DBS-C01 Mock Exam 78 — 25 Questions

Question 1

Refer to the exhibit. An IAM policy is attached to a user. What is the effect when the user attempts to delete the RDS DB instance named 'prod-db'?

Accepted Answer

The user cannot delete the instance because of the explicit Deny statement.. The policy explicitly denies the rds:DeleteDBInstance action on the specific resource. Even though there is an Allow on other actions, an explicit Deny overrides any Allow. The user cannot delete the instance. Option A is wrong because the Deny takes precedence. Option B is wrong because the policy explicitly prevents deletion. Option D is wrong because the Deny is on the specific instance.

Answer

The user can delete any other instance except 'prod-db'.

Answer

The user can delete the instance because the Deny statement only applies to snapshots.

Answer

The user can delete the instance because of the Allow on DescribeDBInstances.

Question 2

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security policy requires that all connections to the database use SSL/TLS. What should the database administrator do to meet this requirement?

Accepted Answer

Download the RDS certificate bundle and set the 'rds.force_ssl' parameter to 1 in the DB parameter group.. Option C is correct. To enforce SSL/TLS connections to RDS for Oracle, you must download the RDS certificate bundle and configure the DB instance to require SSL by setting the 'rds.force_ssl' parameter to 1 in the DB parameter group. Clients must then connect using SSL. Option A is incorrect because modifying the security group does not enforce SSL at the database level. Option B is incorrect because enabling IAM authentication does not enforce SSL. Option D is incorrect because setting the DB instance to publicly accessible is not secure and does not enforce SSL.

Answer

Enable IAM database authentication for the DB instance.

Answer

Modify the DB instance security group to only allow traffic on port 443.

Answer

Set the DB instance to be publicly accessible and use a VPN connection.

Question 3

A company is using Amazon RDS for PostgreSQL to store application data. The security team wants to ensure that database audit logs are stored securely and cannot be modified after creation. Which AWS service should be used to meet this requirement?

Accepted Answer

Amazon CloudWatch Logs. Option A is correct because Amazon RDS can publish audit logs to CloudWatch Logs, and CloudWatch Logs can be configured with a retention policy and prevent modification of logs via IAM policies or log group encryption. Option B is wrong because S3 can store logs but requires additional configuration to ensure immutability (e.g., S3 Object Lock). Option C is wrong because CloudTrail is for API auditing, not database audit logs. Option D is wrong because KMS is used for encryption keys, not for storing logs.

Answer

AWS Key Management Service (KMS)

Answer

AWS CloudTrail

Answer

Amazon S3

Question 4

A company wants to ensure that an Amazon RDS for MySQL DB instance is encrypted at rest. Which action should be taken to enable encryption for the first time?

Accepted Answer

Create a new encrypted DB instance using AWS KMS.. Option A is correct because RDS encryption at rest can only be enabled when creating a new DB instance, not on an existing one. Option B is wrong because enabling encryption requires creating an encrypted snapshot and restoring as a new instance, not just modifying. Option C is wrong because encryption cannot be enabled on an existing instance. Option D is wrong because encryption is configured at instance creation, not through parameter groups.

Answer

Enable encryption on the existing DB instance using the AWS CLI.

Answer

Set the rds.encrypted parameter to true in the DB parameter group.

Answer

Modify the existing DB instance and enable encryption.

Question 5

A company is using Amazon RDS for PostgreSQL with a read replica. The security team wants to ensure that data in transit between the primary DB instance and the read replica is encrypted. What should be done?

Accepted Answer

Enable encryption at rest on the primary DB instance using AWS KMS.. Option A is correct because enabling encryption at rest on the primary instance automatically encrypts the replication traffic. Option B is wrong because encryption in transit between primary and replica is automatically encrypted if the primary is encrypted. Option C is wrong because SSL/TLS is for client connections, not replication. Option D is wrong because a VPN is not needed.

Answer

Set up a VPN connection between the primary and the replica.

Answer

Configure the read replica to use a different KMS key.

Answer

Enable SSL/TLS on the read replica and configure the primary to use it.

Question 6

A developer needs to allow an application running on EC2 to access an Amazon RDS database without storing database credentials in the application code. Which solution is the MOST secure?

Accepted Answer

Use IAM database authentication for the RDS instance and assign an IAM role to the EC2 instance.. Option D is correct because AWS Secrets Manager can rotate secrets automatically, and the application retrieves them via API, avoiding hardcoded credentials. Option A is wrong because storing credentials in the code is insecure. Option B is wrong because IAM database authentication for RDS MySQL/Aurora allows passwordless access using IAM roles, which is more secure than storing passwords. Option C is wrong because Parameter Store can store secrets but does not automatically rotate RDS credentials.

Answer

Store the database password in AWS Systems Manager Parameter Store as a SecureString.

Answer

Store the database password in the application configuration file.

Answer

Store the database password in AWS Secrets Manager and enable automatic rotation.

Question 7

A company is storing sensitive customer data in an Amazon RDS for MySQL DB instance. They need to ensure that data is encrypted at rest. What is the simplest way to achieve this?

Accepted Answer

Launch a new encrypted DB instance and migrate the data.. Option B is correct because enabling encryption at rest on a new RDS instance is straightforward. Option A is wrong because enabling encryption on an existing unencrypted DB instance requires a snapshot and restore. Option C is wrong because client-side encryption is more complex and not the simplest. Option D is wrong because RDS does not natively support Transparent Data Encryption (TDE) for MySQL.

Answer

Enable encryption on the existing DB instance by modifying the DB instance settings.

Answer

Enable Transparent Data Encryption (TDE) on the MySQL instance.

Answer

Use client-side encryption with AWS KMS to encrypt data before inserting into the database.

Question 8

Which THREE of the following are best practices for securing an Amazon Aurora MySQL database? (Select THREE.)

Accepted Answer

Enable encryption at rest using AWS KMS.. Options A, B, and E are correct. Option C is wrong because storing secrets in application code is insecure. Option D is wrong because disabling automated backups reduces data durability.

Answer

Store database credentials in application code for simplicity.

Answer

Disable automated backups to reduce attack surface.

Question 9

A company runs an Amazon Aurora MySQL-compatible database cluster. The security team requires that all database credentials be rotated automatically every 30 days. Which combination of AWS services can meet this requirement with minimal operational overhead?

Accepted Answer

Store the password in AWS Secrets Manager and enable automatic rotation with a 30-day interval.. AWS Secrets Manager can automatically rotate secrets for Amazon RDS databases. Option A is wrong because IAM database authentication does not handle password rotation. Option B is wrong because Systems Manager Parameter Store can store secrets but does not have built-in rotation for RDS. Option D is wrong because CloudHSM does not manage database password rotation.

Answer

Use IAM database authentication and rotate the IAM user keys every 30 days.

Answer

Use AWS CloudHSM to generate a new password and a Lambda function to update the database.

Answer

Store the password in AWS Systems Manager Parameter Store and use a scheduled Lambda function to update the password.

Question 10

Refer to the exhibit. A developer created an IAM policy with the above command and attached it to a user. What is the security implication of this policy?

Accepted Answer

The policy grants full administrative access to all RDS resources in the account.. The policy allows all RDS actions on all resources. This gives the user full administrative access to all RDS resources in the account, which is overly permissive and violates least privilege. Option A is wrong because the policy does not restrict to a specific region. Option C is wrong because it does allow modifying instances. Option D is wrong because it does not restrict to specific instances.

Answer

The policy restricts access to only one specific DB instance.

Answer

The policy allows only actions in the us-east-1 region.

Answer

The policy only allows read-only access to RDS.

Question 11

A security engineer needs to restrict access to an Amazon DynamoDB table so that only users from a specific AWS account can read and write data. Which of the following can be used to achieve this? (Choose TWO.)

Accepted Answer

Use a VPC endpoint policy for DynamoDB.. Options B and D are correct. An IAM policy with a condition that checks the 'aws:SourceAccount' or 'aws:SourceArn' can restrict access to requests coming from a specific account. Also, a VPC endpoint policy for DynamoDB can restrict access to specific tables and source accounts. Option A is incorrect because DynamoDB does not support resource-based policies. Option C is incorrect because an S3 bucket policy does not apply to DynamoDB. Option E is incorrect because a security group does not control DynamoDB access at the account level.

Answer

Use a resource-based policy on the DynamoDB table.

Answer

Use a security group to restrict access to the DynamoDB table.

Answer

Use an S3 bucket policy to allow access to the DynamoDB table.

Question 12

A company uses Amazon DynamoDB to store session data. The security team has enabled DynamoDB Accelerator (DAX) for performance. However, they are concerned about data encryption at rest. DAX encrypts data at rest by default. The security team wants to use a customer managed key (CMK) in AWS KMS. How can this be configured?

Accepted Answer

Create a DAX cluster and specify the KMS key ID of a symmetric customer managed key during creation.. Option B is correct because DAX supports specifying a KMS key at cluster creation, and it must be a symmetric CMK. Option A is wrong because DAX does support encryption at rest, and it can use a CMK. Option C is wrong because DAX uses KMS for encryption, not S3. Option D is wrong because the KMS key must be a symmetric CMK; asymmetric CMKs are not supported for DAX encryption.

Answer

Use an asymmetric customer managed key because it provides better security.

Answer

DAX does not support encryption at rest with a customer managed key; only AWS managed keys are supported.

Answer

Enable encryption at rest on the DAX cluster after creation by modifying the cluster settings.

Question 13

A company has an Amazon DynamoDB table that stores sensitive user data. The security team requires that all data is encrypted at rest using a customer-managed AWS KMS key. Additionally, they want to ensure that the table can only be accessed by a specific IAM role. Which combination of steps should be taken to meet these requirements? (Select TWO.)

Accepted Answer

Specify a customer-managed KMS key in the DynamoDB table creation.. Options A and B are correct. Option A: You can specify a customer-managed KMS key when creating the table. Option B: To restrict access to a specific IAM role, you should use an IAM policy that denies access unless the request comes from that role. Option C is wrong because SSE-C is for S3, not DynamoDB. Option D is wrong because encryption cannot be enabled after table creation without recreating the table. Option E is wrong because bucket policies are for S3, not DynamoDB.

Answer

Enable server-side encryption with S3-managed keys (SSE-S3) on the DynamoDB table.

Answer

Attach a bucket policy to restrict access to the DynamoDB table.

Answer

Modify the existing DynamoDB table to enable encryption at rest.

Question 14

A company has an Amazon DynamoDB table with a global secondary index (GSI). The security team wants to ensure that the table and the GSI are encrypted at rest. How can this be achieved?

Accepted Answer

Nothing; DynamoDB encrypts all data at rest by default.. Option A is correct because DynamoDB encrypts all tables and GSIs at rest by default. Option B is wrong because encryption is always on. Option C is wrong because encryption cannot be disabled. Option D is wrong because GSIs are automatically encrypted with the table.

Answer

Create the table with encryption disabled to avoid performance impact.

Answer

Enable encryption at rest on the table and the GSI separately.

Answer

Enable encryption on the GSI using a KMS key.

Question 15

A company needs to securely store and manage the master password for their Amazon RDS for PostgreSQL instance. Which AWS service is purpose-built for managing secrets with automatic rotation?

Accepted Answer

AWS Secrets Manager. Option B is correct because AWS Secrets Manager is designed for secret management with built-in rotation. Option A is wrong because KMS is for encryption keys, not secret management. Option C is wrong because CloudHSM provides hardware security modules but not secret rotation. Option D is wrong because IAM is for identity and access management, not secret storage.

Answer

AWS Key Management Service (KMS)

Answer

AWS Identity and Access Management (IAM)

Answer

AWS CloudHSM

Question 16

A company uses Amazon RDS for PostgreSQL and needs to ensure that only specific IP addresses can connect to the database. Which configuration should be used?

Accepted Answer

Modify the VPC security group associated with the DB instance to allow inbound traffic only from specific IP addresses.. Option C is correct because security group rules control inbound traffic based on IP addresses or other security groups. Option A is wrong because DB subnet groups define subnets, not IP filtering. Option B is wrong because parameter groups control database engine parameters, not network access. Option D is wrong because IAM policies control permissions for AWS actions, not network-level access.

Answer

Configure the DB subnet group to allow only specific IP addresses.

Answer

Set the rds.force_ssl parameter in the DB parameter group.

Answer

Create an IAM policy that restricts access to the RDS API based on source IP.

Question 17

Which TWO of the following are valid ways to encrypt data at rest in Amazon DynamoDB? (Select TWO.)

Accepted Answer

Use AWS owned CMK for server-side encryption.. Options C and D are correct. Option A is wrong because DynamoDB does not use EBS volumes. Option B is wrong because DynamoDB does not support TDE. Option E is wrong because client-side encryption is not encryption at rest of the DynamoDB service.

Answer

Enable Transparent Data Encryption (TDE).

Answer

Enable EBS encryption on the underlying storage.

Answer

Implement client-side encryption before sending data to DynamoDB.

Question 18

A developer accidentally exposed an Amazon RDS snapshot to the public. What is the quickest way to remediate this issue?

Accepted Answer

Modify the snapshot permissions to set it to private.. The quickest remediation is to modify the snapshot and set it to private. Option A is incorrect because deleting the snapshot may cause data loss. Option C is incorrect because copying a public snapshot still results in a public snapshot. Option D is incorrect because sharing with a specific account does not revoke public access.

Answer

Delete the snapshot and create a new one from the source DB instance.

Answer

Copy the snapshot to a new snapshot and delete the original.

Answer

Share the snapshot with only the required AWS account.

Question 19

A company wants to encrypt data at rest for an existing Amazon RDS for MySQL DB instance. The database is currently unencrypted. What is the most efficient way to enable encryption?

Accepted Answer

Create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the DB instance from the encrypted snapshot.. Option B is correct because RDS does not support enabling encryption on an existing unencrypted DB instance directly. You must create a snapshot, copy it with encryption enabled, and restore from that encrypted snapshot. Option A is incorrect because you cannot modify the DB instance to enable encryption. Option C is incorrect because AWS KMS does not automatically encrypt the DB instance. Option D is incorrect because you cannot directly configure encryption on the existing instance.

Answer

Enable encryption on the existing DB instance by modifying the parameter group.

Answer

Use AWS KMS to automatically encrypt the DB instance.

Answer

Modify the DB instance and enable encryption from the RDS console.

Question 20

A company is running an Amazon RDS for SQL Server DB instance with Multi-AZ deployment. The security team wants to ensure that all data at rest is encrypted using a customer-managed key stored in AWS KMS. Which steps must be taken to achieve this? (Choose THREE.)

Accepted Answer

Copy the snapshot and specify encryption with a KMS key.. Options A, C, and E are correct. To encrypt an existing unencrypted RDS instance, you must create a snapshot, copy the snapshot with encryption using a KMS key, and then restore the DB instance from the encrypted snapshot. Option B is incorrect because you cannot enable encryption on an existing DB instance directly. Option D is incorrect because Multi-AZ deployment does not automatically encrypt data.

Answer

Modify the DB instance and enable encryption.

Answer

Enable Multi-AZ deployment to encrypt data at rest.

DBS-C01 Mock Exam 78 — 25 Questions

Exhibit

DBS-C01 Mock Exam 78 — 25 Questions

Exhibit