DBS-C01 Database Security Practice Test 11 — 15 Questions

Question 1

A database administrator needs to audit all SQL statements executed on an Amazon RDS for Oracle DB instance. The audit logs must be stored in Amazon S3 for long-term retention and analysis with Amazon Athena. Which solution meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Oracle's unified auditing and stream audit logs to CloudWatch Logs, then export to S3.. For auditing all SQL statements on RDS for Oracle, you must enable Oracle's native auditing (unified auditing or traditional auditing) and configure the audit logs to be published to CloudWatch Logs via the RDS log export feature. From CloudWatch Logs, you can export the logs to Amazon S3 for long-term retention and then query them with Amazon Athena. This meets the requirement to audit SQL statements and store them in S3 for Athena analysis.

Answer

Enable Enhanced Monitoring on the RDS instance and publish logs to CloudWatch Logs.

Answer

Enable AWS CloudTrail to capture RDS API calls and store them in S3.

Answer

Enable detailed billing reports and configure them to include database queries.

Question 2

A security engineer is designing a disaster recovery plan for an Amazon DynamoDB table that contains sensitive data. The table is encrypted using an AWS KMS customer managed key (CMK). The engineer needs to ensure that the table can be restored in a different AWS Region. Which TWO actions must be taken to enable cross-region restores with the same encryption? (Choose TWO.)

Accepted Answer

Enable point-in-time recovery (PITR) on the table.. Option A is correct because DynamoDB cross-Region restore from a backup requires point-in-time recovery (PITR) to be enabled on the source table; PITR creates the continuous backups that can be restored into another Region. Option D is correct because the table is encrypted with a customer managed KMS key, and to restore in a different Region with the same encryption the key material must exist there, which is achieved by creating a multi-Region KMS key and replicating it to the destination Region. Option B is not required because global tables provide multi-Region replication of live data, not the backup/restore mechanism needed for cross-Region restores. Option C is unnecessary because exporting to S3 and copying objects does not restore a DynamoDB table with its original KMS encryption. Option E is wrong because CloudHSM keys are not the KMS CMK used by DynamoDB and do not enable cross-Region restores with the same encryption.

Answer

Enable DynamoDB global tables.

Answer

Export the table to S3 and copy the S3 objects to the destination Region.

Answer

Create a CloudHSM key and use it for encryption.

Question 3

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database contains sensitive personally identifiable information (PII). The security team requires that the data be encrypted in transit between the application and the RDS instance, and also encrypted at rest using a key managed by the company. Which THREE actions should the company take? (Choose THREE.)

Accepted Answer

Configure the RDS instance to require SSL/TLS connections.. Options A, C, and E are correct. Option A: Configuring the RDS instance to require SSL/TLS encrypts data in transit, meeting the encryption-in-transit requirement. Option C: Enabling encryption at rest for the RDS instance at launch time allows use of AWS KMS for encryption, satisfying the at-rest encryption requirement. Option E: Creating a customer managed key (CMK) in AWS KMS enables the company to manage the encryption key, meeting the requirement for a key managed by the company. Option B is incorrect because setting rds.force_ssl to 1 in the DB parameter group is a step within configuring SSL/TLS, but the primary action is option A; moreover, the correct method to enforce SSL for Oracle RDS involves using the option group with the SSL option, not just the parameter group. Option D is incorrect because Transparent Data Encryption (TDE) using CloudHSM is not required; the at-rest encryption requirement is already fulfilled by enabling RDS encryption with a CMK (options C and E), and TDE with CloudHSM adds unnecessary complexity and potential licensing issues.

Answer

Modify the DB parameter group to set the 'rds.force_ssl' parameter to 1.

Answer

Enable Transparent Data Encryption (TDE) using CloudHSM.

Question 4

A database administrator has the IAM policy shown above attached to their user. When they try to run the AWS CLI command `aws rds describe-db-instances --region us-west-2`, they receive an access denied error. Why does this fail?

Accepted Answer

The policy explicitly restricts the resource to a specific DB instance ARN in us-east-1, and the command specifies a different region.. The IAM policy attached to the user restricts the rds:DescribeDBInstances action to a specific DB instance ARN located in us-east-1 (via the Resource element). When the CLI command targets us-west-2, the request is evaluated against a resource ARN in a different region, which does not match the policy's Resource, so the request is implicitly denied. IAM policies are region-aware through the resource ARN, and a mismatch results in AccessDenied.

Answer

The user must use multi-factor authentication (MFA) to perform the describe action.

Answer

The user does not have permission to describe DB instances in any region.

Answer

The policy includes a condition key that denies access when the region is not us-east-1.

Question 5

A financial services company uses Amazon DynamoDB to store transaction data. The table is encrypted with an AWS managed KMS key. The compliance team requires that the encryption key be rotated every 90 days. The current key was created 6 months ago and has not been rotated. The company also needs to ensure that all access to the table is logged for audit purposes. The security engineer proposes to enable DynamoDB Streams and AWS CloudTrail. However, the compliance team notes that CloudTrail only logs management plane events (e.g., CreateTable) and not data plane events (e.g., GetItem, PutItem). What should the engineer do to meet both requirements?

Accepted Answer

Create a customer managed KMS key, enable automatic key rotation, and configure CloudTrail to log data events for the DynamoDB table.. To meet both requirements, the engineer should create a customer managed KMS key, enable automatic key rotation (which rotates the key annually, but for 90-day rotation, the engineer can create a new key every 90 days and update the table), and configure CloudTrail to log data events for the DynamoDB table. CloudTrail data events capture data plane operations like GetItem and PutItem, which addresses the logging requirement. Option A is incorrect because AWS managed keys do not support automatic rotation; also, CloudTrail data events are not tied to key type. Option B is incorrect because switching to a customer managed key alone does not enable data event logging. Option C is incorrect because DynamoDB Streams are used for change data capture and streaming to other services, not for audit logging of data plane operations; CloudWatch Logs from Streams do not capture all API calls.

Answer

Use AWS CloudTrail data events to capture DynamoDB data plane operations and store the logs in S3.

Answer

Switch to an AWS managed KMS key and enable automatic rotation.

Answer

Enable DynamoDB Streams and stream write events to CloudWatch Logs for auditing.

Question 6

A startup is using Amazon RDS for MySQL as its primary database. The database contains user profiles and payment information. The security team wants to ensure that database snapshots are encrypted and that the encryption key is managed by the company. The team also wants to enforce that all future snapshots are encrypted automatically. The current RDS instance is not encrypted. What should they do?

Accepted Answer

Create a new encrypted RDS instance, migrate the data, and point the application to the new instance.. The correct answers are B and D because RDS encryption can only be enabled at instance creation time or by restoring from an encrypted snapshot. Option B creates a new encrypted instance with a customer-managed KMS key and migrates data, ensuring all future snapshots inherit encryption. Option D uses snapshot copy with encryption, which produces an encrypted snapshot that can be restored to a new encrypted instance, also satisfying the requirement for customer-managed keys and automatic encryption of future snapshots.

Answer

Enable encryption on the existing RDS instance by modifying the DB instance.

Answer

Use AWS KMS to encrypt the underlying EBS volumes of the RDS instance.

Question 7

A company has a multi-account AWS environment using AWS Organizations. The security team wants to centrally manage database encryption keys for all Amazon RDS instances across accounts. They require that the keys be stored in a single account, and that each account can use the key to encrypt its RDS instances. Additionally, they want to automatically rotate the keys every year. Which solution should they implement?

Accepted Answer

Create a customer managed KMS key in the central account and grant the RDS service in each account permission to use the key.. A customer managed KMS key in the central account can be shared with other accounts via the key policy, and the RDS service in each member account can be granted kms:GenerateDataKey and kms:Decrypt permissions. This satisfies the single-account storage requirement and supports automatic annual rotation.

Answer

Copy the KMS key from the central account to each account using the KMS key replication feature.

Answer

Use AWS CloudHSM to create a key and share the HSM partition with each account.

Answer

Create a multi-Region customer managed KMS key in the central account and replicate it to each account.

Question 8

A company is using Amazon DynamoDB with a TTL attribute to automatically delete expired items. The security team is concerned that deleted items might still be recoverable from backups. They need to ensure that once an item is deleted by TTL, it is not included in future on-demand backups. Additionally, they want to ensure that the TTL deletion itself is logged for audit purposes. What should they do?

Accepted Answer

Enable DynamoDB Streams on the table and use a Lambda function to log TTL deletion events to CloudWatch Logs.. DynamoDB Streams captures item-level changes including TTL deletions, emitting a REMOVE event with userIdentity principal 'dynamodb.amazonaws.com'. A Lambda function can process these stream records and write them to CloudWatch Logs, providing an audit trail. This approach also ensures that once an item is deleted by TTL, it is removed from the table and will not appear in future on-demand backups, because backups capture the table state at the time of backup. TTL deletions are permanent and not included in subsequent backups.

Answer

Disable TTL and implement a custom deletion process that logs deletions before removing items.

Answer

Use AWS CloudTrail to log the UpdateTimeToLive API call.

Answer

Enable AWS CloudTrail data events for DynamoDB to capture TTL deletions.

Question 9

A company is using Amazon Aurora MySQL and needs to audit all database logins, including failed attempts, and store the audit logs for one year for compliance. The logs must be immutable and accessible only by the security team. Which solution should the company implement?

Accepted Answer

Enable RDS for Aurora database activity streams, stream to CloudWatch Logs, and export to S3 with S3 Object Lock enabled.. Amazon Aurora MySQL supports Database Activity Streams (DAS), which capture all database activity including logins and failed attempts, and can be streamed to CloudWatch Logs and then exported to S3. To meet the immutability and access-control requirements, S3 Object Lock (in compliance mode) prevents deletion or modification for the retention period, and S3 bucket policies/IAM restrict access to the security team. This combination satisfies auditing, one-year retention, immutability, and restricted access.

Answer

Enable VPC Flow Logs to capture network connections to the database endpoint.

Answer

Enable AWS CloudTrail to log database login events.

Answer

Enable the standard MySQL audit log plugin and store logs in a database table with restricted access.

Question 10

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database contains sensitive data that must be encrypted at rest using a customer-managed KMS key. The company also needs to ensure that the database is automatically patched by AWS. Which DB instance configuration should be used?

Accepted Answer

Multi-AZ, encryption at rest enabled with a customer-managed KMS key, auto minor version upgrade enabled.. The requirements are encryption at rest with a customer-managed KMS key and automatic patching via auto minor version upgrade. Both B (Multi-AZ) and C (Single-AZ) meet these requirements. A fails because auto minor version upgrade is disabled. D fails because it uses an AWS-managed KMS key, not a customer-managed key. High availability is not a requirement in the stem, so both B and C are correct.

Answer

Single-AZ, encryption at rest enabled with a customer-managed KMS key, auto minor version upgrade disabled.

Answer

Multi-AZ, encryption at rest enabled with an AWS-managed KMS key, auto minor version upgrade enabled.

Question 11

A healthcare company stores sensitive patient data in an Amazon DynamoDB table. The security team wants to ensure that all data at rest is encrypted using a customer managed AWS KMS key (CMK) and that the key is rotated annually. The table is currently encrypted with an AWS owned key. Which action should be taken to meet these requirements?

Accepted Answer

Create a new DynamoDB table with encryption at rest using a customer managed CMK, and migrate the data from the old table.. DynamoDB encryption at rest is configured only at table creation. To switch from an AWS owned key to a customer managed CMK, you must create a new table with the desired encryption settings and migrate the data. Then, in AWS KMS, you can enable automatic key rotation on the CMK, which rotates the key material annually. This meets both the encryption and rotation requirements.

Answer

Enable KMS encryption on the DynamoDB table using the AWS managed key alias/aws/dynamodb, and configure automatic key rotation.

Answer

Use AWS KMS to create a customer managed CMK, then update the DynamoDB table's SSESpecification to use that key.

Answer

Modify the existing DynamoDB table to use a customer managed CMK and enable automatic rotation on the key.

Question 12

A financial services company runs an Amazon Aurora MySQL cluster that stores credit card data. A security audit reveals that database administrators are using their personal IAM credentials to connect to the cluster, and there is no record of which user performed which query. The company wants to enforce the use of temporary, role-based credentials for all database connections and capture individual user identities in audit logs. Which solution should a database specialist implement?

Accepted Answer

Enable IAM database authentication on the Aurora cluster and configure users to connect using an authentication token generated from their IAM role.. IAM database authentication is the native Aurora feature that uses IAM roles to generate short-lived authentication tokens, removing the need for static passwords. It integrates with AWS CloudTrail and database activity streams to log the IAM identity, enabling per-user auditing. The other options either rely on static credentials or add unnecessary complexity without meeting the identity and auditing requirements.

Answer

Use AWS Directory Service for Microsoft Active Directory to authenticate users and enable Kerberos authentication on the Aurora cluster.

Answer

Configure an AWS Lambda function to create a new database user for each connection and delete it after the session ends.

Answer

Store database credentials in AWS Secrets Manager and enable automatic rotation every 30 days.

Question 13

A company runs an Amazon Aurora PostgreSQL cluster that stores regulated healthcare data. The security team must ensure that all connections to the database are encrypted, and that clients that cannot negotiate TLS are rejected. The team also wants to verify the server certificate presented by the cluster endpoint. Which combination of actions should a database specialist take to meet these requirements?

Accepted Answer

Set the cluster parameter rds.force_ssl to 1 and download the regional RDS certificate bundle (global-bundle.pem) to configure clients with sslmode=verify-full.. Forcing TLS on Aurora PostgreSQL is achieved by setting the rds.force_ssl parameter to 1 in a custom cluster parameter group, which rejects non-TLS connections. To verify the server certificate, clients must use the RDS certificate bundle with sslmode=verify-full. Together these actions enforce encryption in transit and validate the server identity, meeting the security requirements.

Answer

Attach an IAM policy that denies rds:CreateDBInstance and rds:ModifyDBCluster unless aws:SecureTransport is true.

Answer

Enable IAM database authentication on the Aurora cluster and require all users to connect with short-lived IAM tokens instead of passwords.

Answer

Configure the Aurora cluster with a security group that allows only port 5432 from the application subnet, and rotate the master password with AWS Secrets Manager.

Question 14

A company uses Amazon Redshift and needs to grant a data analyst read-only access to a specific table in the 'sales' schema. The analyst should not be able to see any other tables in that schema. The company wants to follow the principle of least privilege. Which approach should a database specialist use?

Accepted Answer

Create a new database user, grant USAGE on the 'sales' schema, and grant SELECT on the specific table.. In Amazon Redshift, schema-level USAGE is required to access objects within the schema. To grant read-only access to a single table, you grant USAGE on the schema and SELECT on that table. This ensures the user can see the schema but only query the specified table. Granting SELECT on all tables or using schema-level SELECT is not valid and would not provide the correct permissions.

Answer

Create a new database user, grant SELECT on all tables in the 'sales' schema, and then revoke SELECT on all tables except the specific table.

Answer

Create a new database user, grant ALL on the 'sales' schema, and then revoke all privileges except SELECT on the specific table.

Answer

Create a new database user, grant SELECT on the 'sales' schema, and rely on the default table-level permissions to restrict access.

Question 15

A financial services company runs an Amazon Aurora PostgreSQL cluster that stores account details. The security team requires that all connections to the database use TLS with a minimum version of TLS 1.2 and that the database reject any unencrypted connections. The DB cluster parameter group has been modified to set rds.force_ssl to 1. What additional step must be taken to enforce TLS for all client connections?

Accepted Answer

Set the rds.force_ssl parameter to 1 in a custom DB cluster parameter group and apply it to the Aurora cluster, then reboot the cluster.. To enforce TLS for all connections to an Aurora PostgreSQL cluster, you must set the rds.force_ssl parameter to 1 in the cluster's parameter group and reboot the cluster. This parameter causes the database to reject any connection that is not using SSL/TLS. Security groups and IAM authentication do not enforce encryption. ACM certificates are not used for this purpose.

Answer

Modify the Aurora cluster to enable IAM database authentication, which automatically enforces TLS for all connections.

Answer

Enable SSL enforcement at the VPC level by attaching a security group that only allows TLS traffic on port 5432.

Answer

Configure the Aurora cluster to use AWS Certificate Manager (ACM) to issue certificates and require clients to present them for mutual TLS authentication.