DBS-C01 Mock Exam 77 — 25 Questions

Question 1

A company uses Amazon DynamoDB to store sensitive user data. The security team wants to ensure that all data is encrypted at rest using a customer-managed AWS KMS key. The DynamoDB table was created with the default AWS managed key. What is the required action to change the encryption key?

Accepted Answer

Create a new DynamoDB table with the desired KMS key, export data from the old table, and import into the new table.. Option D is correct because DynamoDB encryption at rest uses KMS and the encryption key can only be changed when creating a new table. You cannot modify the encryption key on an existing table. Option A is wrong because there is no UpdateTable API for encryption key. Option B is wrong because the default key cannot be deleted if in use. Option C is wrong because KMS key rotation does not change the key material used by DynamoDB.

Answer

Use the UpdateTable API to specify the new KMS key.

Answer

Enable automatic key rotation on the existing KMS key.

Answer

Delete the default AWS managed key and create a new customer managed key.

Question 2

A developer needs to allow an application running on an EC2 instance to connect to an Amazon RDS for MySQL DB instance securely. Which combination of steps should the developer take?

Accepted Answer

Attach an IAM role to the EC2 instance with permissions to use RDS IAM authentication, and configure the database to use an authentication token.. Option B is correct because using IAM roles for EC2 and IAM database authentication for RDS is the most secure approach. Option A is wrong because hardcoding credentials in the application is insecure. Option C is wrong because opening the database to the world is insecure. Option D is wrong because storing credentials in S3 without encryption is insecure.

Answer

Store the database password in the application code.

Answer

Open the RDS security group to allow traffic from 0.0.0.0/0.

Answer

Store the credentials in an S3 bucket and download them at runtime.

Question 3

A security administrator is setting up a new Amazon RDS for SQL Server database. The company requires that all data be encrypted at rest and in transit. Additionally, the database must be accessible only from a specific CIDR range. Which TWO actions should the administrator take? (Choose TWO.)

Accepted Answer

Enable encryption at rest using AWS KMS.. Options A and D are correct. Option A: Enabling encryption at rest is a requirement. Option D: Configuring the security group to allow inbound traffic from the specific CIDR range meets the network access restriction. Option B is wrong because encryption in transit is typically handled by the database engine (SSL/TLS), not by an RDS option. Option C is wrong because the DB parameter group does not control network access. Option E is wrong because encryption at rest uses KMS, not CloudHSM by default.

Answer

Enable encryption in transit by modifying the RDS option group to include SSL.

Answer

Modify the DB parameter group to restrict network access.

Answer

Use AWS CloudHSM to manage encryption keys for the database.

Question 4

A company is using Amazon RDS for SQL Server with Multi-AZ deployment. The security team wants to ensure that database audit logs are stored in a secure S3 bucket for long-term retention. The audit logs are currently stored on the RDS instance. Which approach should be used to export the audit logs to S3?

Accepted Answer

Modify the RDS instance to use the 'SQLSERVER_AUDIT' option and specify an S3 bucket as the audit destination.. Option D is correct because RDS for SQL Server supports exporting audit logs to S3 via the 'rds_sqlserver_audit' option group or by using the 'mysql' option? Actually, for SQL Server, you can use the 'SQLSERVER_AUDIT' option and specify an S3 bucket. Option A is for general log files. Option B is for Oracle. Option C is for MySQL.

Answer

Use the Amazon RDS for Oracle 'Audit' feature and specify an S3 bucket as the audit trail destination.

Answer

Enable the 'General Log' option in the RDS parameter group and configure the log destination as S3.

Answer

Configure the RDS instance to publish logs to CloudWatch Logs, and then export CloudWatch Logs to S3 using a subscription filter.

Question 5

A developer is configuring an Amazon RDS for PostgreSQL DB instance. The application connects using IAM database authentication. Which setting must be enabled on the DB instance for IAM authentication to work?

Accepted Answer

Set the 'rds.force_ssl' parameter to 1.. Option B is correct because IAM database authentication requires the 'rds.force_ssl' parameter to be set to 1 to enforce TLS connections. Option A is wrong because IAM authentication does not require the database port to be changed. Option C is wrong because the master username is still used for IAM authentication. Option D is wrong because the DB instance can be in a VPC; IAM authentication works within a VPC.

Answer

Set the database port to 5432.

Answer

Ensure the DB instance is publicly accessible.

Answer

Change the master username to 'iam_user'.

Question 6

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all network traffic between the application servers and the database be encrypted using TLS. The application servers are in a different VPC connected via VPC Peering. What is the simplest way to enforce encryption in transit?

Accepted Answer

Enable the rds.force_ssl parameter in the DB parameter group and configure the application to use SSL connections.. Option A is correct because enabling the rds.force_ssl parameter ensures that Oracle connections require SSL, and using SSL certificates on the client side establishes encrypted connections. Option B is wrong because a VPN adds complexity and is not necessary. Option C is wrong because the default parameter group may not have SSL enabled. Option D is wrong because the security group does not enforce encryption.

Answer

Modify the security group for the RDS instance to only allow traffic on port 443.

Answer

Use a default DB parameter group, as it already enforces SSL.

Answer

Set up a VPN connection between the two VPCs and route all traffic through it.

Question 7

A company uses Amazon DynamoDB to store session data for a web application. The security team discovers that an IAM user has been performing unauthorized scans on the table. They need to implement controls to detect and prevent such unauthorized access in the future. Which THREE actions should the security team take? (Choose THREE.)

Accepted Answer

Enable AWS CloudTrail logging and create a metric filter for Scan API calls.. Options A, B, and E are correct. Option A: Using CloudTrail logs to detect unauthorized scans helps with detective controls. Option B: Implementing a resource-based policy with a condition key 'dynamodb:Scan' to deny access is a preventive control. Option E: Using fine-grained access control with IAM conditions like 'dynamodb:Attributes' can restrict scans to specific attributes. Option C is wrong because VPC Flow Logs capture network traffic, not DynamoDB operations. Option D is wrong because disabling scan operations is not practical; many use cases require scans.

Answer

Disable the Scan operation on the DynamoDB table.

Answer

Enable VPC Flow Logs to monitor traffic to DynamoDB.

Question 8

A company is using Amazon DynamoDB with a global table. The security team requires that all data be encrypted at rest using a customer-managed KMS key. The table was originally created with AWS managed key encryption. The company wants to switch to a customer-managed key without downtime. What should they do?

Accepted Answer

Create a new table with the customer-managed key, export the data from the old table using AWS Data Pipeline, and import into the new table.. Option C is correct because you cannot modify the encryption key of an existing DynamoDB table. You must create a new table with the desired key and migrate data. Option A is not possible. Option B does not work for global tables? Actually, for global tables, you can update the encryption key? No, it's not supported. Option D is the correct process.

Answer

Use the UpdateTable API to change the KMS key to the customer-managed key.

Answer

Enable DynamoDB Streams on the old table and use a Lambda function to copy data to a new table with the customer-managed key.

Answer

Create a new replica in the global table with the customer-managed key and then delete the old replica.

Question 9

A company is using Amazon Redshift for data warehousing. The security team requires column-level access control so that certain users cannot view specific columns containing PII. Which approach should the data engineer implement?

Accepted Answer

Create views that exclude the sensitive columns and grant SELECT on the views to the users.. Option D is correct because Redshift supports column-level security via views that restrict columns, and you grant access to the view instead of the table. Option A is wrong because Redshift does not support column-level GRANT. Option B is wrong because row-level security does not restrict columns. Option C is wrong because column-level encryption is not natively supported in Redshift and would require application changes.

Answer

Implement row-level security policies using CREATE ROW LEVEL SECURITY POLICY.

Answer

Use GRANT SELECT ON table (col1, col2) TO user.

Answer

Encrypt the sensitive columns using AWS KMS and decrypt in the application.

Question 10

A company uses Amazon Redshift for data warehousing. The security team has implemented column-level security using Redshift's column-level access controls. However, during a security audit, it is discovered that a user with SELECT privilege on a table can still see the content of a column that should be restricted. The column is defined with a GRANT statement that only allows SELECT on certain columns to specific users. What is the most likely cause of this issue?

Accepted Answer

The user was previously granted SELECT on the entire table, and the column-level GRANT did not revoke that broader permission.. Option C is correct because column-level GRANTs in Redshift do not revoke existing permissions; they only add. If the user already had SELECT on the table, they still have access to all columns. Option A is not relevant. Option B is about views, not the issue. Option D is unrelated.

Answer

The column is part of a distribution key that bypasses security controls.

Answer

The user is accessing the table via a stored procedure that bypasses column-level security.

Answer

The column-level security is not supported in Redshift; it must be implemented using views.

Question 11

A database administrator is troubleshooting why Amazon RDS Enhanced Monitoring is not displaying metrics for a DB instance. The IAM role attached to the instance has the policy shown in the exhibit. What is the likely cause?

Accepted Answer

The policy is missing the 'rds:CreateDBInstance' action.. Option D is correct because Enhanced Monitoring requires the 'rds:CreateDBInstance' permission for the monitoring role, which is missing. Option A is wrong because the actions listed are valid. Option B is wrong because the resource is '*' which includes all. Option C is wrong because the actions are allowed, not denied.

Answer

The policy denies the 'rds:DescribeDBInstances' action.

Answer

The policy does not include 'monitoring:ListMetrics'.

Answer

The resource is set to '*' instead of the specific DB instance ARN.

Question 12

A company is designing a secure strategy for managing Amazon RDS for Oracle encryption keys. They want to use AWS KMS with Customer Master Keys (CMKs) for encryption at rest. Which THREE best practices should they follow?

Accepted Answer

Grant the RDS service principal (rds.amazonaws.com) only the necessary KMS permissions to use the CMK.. Options A, C, and D are correct. Using separate KMS keys for different environments provides isolation, enabling automatic key rotation is a security best practice, and granting least privilege access to KMS keys is fundamental. Option B is wrong because storing the CMK in the database is insecure. Option E is wrong because disabling key rotation is not recommended.

Answer

Disable key rotation to maintain consistent encryption across all snapshots.

Answer

Store the KMS CMK inside the Oracle database for faster encryption.

Question 13

A company has an Amazon S3 bucket that stores database backup files. The backups are encrypted using server-side encryption with AWS KMS (SSE-KMS). The security team wants to ensure that only a specific IAM role can decrypt the backups when restoring the database. Which policy should be attached to the KMS key to achieve this?

Accepted Answer

A KMS key policy that grants kms:Decrypt to the IAM role.. Option D is correct because a KMS key policy can grant the kms:Decrypt permission to a specific IAM role. Option A does not restrict decryption. Option B is for S3 bucket policy, not KMS. Option C is for S3, not KMS.

Answer

An S3 bucket policy that grants kms:Decrypt to the IAM role.

Answer

An S3 bucket policy that grants s3:GetObject to the IAM role.

Answer

An IAM policy attached to the role that grants kms:Decrypt.

Question 14

A security auditor notices that the DynamoDB table 'UserData' is encrypted with a KMS key (exhibit). The company policy requires that all DynamoDB tables use an AWS managed key for encryption. What must be done to comply with the policy?

Accepted Answer

Create a new DynamoDB table with SSE enabled using the AWS managed key, then export data from the existing table and import into the new table.. Option A is correct because you cannot change the encryption key of an existing table; you must create a new table with the AWS managed key and migrate data. Option B is wrong because you cannot change the key on an existing table. Option C is wrong because deleting the key would break access. Option D is wrong because the table is already encrypted, just not with the required key.

Answer

Delete the customer managed KMS key and recreate it as an AWS managed key.

Answer

Modify the table's SSE configuration to use the AWS managed key.

Answer

Use the UpdateTable API to change the KMS key to the AWS managed key.

Question 15

A security engineer runs the AWS CLI command shown in the exhibit. The engineer wants to ensure that all RDS DB instances in the account are encrypted at rest. What should the engineer do to remediate the unencrypted read replica?

Accepted Answer

Delete the unencrypted read replica and create a new read replica from the encrypted source, enabling encryption on the new replica.. Option D is correct because the read replica is unencrypted, and to encrypt it, you must create a new encrypted read replica from the encrypted source. Option A is wrong because modifying the replica directly does not support enabling encryption. Option B is wrong because you cannot encrypt an existing read replica in place. Option C is wrong because the source is encrypted, so the new replica can be encrypted.

Answer

Modify the read replica by setting the StorageEncrypted parameter to true.

Answer

Enable encryption on the source DB instance and the read replica will automatically become encrypted.

Answer

Create a snapshot of the read replica, encrypt the snapshot, and restore it as a new instance.

Question 16

A company wants to audit all SQL statements executed on their RDS for PostgreSQL database. Which AWS service should they use?

Accepted Answer

CloudWatch Logs with PostgreSQL audit logs. Option B is correct. Amazon RDS for PostgreSQL integrates with AWS CloudTrail for API calls, but for SQL-level auditing, you must use the database's native audit logging (e.g., pgaudit extension) and log files to CloudWatch Logs. Option A is for VPC flow logs. Option C is for database activity streams, but that's for Aurora, not RDS PostgreSQL. Option D is for monitoring performance.

Answer

AWS Database Migration Service (DMS)

Answer

VPC Flow Logs

Answer

Amazon RDS Performance Insights

Question 17

A company has a compliance requirement to encrypt all RDS snapshots at rest using a customer-managed KMS key. The RDS instance is already encrypted with an AWS-managed key. What is the correct procedure to ensure snapshots use the customer-managed key?

Accepted Answer

Take a snapshot of the RDS instance, copy the snapshot specifying the customer-managed KMS key, and restore from the copied snapshot.. Option C is correct. You cannot change the encryption key of an existing RDS instance; you must create a snapshot, copy it with a new key, and restore. Option A is not possible. Option B is not possible. Option D is not possible without copying.

Answer

Create a new RDS instance with the customer-managed KMS key and migrate data using DMS.

Answer

Change the default KMS key for the AWS account to the customer-managed key.

Answer

Modify the RDS instance to use the customer-managed KMS key directly.

Question 18

A database administrator has the IAM policy shown in the exhibit. Which action will be allowed by this policy?

Accepted Answer

Create a snapshot of the prod-db instance.. Option B is correct. The policy explicitly allows CreateDBSnapshot on the resource. Option A is denied. Option C is not in the policy. Option D is not in the policy.

Answer

Modify the prod-db instance.

Answer

Delete the prod-db instance.

Answer

Describe all DB instances in the account.

Question 19

A developer retrieved a database secret using the AWS CLI as shown. What is the MOST secure way to store and rotate this secret?

Accepted Answer

Store the secret in AWS Secrets Manager and enable automatic rotation with a Lambda function.. Option A is correct. Secrets Manager can automatically rotate secrets, and the secret should be retrieved using IAM permissions. Option B is insecure. Option C is not best practice. Option D is not needed.

Answer

Store the secret in AWS Systems Manager Parameter Store as a SecureString.

Answer

Store the secret in a configuration file on the EC2 instance.

Answer

Use the secret as-is and change it manually every 90 days.

Question 20

A company needs to rotate the master user password for an Amazon RDS for MySQL DB instance. What is the recommended way to do this without downtime?

Accepted Answer

Use the AWS Management Console, CLI, or API to modify the DB instance with a new master password.. Option D is correct because modifying the DB instance and setting a new password in the console triggers a password update without reboot. Option A is wrong because it causes a reboot. Option B is wrong because you can update the password without deleting the instance. Option C is wrong because updating the DB parameter group does not change the master password.

Answer

Modify the DB instance and set a new password, which will cause a reboot for the change to take effect.

Answer

Update the DB parameter group with the new password.

Answer

Delete the DB instance and launch a new one with the new password.