DBS-C01 Database Security Practice Test 11 — 15 Questions

Question 1

A company is using Amazon DocumentDB (with MongoDB compatibility) for a content management system. The security team requires that all data be encrypted at rest and in transit. The DocumentDB cluster is already encrypted at rest using AWS KMS. To enforce encryption in transit, the security team wants to ensure that all client connections use TLS. The team has enabled the 'tls' parameter in the cluster parameter group. However, a developer reports that they can still connect to the cluster without specifying TLS options using the mongo shell. The developer is connecting from an EC2 instance in the same VPC. The security group for the DocumentDB cluster allows inbound traffic on port 27017 from the EC2 instance's security group. What is the most likely reason the developer can connect without TLS?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The 'tls' parameter was not applied to the cluster because the parameter group was not associated with the cluster or the cluster was not rebooted.. In Amazon DocumentDB, enabling the 'tls' parameter in the cluster parameter group requires the parameter group to be associated with the cluster and the cluster to be rebooted for the change to take effect. If the parameter group was not properly associated or the cluster was not rebooted after modifying the parameter, TLS enforcement would not be active, allowing connections without TLS. Options A, B, and C are incorrect because DocumentDB supports TLS (via SSL), intra-VPC traffic does not bypass TLS, and older mongo shell versions can still use TLS if configured.

Answer

DocumentDB does not support TLS; it only supports SSL.

Answer

The EC2 instance is in the same VPC, so TLS is not enforced for intra-VPC traffic.

Answer

The developer is using an older version of the mongo shell that does not support TLS.

Question 2

A company is using an Amazon RDS for MySQL DB instance. The security team requires that all database connections be encrypted in transit. Which configuration step ensures this requirement is met?

Accepted Answer

Set the 'require_secure_transport' parameter to 1 in the DB parameter group.. Setting the 'require_secure_transport' parameter to 1 in the DB parameter group forces clients to use TLS/SSL for connections, ensuring encryption in transit. Option A is incorrect because enabling encryption at rest (RDS encryption) secures data on disk but does not enforce encryption of data in transit. Option B is incorrect because storing passwords in AWS Secrets Manager manages credentials but does not enforce encrypted connections. Option C is incorrect because modifying a network ACL to allow traffic on port 3306 controls network access but does not enforce encryption of the data transmitted over that port.

Answer

Enable encryption at rest for the RDS instance.

Answer

Store the database password in AWS Secrets Manager.

Answer

Modify the network ACL to only allow traffic on port 3306.

Question 3

A company uses Amazon DynamoDB to store sensitive user data. The security team wants to ensure that all data is encrypted at rest using a customer-managed AWS KMS key. The DynamoDB table was created with the default AWS managed key. What is the required action to change the encryption key?

Accepted Answer

Create a new DynamoDB table with the desired KMS key, export data from the old table, and import into the new table.. DynamoDB does not allow changing the encryption key on an existing table. To use a customer-managed KMS key, you must create a new table with the desired key, export data from the old table, and import it into the new table. Option A is incorrect because the UpdateTable API does not support changing the encryption key. Option C is incorrect because enabling automatic key rotation on the existing KMS key does not change the key used by DynamoDB; it rotates the key material but the table still uses the same key ID. Option D is incorrect because deleting the default AWS managed key would break encryption for any tables using it, and it does not allow you to change the key for the existing table.

Answer

Use the UpdateTable API to specify the new KMS key.

Answer

Enable automatic key rotation on the existing KMS key.

Answer

Delete the default AWS managed key and create a new customer managed key.

Question 4

A developer is configuring an Amazon RDS for PostgreSQL DB instance. The application connects using IAM database authentication. Which setting must be enabled on the DB instance for IAM authentication to work?

Accepted Answer

Set the 'rds.force_ssl' parameter to 1.. IAM database authentication for Amazon RDS PostgreSQL requires an encrypted connection to protect the authentication token. Setting the 'rds.force_ssl' parameter to 1 enforces TLS/SSL connections between the client and the database, which is a prerequisite for IAM authentication. Option A is incorrect because the port (default 5432) does not need to change for IAM. Option C is incorrect because the DB instance can be private within a VPC; IAM authentication works over private or public connections as long as TLS is enforced. Option D is incorrect because the master username is not changed; IAM authentication uses database users that are mapped to IAM identities.

Answer

Set the database port to 5432.

Answer

Ensure the DB instance is publicly accessible.

Answer

Change the master username to 'iam_user'.

Question 5

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all data be encrypted at rest using a key stored in AWS CloudHSM. What must be done to meet this requirement?

Accepted Answer

Use Oracle Transparent Data Encryption (TDE) with CloudHSM as the key store.. Use Oracle Transparent Data Encryption (TDE) with CloudHSM as the key store. RDS for Oracle supports TDE, which allows encryption at rest using keys stored in CloudHSM. Option A is incorrect because RDS encryption at rest uses AWS KMS, and while KMS can use a CloudHSM key as a custom key store, the question specifies the key must be stored in CloudHSM directly, which is achieved via TDE integration. Option B is incorrect because RDS does not support custom file system encryption; encryption at rest is managed at the database or instance level. Option C is incorrect because SSL/TLS provides encryption in transit, not at rest.

Answer

Enable RDS encryption at rest using a KMS key backed by CloudHSM.

Answer

Create an encrypted file system on the RDS instance using CloudHSM.

Answer

Configure SSL/TLS for the database connection.

Question 6

A security engineer is designing access controls for an Amazon DynamoDB table containing customer data. Which TWO actions enforce least privilege access?

Accepted Answer

Use IAM conditions to restrict access to specific attributes.. Options A and C are correct. Using IAM conditions to restrict access to specific attributes (A) and implementing fine-grained access control using IAM policy conditions (C) both enforce least privilege by limiting the data and actions a user can access. Option B violates least privilege by granting all actions to all users. Option D is incorrect because Amazon DynamoDB does not support resource-based policies; access is controlled via identity-based IAM policies. Option E is incorrect because a VPC endpoint policy allowing all actions does not restrict access.

Answer

Grant dynamodb:* action to all users.

Answer

Use a resource-based policy on the DynamoDB table.

Answer

Attach a VPC endpoint policy that allows all actions.

Question 7

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The security team wants to audit all database logins and queries. Which TWO actions should be taken to enable auditing?

Accepted Answer

Publish MySQL logs to Amazon CloudWatch Logs.. Options C and D are correct. Setting the general_log parameter to 1 (D) captures all queries, and publishing MySQL logs to CloudWatch Logs (C) allows analysis. Option A is wrong because AWS CloudTrail data events capture API calls to RDS, not database queries. Option B is wrong because event notifications are for instance events, not queries. Option E is wrong because Enhanced Monitoring provides OS-level metrics, not query logs.

Answer

Enable AWS CloudTrail data events for RDS.

Answer

Create an RDS event notification subscription.

Answer

Enable Enhanced Monitoring.

Question 8

A company is using Amazon Redshift and needs to encrypt data at rest with a customer-managed key. Which TWO steps are required to enable encryption with a customer-managed AWS KMS key?

Accepted Answer

Create a customer-managed key in AWS KMS.. Options A and B are correct. To enable encryption with a customer-managed AWS KMS key, you must first create a customer-managed KMS key (A) and then specify that KMS key when creating a new Redshift cluster (B). Option C is incorrect because you cannot modify an existing unencrypted Redshift cluster to enable encryption; encryption must be set at cluster creation or by restoring from an encrypted snapshot. Option D is incorrect because Redshift encryption with KMS does not require an HSM. Option E is incorrect because AWS Support cannot enable encryption; it must be performed by the customer via the AWS Management Console, CLI, or API.

Answer

Use the AWS CLI to modify the cluster to enable encryption.

Answer

Configure the Redshift cluster to use an HSM.

Answer

Request AWS Support to enable encryption.

Question 9

A database administrator is troubleshooting why Amazon RDS Enhanced Monitoring is not displaying metrics for a DB instance. The IAM role attached to the instance has the policy shown in the exhibit. What is the likely cause?

Accepted Answer

The policy denies the 'rds:DescribeDBInstances' action.. Amazon RDS Enhanced Monitoring requires the IAM role to have permission to describe the DB instance using 'rds:DescribeDBInstances'. This action is necessary for the monitoring service to retrieve information about the instance so it can collect and publish OS metrics. If the policy explicitly denies this action, Enhanced Monitoring will fail to display metrics. Option C is incorrect because 'monitoring:ListMetrics' is not required; Enhanced Monitoring publishes to CloudWatch Logs, not CloudWatch Metrics, and the IAM role needs logs permissions (e.g., 'logs:PutLogEvents') rather than monitoring actions. Options B and D are also incorrect: 'rds:CreateDBInstance' is unrelated to monitoring, and using a resource of '*' is acceptable as long as the trust policy allows RDS to assume the role.

Answer

The policy is missing the 'rds:CreateDBInstance' action.

Answer

The policy does not include 'monitoring:ListMetrics'.

Answer

The resource is set to '*' instead of the specific DB instance ARN.

Question 10

A security auditor notices that the DynamoDB table 'UserData' is encrypted with a KMS key (exhibit). The company policy requires that all DynamoDB tables use an AWS managed key for encryption. What must be done to comply with the policy?

Accepted Answer

Create a new DynamoDB table with SSE enabled using the AWS managed key, then export data from the existing table and import into the new table.. DynamoDB does not support changing the KMS key or SSE configuration after table creation. To use the AWS managed key instead of a customer managed key, you must create a new table with SSE-KMS enabled using the AWS managed key (alias 'aws/dynamodb'), export the existing table data (via DynamoDB export to S3 or using a scan/write process), and import it into the new table. Option B is incorrect because a customer managed KMS key cannot be converted into an AWS managed key; they are distinct key types. Option C is incorrect because you cannot modify the SSE configuration of an existing DynamoDB table; encryption settings are immutable after creation. Option D is incorrect because the UpdateTable API does not allow changing the KMS key used for encryption; it only supports updating other table settings like billing mode or provisioned throughput.

Answer

Delete the customer managed KMS key and recreate it as an AWS managed key.

Answer

Modify the table's SSE configuration to use the AWS managed key.

Answer

Use the UpdateTable API to change the KMS key to the AWS managed key.

Question 11

A developer is checking the encryption status of an RDS MySQL instance. The CLI output shows StorageEncrypted is true. What does this indicate?

Accepted Answer

The database is encrypted at rest using a KMS key.. When StorageEncrypted is true, it indicates that the RDS MySQL instance is encrypted at rest using a KMS key. Option A is incorrect because StorageEncrypted does not relate to encryption in transit. Option B is incorrect because it can be either AWS managed or customer managed KMS key. Option C is incorrect because StorageEncrypted: true means encryption at rest is enabled.

Answer

Connections to the database are encrypted in transit.

Answer

The database is encrypted using the AWS managed key for RDS.

Answer

The database does not have encryption at rest enabled.

Question 12

A financial services company runs a critical application on Amazon RDS for PostgreSQL. The database stores sensitive customer financial data. The security team has mandated that all access to the database must be through IAM database authentication to eliminate the need for passwords. The application currently uses a master user password stored in AWS Secrets Manager. The DBA needs to implement IAM authentication without downtime. The application is deployed on Amazon ECS and connects to the database using a connection string. The DBA has already created an IAM role for the ECS task with a policy that allows rds-db:connect. The DBA has also modified the DB instance to require SSL. However, after making these changes, the application cannot connect. The error message indicates 'IAM authentication is not enabled for this user'. What step did the DBA miss?

Accepted Answer

The DBA did not create a database user that is set to use IAM authentication.. IAM database authentication requires that a database user be created with the IAM authentication method. Specifically, the user must be created with the CREATEROLE privilege and granted the rds_iam role. Without this step, the authentication fails even if the IAM role is correctly configured. Option B is incorrect because the IAM policy was already attached. Option C is incorrect because IAM authentication does not require a password; it uses authentication tokens. Option D is incorrect because the security group and port are not related to IAM authentication.

Answer

The DBA did not attach the IAM policy to the ECS task role.

Answer

The DBA did not enable the 'password' authentication method.

Answer

The DBA did not update the security group to allow traffic on port 5432.

Question 13

A retail company uses Amazon DynamoDB to store product catalog data. The security team wants to ensure that only authorized applications can read and write to the table. The applications are running on Amazon EC2 instances. The current setup uses an IAM role attached to the EC2 instance with a policy that grants dynamodb:* on the specific table. However, during a security audit, it was discovered that any process on the EC2 instance can access the table because the instance has access to the temporary credentials from the instance metadata service. The security team requires that only specific processes (the application) can access the credentials, and that the credentials cannot be extracted from the instance. What should be done to meet these requirements?

Accepted Answer

Create a VPC endpoint for DynamoDB with a policy that restricts access to the specific IAM role, and configure the EC2 instance to use IMDSv2 with a hop limit.. Using a VPC endpoint for DynamoDB with a policy that restricts access to the specific IAM role ensures that only requests from that role are allowed, and using IMDSv2 with a hop limit prevents credential theft by ensuring that only the intended application process on the EC2 instance can access the credentials. Option B is incorrect because security groups control network traffic but do not enforce IAM role usage. Option C is incorrect because storing AWS access keys on the instance is less secure and exposes credentials to any process. Option D is incorrect because DynamoDB does not support resource-based policies; IAM roles are authorized via identity-based policies attached to the role.

Answer

Modify the security group to only allow traffic from the EC2 instance's private IP.

Answer

Store AWS access keys on the EC2 instance and use them in the application.

Answer

Attach a resource-based policy to the DynamoDB table allowing only the EC2 instance's IAM role.

Question 14

A small business runs a web application on a single Amazon RDS for MySQL DB instance. The application uses a master user account for all database operations. The security team is concerned about the risk of SQL injection and wants to implement the principle of least privilege. They want to create separate database users for read-only and read-write operations. The application currently uses a single connection string. The developer needs to modify the application to use two separate users. What is the correct approach to implement this securely?

Accepted Answer

Create a read-only user and a read-write user in the database, grant minimal privileges, and modify the application to use the appropriate user for each operation.. Creating separate users with minimal privileges and modifying the application to use the appropriate user for each operation reduces the risk of SQL injection and enforces least privilege. Option A is wrong because using stored procedures with a single master user does not eliminate the need for separate users for different privilege levels. Option B is wrong because restricting IP address does not address the need for granular permissions. Option C is wrong because enabling IAM database authentication with a single IAM role does not provide separate read-only and read-write capabilities.

Answer

Use stored procedures for all database operations and grant execute only to the master user.

Answer

Keep using the master user but restrict its IP address.

Answer

Enable IAM database authentication and use a single IAM role.

Question 15

A healthcare company is migrating its patient records database to Amazon RDS for SQL Server. The database contains Protected Health Information (PHI). The compliance team requires that all PHI data be encrypted at rest and that the encryption keys be stored in a dedicated AWS CloudHSM cluster. Additionally, the database must be replicated to a second AWS region for disaster recovery. The DBA has enabled RDS encryption at rest using a KMS key, but the compliance team insists on using CloudHSM. What should the DBA do to meet the compliance requirement while maintaining disaster recovery?

Accepted Answer

Enable Transparent Data Encryption (TDE) using a CloudHSM key and create a cross-region read replica for DR.. RDS for SQL Server supports Transparent Data Encryption (TDE) with CloudHSM as the key store, and RDS read replicas can be created across regions for disaster recovery. Option A is incorrect because RDS encryption at rest with a KMS key does not meet the CloudHSM requirement; KMS custom key stores (backed by CloudHSM) are not supported for RDS encryption at rest. Option B is incorrect because DynamoDB encryption with CloudHSM via KMS custom key store is possible but unnecessary and does not maintain the existing SQL Server database. Option C is incorrect because using RDS Custom with TDE and manual log shipping is more complex and not the standard approach for cross-region disaster recovery with RDS.

Answer

Use RDS encryption at rest with a KMS key backed by CloudHSM (custom key store).

Answer

Migrate the database to Amazon DynamoDB with encryption using CloudHSM via KMS custom key store.

Answer

Use an RDS Custom for SQL Server instance and configure TDE with CloudHSM, then set up log shipping to another region.