DBS-C01 Database Security Practice Test 10 — 15 Questions

Question 1

A company has an Amazon S3 bucket that stores database backup files. The backups are encrypted using server-side encryption with AWS KMS (SSE-KMS). The security team wants to ensure that only a specific IAM role can decrypt the backups when restoring the database. Which policy should be attached to the KMS key to achieve this?

Accepted Answer

A KMS key policy that grants kms:Decrypt to the IAM role.. Option D is correct because a KMS key policy can grant the kms:Decrypt permission to a specific IAM role. Option A does not restrict decryption. Option B is for S3 bucket policy, not KMS. Option C is for S3, not KMS.

Answer

An S3 bucket policy that grants kms:Decrypt to the IAM role.

Answer

An S3 bucket policy that grants s3:GetObject to the IAM role.

Answer

An IAM policy attached to the role that grants kms:Decrypt.

Question 2

A company is using Amazon RDS for MySQL to power a web application. The database contains sensitive data, and the security team requires that all connections to the database use SSL/TLS. The team has enabled 'require_secure_transport' parameter in the DB parameter group. However, a developer reports that they are able to connect to the database using a MySQL client without specifying SSL options. What could be the reason?

Accepted Answer

The 'require_secure_transport' parameter is not set to '1' in the DB parameter group.. Option B is correct because RDS offers a '--ssl-mode' option in the MySQL client; if not specified, the client may use SSL by default if the server requires it. But the developer might be using an older client that defaults to non-SSL. The 'require_secure_transport' parameter in RDS forces SSL only for new connections; however, if the client does not request SSL, the server may still accept non-SSL if the parameter is not set correctly. Actually, the correct answer is that the parameter might not be set to '1'. Option B is the most plausible.

Answer

The RDS instance is configured to accept both SSL and non-SSL connections by default.

Answer

The MySQL client automatically upgrades to SSL when the server requires it.

Answer

The developer is connecting from an EC2 instance in the same VPC, which bypasses SSL enforcement.

Question 3

A company is using Amazon DynamoDB with fine-grained access control using IAM policies. The security team wants to ensure that a specific IAM role can only read items from a table where the 'status' attribute equals 'active'. The table is named 'Orders'. Which IAM policy statement should be used?

Accepted Answer

Condition: { 'ForAllValues:StringEquals': { 'dynamodb:Attributes': ['active'] } }. Option C is correct because DynamoDB fine-grained access control uses Condition keys like 'dynamodb:LeadingKeys' or 'dynamodb:Attributes' with a policy variable. The correct condition for row-level security is 'dynamodb:LeadingKeys' if the partition key is 'status', but typically 'dynamodb:Attributes' is used for attribute-level. However, the question asks for item-level access based on attribute value, which is not directly supported; instead, use a condition with the partition key. Option C uses 'ForAllValues:StringEquals' with 'dynamodb:Attributes' to restrict to specific attributes only, not values. Actually, to restrict based on attribute value, you need to use a condition with the key 'dynamodb:LeadingKeys' if the partition key is 'status'. But since the question says 'read items from a table where the 'status' attribute equals 'active'', the correct approach is to use a condition with the partition key. None of the options are perfect; however, Option D is closest because it restricts the partition key value. But the correct answer is none? Let's re-evaluate. In DynamoDB, you can use 'dynamodb:LeadingKeys' to restrict the partition key value. So if 'status' is the partition key, the policy should use 'dynamodb:LeadingKeys' with condition 'StringEquals'. Option D uses 'dynamodb:Select' which is not a valid condition key. Option B uses 'dynamodb:Attributes' which is for attribute-level access, not item-level based on value. Option C uses 'dynamodb:Attributes' correctly for read access to specific attributes, but not value. Option A uses 'dynamodb:ReturnValues', which is not relevant. The correct answer should be a condition on 'dynamodb:LeadingKeys' but not listed. However, Option B is about restricting to specific attributes, which is attribute-level, not item-level. The question might be flawed, but as per exam, Option C is often considered correct for fine-grained access control to items based on attributes. Actually, the correct answer is Option C because it uses 'ForAllValues:StringEquals' with 'dynamodb:Attributes' to restrict read access to only items that have the 'status' attribute set to 'active'? No, 'dynamodb:Attributes' condition checks the attributes that are requested or returned, not their values. For value-based access, you need to use 'dynamodb:LeadingKeys' with the condition on the partition key. Since the question does not specify that 'status' is the partition key, Option C is the best among given.

Answer

Condition: { 'ForAllValues:StringEquals': { 'dynamodb:Attributes': ['status'] } }

Answer

Condition: { 'ForAllValues:StringEquals': { 'dynamodb:ReturnValues': 'ALL_OLD' } }

Answer

Condition: { 'StringEquals': { 'dynamodb:Select': 'SPECIFIC_ATTRIBUTES' } }

Question 4

A company is using Amazon RDS for SQL Server with Multi-AZ deployment. The security team wants to ensure that database audit logs are stored in a secure S3 bucket for long-term retention. The audit logs are currently stored on the RDS instance. Which approach should be used to export the audit logs to S3?

Accepted Answer

Modify the RDS instance to use the 'SQLSERVER_AUDIT' option and specify an S3 bucket as the audit destination.. Option D is correct because RDS for SQL Server supports exporting audit logs to S3 via the 'rds_sqlserver_audit' option group or by using the 'mysql' option? Actually, for SQL Server, you can use the 'SQLSERVER_AUDIT' option and specify an S3 bucket. Option A is for general log files. Option B is for Oracle. Option C is for MySQL.

Answer

Use the Amazon RDS for Oracle 'Audit' feature and specify an S3 bucket as the audit trail destination.

Answer

Enable the 'General Log' option in the RDS parameter group and configure the log destination as S3.

Answer

Configure the RDS instance to publish logs to CloudWatch Logs, and then export CloudWatch Logs to S3 using a subscription filter.

Question 5

A company is using Amazon DynamoDB with a global table. The security team requires that all data be encrypted at rest using a customer-managed KMS key. The table was originally created with AWS managed key encryption. The company wants to switch to a customer-managed key without downtime. What should they do?

Accepted Answer

Create a new table with the customer-managed key, export the data from the old table using AWS Data Pipeline, and import into the new table.. Option C is correct because you cannot modify the encryption key of an existing DynamoDB table. You must create a new table with the desired key and migrate data. Option A is not possible. Option B does not work for global tables? Actually, for global tables, you can update the encryption key? No, it's not supported. Option D is the correct process.

Answer

Use the UpdateTable API to change the KMS key to the customer-managed key.

Answer

Enable DynamoDB Streams on the old table and use a Lambda function to copy data to a new table with the customer-managed key.

Answer

Create a new replica in the global table with the customer-managed key and then delete the old replica.

Question 6

A company is using Amazon RDS for PostgreSQL and wants to implement encryption in transit for all client connections. The security team has identified that some connections are not using SSL. Which TWO actions should the company take to enforce SSL for all connections?

Accepted Answer

Set the 'rds.force_ssl' parameter to '1' in the DB parameter group.. Options A and C are correct. Setting 'rds.force_ssl=1' in the parameter group forces the server to accept only SSL connections. Revoking non-SSL privileges (or modifying pg_hba.conf) ensures no non-SSL users can connect. Option B is unnecessary if the server enforces SSL. Option D is for client-side, not server-side. Option E is for client-side.

Answer

Install the RDS CA certificate on all client machines.

Answer

Create a new SSL certificate and associate it with the RDS instance.

Answer

Configure the application connection string to use 'sslmode=require'.

Question 7

A company is using Amazon Redshift for analytics. The security team wants to audit all SQL queries executed against the database, including the actual query text, for compliance. They also want to ensure that the audit logs are stored in a secure, immutable location. Which THREE services or features should they use together to meet these requirements?

Accepted Answer

Redshift Audit Logging. Options A, C, and E are correct. Redshift Audit Logging captures SQL queries. CloudWatch Logs can be used as a destination for audit logs (via streaming). Then, CloudWatch Logs can export logs to S3, and S3 Object Lock provides immutability. Option B is for performance, not auditing. Option D is for network monitoring.

Answer

VPC Flow Logs

Answer

Redshift Spectrum

Question 8

A company is using Amazon RDS for MySQL and wants to implement database activity monitoring to detect suspicious queries. Which TWO AWS services can be used together to achieve this?

Accepted Answer

AWS Lambda. Options A and D are correct. RDS can publish logs to CloudWatch Logs, and CloudWatch Logs can trigger a Lambda function to analyze logs in real-time. Option B is for vulnerability scanning. Option C is for patching. Option E is for auditing API calls, not database queries.

Answer

AWS CloudTrail

Answer

AWS Systems Manager Patch Manager

Answer

Amazon Inspector

Question 9

A company has an Amazon DynamoDB table that stores user sessions. The security team wants to ensure that only authorized applications can read and write to the table, and that all access is logged. Which THREE steps should the company take to meet these requirements?

Accepted Answer

Enable AWS CloudTrail to log DynamoDB API calls.. Options B, C, and D are correct. IAM roles with least privilege restrict access. AWS CloudTrail logs API calls. VPC endpoints ensure traffic stays within AWS network and can be controlled via endpoint policies. Option A is for auditing, but CloudTrail is more comprehensive. Option E is for encryption, not access control.

Answer

Encrypt the table using a customer-managed KMS key.

Answer

Enable DynamoDB Streams and process events with Lambda.

Question 10

A company runs an e-commerce platform on AWS. The application uses an Amazon RDS for MySQL Multi-AZ database instance. The security team recently conducted an audit and found that the database is accessible from the internet because the public accessibility setting is enabled. The security team has disabled public accessibility and updated the security group to allow inbound traffic only from the application's security group. However, after these changes, the application can no longer connect to the database. The application is running on EC2 instances in the same VPC. The RDS instance is also in the same VPC. The security group for the RDS instance allows inbound MySQL traffic (port 3306) from the application's security group. The application's security group allows all outbound traffic. The application's EC2 instances have a public IP address and are in a public subnet. The RDS instance is in a private subnet. The VPC has an internet gateway attached. What is the most likely cause of the connection failure?

Accepted Answer

The application is using the RDS public DNS name, which no longer resolves after disabling public accessibility.. Option C is correct. When public accessibility is disabled, RDS removes the public IP address. The application's EC2 instances are in a public subnet with public IPs, but they need to communicate with the RDS instance in a private subnet. Since public accessibility is disabled, the RDS instance has only a private IP. The EC2 instances can reach the private IP if they are in the same VPC. However, the issue might be that the security group rule referencing the application's security group is not working because the application's security group is not correctly associated, or there is a network ACL issue. Actually, the most common cause is that the RDS instance's security group is not allowing traffic from the application's security group, but the question says it does allow. Another cause could be that the application is trying to connect using the public DNS name which now resolves to a private IP, but the EC2 instances might not have a route to the private subnet? Wait, they are in the same VPC, so they can reach. The likely cause is that the security group rule is configured with the application's security group ID, but the application's security group is not correctly associated with the EC2 instances, or there is a misconfiguration in the security group rules. Option A is wrong because disabling public accessibility does not change the security group. Option B is wrong because you don't need a NAT gateway for same VPC traffic. Option D is wrong because the RDS instance does not need an internet gateway. The correct answer is that the security group rule might be incorrectly set up, but the question states it allows. Maybe the application is using the public DNS name which after disabling public accessibility, the DNS name still resolves to the private IP? That should work. The most likely is that the security group for the RDS instance is not allowing traffic from the application's security group because the application's security group is in a different region? No. I think the intended answer is Option A: the security group is still configured to allow traffic from the public IP of the EC2 instances, not from the application's security group. But the question says it allows from the application's security group. Actually, the answer might be Option C: the RDS instance is in a private subnet and requires a NAT gateway for outbound traffic, but not for inbound. Inbound traffic from the same VPC does not require a NAT gateway. So Option C is plausible if the application's EC2 instances are in a public subnet and the RDS is in a private subnet, they can still communicate if the security group allows. Perhaps the issue is that the application's EC2 instances have a public IP and are trying to connect via the public endpoint, which is no longer available. The correct action is to ensure the application uses the private DNS name. But the question asks for the most likely cause. I'll go with Option C: The RDS instance is in a private subnet and requires a NAT gateway for inbound connections from the internet, but since the application is in the same VPC, it doesn't. Actually, the answer is likely that the security group for the RDS instance is still referencing the old public IPs, but the question says it references the application's security group. Hmm.

Answer

The RDS instance is in a private subnet and cannot receive inbound traffic from the public subnet EC2 instances without a VPC peering or VPN.

Answer

The security group for the RDS instance still allows traffic from the public IP addresses of the EC2 instances, but the EC2 instances now have different public IPs.

Answer

The EC2 instances need a NAT gateway to communicate with the RDS instance in the private subnet.

Question 11

A company is using Amazon DocumentDB (with MongoDB compatibility) for a content management system. The security team requires that all data be encrypted at rest and in transit. The DocumentDB cluster is already encrypted at rest using AWS KMS. To enforce encryption in transit, the security team wants to ensure that all client connections use TLS. The team has enabled the 'tls' parameter in the cluster parameter group. However, a developer reports that they can still connect to the cluster without specifying TLS options using the mongo shell. The developer is connecting from an EC2 instance in the same VPC. The security group for the DocumentDB cluster allows inbound traffic on port 27017 from the EC2 instance's security group. What is the most likely reason the developer can connect without TLS?

Accepted Answer

The 'tls' parameter was not applied to the cluster because the parameter group was not associated with the cluster or the cluster was not rebooted.. Option B is correct. DocumentDB supports both TLS and non-TLS connections on the same port. Enabling the 'tls' parameter in the parameter group only affects new connections if the client requests TLS; it does not force TLS. To enforce TLS, you must modify the cluster's security group to block non-TLS traffic, or use a different port for TLS. However, DocumentDB does not have a separate port for TLS; the same port can accept both. The parameter 'tls' when set to 'enabled' actually forces TLS for all connections? Actually, in DocumentDB, setting the cluster parameter 'tls' to 'enabled' does enforce TLS; but the developer might be using an older client that does not support TLS. But the question says the developer can connect without specifying TLS options. That suggests that the parameter might not be applied or the cluster was not rebooted. Option A is possible but less likely. Option C is incorrect because TLS is supported. Option D is incorrect because the same VPC does not bypass TLS.

Answer

DocumentDB does not support TLS; it only supports SSL.

Answer

The EC2 instance is in the same VPC, so TLS is not enforced for intra-VPC traffic.

Answer

The developer is using an older version of the mongo shell that does not support TLS.

Question 12

A company is using an Amazon RDS for MySQL DB instance. The security team requires that all database connections be encrypted in transit. Which configuration step ensures this requirement is met?

Accepted Answer

Set the 'require_secure_transport' parameter to 1 in the DB parameter group.. Option A is correct because enabling the 'require_secure_transport' parameter forces clients to use TLS/SSL for connections. Option B is wrong because encryption at rest (RDS encryption) does not enforce in-transit encryption. Option C is wrong because a network ACL controls traffic at the subnet level but does not enforce encryption. Option D is wrong because storing secrets in AWS Secrets Manager does not enforce encrypted connections.

Answer

Enable encryption at rest for the RDS instance.

Answer

Store the database password in AWS Secrets Manager.

Answer

Modify the network ACL to only allow traffic on port 3306.

Question 13

A company uses Amazon DynamoDB to store sensitive user data. The security team wants to ensure that all data is encrypted at rest using a customer-managed AWS KMS key. The DynamoDB table was created with the default AWS managed key. What is the required action to change the encryption key?

Accepted Answer

Create a new DynamoDB table with the desired KMS key, export data from the old table, and import into the new table.. Option D is correct because DynamoDB encryption at rest uses KMS and the encryption key can only be changed when creating a new table. You cannot modify the encryption key on an existing table. Option A is wrong because there is no UpdateTable API for encryption key. Option B is wrong because the default key cannot be deleted if in use. Option C is wrong because KMS key rotation does not change the key material used by DynamoDB.

Answer

Use the UpdateTable API to specify the new KMS key.

Answer

Enable automatic key rotation on the existing KMS key.

Answer

Delete the default AWS managed key and create a new customer managed key.

Question 14

A developer is configuring an Amazon RDS for PostgreSQL DB instance. The application connects using IAM database authentication. Which setting must be enabled on the DB instance for IAM authentication to work?

Accepted Answer

Set the 'rds.force_ssl' parameter to 1.. Option B is correct because IAM database authentication requires the 'rds.force_ssl' parameter to be set to 1 to enforce TLS connections. Option A is wrong because IAM authentication does not require the database port to be changed. Option C is wrong because the master username is still used for IAM authentication. Option D is wrong because the DB instance can be in a VPC; IAM authentication works within a VPC.

Answer

Set the database port to 5432.

Answer

Ensure the DB instance is publicly accessible.

Answer

Change the master username to 'iam_user'.

Question 15

A company is using Amazon Redshift for data warehousing. The security team requires column-level access control so that certain users cannot view specific columns containing PII. Which approach should the data engineer implement?

Accepted Answer

Create views that exclude the sensitive columns and grant SELECT on the views to the users.. Option D is correct because Redshift supports column-level security via views that restrict columns, and you grant access to the view instead of the table. Option A is wrong because Redshift does not support column-level GRANT. Option B is wrong because row-level security does not restrict columns. Option C is wrong because column-level encryption is not natively supported in Redshift and would require application changes.

Answer

Implement row-level security policies using CREATE ROW LEVEL SECURITY POLICY.

Answer

Use GRANT SELECT ON table (col1, col2) TO user.

Answer

Encrypt the sensitive columns using AWS KMS and decrypt in the application.