DBS-C01 Database Security Practice Test 12 — 15 Questions

Question 1

A company uses an Amazon RDS for SQL Server instance with Transparent Data Encryption (TDE) enabled. The security team wants to ensure that the TDE certificate and private key are stored in a secure, centralized location and are automatically backed up. Which AWS service should be used to store the TDE certificate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon S3 with server-side encryption using AWS KMS.. For RDS for SQL Server, TDE certificates are stored in an Amazon S3 bucket. You can encrypt the bucket using AWS KMS for security. RDS accesses the bucket to retrieve the certificate and private key when you enable TDE on the instance. This approach centralizes storage, provides durability, and allows automatic backup through S3 features like versioning and lifecycle policies.

Answer

AWS Secrets Manager.

Answer

AWS Certificate Manager (ACM).

Answer

AWS Systems Manager Parameter Store.

Question 2

A company uses Amazon Redshift for a data warehouse that contains financial data. The security team requires that all data at rest be encrypted using a customer-managed AWS KMS key (CMK) that the company controls, and that the key be rotated annually. The Redshift cluster is currently unencrypted. Which action should a database specialist take to meet these requirements with minimal downtime?

Accepted Answer

Create a new encrypted Redshift cluster using the customer-managed CMK, migrate the data, and then enable automatic key rotation on the CMK.. Redshift clusters cannot be encrypted in place after creation; encryption must be enabled when the cluster is created or when an unencrypted snapshot is restored into a new encrypted cluster. Therefore, creating a new encrypted cluster with the customer-managed CMK and migrating data is the correct approach. Enabling automatic key rotation on the CMK meets the annual rotation requirement, and with proper planning downtime can be minimal.

Answer

Use AWS CloudFormation to update the existing cluster's stack and add an EncryptionType property set to KMS with the CMK ARN.

Answer

Enable encryption on the existing cluster by modifying it to use the customer-managed CMK, then enable automatic key rotation on the CMK.

Answer

Take a snapshot of the unencrypted cluster, copy it with encryption using the CMK, and restore the encrypted snapshot into the existing cluster.

Question 3

A company uses Amazon DynamoDB to store session data for a web application. The security team wants to ensure that all data written to the table is encrypted at rest using a customer-managed AWS KMS key, and that the key is rotated annually. The table is currently encrypted with an AWS owned key. What should the company do to meet these requirements?

Accepted Answer

Modify the table to enable server-side encryption with a customer-managed KMS key, and enable automatic key rotation on the KMS key.. DynamoDB tables can be encrypted at rest using customer-managed KMS keys. You can modify the table's encryption settings to use a customer-managed key. Then, enable automatic key rotation for that KMS key. This satisfies both encryption with a customer-managed key and annual rotation. Other options do not provide encryption at rest with a customer-managed key.

Answer

Create a new table with encryption using an AWS managed key, and migrate the data to the new table.

Answer

Enable DynamoDB Streams and use AWS Lambda to encrypt each item with a customer-managed KMS key before writing to the table.

Answer

Use AWS Certificate Manager (ACM) to provision a certificate and configure DynamoDB to use it for encryption at rest.

Question 4

A healthcare company stores patient data in an Amazon DynamoDB table. The security team must ensure that all data at rest is encrypted with a customer managed key (CMK) in AWS KMS and that they can audit key usage. They have created a CMK and configured the table to use it. A compliance auditor asks for proof that the encryption key is rotated annually. What should the company do to meet this requirement with minimal operational overhead?

Accepted Answer

Enable automatic annual rotation for the CMK in AWS KMS.. AWS KMS automatic key rotation for customer managed keys rotates the backing key annually while keeping the same key ID, so DynamoDB can continue to decrypt data seamlessly. This provides an auditable rotation history with minimal operational effort. The other options either require manual intervention, use AWS managed keys that do not meet the CMK requirement, or misinterpret DynamoDB Streams.

Answer

Manually create a new CMK each year and update the DynamoDB table to use the new key.

Answer

Enable DynamoDB Streams to capture key rotation events and store them in Amazon S3 for audit.

Answer

Use an AWS managed key for DynamoDB and rely on AWS to rotate it.

Question 5

A company is using Amazon DynamoDB to store user session data. The security team wants to implement fine-grained access control so that users can only access items that belong to them. The application uses an IAM role for each user, and the DynamoDB table has a partition key named 'UserId'. Which two conditions should be included in the IAM policy to enforce this? (Choose two.)

Accepted Answer

dynamodb:LeadingKeys condition with a value of ${aws:userid} to restrict access to items where the partition key matches the user's ID.. To enforce fine-grained access control in DynamoDB, you use the dynamodb:LeadingKeys condition to restrict access based on the partition key. The value can be set to a variable like ${aws:userid} or ${aws:username}, which resolves to the IAM user's ID or name. This ensures that users can only access items where the partition key matches their identity. Both conditions are valid, though ${aws:userid} is more secure as it is unique and immutable.

Answer

dynamodb:ReturnValues condition to limit returned data.

Answer

dynamodb:Select condition to allow only specific query operations.

Answer

dynamodb:Attributes condition to limit access to specific attributes.

Question 6

A financial services company runs an Amazon Aurora PostgreSQL cluster. A compliance requirement mandates that all connections to the database must be encrypted in transit, and the security team wants to enforce this at the cluster level without modifying application code. The cluster uses a custom parameter group. Which action should a database specialist take to meet this requirement?

Accepted Answer

Set the rds.force_ssl parameter to 1 in the cluster parameter group and reboot the cluster.. The rds.force_ssl parameter, when set to 1 in a custom cluster parameter group, forces all connections to use SSL/TLS. This is the standard method to enforce encryption in transit for Aurora PostgreSQL. After changing the parameter, a reboot applies it. Other options do not enforce encryption at the database level.

Answer

Modify the security group associated with the cluster to allow only port 5432 with SSL.

Answer

Enable IAM database authentication on the cluster and require all users to authenticate with IAM.

Answer

Configure the cluster to use a custom endpoint with SSL enforcement via AWS Certificate Manager (ACM).

Question 7

A company runs an Amazon RDS for SQL Server instance with Transparent Data Encryption (TDE) enabled using the option group. The security team wants to ensure that the TDE certificates and private keys are managed by the company and not AWS. They also need to rotate the certificates periodically without downtime. What should they do?

Accepted Answer

Use the RDS option group to import the TDE certificate and private key from an Amazon S3 bucket, and rotate by creating a new option group and applying it during a maintenance window.. RDS for SQL Server TDE requires importing a certificate and private key from Amazon S3 into an option group. Rotation involves creating a new option group with the new certificate and applying it, which may cause a brief outage. The other options incorrectly suggest Secrets Manager integration, KMS key usage, or automatic certificate generation, none of which are supported for TDE on RDS SQL Server.

Answer

Store the TDE certificate and private key in AWS Secrets Manager and reference them in the option group.

Answer

Enable TDE using AWS KMS customer managed keys instead of certificates, and rotate the KMS key annually.

Answer

Use the RDS console to generate a self-signed certificate and enable automatic rotation every 90 days.

Question 8

A healthcare company runs an Amazon RDS for SQL Server Multi-AZ instance that contains protected health information. The security team requires that all connections to the database use TLS and that the server enforce encryption for incoming connections. A database specialist needs to configure the option group to meet this requirement. Which action should the specialist take?

Accepted Answer

Add the FORCE_ENCRYPTION option to the option group, set it to true, and apply the option group to the instance.. RDS for SQL Server enforces encrypted connections through the FORCE_ENCRYPTION option in an option group. Setting that option to true and attaching the option group to the instance causes the server to reject unencrypted connections. Parameter-based approaches like rds.force_ssl belong to other engines, and no encrypt_connections parameter exists for SQL Server.

Answer

Add the SSL option to the option group and set the value to 1, then reboot the instance.

Answer

Modify the parameter group to set rds.force_ssl to 1 and reboot the instance.

Answer

Create a new parameter group with the encrypt_connections parameter set to required and associate it with the instance.

Question 9

A company uses Amazon RDS for SQL Server with Transparent Data Encryption (TDE) enabled. The security team wants to ensure that the TDE certificates and private keys are stored in a secure, centralized location and that the database can be restored to another AWS account if needed. Which approach should a database specialist take?

Accepted Answer

Export the TDE certificate and private key from the source instance, upload them to an Amazon S3 bucket, and use the same bucket for restoration in the target account.. RDS for SQL Server TDE requires the certificate and private key to be exported and stored in Amazon S3 for cross-account restore. The certificate and key are managed by RDS but can be exported to an S3 bucket. To restore to another account, the target account must have access to that S3 bucket and the necessary permissions. This centralizes the certificate storage and enables the restore.

Answer

Store the TDE certificate and private key in AWS Secrets Manager and grant access to the target account.

Answer

Enable automatic backups and rely on the backup to include the TDE certificate, then share the backup with the target account.

Answer

Use AWS KMS to create a customer-managed key and configure RDS to use it for TDE instead of a certificate.

Question 10

A company runs an Amazon RDS for Oracle DB instance with a custom option group that includes the Oracle Enterprise Manager (OEM) option. The security team wants to restrict access to the OEM console to only a specific CIDR range. What is the correct way to achieve this?

Accepted Answer

In the option group, configure the OEM option with a security group that allows access only from the specified CIDR range.. To restrict access to the OEM console for RDS for Oracle, you configure the OEM option in the option group with a VPC security group that has inbound rules limited to the desired CIDR range. This security group is separate from the DB instance's security group. Other methods like AWS WAF or parameter groups do not apply.

Answer

Modify the RDS instance's parameter group to set the OEM_ACCESS parameter to the specified CIDR range.

Answer

Use AWS WAF to create a web ACL that blocks all traffic to the OEM console except from the specified CIDR range.

Answer

Modify the security group associated with the RDS instance to allow inbound traffic on the OEM port only from the specified CIDR range.

Question 11

A company uses Amazon RDS for SQL Server with Transparent Data Encryption (TDE) enabled using the default option group. The security team now requires that the encryption keys be managed in AWS Key Management Service (KMS) with a customer managed key (CMK) for compliance. What must a database specialist do to meet this requirement?

Accepted Answer

Modify the DB instance to use a custom option group with TDE and specify the KMS CMK.. To use a customer managed key for TDE on RDS for SQL Server, you must create a custom option group with the TDE option and specify the KMS key. Then apply the option group to the DB instance. This enables TDE with the CMK, satisfying compliance. Other options either do not use KMS CMK or are not supported.

Answer

Use AWS CloudHSM to store the TDE certificate and configure RDS to use it.

Answer

Create a new DB instance with encryption enabled and migrate the data using native backup and restore.

Answer

Enable encryption at rest on the DB instance by modifying the storage encryption settings and selecting the CMK.

Question 12

A healthcare company runs an Amazon Aurora PostgreSQL cluster that stores sensitive patient records. The security team must ensure that all connections to the database are encrypted in transit and that the encryption uses TLS 1.2 or higher. Which configuration should be implemented to meet these requirements?

Accepted Answer

Modify the Aurora cluster parameter group to set rds.force_ssl to 1 and set the ssl_min_protocol_version parameter to TLSv1.2.. To enforce encryption in transit and a minimum TLS version for Aurora PostgreSQL, you must set the rds.force_ssl parameter to 1 and ssl_min_protocol_version to TLSv1.2 in a custom cluster parameter group. These parameters are applied at the cluster level and ensure that all connections use TLS 1.2 or higher. Other options address authentication or network access but not transport encryption.

Answer

Configure the Aurora cluster to use AWS Certificate Manager (ACM) to issue certificates for the database endpoint and enable SSL termination at the cluster.

Answer

Enable IAM database authentication on the Aurora cluster and require all users to authenticate with IAM credentials.

Answer

Create a security group rule that allows traffic only on port 5432 and attach it to the Aurora cluster.

Question 13

A healthcare company runs an Amazon Aurora PostgreSQL cluster. Regulatory requirements mandate that all data at rest be encrypted with keys that the company manages and can immediately disable. The security team must implement this without modifying the application or the database schema. Which solution meets these requirements?

Accepted Answer

Enable encryption at rest by modifying the Aurora cluster to use an AWS KMS customer managed key.. The requirement is to encrypt all data at rest with a customer managed key that can be immediately disabled. Modifying the Aurora cluster to use a KMS customer managed key achieves this transparently, without application changes. Other options either use AWS managed keys (no control), require application changes, or are not natively supported.

Answer

Use AWS CloudHSM to store the database encryption keys and configure Aurora to use the CloudHSM cluster.

Answer

Enable encryption at rest by restoring the Aurora cluster from a snapshot with encryption enabled using an AWS managed key.

Answer

Implement column-level encryption using the pgcrypto extension within the database and manage the keys in AWS Secrets Manager.

Question 14

A company runs an Amazon Aurora PostgreSQL cluster. Compliance requires that all connections to the writer endpoint use TLS 1.2 or higher, and that any client presenting an outdated protocol be rejected rather than silently downgraded. Which configuration achieves this requirement?

Accepted Answer

Set the parameter rds.force_ssl to 1 and set ssl_min_protocol_version to TLSv1.2 in a custom DB cluster parameter group.. Enforcing TLS 1.2 or higher requires both rejecting non-TLS sessions and raising the minimum accepted protocol version. rds.force_ssl handles the first part, and ssl_min_protocol_version handles the second. Placing these in a custom Aurora cluster parameter group ensures every instance in the cluster applies the same restrictions without per-instance drift.

Answer

Enable IAM database authentication and require all users to connect using an authentication token.

Answer

Set the parameter rds.force_ssl to 1 in a custom DB parameter group attached to each instance.

Answer

Attach an AWS WAF web ACL to the Aurora cluster to block requests that do not use TLS 1.2.

Question 15

A company uses Amazon Redshift and has enabled audit logging to Amazon S3. The security team needs to ensure that all connection attempts to the Redshift cluster are logged, including successful and failed logins. Which log type should be enabled to capture this information?

Accepted Answer

Connection log. In Amazon Redshift, the connection log captures authentication attempts and connections, including successful and failed logins. This is the log type that should be enabled to meet the requirement. The user activity log records SQL statements, and the user log contains query and connection information but is not specifically for connection attempts. The term 'audit log' is not a Redshift log type.

Answer

Audit log

Answer

User log

Answer

User activity log