DBS-C01 Database Security Practice Test 10 — 15 Questions

Question 1

A company uses Amazon RDS for SQL Server with Multi-AZ deployment. The security team wants to ensure that all data at rest is encrypted using a customer-managed KMS key in both the primary and standby instances. Which THREE actions are required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Specify a customer-managed KMS key during creation.. Option B is correct because when you create an RDS for SQL Server DB instance you must explicitly choose a customer-managed KMS key in the encryption settings; if you leave the default, RDS uses the AWS-managed key aws/rds, which does not satisfy the requirement for a customer-managed key. Option D is correct because Multi-AZ must be enabled at creation time (or the instance must be converted to Multi-AZ) so that the standby instance is provisioned and encrypted with the same KMS key as the primary, ensuring encryption at rest on both nodes. Option E is correct because encryption at rest must be enabled when the DB instance is created; RDS does not allow you to enable encryption on an existing unencrypted SQL Server instance, so you must turn it on during creation (or restore from an encrypted snapshot). Option A is not correct because RDS automatically uses the same KMS key for the primary and standby instances; a separate key for the standby is neither required nor supported. Option C is not correct because RDS for SQL Server encrypts data at rest at the storage layer using KMS, not by requiring you to manually enable TDE; TDE is an optional database-level feature and is not the mechanism that satisfies the KMS encryption requirement.

Answer

Create a separate KMS key for the standby instance.

Answer

Enable Transparent Data Encryption (TDE) on the instance.

Question 2

A user is unable to list the contents of the S3 bucket 'my-db-backups' using the AWS CLI. The IAM policy attached to the user is shown in the exhibit. What is the likely cause?

Accepted Answer

The policy does not grant 's3:ListBucket' permission.. The IAM policy shown in the exhibit grants only object-level permissions (e.g., s3:GetObject, s3:PutObject) on the bucket's objects, but does not include the s3:ListBucket action. The 'aws s3 ls s3://my-db-backups' command requires s3:ListBucket on the bucket ARN itself (arn:aws:s3:::my-db-backups), not on the object ARN (arn:aws:s3:::my-db-backups/*). Without that action, the CLI returns Access Denied.

Answer

The user is using the wrong bucket name.

Answer

The resource ARN is missing the bucket-level ARN needed for listing.

Answer

The policy has a syntax error.

Question 3

A company uses Amazon RDS for PostgreSQL and wants to audit all database login attempts. Which TWO services can be used together to achieve this?

Accepted Answer

Enable AWS CloudTrail.. Option A (AWS CloudTrail) is correct because RDS API calls such as ModifyDBInstance and CreateDBInstance, including the enabling of IAM database authentication and related configuration changes, are recorded as management events in CloudTrail, giving an audit trail of control-plane actions tied to database access setup. Option E (RDS for PostgreSQL logging to CloudWatch Logs) is correct because PostgreSQL's connection and authentication events (for example, log_connections and log_disconnections, plus failed-login messages) can be exported to CloudWatch Logs, where they can be queried and retained for auditing actual login attempts. Together, CloudTrail captures the AWS-level API activity and CloudWatch Logs captures the database-engine-level login events, satisfying the requirement to audit all login attempts. Option B (VPC Flow Logs) is not correct because it only records IP traffic metadata (source/destination, ports, accept/reject) and cannot identify database users or authentication outcomes. Option C (S3 access logs) is not correct because it records requests made to S3 buckets, not RDS API calls or PostgreSQL logins. Option D (RDS Enhanced Monitoring) is not correct because it provides OS-level metrics such as CPU, memory, and disk I/O, not authentication or login auditing.

Answer

Enable VPC Flow Logs.

Answer

Enable S3 access logs to capture API calls.

Answer

Enable RDS Enhanced Monitoring.

Question 4

A company runs a production Amazon DynamoDB table with on-demand capacity. The security team requires that all access to the table be logged for compliance. What is the most cost-effective way to log every DynamoDB API call?

Accepted Answer

Enable AWS CloudTrail and create a trail that delivers logs to Amazon CloudWatch Logs.. AWS CloudTrail logs every DynamoDB API call (control plane and data plane) and can deliver those logs to CloudWatch Logs for compliance retention and analysis. This is the most cost-effective way to capture all API calls because CloudTrail is the native auditing service for AWS API activity. DynamoDB Streams captures item-level changes, not API calls, and VPC Flow Logs capture network traffic, not API-level auditing.

Answer

Enable DynamoDB Streams on the table and process the stream with AWS Lambda.

Answer

Enable Amazon CloudWatch Logs to capture DynamoDB API calls.

Answer

Enable VPC Flow Logs and analyze them with Amazon Athena.

Question 5

A CloudFormation template is used to create an RDS DB instance with encryption, as shown in the exhibit. The stack creation fails because the DB instance creation fails. What is the most likely cause?

Accepted Answer

The DB instance depends on the KMS key, but there is no DependsOn clause to ensure the key is created first.. In CloudFormation, when a resource references another resource (like a KMS key) via Ref or GetAtt, CloudFormation automatically creates an implicit dependency and creates the referenced resource first. However, if the KMS key is referenced only by its ARN as a string (not via Ref/GetAtt), there is no implicit dependency, so the DB instance may be created before the KMS key exists, causing failure. The correct fix is to add a DependsOn clause to ensure the KMS key is created first.

Answer

The DB instance has StorageEncrypted set to true but KmsKeyId is not a valid ARN.

Answer

The KMS key policy does not grant permissions to the RDS service principal.

Answer

The KmsKeyId property requires the key ARN, not a reference.

Question 6

A company uses Amazon RDS for MySQL and wants to ensure that database users are authenticated using IAM database authentication. Which action must be performed to enable this?

Accepted Answer

Set the parameter 'require_secure_transport' to ON and use the AWSAuthenticationPlugin.. To enable IAM database authentication on RDS for MySQL, you must set the require_secure_transport parameter to ON (IAM auth requires SSL/TLS) and use the AWSAuthenticationPlugin, which is the MySQL plugin that validates IAM-generated tokens. The database user must also be created with the AWSAuthenticationPlugin identified, but the key configuration action is the parameter plus plugin.

Answer

Create database users with MySQL native password authentication.

Answer

Attach an IAM role to the RDS instance for database authentication.

Answer

Change the database port to 3306 to enable IAM authentication.

Question 7

A company wants to audit all SQL queries made to their Amazon RDS for MySQL database. Which AWS service should they use?

Accepted Answer

Database Activity Streams. Database Activity Streams (D) is the correct choice because it provides a near-real-time stream of database activity, including all SQL queries, directly from the RDS for MySQL engine. This service integrates with AWS services like Amazon Kinesis and third-party monitoring tools to capture and audit every SQL statement, user login, and schema change at the database engine level, which is essential for comprehensive auditing.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

AWS CloudTrail

Question 8

A company wants to ensure that an Amazon RDS for MySQL database is automatically backed up daily and backups are encrypted. What should they do?

Accepted Answer

Enable automated backups and encryption at rest on the RDS instance.. Amazon RDS supports automated backups and encryption at rest as native features. Enabling automated backups configures a daily backup window and retains backups for a specified retention period (up to 35 days), and enabling encryption at rest encrypts the underlying storage, automated backups, read replicas, and snapshots. This directly satisfies the requirement for automatic daily backups and encrypted backups without custom scripting.

Answer

Take manual snapshots daily and enable encryption on the snapshot copy.

Answer

Use Amazon CloudWatch Events to trigger a Lambda function that exports the database to S3 with encryption.

Answer

Configure AWS Backup to back up the RDS instance to an S3 bucket with default encryption.

Question 9

A company is using Amazon DynamoDB with encryption at rest using an AWS managed key. The security team now requires that the encryption key be rotated every 90 days. What should they do?

Accepted Answer

Use a customer managed key and manually rotate it every 90 days by creating a new key and updating the DynamoDB table.. DynamoDB tables encrypted with an AWS managed key (aws/dynamodb) cannot have their key rotation controlled by the customer — AWS manages rotation automatically (typically every 3 years) and does not allow custom rotation schedules. To meet a 90-day rotation requirement, the customer must switch to a customer managed key (CMK) and perform manual rotation, because DynamoDB does not support automatic KMS key rotation for table encryption keys. The correct approach is to create a new CMK, update the table to use it, and repeat every 90 days — which is exactly what option D describes.

Answer

Enable automatic key rotation in AWS KMS for the default DynamoDB key.

Answer

Create a new customer managed key and enable automatic rotation every 90 days.

Answer

Disable encryption at rest and implement client-side encryption.

Question 10

A company is using Amazon RDS for PostgreSQL and needs to audit login attempts. Which configuration is required?

Accepted Answer

Set rds.log_connections to 1 in the DB parameter group.. The correct option is A: setting rds.log_connections to 1 in the DB parameter group. For Amazon RDS for PostgreSQL, this parameter enables logging of connection and disconnection events, including login attempts, to the PostgreSQL log, which can then be reviewed or exported to CloudWatch Logs. Option B is incorrect because AWS CloudTrail records RDS API management actions, not database-level login attempts. Option C is incorrect because security groups do not provide traffic logging; that would require VPC Flow Logs, and even then it would not capture PostgreSQL authentication events. Option D is incorrect because Enhanced Monitoring reports OS-level metrics such as CPU and memory, not database login auditing.

Answer

Enable AWS CloudTrail for the RDS instance.

Answer

Modify the security group to log all inbound traffic on port 5432.

Answer

Enable RDS Enhanced Monitoring.

Question 11

Which THREE measures can help protect an Amazon RDS database from a DDoS attack? (Choose 3.)

Accepted Answer

Place the RDS instance in a private subnet without direct internet access.. Placing the RDS instance in a private subnet without direct internet access (Option A) prevents any external traffic from reaching the database endpoint, removing the attack surface entirely. Using security groups to restrict inbound traffic to known IP addresses (Option B) limits the sources that can initiate connections, reducing the potential for volumetric attacks. AWS Shield Advanced (Option D) provides additional DDoS mitigation capabilities, including detection and automatic application-layer protections. These three measures work together to defend against different attack vectors.

Answer

Make the RDS instance publicly accessible for easy monitoring.

Answer

Disable audit logging to reduce resource usage.

Question 12

Which TWO AWS services can be used to monitor and alert on suspicious database access patterns in Amazon RDS? (Choose 2.)

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch (B) is correct because it collects RDS metrics and database logs (e.g., via CloudWatch Logs for audit, error, and slow query logs) and lets you create metric filters and alarms that trigger on suspicious access patterns such as unusual connection counts or failed logins. Amazon GuardDuty (E) is correct because it continuously analyzes CloudTrail management events, VPC Flow Logs, and DNS logs with threat intelligence and ML to detect anomalous or malicious activity, including suspicious access to RDS resources and related credentials. Amazon Inspector (A) is a vulnerability management service that scans EC2, Lambda, and container workloads for software vulnerabilities and unintended network exposure, not database access monitoring. AWS Trusted Advisor (C) provides best-practice checks for cost, security, fault tolerance, and service limits, but it does not monitor database access patterns. AWS Config (D) records resource configuration changes and evaluates compliance rules, so it tracks configuration drift rather than suspicious runtime database access behavior.

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 13

Refer to the exhibit. An IAM policy is attached to a user. The user attempts to delete a DB instance named 'prod-db'. What will happen?

Accepted Answer

The delete will fail because of the explicit Deny statement.. In AWS IAM, an explicit Deny statement always overrides any Allow statement, regardless of the order or specificity of the policies. If the attached policy contains a Deny for the rds:DeleteDBInstance action on the prod-db resource (or a wildcard matching it), the delete request is unconditionally blocked. The Allow statement granting modify permissions cannot override the explicit Deny, so the operation fails with an AccessDenied error.

Answer

The delete will succeed because the Allow statement grants modify permission.

Answer

The delete will succeed because the resource is 'prod-db' which does not match the deny pattern.

Answer

The delete will succeed only if the user has MFA enabled.

Question 14

Refer to the exhibit. A company has an S3 bucket with server-side encryption using AWS KMS. The bucket policy allows access to a user, but the user receives 'Access Denied' when trying to download an object. The IAM policy for the user is shown. What is the MOST likely cause?

Accepted Answer

The policy has a condition that limits kms:Decrypt to when the request is made through the S3 service, but the user might be using a different service to access the object (e.g., directly via KMS API).. The most likely cause is that the IAM policy includes a condition that restricts kms:Decrypt to requests made through the S3 service (e.g., using the aws:ViaAWSService condition key). If the user is accessing the object directly via the KMS API or another service, the condition fails, resulting in Access Denied. This is a common pattern to enforce encryption context or service-specific access.

Answer

The user does not have MFA enabled.

Answer

The KMS key ID in the policy is incorrect.

Answer

The policy does not allow kms:Decrypt for the S3 bucket.

Question 15

A security audit reveals that an Amazon RDS for MySQL DB instance is accessible from the internet. The security team requires that the database be accessible only from a specific set of application servers within the same VPC. Which solution should be implemented?

Accepted Answer

Modify the DB instance's security group to allow inbound traffic only from the application servers' security group.. RDS security groups control inbound access at the instance level. By modifying the DB instance's security group to allow inbound traffic only from the application servers' security group, you ensure that only those instances can reach the database, effectively removing internet accessibility. This is the least disruptive and most precise solution.

Answer

Apply a network ACL that denies inbound traffic from 0.0.0.0/0 and allows from the application servers' IP range.

Answer

Enable encryption at rest on the DB instance to prevent unauthorized access.

Answer

Move the DB instance to a private subnet and configure a bastion host for access.