit.

Answer

Use a customer-managed KMS key to encrypt data in transit.

Answer

Configure a security group to restrict inbound traffic to the DynamoDB table.

Question 2

A company is using Amazon DynamoDB and wants to ensure that only authorized users can access a specific table. Which AWS service should be used to manage access control?

Accepted Answer

AWS Identity and Access Management (IAM).. Option B is correct because IAM is used to manage access to DynamoDB tables through policies. Option A is wrong because security groups control network traffic, not database access. Option C is wrong because CloudHSM is for encryption keys, not access control. Option D is wrong because KMS is for encryption, not access control.

Answer

AWS CloudHSM.

Answer

AWS Key Management Service (KMS).

Answer

Amazon VPC security groups.

Question 3

A company has an Amazon RDS for Oracle DB instance that stores sensitive data. The security team wants to audit all SQL queries that read or modify specific columns containing personally identifiable information (PII). The audit logs must be stored for 5 years. Which solution should the database specialist implement?

Accepted Answer

Use Oracle fine-grained auditing to create an audit policy on the specific columns and store logs in a custom table.. Option C is correct because Amazon RDS for Oracle supports fine-grained auditing using the AUDIT policy for specific columns. Option A is wrong because RDS does not support Oracle Audit Vault. Option B is wrong because database activity streams capture all activities but do not filter by column; also they are stored in CloudWatch Logs, not for 5 years by default. Option D is wrong because RDS Enhanced Monitoring is for OS metrics, not SQL auditing.

Answer

Enable database activity streams and send logs to Amazon CloudWatch Logs with a retention of 5 years.

Answer

Enable RDS Enhanced Monitoring and enable SQL auditing in the parameter group.

Answer

Enable Oracle Audit Vault and Database Firewall.

Question 4

A company uses Amazon DynamoDB to store user session data. The security team requires that all data be encrypted at rest using a customer-managed AWS KMS key. The DynamoDB table is already configured with AWS managed KMS encryption. How can the company meet the encryption requirement without recreating the table?

Accepted Answer

Use the UpdateTable API to specify the new KMS key in the SSESpecification parameter.. Option C is correct because DynamoDB supports updating the encryption key for an existing table using the UpdateTable API with the SSESpecification parameter. You can switch from AWS managed key to a customer managed key. Option A is incorrect because you cannot change the encryption configuration during table creation after the table exists. Option B is incorrect because exporting to S3 and re-importing is unnecessary and causes more downtime. Option D is incorrect because DynamoDB streams are used for change data capture, not for encryption changes.

Answer

Enable DynamoDB Streams and use a Lambda function to copy data to a new table with the desired encryption.

Answer

Export the table to Amazon S3 using the on-demand backup feature, then import it into a new table encrypted with the desired KMS key.

Answer

Delete the table and recreate it with the new KMS key.

Question 5

Which TWO of the following are methods to encrypt data at rest for an Amazon RDS for Oracle DB instance? (Select TWO.)

Accepted Answer

Enable encryption at rest using AWS KMS when creating the DB instance.. Options B and D are correct. RDS Oracle supports both Transparent Data Encryption (TDE) using Oracle native encryption and encryption using AWS KMS. Option A (SSL) is for data in transit. Option C (client-side encryption) is not supported natively by RDS. Option E (S3 SSE) applies to S3, not RDS.

Answer

Enable SSL/TLS for the DB instance.

Answer

Configure Amazon S3 server-side encryption on the DB instance's storage.

Answer

Use client-side encryption in the application before sending data to RDS.

Question 6

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all database connections use SSL and that the database is encrypted at rest. Which THREE steps are required to meet these requirements? (Choose THREE.)

Accepted Answer

Modify the DB parameter group to set 'require_ssl' to 'true'.. Options A, B, and D are correct. Enabling encryption at rest is done during instance creation. SSL enforcement requires modifying the parameter group and downloading the certificate. Option C is wrong because RDS manages the certificate; you don't upload your own. Option E is wrong because you don't need to install the certificate on every client; it's needed on the application side.

Answer

Upload a custom SSL certificate to the RDS instance.

Answer

Install the SSL certificate on every client machine.

Question 7

A company is using Amazon RDS for PostgreSQL with automated backups. The security team requires that backups be encrypted at rest. The DB instance is currently unencrypted. What is the most efficient way to enable encryption for future backups?

Accepted Answer

Create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance.. Option C is correct because you cannot enable encryption on an existing unencrypted RDS instance directly; you must take a snapshot, copy it with encryption, and restore to a new encrypted instance. Option A is wrong because modifying the instance does not allow enabling encryption. Option B is wrong because enabling encryption on the backup destination (S3) does not encrypt the backup data itself if the source is unencrypted. Option D is wrong because you cannot enable encryption on an existing instance.

Answer

Enable encryption by setting the 'backup_encryption' parameter in the DB parameter group.

Answer

Modify the DB instance to enable encryption.

Answer

Enable encryption on the S3 bucket where backups are stored.

Question 8

A company is using Amazon Redshift for data warehousing. The security team requires that all data be encrypted at rest using a customer-managed AWS KMS key. Additionally, the team wants to ensure that the key must be used only for this specific Redshift cluster. Which configuration should be applied?

Accepted Answer

Create a new KMS key with a key policy that grants access only to the Redshift cluster's IAM role.. Option D is correct because Redshift uses KMS keys for encryption; a cluster-specific key can be created and used. Option A is wrong because default KMS key is AWS managed, not customer-managed. Option B is wrong because cluster subnet group does not affect encryption. Option C is wrong because HSM is not used for Redshift encryption.

Answer

Create a new KMS key and associate it with the Redshift cluster's subnet group.

Answer

Use the default AWS managed KMS key for Redshift.

Answer

Use an HSM-backed key from CloudHSM.

Question 9

A database administrator needs to audit all SQL statements executed on an Amazon RDS for PostgreSQL DB instance. Which service should be used to capture and log the SQL statements?

Accepted Answer

Amazon RDS for PostgreSQL database activity streams. Option D is correct. Amazon RDS for PostgreSQL supports database activity streams, which can be integrated with services like Amazon CloudWatch and AWS CloudTrail to provide a near real-time stream of database activities. The other options do not capture SQL statements: CloudTrail records API calls to RDS, Config records resource configuration changes, and Inspector is for vulnerability assessment.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon Inspector

Question 10

An IAM policy is attached to a role used by an application to access an Amazon RDS for MySQL DB instance. The DB instance is encrypted with a customer-managed KMS key. The application is unable to create a snapshot of the encrypted DB instance. Which missing permission is the most likely cause?

Accepted Answer

kms:CreateGrant. Option D is correct. To create a snapshot of an encrypted RDS instance, the IAM role needs permission to the KMS key for the kms:CreateGrant action. The policy allows kms:Decrypt and kms:GenerateDataKey but not kms:CreateGrant, which is required for RDS to use the KMS key on behalf of the user when creating a snapshot. Options A, B, and C are not required for snapshot creation.

Answer

kms:ReEncrypt

Answer

kms:DescribeKey

Answer

kms:Encrypt

Question 11

A security auditor reviews the output of a DynamoDB table description command as shown in the exhibit. Which statement accurately describes the encryption configuration of the Users table?

Accepted Answer

The table is encrypted using a customer managed KMS key.. Option B is correct. The output shows SSEDescription with Status ENABLED, SSEType KMS, and a KMSMasterKeyArn, indicating that the table is encrypted using a customer-managed KMS key. Option A is incorrect because the key ARN is a customer managed key, not an AWS managed key. Option C is incorrect because the status is ENABLED. Option D is incorrect because the table is encrypted.

Answer

The table is encrypted using an AWS managed KMS key.

Answer

The table uses server-side encryption with an S3 managed key.

Answer

The table is not encrypted at rest.

Question 12

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database contains sensitive data that must be encrypted at rest. Which action should the company take to enable encryption on the RDS instance?

Accepted Answer

Create a new RDS DB instance with encryption enabled and migrate the data.. Amazon RDS for Oracle supports encryption at rest using AWS KMS. Encryption can only be enabled when the DB instance is created; you cannot encrypt an existing unencrypted RDS instance. You must either create a new encrypted instance and migrate the data, or use Oracle features like TDE. Option A is correct because you create a new encrypted instance. Option B is wrong because you cannot modify an existing instance to add encryption. Option C is wrong because you cannot encrypt a snapshot and restore from it if the original instance was unencrypted. Option D is wrong because Oracle TDE is an option but requires additional configuration; the simplest solution is to create a new encrypted instance.

Answer

Modify the existing RDS DB instance and enable encryption.

Answer

Enable Oracle Transparent Data Encryption (TDE) on the existing RDS instance.

Answer

Take a snapshot of the existing database, encrypt the snapshot, and restore from it.

Question 13

A company uses Amazon RDS for PostgreSQL to store customer data. The security team wants to audit all SQL queries executed against the database, including SELECT statements. Which TWO actions should be taken to achieve this?

Accepted Answer

Install the pgaudit extension in the DB instance.. To audit SQL queries in RDS PostgreSQL, you can enable the pgaudit extension (Option A) and set the appropriate parameters (Option B). Database Activity Streams (Option C) send events to CloudWatch and Kinesis, but they capture a subset of activities and require additional configuration; they are not the primary method for SQL auditing. Option D is about logging connections, not queries. Option E is for MySQL, not PostgreSQL.

Answer

Enable the 'log_connections' and 'log_disconnections' parameters.

Answer

Set the 'audit_log_enabled' parameter to 1 in the DB parameter group.

Answer

Enable Database Activity Streams on the DB instance.

Question 14

A company is designing a disaster recovery strategy for an Amazon RDS for SQL Server DB instance that contains sensitive financial data. The database must be encrypted at rest using a customer-managed AWS KMS key. The recovery point objective (RPO) is 5 minutes, and the recovery time objective (RTO) is 1 hour. Which THREE steps should be taken to meet these requirements?

Accepted Answer

Enable Multi-AZ deployment for automatic failover.. To meet the RPO of 5 minutes, enable Multi-AZ with automatic failover (Option A) and automated backups with a 5-minute backup window (Option B). For RTO of 1 hour, manual DB snapshot restore is faster than point-in-time restore; automated backups allow point-in-time recovery but may take longer. Option C is wrong because manual snapshots are not automated; you need automated backups. Option D is correct because you need to ensure the KMS key is available in the secondary Region for cross-Region DR. Option E is correct because a read replica can be promoted faster than restoring from a snapshot.

Answer

Take a manual DB snapshot every hour.

Answer

Store the KMS key in the secondary Region by creating a cross-Region KMS key replica.

Question 15

A company is setting up an Amazon Aurora MySQL-compatible database. The security policy requires that all traffic between the application and database be encrypted in transit. Which TWO steps should be taken?

Accepted Answer

Set the 'require_secure_transport' parameter to 'ON' in the DB cluster parameter group.. To encrypt in transit, you need to enforce SSL on the server side (Option A) and have the application use the SSL endpoint (Option B). Option C is not necessary because Aurora uses a cluster endpoint. Option D is about network-level encryption, which is not required if SSL is used. Option E is about data at rest, not in transit.

Answer

Use a Network Load Balancer with a TLS listener in front of the Aurora cluster.

Answer

Place the Aurora cluster in a private subnet with a VPN connection.

Answer

Enable encryption at rest using AWS KMS.

Question 16

Refer to the exhibit. A company has attached this IAM policy to an IAM role used by an application running on Amazon EC2. The application needs to decrypt data in an S3 bucket that is encrypted with the specified KMS key. However, the application is receiving access denied errors. What is the most likely cause?

Accepted Answer

The application is decrypting the data by calling KMS directly instead of using S3's server-side decryption.. The policy condition 'kms:ViaService' restricts KMS operations to only when they are made through S3. However, the condition also includes 'kms:CallerAccount' which is redundant but not harmful. The error likely occurs because the EC2 instance does not have the correct IAM role, or the policy is missing 'kms:Decrypt' for the specific ciphertext. But the most common mistake is that the application is not using the S3 service to decrypt; if the application reads the encrypted object and then calls KMS directly to decrypt, the 'kms:ViaService' condition will fail because the call is not via S3. Option B addresses this. Option A is wrong because the condition is present. Option C is wrong because the role is not explicitly denied. Option D is wrong because the policy allows KMS actions.

Answer

The policy does not include 'kms:Decrypt' for the specific key.

Answer

The policy is missing a 'Principal' element.

Answer

The IAM role does not have a trust policy that allows EC2 to assume it.

Question 17

A company has an Amazon Redshift cluster that contains sensitive data. The security team wants to ensure that all data is encrypted at rest and that the encryption keys are managed by AWS. Which configuration should be used?

Accepted Answer

Enable encryption at rest using the default AWS-managed KMS key for Redshift.. Amazon Redshift supports encryption at rest using AWS KMS. When you enable encryption, you can choose to use the default AWS-managed key (aws/redshift) or a customer-managed key. The default key is managed by AWS, meeting the requirement that keys are managed by AWS. Option A is client-side, not server-side. Option C is wrong because HSM does not automatically rotate. Option D is wrong because Redshift does not use S3-managed keys for its own storage.

Answer

Use AWS CloudHSM to generate and store encryption keys.

Answer

Use server-side encryption with S3-managed keys (SSE-S3) for the Redshift cluster.

Answer

Use client-side encryption with the AWS Encryption SDK.

Question 18

Refer to the exhibit. A database administrator is reviewing the output of 'SHOW FULL PROCESSLIST' on an Amazon RDS for MySQL DB instance. The company's security policy requires that all database users access only the minimum necessary data. Which user's activity should be investigated further?

Accepted Answer

The admin user, because the query is selecting all columns from the credit_cards table.. The admin user is executing a full scan of the credit_cards table, which is a security concern because it could be accessing unnecessary data. The app_user is querying a specific column with a condition, which is more appropriate. The admin user should have a more restrictive query. Option B is correct. Option A is wrong because the admin user's query is broad. Option C is wrong because the app_user's query is specific. Option D is wrong because both queries are selecting data, but the admin's is more concerning.

Answer

Both users, because they are both accessing the credit_cards table.

Answer

The app_user, because the query is selecting card_number which is sensitive.

Answer

Neither user, because the queries are normal for their roles.

Question 19

Refer to the exhibit. A database administrator has this IAM policy attached to their user. They are trying to authorize ingress to a DB security group named 'my-security-group' in the us-east-1 region. The operation fails. What is the most likely reason?

Accepted Answer

The user is missing the 'rds:DescribeDBSecurityGroups' permission, which is required to perform the authorize operation.. The policy allows 'AuthorizeDBSecurityGroupIngress' on the specific security group ARN. However, the ARN format is incorrect. The correct ARN for a DB security group is 'arn:aws:rds:us-east-1:123456789012:secgrp:my-security-group'? Actually, the resource type is 'secgrp'? No, the correct resource type is 'security-group'? In AWS RDS, the resource type for DB security groups is 'secgrp'? Wait, let's check: For RDS DB security groups, the resource type in IAM is 'secgrp'? Actually, the ARN format is 'arn:aws:rds:region:account:secgrp:security-group-name'. So the ARN in the policy is correct? The issue might be that the security group does not exist or is in a different region. However, the most common mistake is that the user also needs permission to 'rds:DescribeDBSecurityGroups' to view the security group. Option A is a valid explanation. Option B is wrong because the policy does allow the action on that resource. Option C is wrong because the policy allows the action. Option D is wrong because the user can create security groups.

Answer

The user is not allowed to create DB security groups, which is a prerequisite.

Answer

The policy does not grant 'rds:AuthorizeDBSecurityGroupIngress' on the specific security group.

Answer

The security group ARN in the policy is incorrect; it should include the security group ID instead of the name.

Question 20

A company is using Amazon RDS for MySQL and wants to restrict access to the database based on the source IP address. Which AWS feature should be used to achieve this?

Accepted Answer

VPC Security Groups. Security groups act as a virtual firewall for RDS instances. You can specify inbound rules that allow traffic only from certain IP addresses or other security groups. Network ACLs are for subnets, not individual instances. IAM policies control API access, not network traffic. DB parameter groups configure database engine parameters.

Answer

DB Parameter Groups

Answer

IAM Database Authentication

Answer

Network ACLs