DBS-C01 Mock Exam 81 — 25 Questions

Question 1

A company is running an Amazon RDS for SQL Server instance with Multi-AZ deployment. The security team requires that all data at rest be encrypted. The instance was originally launched without encryption. What is the most efficient way to enable encryption at rest for this existing instance?

Accepted Answer

Take a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance.. Option C is correct because you cannot directly enable encryption on an existing unencrypted RDS instance; you must create a snapshot, copy it with encryption, and restore the encrypted snapshot to a new instance. Option A is wrong because modifying the DB instance does not support enabling encryption. Option B is wrong because enabling encryption requires a snapshot copy, not just creating an encrypted read replica. Option D is wrong because while you could migrate data manually, it is less efficient than snapshot restoration.

Answer

Modify the DB instance and set the encryption attribute to true.

Answer

Use AWS Database Migration Service (DMS) to migrate the data to a new encrypted RDS instance.

Answer

Create a read replica with encryption enabled and promote it to become the primary instance.

Question 2

A database administrator needs to audit all SQL statements executed on an Amazon Aurora MySQL DB cluster, including SELECT queries. Which AWS service should be used to capture and store these logs?

Accepted Answer

Amazon RDS Database Activity Streams. Option C is correct because RDS Database Activity Streams sends database activity to CloudWatch Logs and Kinesis Data Streams for auditing. Option A is wrong because Enhanced Monitoring provides OS-level metrics, not SQL statements. Option B is wrong because RDS Performance Insights monitors performance, not audit SQL. Option D is wrong because CloudWatch Logs can store logs but does not capture SQL statements directly; it requires a source like Database Activity Streams.

Answer

Amazon RDS Enhanced Monitoring

Answer

Amazon CloudWatch Logs

Answer

Amazon RDS Performance Insights

Question 3

A company needs to comply with PCI DSS requirements for an Amazon RDS for Oracle DB instance. The requirements include encryption of sensitive data at rest and in transit, and automated key rotation. Which combination of services and configurations should be used? (Select THREE.)

Accepted Answer

Enable encryption at rest on the RDS instance using AWS KMS.. Options A, C, and D are correct. Option A: Enable encryption at rest with KMS. Option C: Enable encrypted replication for read replicas if used. Option D: Use Secrets Manager for automated credential rotation. Option B is wrong because CloudHSM is not required for key rotation; KMS can rotate keys automatically. Option E is wrong because VPC Flow Logs are for network monitoring, not encryption.

Answer

Use AWS CloudHSM to generate and store encryption keys.

Answer

Enable VPC Flow Logs to audit database connections.

Question 4

A company wants to enforce that all new Amazon RDS DB instances are created with encryption at rest enabled. Which approach should be taken?

Accepted Answer

Use an IAM policy that denies the rds:CreateDBInstance action unless rds:StorageEncrypted is set to true.. Option B is correct because an IAM policy with a condition on rds:StorageEncrypted can deny creation of unencrypted instances. Option A is wrong because CloudWatch Events can trigger a remediation Lambda but does not prevent creation. Option C is wrong because AWS Config can detect noncompliant instances but does not enforce at creation time. Option D is wrong because RDS does not have a default encryption setting at the account level.

Answer

Use AWS CloudTrail to detect unencrypted instance creation and automatically delete them.

Answer

Use AWS Config rules to mark unencrypted instances as noncompliant.

Answer

Enable encryption by default in the RDS console.

Question 5

A snapshot of an Amazon RDS DB instance is shown in the exhibit. What does the output indicate?

Accepted Answer

The snapshot is encrypted and the encryption process is complete.. Option D is correct because the snapshot is encrypted (Encrypted: true) and the status is 'encrypted', meaning the snapshot encryption is complete. Option A is wrong because the snapshot exists and is encrypted. Option B is wrong because the snapshot is encrypted. Option C is wrong because the status is not 'creating'.

Answer

The snapshot creation is still in progress.

Answer

The snapshot is not encrypted.

Answer

The snapshot is in the process of being encrypted.

Question 6

A user is unable to list the contents of the S3 bucket 'my-db-backups' using the AWS CLI. The IAM policy attached to the user is shown in the exhibit. What is the likely cause?

Accepted Answer

The policy does not grant 's3:ListBucket' permission.. Option A is correct because the policy does not include 's3:ListBucket' action. Option B is wrong because the resource includes the bucket. Option C is wrong because the policy is valid JSON. Option D is wrong because the bucket name is correct.

Answer

The user is using the wrong bucket name.

Answer

The resource ARN is missing the bucket-level ARN needed for listing.

Answer

The policy has a syntax error.

Question 7

A company hosts a critical application on Amazon RDS for PostgreSQL. The security team requires that all database connections be encrypted in transit. Which configuration step is necessary?

Accepted Answer

Set the rds.force_ssl parameter to 1 in the DB parameter group.. Enforcing SSL/TLS for connections is required for encryption in transit. Option B is correct. Option A is wrong because enabling encryption at rest does not encrypt data in transit. Option C is wrong because a VPN encrypts network traffic but does not enforce database-level SSL. Option D is wrong because modifying security group rules does not encrypt connections.

Answer

Create a VPN connection between the application and the database.

Answer

Modify the security group to allow only port 5432 from the application.

Answer

Enable encryption at rest using AWS KMS.

Question 8

A company uses Amazon DynamoDB with DAX and wants to implement fine-grained access control using IAM. Which THREE conditions can be used in an IAM policy to restrict access to specific items based on the primary key?

Accepted Answer

dynamodb:Attributes. Options A, B, and D are correct. DynamoDB supports IAM conditions for fine-grained access control using dynamodb:LeadingKeys, dynamodb:Attributes, and dynamodb:Select. Option C is wrong because dynamodb:TableName identifies the table, not items. Option E is wrong because dynamodb:ReturnValues is a parameter for write operations, not a condition for access control.

Answer

dynamodb:ReturnValues

Answer

dynamodb:TableName

Question 9

A company has an Amazon RDS for SQL Server DB instance that stores financial data. The security team requires that the data be encrypted at rest using a customer-managed key stored in AWS KMS. Additionally, they want to ensure that the key cannot be deleted without authorization. What should be done?

Accepted Answer

Create a customer-managed KMS key, enable key rotation, and set a deletion protection policy.. Option D is correct because enabling key rotation and deletion protection on the KMS key provides the required controls. Option A is wrong because enabling encryption on RDS does not by itself protect the key from deletion. Option B is wrong because CloudHSM keys are not managed through KMS. Option C is wrong because CloudTrail only logs actions, it does not prevent deletion.

Answer

Enable encryption on the RDS instance and use the default KMS key.

Answer

Use AWS CloudHSM to generate and store the encryption key, and associate it with the RDS instance.

Answer

Enable AWS CloudTrail to log key deletion attempts.

Question 10

A security team is auditing IAM policies for Amazon RDS. They want to ensure that all RDS snapshots shared with other AWS accounts are encrypted. Which IAM policy condition key should be used to enforce this?

Accepted Answer

rds:Encrypted. Option C is correct because rds:Encrypted is a condition key that checks whether a snapshot is encrypted. Option A is wrong because rds:SnapshotEncrypted is not a valid condition key. Option B is wrong because s3:x-amz-server-side-encryption is for S3. Option D is wrong because rds:StorageEncrypted is for DB instances, not snapshots.

Answer

rds:SnapshotEncrypted

Answer

rds:StorageEncrypted

Answer

s3:x-amz-server-side-encryption

Question 11

Which TWO AWS services can be used to centrally manage database credentials and automate rotation for Amazon RDS? (Choose two.)

Accepted Answer

AWS Secrets Manager. Options A and D are correct. AWS Secrets Manager and AWS Systems Manager Parameter Store (SecureString) can both store RDS credentials, but Secrets Manager has built-in rotation for RDS. Option B is wrong because IAM database authentication eliminates the need for credentials but does not store them. Option C is wrong because KMS manages encryption keys, not secrets. Option E is wrong because CloudHSM provides hardware security modules, not secret management.

Answer

AWS Key Management Service (KMS)

Answer

IAM database authentication

Answer

AWS CloudHSM

Question 12

A database administrator runs the command shown in the exhibit. The security team requires that the database be encrypted at rest. What should the administrator do to enable encryption?

Accepted Answer

Create a snapshot of the DB instance, copy the snapshot with encryption, and restore from the encrypted snapshot.. Option B is correct because encryption cannot be enabled on an existing unencrypted instance; you must create a snapshot, copy it with encryption, and restore. Option A is wrong because modifying the instance does not add encryption. Option C is wrong because encryption is at the storage level, not table level. Option D is wrong because the command shows StorageEncrypted is false, so it is not encrypted.

Answer

Enable encryption at the table level using MySQL's built-in encryption.

Answer

Modify the DB instance and set StorageEncrypted to true.

Answer

The instance is already encrypted because the output shows 'StorageEncrypted' as false.

Question 13

A company needs to encrypt data at rest for their Amazon Aurora PostgreSQL database. Which solution is the MOST secure and requires the least operational overhead?

Accepted Answer

Enable encryption at rest using AWS KMS when creating the Aurora cluster.. Enabling encryption at rest using AWS KMS during database creation is the simplest and most secure approach. Option A is correct. Option B is wrong because encrypting after creation requires a manual snapshot and restore. Option C is wrong because client-side encryption adds complexity. Option D is wrong because EBS encryption does not cover the database engine layer.

Answer

Use Amazon EBS encryption on the underlying volumes.

Answer

Encrypt the database after creation by modifying the DB instance.

Answer

Use client-side encryption in the application.

Question 14

Which TWO AWS services can be used to monitor and alert on suspicious database access patterns in Amazon RDS? (Choose 2.)

Accepted Answer

Amazon CloudWatch. Amazon GuardDuty and Amazon CloudWatch can both be used to monitor and alert on suspicious access. Option A is wrong because AWS Config is for configuration monitoring. Option C is wrong because AWS Trusted Advisor provides best practices. Option E is wrong because Amazon Inspector is for vulnerability assessment.

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 15

A database administrator needs to audit all SQL statements executed on an Amazon RDS for Oracle DB instance. The audit logs must be stored in Amazon S3 for long-term retention and analysis with Amazon Athena. Which solution meets these requirements?

Accepted Answer

Configure Oracle's unified auditing and stream audit logs to CloudWatch Logs, then export to S3.. Option D is correct because Oracle's unified auditing can be configured to write logs to S3 via the database activity stream, which integrates with CloudWatch Logs and then to S3. Option A is wrong because RDS Enhanced Monitoring provides OS metrics, not SQL audit. Option B is wrong because CloudTrail does not capture SQL statements. Option C is wrong because enabling detailed billing does not provide SQL audit.

Answer

Enable Enhanced Monitoring on the RDS instance and publish logs to CloudWatch Logs.

Answer

Enable AWS CloudTrail to capture RDS API calls and store them in S3.

Answer

Enable detailed billing reports and configure them to include database queries.

Question 16

A company has an Amazon RDS for MySQL DB instance that is publicly accessible. The security team wants to restrict access to only specific IP addresses. Which configuration should be used?

Accepted Answer

Configure a security group associated with the RDS instance to allow inbound traffic only from the specific IP addresses.. Option B is correct because DB security groups (or VPC security groups) can be configured to allow inbound traffic only from specific IP addresses. Option A is wrong because network ACLs are stateless and less granular. Option C is wrong because the RDS instance is publicly accessible, so it has a public endpoint; a VPC endpoint is not needed. Option D is wrong because IAM policies do not restrict network access.

Answer

Create a VPC endpoint for RDS and attach a policy that allows only the specific IP addresses.

Answer

Use an IAM policy with a condition that restricts the source IP address.

Answer

Configure a network ACL to allow inbound traffic from the specific IP addresses.

Question 17

A company has an Amazon RDS for Oracle DB instance that needs to be encrypted at rest. The instance currently uses Oracle Transparent Data Encryption (TDE) with a key stored in the database. The company wants to use AWS KMS for key management. What is the correct migration path?

Accepted Answer

Take a snapshot of the DB instance, copy the snapshot with KMS encryption, and restore from the encrypted snapshot.. Option D is correct because to change the encryption key from Oracle TDE to KMS, you must take a snapshot, copy it with encryption (using KMS key), and restore. Option A is wrong because you cannot modify the encryption key in place. Option B is wrong because creating a read replica does not allow changing the encryption key. Option C is wrong because you cannot directly enable KMS on an existing TDE instance.

Answer

Enable KMS encryption directly on the existing DB instance using the AWS CLI.

Answer

Create a read replica with KMS encryption.

Answer

Modify the DB instance and select the KMS key.

Question 18

A financial company uses Amazon RDS for PostgreSQL with a custom parameter group. The security team wants to ensure that all connections to the database are encrypted in transit. Which combination of actions should the database administrator take? (Select TWO.)

Accepted Answer

Set the parameter 'rds.force_ssl' to 1 in the custom parameter group.. Options A and B are correct because setting rds.force_ssl to 1 forces SSL connections, and requiring SSL in the security group allows only encrypted traffic. Option C is wrong because the default PostgreSQL port is 5432, and changing it does not enforce encryption. Option D is wrong because disabling SSL in the parameter group would prevent encrypted connections. Option E is wrong because IAM roles are for authentication, not transport encryption.

Answer

Attach an IAM role to the RDS instance to authenticate users.

Answer

Change the database port to 8432 to use a non-standard port.

Answer

Set 'ssl' to 'off' in the parameter group.

Question 19

A company needs to encrypt an existing unencrypted Amazon RDS for Oracle DB instance. Which set of steps should be followed?

Accepted Answer

Take a snapshot of the instance, copy the snapshot with encryption enabled, and restore from the encrypted snapshot.. Option C is correct. Option A is wrong because encryption cannot be enabled by modifying the instance. Option B is wrong because you cannot add a KMS key to an existing instance. Option D is wrong because you need to restore from an encrypted snapshot, not just copy it.

Answer

Enable encryption using the AWS Management Console by selecting the instance and choosing 'Enable Encryption'.

Answer

Modify the DB instance and set the KMS key ID to enable encryption.

Answer

Copy the snapshot to an encrypted snapshot and then restore.

Question 20

A company is using Amazon DynamoDB with encryption at rest using an AWS managed key. The security team now requires that the encryption key be rotated every 90 days. What should they do?

Accepted Answer

Use a customer managed key and manually rotate it every 90 days by creating a new key and updating the DynamoDB table.. DynamoDB encryption at rest using AWS managed key does not support customer-controlled rotation. Option C is correct. Option A is wrong because AWS managed keys rotate automatically every year, not on customer schedule. Option B is wrong because KMS automatic rotation is annual and cannot be set to 90 days. Option D is wrong because disabling encryption is not a valid option.

Answer

Enable automatic key rotation in AWS KMS for the default DynamoDB key.

Answer

Create a new customer managed key and enable automatic rotation every 90 days.

Answer

Disable encryption at rest and implement client-side encryption.