DBS-C01 Database Security — 20 Questions

Question 1

A company is designing a disaster recovery strategy for an Amazon Aurora MySQL database. The database stores sensitive data that must be encrypted at rest. The primary region is us-east-1, and the secondary region is us-west-2. Which THREE steps are required to set up cross-region replication with encryption at rest?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a multi-Region KMS key to encrypt the Aurora cluster in the primary region.. A multi-Region KMS key allows the same key material to be replicated to the secondary region, enabling the cross-region read replica (created automatically) to decrypt the encrypted data without re-encrypting. Option C is not a separate required step: when you enable cross-region replication on the Aurora cluster (Option E), Aurora automatically creates a cross-region read replica in the secondary region. Option D is required to authorize the Aurora service in us-west-2 to use the locally created KMS key. Option B is unnecessary because parameter groups do not affect encryption.

Answer

Ensure the DB cluster parameter group is the same in both regions.

Answer

Create a cross-Region read replica in the secondary region.

Question 2

A financial services company runs a critical application on Amazon RDS for PostgreSQL with Multi-AZ and automated backups enabled. The database stores sensitive customer data, and the security team recently audited the environment and found that the database master user password is stored in plain text in a configuration file on the application server. Additionally, the security team noted that the database security group allows inbound traffic from 0.0.0.0/0 on port 5432. The company needs to remediate these issues immediately without downtime and must ensure that access to the database is restricted to only the application servers, and that password management follows AWS best practices. The application connects to the database using the master user credentials. What should the database specialist do to meet these requirements?

Accepted Answer

Modify the security group to allow inbound traffic on port 5432 only from the private IP address of the application server. Store the database password in AWS Secrets Manager and configure automatic rotation. Update the application to retrieve the password from Secrets Manager.. It restricts inbound traffic to the application server's private IP address, which is the secure approach for traffic within AWS, and it uses AWS Secrets Manager to store the master password with automatic rotation, following AWS best practices for secrets management. This eliminates the plain-text password exposure and ensures no downtime by updating the application to retrieve credentials dynamically from Secrets Manager.

Answer

Modify the security group to allow inbound traffic on port 5432 only from the public IP address of the application server. Rotate the password using the AWS CLI and store the new password in an encrypted file on the application server. Update the application to read the password from the encrypted file.

Answer

Modify the security group to allow inbound traffic on port 5432 only from the private IP address of the application server. Rotate the master password by modifying the DB instance and store the new password in AWS Systems Manager Parameter Store as a SecureString. Update the application to retrieve the password from Parameter Store.

Answer

Modify the security group to allow inbound traffic on port 5432 only from the private IP address of the application server. Rotate the password using the AWS CLI and store the new password in an encrypted file on the application server. Update the application to read the password from the encrypted file.

Question 3

A company has an Amazon RDS for MySQL Multi-AZ DB instance that stores sensitive financial data. The security team has enabled encryption at rest using a KMS key. They also need to ensure that database audit logs are encrypted and stored in an S3 bucket. The logs must be accessible only by the security team via a VPC endpoint. The log data must be retained for 7 years. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Enable MySQL audit logs and publish them to Amazon CloudWatch Logs. Use a CloudWatch Logs subscription filter to stream logs to an S3 bucket encrypted with KMS, with a bucket policy that restricts access via VPC endpoint.. It is the most efficient: enabling MySQL audit logs, publishing them to CloudWatch Logs, and using a CloudWatch Logs subscription filter to stream encrypted logs to S3 with access restricted via VPC endpoint. This uses managed services with minimal configuration. Option A is wrong because RDS cannot publish audit logs directly to S3; it requires an intermediate step. Option B is wrong because installing a custom audit plugin and using Lambda to export logs adds significant operational overhead and complexity. Option D is wrong because RDS does not natively support sending audit logs to Kinesis Data Firehose; setting that up would require additional components and overhead.

Answer

Configure RDS to publish audit logs directly to an S3 bucket with a bucket policy that restricts access to the security team's IAM roles.

Answer

Install a custom audit plugin on the RDS instance that writes logs to a separate RDS table, then use AWS Lambda to export the table to S3 periodically.

Answer

Enable RDS audit logs and send them to Amazon Kinesis Data Firehose, which writes to an S3 bucket with encryption and VPC endpoint restrictions.

Question 4

A company has an Amazon DynamoDB table with global secondary indexes (GSIs) that store personally identifiable information (PII). The security team requires that all PII is encrypted at rest using a customer-managed KMS key. The table already exists and is encrypted with the default AWS managed key. What is the MOST efficient way to change the encryption to a customer-managed key?

Accepted Answer

Create a new DynamoDB table with the customer-managed key, use AWS Glue to copy the data from the old table to the new table, and then delete the old table.. DynamoDB does not allow changing encryption on an existing table. You must create a new table with the desired customer-managed KMS key, copy the data (e.g., using AWS Glue), and then delete the old table. Option A is incorrect: although you can restore a backup to a new table with a different key, this method requires an additional backup step, making it less efficient than directly copying data via AWS Glue. Option B is incorrect because the AWS Management Console does not support modifying encryption on an existing table. Option D is incorrect because the 'update-table' CLI command cannot change encryption after table creation.

Answer

Create a backup of the table, restore the backup to a new table, and specify the customer-managed key during restoration.

Answer

Use the AWS Management Console to modify the table and select the customer-managed key.

Answer

Use the AWS CLI 'update-table' command with the --sse-specification parameter to change the key.

Question 5

A company is using Amazon DynamoDB with encryption at rest using a customer-managed KMS key. The security team wants to audit every use of this KMS key. Which TWO steps should be taken to meet this requirement?

Accepted Answer

Turn on KMS key auditing in the key's advanced configuration.. Options B and D are correct. To audit every use of a customer-managed KMS key, you need to enable AWS CloudTrail to log all KMS API calls (option D). Additionally, for the key itself, you can turn on KMS key auditing in the key's advanced configuration (option B), which provides detailed audit data. Option A is incorrect because sending KMS audit logs to Amazon CloudWatch Logs is not a required step; CloudWatch Logs can store logs but you must first enable auditing via CloudTrail or key auditing. Option C is incorrect because AWS Config records configuration changes to the KMS key, not the usage of the key for cryptographic operations. Option E is incorrect because VPC Flow Logs capture network traffic, not KMS API calls.

Answer

Send KMS audit logs to Amazon CloudWatch Logs.

Answer

Enable AWS Config to record KMS key configuration changes.

Answer

Enable VPC Flow Logs for the DynamoDB VPC endpoint.

Question 6

A company has an Amazon RDS for Oracle DB instance that stores Personally Identifiable Information (PII). The security team requires that the data be transparently encrypted at rest using a key stored in AWS CloudHSM. What should the database administrator do to meet this requirement?

Accepted Answer

Create a custom DB engine using a custom AMI that includes CloudHSM integration.. The requirement is to use a key stored in AWS CloudHSM for transparent encryption of an Amazon RDS for Oracle DB instance. RDS for Oracle does not natively support integrating with CloudHSM for TDE. The only viable approach to meet this requirement is to use RDS Custom for Oracle, which allows the creation of a custom DB engine using a custom AMI. With RDS Custom, you can customize the database and host environment to integrate CloudHSM with Oracle TDE. Option A is incorrect because Oracle Data Pump does not provide transparent encryption. Option B is incorrect because RDS does not allow configuring the Oracle wallet to point to an external HSM. Option C is incorrect because AWS KMS does not directly use a key stored in CloudHSM unless you set up a custom key store, but even then, RDS Oracle TDE integration with KMS does not support CloudHSM-backed keys.

Answer

Use Oracle Data Pump to export the data, encrypt it using CloudHSM, and import it back into RDS.

Answer

Enable TDE and configure the Oracle wallet to point to the CloudHSM key.

Answer

Enable TDE and use AWS KMS as the key manager by integrating with the Oracle TDE keystore.

Question 7

A company is using Amazon Redshift for data warehousing. The security team requires column-level access control so that certain users cannot view specific columns containing PII. Which approach should the data engineer implement?

Accepted Answer

Create views that exclude the sensitive columns and grant SELECT on the views to the users.. The correct approach is to create views that exclude sensitive columns and grant SELECT on those views to the users (Option A). Amazon Redshift supports column-level security via views; you grant access to the view rather than the underlying table. Option B is incorrect because row-level security policies (e.g., in PostgreSQL) are not available in Redshift. Option C is incorrect because although Redshift does support column-level GRANT (e.g., GRANT SELECT ON table (col1) TO user), creating views is the more standard and manageable approach for column-level access control. Option D is incorrect because column-level encryption with AWS KMS does not provide fine-grained access control; it only protects data at rest and requires application changes for decryption.

Answer

Implement row-level security policies using CREATE ROW LEVEL SECURITY POLICY.

Answer

Use GRANT SELECT ON table (col1, col2) TO user.

Answer

Encrypt the sensitive columns using AWS KMS and decrypt in the application.

Question 8

A company is running an Amazon RDS for SQL Server instance with Multi-AZ deployment. The security team requires that all data at rest be encrypted. The instance was originally launched without encryption. What is the most efficient way to enable encryption at rest for this existing instance?

Accepted Answer

Take a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance.. Encryption cannot be enabled directly on an existing unencrypted RDS instance. The most efficient method is to take a snapshot, copy it with encryption enabled, and restore the encrypted snapshot to a new DB instance. Option A is wrong because modifying the DB instance does not support enabling encryption; encryption must be set at launch. Option B is wrong while AWS DMS can migrate data, it is not the most efficient method for simply enabling encryption; the snapshot approach is simpler and faster. Option D is wrong because you cannot create an encrypted read replica from an unencrypted source; the read replica inherits the encryption setting of the source, which is unencrypted.

Answer

Modify the DB instance and set the encryption attribute to true.

Answer

Use AWS Database Migration Service (DMS) to migrate the data to a new encrypted RDS instance.

Answer

Create a read replica with encryption enabled and promote it to become the primary instance.

Question 9

A company uses Amazon Aurora MySQL and needs to audit all database logins, including failed attempts. Which feature should be enabled?

Accepted Answer

Database Activity Streams. Database Activity Streams provide a near real-time stream of database activity, including logins and failed attempts, and integrate with AWS CloudWatch and third-party tools. Option B (Enhanced Monitoring) is incorrect because it provides OS-level metrics like CPU and memory usage, not database login auditing. Option C (VPC Flow Logs) is incorrect because they capture IP traffic metadata, not database-level events. Option D (AWS CloudTrail) is incorrect because it records API calls made to AWS services, not database login events within Aurora.

Answer

Enhanced Monitoring

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Question 10

A company is using Amazon RDS for PostgreSQL and needs to audit login attempts. Which configuration is required?

Accepted Answer

Set rds.log_connections to 1 in the DB parameter group.. Setting the rds.log_connections parameter to 1 logs login attempts. Option A is correct. Option B is wrong because CloudTrail logs API calls, not database login attempts. Option C is wrong because security groups do not log connections; they only filter traffic. Option D is wrong because Enhanced Monitoring provides OS metrics, not login logs.

Answer

Enable AWS CloudTrail for the RDS instance.

Answer

Modify the security group to log all inbound traffic on port 5432.

Answer

Enable RDS Enhanced Monitoring.

Question 11

A company runs an e-commerce platform on AWS using an Amazon Aurora MySQL database. The database is accessed by multiple microservices, each using a separate database user. The security team recently discovered that a developer accidentally committed database credentials to a public GitHub repository. The credentials were for a user that had write access to the database. The team immediately revoked the credentials and rotated them. However, they want to prevent such incidents from happening again. They need a solution that ensures credentials are not hardcoded in application code, are rotated automatically, and are accessible only to authorized microservices. What should they do?

Accepted Answer

Use AWS Secrets Manager to store the credentials, configure automatic rotation, and attach a resource-based policy to allow access only from the microservices' IAM roles.. AWS Secrets Manager is designed for storing sensitive credentials like database passwords. It supports automatic rotation of secrets, and access can be controlled via IAM policies attached to the microservices' roles, ensuring only authorized microservices can retrieve the credentials. Option A is incorrect because while IAM database authentication eliminates the need for passwords, it requires the microservices to obtain temporary credentials via the IAM API, which still involves managing secrets (e.g., access keys) or using IAM roles; it does not address the automatic rotation of stored credentials. Option B is incorrect because AWS Systems Manager Parameter Store does not support automatic rotation of secrets; it only stores them. Option D is incorrect because storing credentials in an encrypted S3 bucket does not provide automatic rotation, and bucket policies alone do not offer the fine-grained access control and auditing capabilities of Secrets Manager.

Answer

Use IAM database authentication for Aurora and eliminate the use of database passwords.

Answer

Use AWS Systems Manager Parameter Store to store the credentials and grant access via IAM roles.

Answer

Store the credentials in an encrypted S3 bucket and grant access to the microservices via bucket policies.

Question 12

A company runs an Amazon RDS for MySQL DB instance in a VPC. Security requirements mandate that only specific EC2 instances in the same VPC can connect to the database. The security group attached to the RDS instance currently allows inbound traffic on port 3306 from 0.0.0.0/0. Which combination of steps should a database specialist take to meet the security requirement without impacting existing application connectivity? (Choose two.)

Accepted Answer

Remove the inbound rule for 0.0.0.0/0 on the RDS security group.. Removing the overly permissive inbound rule for 0.0.0.0/0 on the RDS security group eliminates unrestricted access, which is a direct violation of the security requirement. Option C is correct because adding an inbound rule that references the security group ID of the EC2 instances allows traffic only from those instances, leveraging security group referencing for granular, stateful access control within the same VPC.

Answer

Modify the network ACL for the DB subnet to allow inbound port 3306 from the EC2 instance's private IP.

Answer

Modify the DB subnet group to place the RDS instance in a public subnet with a route to the EC2 instance.

Answer

Add an inbound rule to the RDS security group allowing traffic from the VPC CIDR on port 3306.

Question 13

A company uses Amazon DynamoDB with a table that stores sensitive customer data. The security team requires that all data at rest be encrypted using a customer-managed AWS KMS key (CMK). Additionally, the company needs to ensure that only specific IAM roles can access the table. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Configure the DynamoDB table to use AWS KMS encryption with a CMK. Create an IAM role with a policy that grants access to the table and includes a condition that the encryption context matches the CMK.. It combines DynamoDB encryption at rest with a customer-managed KMS CMK and uses an IAM role policy with an encryption context condition. This ensures that only specific IAM roles can access the table, and the encryption context condition ties the KMS key usage to the table, providing fine-grained access control with minimal operational overhead. The encryption context is automatically set by DynamoDB to the table ARN, so the condition key `kms:EncryptionContext:aws:dynamodb:tableName` can be used to restrict decryption to that specific table.

Answer

Enable encryption at rest using AWS KMS with a CMK and use column-level encryption with AWS KMS to restrict access.

Answer

Attach a resource-based policy to the DynamoDB table that grants access only to the specific IAM roles.

Answer

Use a DynamoDB Accelerator (DAX) cluster with encryption at rest using a CMK, and attach a resource-based policy to the table.

Answer

Configure the DynamoDB table to use AWS KMS encryption with a CMK, and attach a key policy to the CMK that allows only the specific IAM roles.

Question 14

A database specialist is troubleshooting a connectivity issue with an Amazon RDS for PostgreSQL instance. The instance is in a VPC with a public subnet. The security group allows inbound traffic on port 5432 from the application server's IP address. The application server is in the same VPC but in a private subnet. Despite the security group configuration, the application cannot connect. Which action should the specialist take to resolve the issue?

Accepted Answer

Update the security group inbound rule to allow traffic from the application server's private IP address.. The application server is in a private subnet, so it communicates with the RDS instance using its private IP address. The security group inbound rule must allow traffic from the application server's private IP (or the security group of the application server) on port 5432. The current rule only allows the application server's public IP, which is not used for traffic within the VPC, causing the connection failure.

Answer

Launch the RDS instance in the default VPC.

Answer

Change the DB subnet group to include the application server's subnet.

Answer

Add a network ACL rule allowing inbound traffic on port 5432 from the application server's public IP.

Answer

Modify the RDS instance to be publicly accessible.

Question 15

A company stores financial data in an Amazon Aurora MySQL DB cluster. The security team requires that database audit logs be stored in Amazon CloudWatch Logs and encrypted at rest using a customer-managed KMS key. The database specialist enables audit log publishing to CloudWatch Logs and specifies a KMS key for log encryption. However, the audit logs are not appearing in CloudWatch Logs. What is the most likely cause?

Accepted Answer

The IAM role used for publishing logs does not have the necessary permissions to use the KMS key for CloudWatch Logs.. When publishing database audit logs to CloudWatch Logs with a customer-managed KMS key, the IAM role used by RDS must have explicit permissions for the `kms:Encrypt` and `kms:Decrypt` actions on the KMS key. Without these permissions, RDS cannot encrypt the log stream, and the logs will not appear. Option C correctly identifies this missing permission as the most likely cause.

Answer

The CloudWatch Logs log group does not exist and RDS cannot create it automatically.

Answer

The DB cluster is not configured to export error logs, only audit logs.

Answer

CloudWatch Logs does not support encryption with customer-managed KMS keys for audit logs.

Answer

The audit log parameter is static and requires a DB cluster reboot after modification.

Question 16

A company uses Amazon ElastiCache for Redis to cache session data. The security team requires that all data in transit be encrypted. The Redis cluster currently does not have encryption in transit enabled. The database specialist needs to enable encryption in transit with minimal downtime. Which action should the specialist take?

Accepted Answer

Create a new Redis cluster with encryption in transit enabled, and migrate the data from the existing cluster.. Encryption in transit for ElastiCache for Redis can only be enabled at cluster creation time; it cannot be added to an existing cluster. Therefore, the correct approach is to create a new Redis cluster with encryption in transit enabled, migrate the session data from the existing cluster (e.g., using replication or a manual export/import), and then redirect application traffic to the new cluster. This ensures minimal downtime if the migration is performed during a maintenance window or using a blue/green deployment strategy.

Answer

Update the Redis parameter group to enable the 'encryption-in-transit' parameter and reboot the cluster.

Answer

Use a security group to enforce encrypted connections by allowing only TLS traffic.

Answer

Modify the existing Redis cluster to enable encryption in transit using the AWS CLI.

Answer

Enable encryption in transit on the existing cluster by using the AWS Management Console.

Question 17

A company uses Amazon RDS for SQL Server with Multi-AZ deployment. The security team wants to ensure that all database connections use SSL/TLS encryption. Which TWO actions should the database specialist take to enforce SSL connections? (Choose two.)

Accepted Answer

Create a server-level trigger that requires SSL for all logins.. SQL Server allows you to create a server-level DDL trigger that checks the login event and enforces SSL by examining the `@@OPTIONS` or `encrypt_option` in `sys.dm_exec_connections`. This is a supported method to force SSL for all connections to an RDS for SQL Server instance. Option E is correct because setting the `rds.force_ssl` parameter to 1 in the DB parameter group is the native RDS mechanism to enforce SSL/TLS for all connections to the DB instance.

Answer

Use the RDS Console to enable 'Force SSL' on the DB instance.

Answer

Modify the DB parameter group to set 'require_secure_transport' to ON.

Answer

Add an inbound rule to the security group that only allows traffic on port 1433 from IP addresses that use SSL.

Question 18

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all data be encrypted at rest using a customer-managed KMS key. Additionally, the database should be accessible only from a specific VPC. Which THREE steps should the database specialist take to meet these requirements? (Choose three.)

Accepted Answer

Configure the security group for the RDS instance to allow inbound traffic only from the application security group.. Security groups act as a virtual firewall for RDS instances. By configuring the security group to allow inbound traffic only from the application security group, you restrict database access to specific application servers, meeting the requirement that the database be accessible only from a specific VPC.

Answer

Create a VPC endpoint for RDS and associate it with the DB instance.

Answer

Store the encryption key in Amazon S3 and configure RDS to use it.

Question 19

A company uses Amazon RDS for MySQL with encryption at rest enabled. The security team mandates that all access to the database must be authenticated using IAM database authentication. The database administrator has created a user 'app_user' and granted appropriate privileges. However, when the application tries to connect using an IAM authentication token, it receives an 'Access denied' error. Which action should be taken to resolve this issue?

Accepted Answer

Ensure the IAM role used by the application has a name that matches the database user 'app_user' and has the necessary policy attached.. IAM database authentication for RDS MySQL requires that the database user name matches the IAM role or user name used to generate the authentication token. The IAM role must have a policy that allows the `rds-db:connect` action with a resource ARN specifying the database user. Without this exact match, the authentication token is rejected, resulting in an 'Access denied' error.

Answer

Create a password for 'app_user' and use that password in the connection string.

Answer

Modify the security group to allow inbound traffic on port 3306 from the application's IP address.

Answer

Download the latest Amazon RDS CA certificate and add it to the application trust store.

Question 20

A company is designing a multi-tier application that uses Amazon RDS for PostgreSQL. The application must encrypt data at rest and in transit. Which combination of steps should be taken to meet these requirements? (Choose the single best answer.)

Accepted Answer

Enable encryption at rest when launching the RDS instance, and configure the DB parameter group to require SSL connections.. Amazon RDS for PostgreSQL supports encryption at rest only when enabled at instance launch, and SSL/TLS encryption in transit is enforced by configuring the DB parameter group to require SSL connections (e.g., setting `rds.force_ssl=1`). Encryption at rest cannot be added after creation, and SSL ensures data is encrypted between the application and the database.

Answer

Use client-side encryption for data before sending to RDS, and enable encryption at rest after the instance is created.

Answer

Launch the RDS instance without encryption, then enable encryption at rest using the AWS Console.

Answer

Use AWS KMS to encrypt the connection between the application and RDS.