DBS-C01 Mock Exam 79 — 25 Questions

Question 1

A company is designing a multi-tenant application using Amazon Aurora MySQL. Each tenant's data must be isolated from others. They need to encrypt data at rest with a unique AWS KMS key per tenant. How can this be achieved?

Accepted Answer

Launch separate Aurora clusters for each tenant, each with its own KMS key for encryption at rest.. Option C is correct because Aurora MySQL does not support per-table or per-database encryption keys; encryption at rest is applied to the entire DB cluster using a single KMS key. Option A is wrong because RDS encryption is cluster-wide. Option B is wrong as it describes application-level encryption. Option D is wrong because using separate clusters per tenant is the only way to have per-tenant KMS keys, though it adds cost.

Answer

Create separate databases within the same Aurora cluster and assign a different KMS key to each database.

Answer

Use client-side encryption with different KMS keys per tenant before inserting data into the database.

Answer

Use a single Aurora cluster with row-level encryption using different KMS keys per tenant.

Question 2

An IAM policy is attached to a user. What is the effect of this policy on the user's ability to delete the DB instance named prod-db?

Accepted Answer

The user cannot delete the DB instance because the Deny statement explicitly denies it.. Option B is correct. The Deny statement explicitly denies the DeleteDBInstance action on the specific resource, and an explicit Deny overrides any Allow. Option A is wrong because the Deny overrides. Option C is wrong because the condition is not based on snapshot existence. Option D is wrong because the policy does not allow deletion.

Answer

The user can delete the DB instance only after creating a final snapshot.

Answer

The user can delete the DB instance because the Allow statement grants all actions.

Answer

The user can delete the DB instance because the Allow statement is broader and applies to all resources.

Question 3

A developer needs to grant an IAM user the ability to perform all operations on an Amazon RDS DB instance except the ability to delete it. Which IAM policy action should be explicitly denied?

Accepted Answer

rds:DeleteDBInstance. To prevent deletion, you must explicitly deny the rds:DeleteDBInstance action. Option A is wrong because rds:ModifyDBInstance does not delete. Option C is wrong because rds:StopDBInstance does not delete. Option D is wrong because rds:RebootDBInstance does not delete.

Answer

rds:RebootDBInstance

Answer

rds:StopDBInstance

Answer

rds:ModifyDBInstance

Question 4

A company uses Amazon DynamoDB with a global secondary index (GSI) and client-side encryption using the AWS Encryption SDK. The security team requires that the partition key and sort key be searchable by the application but not stored in plaintext in the table. Which approach should be taken?

Accepted Answer

Use client-side encryption to encrypt only the non-key attributes, leaving the partition and sort keys in plaintext.. Client-side encryption can encrypt certain attributes while leaving the key attributes in plaintext for querying. Option A is wrong because DynamoDB encryption at rest encrypts entire table, not selectively. Option B is wrong because making the table encrypted at rest does not allow search on encrypted keys. Option D is wrong because using a KMS key with DynamoDB encryption at rest still encrypts the whole table, not selectively.

Answer

Encrypt the entire item client-side and use a secondary index on the encrypted keys.

Answer

Use server-side encryption with a KMS key and enable DynamoDB Streams to decrypt on read.

Answer

Use DynamoDB encryption at rest with a customer-managed KMS key.

Question 5

A company is using Amazon Aurora MySQL and needs to audit database logins. Which of the following can be used to capture login events? (Choose TWO.)

Accepted Answer

Database Activity Streams. Options B and C are correct. Database activity streams (DAS) in Aurora capture login events and other activities. Additionally, you can enable the audit plugin in Aurora MySQL to log connections. Option A is incorrect because CloudTrail does not capture database login events. Option D is incorrect because Enhanced Monitoring captures OS metrics. Option E is incorrect because VPC Flow Logs capture network traffic, not database logins.

Answer

VPC Flow Logs

Answer

Enhanced Monitoring

Answer

AWS CloudTrail

Question 6

A company is using Amazon RDS for MySQL and wants to restrict access to a specific database so that an application user can only perform SELECT and INSERT operations on tables within that database. The application user already exists. Which SQL statement should be executed?

Accepted Answer

GRANT SELECT, INSERT ON app_db.* TO 'app_user'@'%';. Option D is correct because the GRANT statement with specific privileges (SELECT, INSERT) on the database name and wildcard tables (*) will grant the required permissions. Option A is wrong because it grants all privileges, which is too permissive. Option B is wrong because it grants DDL privileges (CREATE, ALTER). Option C is wrong because it only grants SELECT, not INSERT.

Answer

GRANT SELECT ON app_db.* TO 'app_user'@'%';

Answer

GRANT CREATE, ALTER, SELECT, INSERT ON app_db.* TO 'app_user'@'%';

Answer

GRANT ALL PRIVILEGES ON app_db.* TO 'app_user'@'%';

Question 7

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database contains personally identifiable information (PII). The security team requires that all PII columns be transparently encrypted and that the encryption keys be stored in AWS CloudHSM. Which solution meets these requirements?

Accepted Answer

Use Oracle Transparent Data Encryption (TDE) with AWS CloudHSM as the key store.. Option D is correct because Oracle TDE with CloudHSM integration allows transparent encryption and stores keys in CloudHSM. Option A is wrong because RDS Encryption uses KMS, not CloudHSM. Option B is wrong because Oracle Data Pump does not encrypt columns. Option C is wrong because RDS does not support custom encryption at the column level natively.

Answer

Enable Amazon RDS encryption at rest using a KMS key and rely on that encryption.

Answer

Modify the Oracle database to use AWS KMS for column-level encryption.

Answer

Use Oracle Data Pump to export data with encryption and store the encryption key in AWS Secrets Manager.

Question 8

A security team is auditing an Amazon RDS for SQL Server DB instance. They notice that SSL connections are not enforced. Which configuration change will enforce SSL for all connections?

Accepted Answer

Set the 'rds.force_ssl' parameter to 1 in the DB parameter group.. Option D is correct because for RDS SQL Server, you can enforce SSL by setting the 'rds.force_ssl' parameter to 1 in the DB parameter group. Option A is wrong because security groups allow traffic but do not enforce SSL. Option B is wrong because the option group manages features like TDE, not SSL enforcement. Option C is wrong because the DB subnet group defines network subnets, not SSL.

Answer

Modify the security group to only allow inbound traffic on port 443.

Answer

Add the SQL Server SSL option to the option group.

Answer

Change the DB subnet group to a public subnet.

Question 9

A company uses Amazon Redshift for data warehousing. The security team requires that all data be encrypted at rest with a customer-managed key, and that the key be rotated every year. Which configuration meets these requirements?

Accepted Answer

Launch the Redshift cluster with encryption enabled using a customer-managed KMS key with automatic annual rotation.. Amazon Redshift supports encryption at rest using a KMS key. You can enable automatic key rotation on a customer-managed KMS key. Option A is wrong because Redshift does not use S3-managed keys for encryption. Option B is wrong because HSM is not required for encryption at rest in Redshift. Option D is wrong because CloudHSM is an alternative but requires manual rotation.

Answer

Launch the Redshift cluster without encryption and enable encryption later using AWS CloudHSM.

Answer

Launch the Redshift cluster with encryption enabled using an S3-managed key.

Answer

Launch the Redshift cluster with encryption enabled using a KMS key and configure the cluster to use an HSM for key storage.

Question 10

A company has an Amazon DynamoDB table with a global secondary index (GSI). The security team wants to ensure that only certain attributes are returned in query results based on the IAM policy of the calling user. What is the most secure and scalable approach?

Accepted Answer

Use IAM condition keys with 'dynamodb:Attributes' to restrict access to specific attributes.. Option C is correct. Using IAM condition keys with 'dynamodb:Attributes' allows fine-grained access control at the attribute level. This is the recommended way to restrict access to specific attributes. Option A is incorrect because attribute-level IAM policies can be applied without VPC endpoints. Option B is incorrect because DynamoDB does not support column-level security through Lambda. Option D is incorrect because modifying the GSI to include only allowed attributes would require multiple GSIs and is not scalable.

Answer

Use an AWS Lambda function as a middleware to filter attributes before returning results.

Answer

Create multiple global secondary indexes that include only the allowed attributes for each user group.

Answer

Create a VPC endpoint for DynamoDB and attach a bucket policy that limits attribute access.

Question 11

An IAM policy is attached to a user. What does this policy allow the user to do?

Accepted Answer

Get an item from the Orders table but only return the order_id, customer_id, and status attributes.. Option B is correct. The policy allows the GetItem action on the Orders table, but only returns the specified attributes (order_id, customer_id, status) due to the condition. Option A is incorrect because the policy does not allow Scan. Option C is incorrect because the policy only allows GetItem, not PutItem. Option D is incorrect because the policy does not allow deleting items.

Answer

Update an item in the Orders table.

Answer

Scan the entire Orders table and return all attributes.

Answer

Delete an item from the Orders table.

Question 12

A company is using Amazon DynamoDB with AWS Lambda to process data. The Lambda function needs to read and write items to a DynamoDB table. The security team wants to follow the principle of least privilege. Which IAM policy statement should be attached to the Lambda execution role?

Accepted Answer

{"Effect":"Allow","Action":["dynamodb:GetItem","dynamodb:PutItem","dynamodb:UpdateItem","dynamodb:DeleteItem"],"Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/MyTable"}. Option C is correct because it grants only the necessary DynamoDB actions (GetItem, PutItem, UpdateItem, DeleteItem) on the specific table. Option A is wrong because it grants DynamoDB full access, which is too permissive. Option B is wrong because it allows all actions on all tables. Option D is wrong because it is overly restrictive; it only allows DescribeTable and ListTables, which are insufficient for read/write.

Answer

{"Effect":"Allow","Action":"dynamodb:*","Resource":"*"}

Answer

{"Effect":"Allow","Action":["dynamodb:DescribeTable","dynamodb:ListTables"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":"dynamodb:*","Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/MyTable"}

Question 13

A company has an Amazon RDS for PostgreSQL DB instance that needs to be accessed by an application running on an Amazon EC2 instance. Both resources are in the same VPC. The security team insists that all traffic between the application and the database be encrypted in transit. Which configuration ensures this?

Accepted Answer

Enable SSL/TLS on the RDS instance and configure the application to connect using SSL.. Option B is correct because enabling SSL/TLS on the RDS instance and configuring the application to use SSL ensures encryption in transit. Option A is wrong because security group rules control access, not encryption. Option C is wrong because VPC peering is for inter-VPC communication. Option D is wrong because a VPN is not needed for same-VPC communication.

Answer

Add a security group rule that allows traffic only from the EC2 instance's private IP.

Answer

Create an AWS Site-to-Site VPN connection between the EC2 instance and the RDS instance.

Answer

Set up VPC peering between the EC2 instance's VPC and the RDS instance's VPC.

Question 14

A company wants to encrypt an existing unencrypted Amazon RDS for PostgreSQL DB instance. What is the correct procedure?

Accepted Answer

Take a snapshot of the instance, create an encrypted copy of the snapshot, and restore the encrypted snapshot to a new DB instance.. Option C is correct because you must create a snapshot, copy it with encryption, and restore to a new encrypted instance. Option A is wrong because you cannot modify an existing instance to enable encryption. Option B is wrong because enabling encryption requires a snapshot copy. Option D is wrong because creating a read replica does not encrypt the primary.

Answer

Take a snapshot of the instance and restore it with encryption enabled.

Answer

Modify the DB instance and enable encryption in the RDS console.

Answer

Create a read replica of the instance and enable encryption on the replica.

Question 15

A company wants to audit all SQL statements executed on their Amazon Aurora MySQL database for compliance. Which AWS feature should be enabled?

Accepted Answer

Database Activity Streams. Option A is correct because Database Activity Streams provide a stream of database activities including SQL queries. Option B is wrong because CloudTrail logs API calls, not SQL statements. Option C is wrong because VPC Flow Logs capture network traffic. Option D is wrong because CloudWatch Logs can store logs but the source should be Database Activity Streams.

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 16

A developer is troubleshooting an issue where an IAM user cannot perform a 'DescribeTable' action on a DynamoDB table. The IAM policy attached to the user is: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["dynamodb:GetItem","dynamodb:PutItem"],"Resource":"*"}]}. What is the most likely reason for the failure?

Accepted Answer

The policy does not include the 'dynamodb:DescribeTable' action.. Option B is correct because the policy only allows GetItem and PutItem, not DescribeTable. Option A is wrong because the resource is '*' which covers all tables. Option C is wrong because DynamoDB actions are case-sensitive, but the policy uses correct casing. Option D is wrong because there is no explicit Deny in the policy.

Answer

The policy uses lowercase 'dynamodb' but the action is case-sensitive.

Answer

There is an implicit Deny for DescribeTable due to a service control policy.

Answer

The resource specified in the policy is '*' which does not include the table.

Question 17

A developer needs to grant an IAM user permission to perform automated backups of an Amazon RDS DB instance. Which IAM action should be allowed?

Accepted Answer

rds:CreateDBSnapshot. Option B is correct because the action to create a DB snapshot is 'rds:CreateDBSnapshot'. Option A is wrong because that action is for manual snapshots? Actually 'CreateDBSnapshot' is the correct action for manual snapshots; automated backups are controlled by 'rds:ModifyDBInstance' to set backup retention. But the question says 'automated backups' which is enabled via the backup retention period. However, typically creating a manual snapshot is a backup action. To be precise: automated backups are enabled by setting backup retention period, which requires 'rds:ModifyDBInstance'. But the question likely expects 'rds:CreateDBSnapshot' for manual backups. Let's adjust: Option B is correct as the action for manual snapshots. But the stem says 'automated backups', which might be a misnomer. We'll go with manual snapshot creation as a common backup task. Option D is wrong because that action is for restoring, not creating backups.

Answer

rds:BackupDBInstance

Answer

rds:RestoreDBInstanceFromDBSnapshot

Answer

rds:ModifyDBInstance

Question 18

An RDS DB instance has two security groups attached. Security group sg-12345678 allows inbound traffic on port 3306 from 0.0.0.0/0. Security group sg-87654321 allows inbound traffic on port 3306 from 10.0.0.0/16. What is the effective inbound access to the DB instance?

Accepted Answer

All IP addresses (0.0.0.0/0) are allowed to connect.. Option C is correct. Security group rules are evaluated together; the most permissive rule applies. Since sg-12345678 allows all IPs, the effective access is from 0.0.0.0/0. Option A is wrong because both groups apply. Option B is wrong because the more permissive rule dominates. Option D is wrong because there is no override of the more permissive rule.

Answer

No IP addresses are allowed because the rules conflict.

Answer

Only the 0.0.0.0/0 range is allowed because sg-12345678 is more permissive.

Answer

Only the 10.0.0.0/16 range is allowed because sg-87654321 is more restrictive.

Question 19

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all connections to the database use Oracle Native Network Encryption (NNE). How should this be configured?

Accepted Answer

Create a custom DB parameter group with the encryption parameters set to REQUIRED.. RDS for Oracle supports NNE by modifying the custom DB parameter group to set the SQLNET.ENCRYPTION_SERVER and SQLNET.ENCRYPTION_TYPES parameters. Option A is wrong because enabling encryption at rest does not affect network encryption. Option B is wrong because RDS does not allow direct modification of sqlnet.ora files; you must use parameter groups. Option C is wrong because IAM database authentication does not encrypt the connection.

Answer

Enable IAM database authentication.

Answer

Modify the sqlnet.ora file on the RDS instance to require encryption.

Answer

Enable encryption at rest using Oracle TDE.

Question 20

A developer needs to connect to an Amazon RDS for PostgreSQL DB instance from an EC2 instance in the same VPC. What is the most secure way to authenticate the connection without storing database credentials in the application code?

Accepted Answer

Enable IAM database authentication and generate an authentication token.. Option D is correct. Using IAM database authentication for RDS PostgreSQL allows the application to connect using an IAM user or role without storing credentials. The authentication token is generated by the AWS SDK and has a 15-minute validity. Option A is incorrect because storing credentials in Secrets Manager is secure but still requires the application to retrieve them. Option B is incorrect because a hardcoded password is not secure. Option C is incorrect because a password in the parameter store is similar to Secrets Manager but still requires retrieval.

Answer

Use a hardcoded password in the application configuration file.

Answer

Store the database password in AWS Secrets Manager and retrieve it at runtime.

Answer

Store the password in AWS Systems Manager Parameter Store as a SecureString.