DBS-C01 Mock Exam 76 — 25 Questions

Question 1

A company is deploying a new Amazon RDS for MySQL database in a VPC. The database must be accessible only from an application server running in the same VPC. The security team also wants to ensure that the database is not accessible from the internet. Which TWO configurations are required? (Choose TWO.)

Accepted Answer

Configure the security group to allow inbound traffic only from the application server's security group.. Options B and D are correct. Option B: Making the DB instance not publicly accessible ensures it cannot be reached from the internet. Option D: Configuring the security group to allow inbound traffic only from the application server's security group limits access. Option A is wrong because a public subnet does not prevent internet access; it enables it. Option C is wrong because a network ACL is stateless and less specific than security groups. Option E is wrong because the parameter group does not control network access.

Answer

Place the DB instance in a public subnet.

Answer

Modify the DB parameter group to restrict network access.

Answer

Configure a network ACL to deny inbound traffic from 0.0.0.0/0.

Question 2

A company is using Amazon RDS for PostgreSQL and wants to implement encryption in transit for all client connections. The security team has identified that some connections are not using SSL. Which TWO actions should the company take to enforce SSL for all connections?

Accepted Answer

Set the 'rds.force_ssl' parameter to '1' in the DB parameter group.. Options A and C are correct. Setting 'rds.force_ssl=1' in the parameter group forces the server to accept only SSL connections. Revoking non-SSL privileges (or modifying pg_hba.conf) ensures no non-SSL users can connect. Option B is unnecessary if the server enforces SSL. Option D is for client-side, not server-side. Option E is for client-side.

Answer

Install the RDS CA certificate on all client machines.

Answer

Create a new SSL certificate and associate it with the RDS instance.

Answer

Configure the application connection string to use 'sslmode=require'.

Question 3

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all data be encrypted at rest using a key stored in AWS CloudHSM. What must be done to meet this requirement?

Accepted Answer

Use Oracle Transparent Data Encryption (TDE) with CloudHSM as the key store.. Option C is correct because RDS for Oracle supports TDE (Transparent Data Encryption) which can use CloudHSM as the key store. Option A is wrong because RDS at rest encryption uses KMS, not CloudHSM directly. Option B is wrong because RDS does not support custom encryption directly via CloudHSM. Option D is wrong because SSL is for in-transit, not at rest.

Answer

Enable RDS encryption at rest using a KMS key backed by CloudHSM.

Answer

Create an encrypted file system on the RDS instance using CloudHSM.

Answer

Configure SSL/TLS for the database connection.

Question 4

A company uses an Amazon RDS for PostgreSQL database with Multi-AZ deployment. The security team wants to audit all SQL queries executed against the database for compliance purposes. Which solution should be implemented to capture and store the queries?

Accepted Answer

Enable PostgreSQL query logging and publish logs to Amazon CloudWatch Logs.. Option C is correct because RDS for PostgreSQL supports log export to CloudWatch Logs, and enabling query logging captures SQL queries. Option A is wrong because RDS events do not contain SQL query details. Option B is wrong because RDS Performance Insights focuses on performance, not query auditing. Option D is wrong because CloudTrail captures API calls, not SQL queries.

Answer

Use AWS CloudTrail to capture SQL queries.

Answer

Enable Performance Insights and store the data in CloudWatch Logs.

Answer

Enable RDS event notifications for database queries.

Question 5

A company is using an Amazon RDS for PostgreSQL database to store sensitive customer data. The security team requires that all data be encrypted at rest and in transit, and that access to the database is restricted to only specific applications. Currently, the database is encrypted at rest using AWS KMS, and connections are made over SSL. However, the security team wants to ensure that even if the database credentials are compromised, an attacker cannot access the database from unauthorized IP addresses. What should be done to meet this requirement?

Accepted Answer

Modify the security group associated with the RDS instance to allow inbound traffic only from the application's IP addresses.. Option D is correct because a security group can restrict inbound traffic to the RDS instance based on source IP addresses. Option A does not restrict network access. Option B is about permissions, not network. Option C creates a separate cluster but does not restrict access to the existing one.

Answer

Attach a resource-based policy to the RDS instance to allow only specific IAM roles.

Answer

Create a new RDS instance in a VPC with a network ACL that allows inbound traffic only from specific IP ranges, and migrate the data.

Answer

Enable IAM database authentication for the RDS instance.

Question 6

A company is using Amazon Redshift for analytics. The security team wants to audit all SQL queries executed against the database, including the actual query text, for compliance. They also want to ensure that the audit logs are stored in a secure, immutable location. Which THREE services or features should they use together to meet these requirements?

Accepted Answer

Redshift Audit Logging. Options A, C, and E are correct. Redshift Audit Logging captures SQL queries. CloudWatch Logs can be used as a destination for audit logs (via streaming). Then, CloudWatch Logs can export logs to S3, and S3 Object Lock provides immutability. Option B is for performance, not auditing. Option D is for network monitoring.

Answer

VPC Flow Logs

Answer

Redshift Spectrum

Question 7

A security engineer is designing access controls for an Amazon DynamoDB table containing customer data. Which TWO actions enforce least privilege access?

Accepted Answer

Use IAM conditions to restrict access to specific attributes.. Options B and D are correct. Using IAM conditions to restrict access to specific attributes (B) and using fine-grained access control with IAM (D) enforce least privilege. Option A is wrong because wildcard actions grant full access. Option C is wrong because DynamoDB does not have VPC endpoints that limit table access. Option E is wrong because resource-based policies are not supported for DynamoDB tables.

Answer

Grant dynamodb:* action to all users.

Answer

Use a resource-based policy on the DynamoDB table.

Answer

Attach a VPC endpoint policy that allows all actions.

Question 8

A security engineer reviews the IAM policy attached to a user. The user is unable to modify any RDS DB instance, even when MFA is enabled. What is the most likely cause?

Accepted Answer

The user does not have MFA enabled, or the instance name does not match the allowed prefixes.. Option A is correct because the policy does not grant the rds:ModifyDBInstance action for all instances; it only allows for prod-* without condition and dev-* with MFA, but the user might be trying to modify an instance that doesn't match either pattern, or the user does not have MFA enabled. However, the question states the user cannot modify ANY instance, so the most likely cause is that the user does not have MFA enabled or the instance is not in the allowed patterns. Option B is wrong because the policy is for RDS, not EC2. Option C is wrong because the policy allows ModifyDBInstance, not just read. Option D is wrong because the policy does have conditions.

Answer

The policy is missing the ec2:ModifyInstance permission.

Answer

The policy does not include a Deny statement for RDS actions.

Answer

The user is trying to use the RDS console, but the policy only allows API calls.

Question 9

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all connections to the database use SSL/TLS encryption. Which step is necessary to enforce SSL connections?

Accepted Answer

Set the 'rds.force_ssl' parameter to 1 in the DB parameter group.. Option A is correct because RDS for Oracle supports SSL/TLS, and you can set a parameter in the DB parameter group to require SSL. Option B is wrong because security groups control network access, not encryption. Option C is wrong because the option group defines features like timezone, not SSL enforcement. Option D is wrong because the subnet group defines networking, not encryption.

Answer

Configure the security group to only allow traffic on port 443.

Answer

Modify the DB subnet group to use a private subnet.

Answer

Add the SSL option to the option group.

Question 10

A company is using Amazon DynamoDB to store financial transactions. The security team requires that all access to the table be logged for auditing, and that any unauthorized access attempts trigger an immediate alert. The company has enabled AWS CloudTrail to log all DynamoDB API calls. However, the security team is concerned that CloudTrail logs may not capture all access patterns, such as queries that return no results. Which additional step should the company take to ensure comprehensive auditing and alerting?

Accepted Answer

Create a CloudWatch Logs metric filter on the CloudTrail log group to detect unauthorized access attempts and set up a CloudWatch alarm.. Option B is correct because CloudWatch Logs can be used to monitor CloudTrail logs and trigger alerts on specific patterns like unauthorized access. Option A only monitors performance, not access. Option C does not monitor access. Option D may miss some operations.

Answer

Configure Amazon Inspector to assess the DynamoDB table for vulnerabilities.

Answer

Enable DynamoDB Accelerator (DAX) and configure it to log all read requests.

Answer

Enable VPC Flow Logs on the subnet where DynamoDB endpoints are deployed.

Question 11

A company is using Amazon RDS for MySQL and wants to implement database activity monitoring to detect suspicious queries. Which TWO AWS services can be used together to achieve this?

Accepted Answer

AWS Lambda. Options A and D are correct. RDS can publish logs to CloudWatch Logs, and CloudWatch Logs can trigger a Lambda function to analyze logs in real-time. Option B is for vulnerability scanning. Option C is for patching. Option E is for auditing API calls, not database queries.

Answer

AWS CloudTrail

Answer

AWS Systems Manager Patch Manager

Answer

Amazon Inspector

Question 12

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The security team wants to audit all database logins and queries. Which TWO actions should be taken to enable auditing?

Accepted Answer

Publish MySQL logs to Amazon CloudWatch Logs.. Options C and D are correct. Enabling the general_log (C) captures all queries, and exporting logs to CloudWatch Logs (D) allows analysis. Option A is wrong because enhanced monitoring is for performance, not queries. Option B is wrong because event notifications are for instance events, not queries. Option E is wrong because RDS does not support AWS CloudTrail for database queries.

Answer

Enable AWS CloudTrail data events for RDS.

Answer

Create an RDS event notification subscription.

Answer

Enable Enhanced Monitoring.

Question 13

A company stores sensitive data in an Amazon RDS for PostgreSQL DB instance. The security team requires that all data at rest be encrypted. The instance is currently unencrypted. What is the simplest way to enable encryption with minimal downtime?

Accepted Answer

Create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the snapshot to a new encrypted DB instance.. Option C is correct because creating a snapshot, copying it with encryption, and restoring a new encrypted instance is the standard approach. Option A is wrong because enabling encryption on an existing instance is not supported. Option B is wrong because moving to RDS Custom is unnecessary. Option D is wrong because you cannot modify an existing instance to enable encryption directly.

Answer

Use the AWS CLI to modify the DB instance and enable encryption.

Answer

Migrate the data to an Amazon RDS for PostgreSQL DB instance using RDS Custom.

Answer

Modify the DB instance and enable encryption in the console.

Question 14

A security engineer is investigating an Amazon RDS for MySQL database that was compromised. The engineer finds that the compromise was due to a SQL injection vulnerability in a web application. The web application uses a database user with full administrative privileges. What is the BEST practice to prevent such incidents in the future?

Accepted Answer

Create dedicated database users with minimal privileges required for each application function.. Option D is correct because using separate database users with least privilege for each application limits the impact of a compromise. Option A is wrong because database audit logs help detect but not prevent. Option B is wrong because it reduces attack surface but does not address the root cause of excessive privileges. Option C is wrong because parameter groups do not enforce least privilege.

Answer

Configure the DB parameter group to use the 'sql_mode' option to reject dangerous queries.

Answer

Enable RDS audit logs to capture all SQL queries.

Answer

Place the RDS instance in a private subnet with a security group that restricts inbound traffic.

Question 15

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database contains personally identifiable information (PII). The security team requires that the data be encrypted at rest using a customer-managed key stored in AWS KMS. Additionally, the team wants to ensure that the key can be rotated automatically every year. What should the company do to meet these requirements?

Accepted Answer

Create a customer-managed key in AWS KMS, enable automatic rotation, and enable encryption on the RDS instance using that key.. Option A is correct because RDS supports encryption at rest using a KMS key, and customer-managed keys can be rotated automatically. Option B is not possible. Option C does not cover encryption at rest. Option D does not provide automatic rotation.

Answer

Enable encryption on the RDS instance using the default RDS encryption and use AWS Secrets Manager to store the key.

Answer

Create a customer-managed key in AWS KMS without automatic rotation, and manually rotate the key using the RDS console.

Answer

Use an AWS managed key for RDS and create an AWS Lambda function to rotate the key manually each year.

Question 16

A company has an Amazon DynamoDB table that stores user sessions. The security team wants to ensure that only authorized applications can read and write to the table, and that all access is logged. Which THREE steps should the company take to meet these requirements?

Accepted Answer

Enable AWS CloudTrail to log DynamoDB API calls.. Options B, C, and D are correct. IAM roles with least privilege restrict access. AWS CloudTrail logs API calls. VPC endpoints ensure traffic stays within AWS network and can be controlled via endpoint policies. Option A is for auditing, but CloudTrail is more comprehensive. Option E is for encryption, not access control.

Answer

Encrypt the table using a customer-managed KMS key.

Answer

Enable DynamoDB Streams and process events with Lambda.

Question 17

A company is using Amazon Redshift and needs to encrypt data at rest with a customer-managed key. Which THREE steps are required to enable encryption with a customer-managed AWS KMS key?

Accepted Answer

Create a customer-managed key in AWS KMS.. Options A, B, and D are correct. You must create a KMS key (A), specify it during cluster creation (B), and modify the cluster to use encryption if not already encrypted (D). Option C is wrong because Redshift does not use CloudHSM for KMS-based encryption. Option E is wrong because only the cluster owner can manage encryption; AWS does not manage it.

Answer

Configure the Redshift cluster to use an HSM.

Answer

Request AWS Support to enable encryption.

Question 18

A company uses an Amazon RDS for MySQL DB instance that needs to be accessed by a Lambda function. Which TWO steps should be taken to ensure secure access?

Accepted Answer

Create an IAM role for the Lambda function with permissions to use RDS IAM database authentication.. Options B and D are correct. Placing the Lambda function in the same VPC and using an IAM role with least privilege are security best practices. Option A is wrong because storing credentials in Lambda environment variables is not secure. Option C is wrong because using the database master user for Lambda is insecure. Option E is wrong because a NAT gateway is not needed for RDS access within the same VPC.

Answer

Store the database credentials in the Lambda environment variables.

Answer

Use the database master user account for the Lambda function.

Answer

Attach a NAT gateway to the Lambda function's VPC for outbound internet access.

Question 19

A company is using an Amazon RDS for MySQL database and needs to audit all database login events. The audit logs must be stored in Amazon S3 for long-term retention. Which steps should be taken to accomplish this?

Accepted Answer

Enable the 'audit_log' plugin, publish logs to CloudWatch Logs, and create an export task to S3.. Option C is correct because RDS for MySQL supports audit logs via the 'audit_log' plugin, which can be published to CloudWatch Logs, and then exported to S3. Option A is wrong because RDS does not natively publish logs directly to S3. Option B is wrong because CloudTrail does not capture database login events. Option D is wrong because the general log is not the same as audit log and may not capture all login events as required.

Answer

Enable the 'general_log' parameter and set 'log_output' to 'FILE', then copy the log file to S3 manually.

Answer

Enable CloudTrail data events for RDS to capture login events and store in S3.

Answer

Enable the 'audit_log' plugin and configure RDS to publish logs to an S3 bucket.

Question 20

A company is using Amazon RDS for MySQL to power a web application. The database contains sensitive data, and the security team requires that all connections to the database use SSL/TLS. The team has enabled 'require_secure_transport' parameter in the DB parameter group. However, a developer reports that they are able to connect to the database using a MySQL client without specifying SSL options. What could be the reason?

Accepted Answer

The 'require_secure_transport' parameter is not set to '1' in the DB parameter group.. Option B is correct because RDS offers a '--ssl-mode' option in the MySQL client; if not specified, the client may use SSL by default if the server requires it. But the developer might be using an older client that defaults to non-SSL. The 'require_secure_transport' parameter in RDS forces SSL only for new connections; however, if the client does not request SSL, the server may still accept non-SSL if the parameter is not set correctly. Actually, the correct answer is that the parameter might not be set to '1'. Option B is the most plausible.

Answer

The RDS instance is configured to accept both SSL and non-SSL connections by default.

Answer

The MySQL client automatically upgrades to SSL when the server requires it.

Answer

The developer is connecting from an EC2 instance in the same VPC, which bypasses SSL enforcement.