DBS-C01 Database Security Practice Test 11 — 15 Questions

Question 1

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all data be encrypted at rest using a key stored in AWS CloudHSM. What must be done to meet this requirement?

Accepted Answer

Use Oracle Transparent Data Encryption (TDE) with CloudHSM as the key store.. Option C is correct because RDS for Oracle supports TDE (Transparent Data Encryption) which can use CloudHSM as the key store. Option A is wrong because RDS at rest encryption uses KMS, not CloudHSM directly. Option B is wrong because RDS does not support custom encryption directly via CloudHSM. Option D is wrong because SSL is for in-transit, not at rest.

Answer

Enable RDS encryption at rest using a KMS key backed by CloudHSM.

Answer

Create an encrypted file system on the RDS instance using CloudHSM.

Answer

Configure SSL/TLS for the database connection.

Question 2

A security engineer is designing access controls for an Amazon DynamoDB table containing customer data. Which TWO actions enforce least privilege access?

Accepted Answer

Use IAM conditions to restrict access to specific attributes.. Options B and D are correct. Using IAM conditions to restrict access to specific attributes (B) and using fine-grained access control with IAM (D) enforce least privilege. Option A is wrong because wildcard actions grant full access. Option C is wrong because DynamoDB does not have VPC endpoints that limit table access. Option E is wrong because resource-based policies are not supported for DynamoDB tables.

Answer

Grant dynamodb:* action to all users.

Answer

Use a resource-based policy on the DynamoDB table.

Answer

Attach a VPC endpoint policy that allows all actions.

Question 3

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The security team wants to audit all database logins and queries. Which TWO actions should be taken to enable auditing?

Accepted Answer

Publish MySQL logs to Amazon CloudWatch Logs.. Options C and D are correct. Enabling the general_log (C) captures all queries, and exporting logs to CloudWatch Logs (D) allows analysis. Option A is wrong because enhanced monitoring is for performance, not queries. Option B is wrong because event notifications are for instance events, not queries. Option E is wrong because RDS does not support AWS CloudTrail for database queries.

Answer

Enable AWS CloudTrail data events for RDS.

Answer

Create an RDS event notification subscription.

Answer

Enable Enhanced Monitoring.

Question 4

A company is using Amazon Redshift and needs to encrypt data at rest with a customer-managed key. Which THREE steps are required to enable encryption with a customer-managed AWS KMS key?

Accepted Answer

Create a customer-managed key in AWS KMS.. Options A, B, and D are correct. You must create a KMS key (A), specify it during cluster creation (B), and modify the cluster to use encryption if not already encrypted (D). Option C is wrong because Redshift does not use CloudHSM for KMS-based encryption. Option E is wrong because only the cluster owner can manage encryption; AWS does not manage it.

Answer

Configure the Redshift cluster to use an HSM.

Answer

Request AWS Support to enable encryption.

Question 5

A database administrator is troubleshooting why Amazon RDS Enhanced Monitoring is not displaying metrics for a DB instance. The IAM role attached to the instance has the policy shown in the exhibit. What is the likely cause?

Accepted Answer

The policy is missing the 'rds:CreateDBInstance' action.. Option D is correct because Enhanced Monitoring requires the 'rds:CreateDBInstance' permission for the monitoring role, which is missing. Option A is wrong because the actions listed are valid. Option B is wrong because the resource is '*' which includes all. Option C is wrong because the actions are allowed, not denied.

Answer

The policy denies the 'rds:DescribeDBInstances' action.

Answer

The policy does not include 'monitoring:ListMetrics'.

Answer

The resource is set to '*' instead of the specific DB instance ARN.

Question 6

A security auditor notices that the DynamoDB table 'UserData' is encrypted with a KMS key (exhibit). The company policy requires that all DynamoDB tables use an AWS managed key for encryption. What must be done to comply with the policy?

Accepted Answer

Create a new DynamoDB table with SSE enabled using the AWS managed key, then export data from the existing table and import into the new table.. Option A is correct because you cannot change the encryption key of an existing table; you must create a new table with the AWS managed key and migrate data. Option B is wrong because you cannot change the key on an existing table. Option C is wrong because deleting the key would break access. Option D is wrong because the table is already encrypted, just not with the required key.

Answer

Delete the customer managed KMS key and recreate it as an AWS managed key.

Answer

Modify the table's SSE configuration to use the AWS managed key.

Answer

Use the UpdateTable API to change the KMS key to the AWS managed key.

Question 7

A developer is checking the encryption status of an RDS MySQL instance. The CLI output shows StorageEncrypted is true. What does this indicate?

Accepted Answer

The database is encrypted at rest using a KMS key.. Option C is correct because StorageEncrypted: true means the data at rest is encrypted using the specified KMS key. Option A is wrong because it does not indicate in-transit encryption. Option B is wrong because the key is a KMS key, not necessarily AWS managed. Option D is wrong because encryption at rest is enabled.

Answer

Connections to the database are encrypted in transit.

Answer

The database is encrypted using the AWS managed key for RDS.

Answer

The database does not have encryption at rest enabled.

Question 8

A financial services company runs a critical application on Amazon RDS for PostgreSQL. The database stores sensitive customer financial data. The security team has mandated that all access to the database must be through IAM database authentication to eliminate the need for passwords. The application currently uses a master user password stored in AWS Secrets Manager. The DBA needs to implement IAM authentication without downtime. The application is deployed on Amazon ECS and connects to the database using a connection string. The DBA has already created an IAM role for the ECS task with a policy that allows rds-db:connect. The DBA has also modified the DB instance to require SSL. However, after making these changes, the application cannot connect. The error message indicates 'IAM authentication is not enabled for this user'. What step did the DBA miss?

Accepted Answer

The DBA did not create a database user that is set to use IAM authentication.. Option B is correct because IAM database authentication requires that the database user be created with the IAM authentication method (using the CREATEROLE option and granting rds_iam role). Without creating a user that is mapped to the IAM role, authentication fails. Option A is wrong because the IAM role is already created. Option C is wrong because IAM authentication does not require a password; it uses authentication tokens. Option D is wrong because the port does not need to be changed.

Answer

The DBA did not attach the IAM policy to the ECS task role.

Answer

The DBA did not enable the 'password' authentication method.

Answer

The DBA did not update the security group to allow traffic on port 5432.

Question 9

A retail company uses Amazon DynamoDB to store product catalog data. The security team wants to ensure that only authorized applications can read and write to the table. The applications are running on Amazon EC2 instances. The current setup uses an IAM role attached to the EC2 instance with a policy that grants dynamodb:* on the specific table. However, during a security audit, it was discovered that any process on the EC2 instance can access the table because the instance has access to the temporary credentials from the instance metadata service. The security team requires that only specific processes (the application) can access the credentials, and that the credentials cannot be extracted from the instance. What should be done to meet these requirements?

Accepted Answer

Create a VPC endpoint for DynamoDB with a policy that restricts access to the specific IAM role, and configure the EC2 instance to use IMDSv2 with a hop limit.. Option D is correct because using a VPC endpoint with a policy that restricts access to the specific IAM role ARN ensures that only requests from that role are allowed, and using IMDSv2 with hop limit prevents credential theft. Option A is wrong because restricting to VPC does not enforce role usage. Option B is wrong because attaching a resource-based policy is not supported for DynamoDB. Option C is wrong because using an access key on the instance is less secure.

Answer

Modify the security group to only allow traffic from the EC2 instance's private IP.

Answer

Store AWS access keys on the EC2 instance and use them in the application.

Answer

Attach a resource-based policy to the DynamoDB table allowing only the EC2 instance's IAM role.

Question 10

A small business runs a web application on a single Amazon RDS for MySQL DB instance. The application uses a master user account for all database operations. The security team is concerned about the risk of SQL injection and wants to implement the principle of least privilege. They want to create separate database users for read-only and read-write operations. The application currently uses a single connection string. The developer needs to modify the application to use two separate users. What is the correct approach to implement this securely?

Accepted Answer

Create a read-only user and a read-write user in the database, grant minimal privileges, and modify the application to use the appropriate user for each operation.. Option C is correct because creating two users with appropriate grants and modifying the application to use them based on the operation reduces risk. Option A is wrong because using a single user does not enforce least privilege. Option B is wrong because IAM database authentication is a different mechanism but does not solve the user separation issue. Option D is wrong because stored procedures do not eliminate the need for separate users.

Answer

Use stored procedures for all database operations and grant execute only to the master user.

Answer

Keep using the master user but restrict its IP address.

Answer

Enable IAM database authentication and use a single IAM role.

Question 11

A healthcare company is migrating its patient records database to Amazon RDS for SQL Server. The database contains Protected Health Information (PHI). The compliance team requires that all PHI data be encrypted at rest and that the encryption keys be stored in a dedicated AWS CloudHSM cluster. Additionally, the database must be replicated to a second AWS region for disaster recovery. The DBA has enabled RDS encryption at rest using a KMS key, but the compliance team insists on using CloudHSM. What should the DBA do to meet the compliance requirement while maintaining disaster recovery?

Accepted Answer

Enable Transparent Data Encryption (TDE) using a CloudHSM key and create a cross-region read replica for DR.. Option B is correct because RDS for SQL Server supports Transparent Data Encryption (TDE) which can use CloudHSM as the key store. Multi-AZ deployments support cross-region read replicas, allowing DR. Option A is wrong because RDS encryption at rest cannot use CloudHSM directly. Option C is wrong because moving to DynamoDB is unnecessary and does not use CloudHSM. Option D is wrong because using an RDS Custom instance with TDE and manual replication is more complex and not recommended.

Answer

Use RDS encryption at rest with a KMS key backed by CloudHSM (custom key store).

Answer

Migrate the database to Amazon DynamoDB with encryption using CloudHSM via KMS custom key store.

Answer

Use an RDS Custom for SQL Server instance and configure TDE with CloudHSM, then set up log shipping to another region.

Question 12

A security engineer reviews the IAM policy attached to a user. The user is unable to modify any RDS DB instance, even when MFA is enabled. What is the most likely cause?

Accepted Answer

The user does not have MFA enabled, or the instance name does not match the allowed prefixes.. Option A is correct because the policy does not grant the rds:ModifyDBInstance action for all instances; it only allows for prod-* without condition and dev-* with MFA, but the user might be trying to modify an instance that doesn't match either pattern, or the user does not have MFA enabled. However, the question states the user cannot modify ANY instance, so the most likely cause is that the user does not have MFA enabled or the instance is not in the allowed patterns. Option B is wrong because the policy is for RDS, not EC2. Option C is wrong because the policy allows ModifyDBInstance, not just read. Option D is wrong because the policy does have conditions.

Answer

The policy is missing the ec2:ModifyInstance permission.

Answer

The policy does not include a Deny statement for RDS actions.

Answer

The user is trying to use the RDS console, but the policy only allows API calls.

Question 13

A company stores sensitive data in an Amazon RDS for PostgreSQL DB instance. The security team requires that all data at rest be encrypted. The instance is currently unencrypted. What is the simplest way to enable encryption with minimal downtime?

Accepted Answer

Create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the snapshot to a new encrypted DB instance.. Option C is correct because creating a snapshot, copying it with encryption, and restoring a new encrypted instance is the standard approach. Option A is wrong because enabling encryption on an existing instance is not supported. Option B is wrong because moving to RDS Custom is unnecessary. Option D is wrong because you cannot modify an existing instance to enable encryption directly.

Answer

Use the AWS CLI to modify the DB instance and enable encryption.

Answer

Migrate the data to an Amazon RDS for PostgreSQL DB instance using RDS Custom.

Answer

Modify the DB instance and enable encryption in the console.

Question 14

A company uses an Amazon RDS for MySQL DB instance that needs to be accessed by a Lambda function. Which TWO steps should be taken to ensure secure access?

Accepted Answer

Create an IAM role for the Lambda function with permissions to use RDS IAM database authentication.. Options B and D are correct. Placing the Lambda function in the same VPC and using an IAM role with least privilege are security best practices. Option A is wrong because storing credentials in Lambda environment variables is not secure. Option C is wrong because using the database master user for Lambda is insecure. Option E is wrong because a NAT gateway is not needed for RDS access within the same VPC.

Answer

Store the database credentials in the Lambda environment variables.

Answer

Use the database master user account for the Lambda function.

Answer

Attach a NAT gateway to the Lambda function's VPC for outbound internet access.

Question 15

A company is designing a secure strategy for managing Amazon RDS for Oracle encryption keys. They want to use AWS KMS with Customer Master Keys (CMKs) for encryption at rest. Which THREE best practices should they follow?

Accepted Answer

Grant the RDS service principal (rds.amazonaws.com) only the necessary KMS permissions to use the CMK.. Options A, C, and D are correct. Using separate KMS keys for different environments provides isolation, enabling automatic key rotation is a security best practice, and granting least privilege access to KMS keys is fundamental. Option B is wrong because storing the CMK in the database is insecure. Option E is wrong because disabling key rotation is not recommended.

Answer

Disable key rotation to maintain consistent encryption across all snapshots.

Answer

Store the KMS CMK inside the Oracle database for faster encryption.