DBS-C01 Database Security Practice Test 12 — 15 Questions

Question 1

A security engineer reviews the IAM policy attached to a user. The user is unable to modify any RDS DB instance, even when MFA is enabled. What is the most likely cause?

Accepted Answer

The user does not have MFA enabled, or the instance name does not match the allowed prefixes.. The scenario states that the user cannot modify any RDS DB instance even when MFA is enabled. This suggests that the IAM policy likely includes a condition requiring MFA or a specific resource prefix (e.g., 'prod-*' or 'dev-*'). If MFA is not actually enabled on the user's account, or if the instance name does not match the allowed prefixes, the condition would fail, denying all ModifyDBInstance actions. Option A is incorrect because EC2 permissions are irrelevant to RDS. Option B is incorrect because the absence of a Deny statement does not cause failure; the issue is an Allow condition not being met. Option D is incorrect because the console versus API distinction does not explain the inability to modify any instance.

Answer

The policy is missing the ec2:ModifyInstance permission.

Answer

The policy does not include a Deny statement for RDS actions.

Answer

The user is trying to use the RDS console, but the policy only allows API calls.

Question 2

A company stores sensitive data in an Amazon RDS for PostgreSQL DB instance. The security team requires that all data at rest be encrypted. The instance is currently unencrypted. What is the simplest way to enable encryption with minimal downtime?

Accepted Answer

Create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the snapshot to a new encrypted DB instance.. An existing unencrypted Amazon RDS instance cannot be directly encrypted. The standard approach to enable encryption with minimal downtime is to create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the snapshot to a new encrypted DB instance. This process typically involves a brief outage during the restore but is simpler than other methods. Option B is incorrect because the AWS CLI does not support enabling encryption on an existing instance. Option C is incorrect because migrating to RDS Custom adds unnecessary complexity and does not directly enable encryption on the current instance. Option D is incorrect because the AWS Management Console also does not allow enabling encryption on an existing instance.

Answer

Use the AWS CLI to modify the DB instance and enable encryption.

Answer

Migrate the data to an Amazon RDS for PostgreSQL DB instance using RDS Custom.

Answer

Modify the DB instance and enable encryption in the console.

Question 3

A company uses an Amazon RDS for MySQL DB instance that needs to be accessed by a Lambda function. Which TWO steps should be taken to ensure secure access?

Accepted Answer

Create an IAM role for the Lambda function with permissions to use RDS IAM database authentication.. Options A and B are correct. Creating an IAM role for the Lambda function with permissions to use RDS IAM database authentication (A) avoids hardcoding credentials and enables secure, temporary authentication. Placing the Lambda function in the same VPC as the RDS instance (B) ensures traffic stays within the AWS network without traversing the internet. Option C is wrong because storing credentials in Lambda environment variables is insecure and exposes them. Option D is wrong because using the database master user account violates least privilege and is insecure. Option E is wrong because a NAT gateway is not needed for RDS access within the same VPC.

Answer

Store the database credentials in the Lambda environment variables.

Answer

Use the database master user account for the Lambda function.

Answer

Attach a NAT gateway to the Lambda function's VPC for outbound internet access.

Question 4

A company is designing a secure strategy for managing Amazon RDS for Oracle encryption keys. They want to use AWS KMS with Customer Master Keys (CMKs) for encryption at rest. Which THREE best practices should they follow?

Accepted Answer

Grant the RDS service principal (rds.amazonaws.com) only the necessary KMS permissions to use the CMK.. Options A, B, and E are correct. Using separate KMS keys for different environments provides isolation (option B), enabling automatic key rotation is a security best practice (option E), and granting least privilege access to KMS keys is fundamental (option A). Option C is incorrect because disabling key rotation is not recommended and can lead to security risks. Option D is incorrect because storing the CMK inside the database is insecure and defeats the purpose of using KMS.

Answer

Disable key rotation to maintain consistent encryption across all snapshots.

Answer

Store the KMS CMK inside the Oracle database for faster encryption.

Question 5

A security engineer runs the AWS CLI command shown in the exhibit. The engineer wants to ensure that all RDS DB instances in the account are encrypted at rest. What should the engineer do to remediate the unencrypted read replica?

Accepted Answer

Delete the unencrypted read replica and create a new read replica from the encrypted source, enabling encryption on the new replica.. To encrypt an unencrypted read replica that is sourced from an encrypted DB instance, you cannot directly enable encryption on an existing read replica or modify it. Instead, you must delete the unencrypted read replica and create a new read replica from the encrypted source, enabling encryption on the new replica. This is because encryption at rest can only be enabled during instance creation, and read replicas inherit encryption settings from the source at creation time. Option A is incorrect because the StorageEncrypted parameter cannot be modified on an existing instance. Option C is incorrect because enabling encryption on the source does not encrypt existing replicas; it only affects new replicas. Option D is incorrect because creating a snapshot of the unencrypted replica and restoring it as a new encrypted instance is not the standard procedure for encrypting a read replica; the correct approach is to recreate the read replica from the encrypted source with encryption enabled.

Answer

Modify the read replica by setting the StorageEncrypted parameter to true.

Answer

Enable encryption on the source DB instance and the read replica will automatically become encrypted.

Answer

Create a snapshot of the read replica, encrypt the snapshot, and restore it as a new instance.

Question 6

A financial company uses Amazon DynamoDB to store customer transaction data. The compliance team requires that all data be encrypted at rest using a customer-managed AWS KMS key. Additionally, they need to ensure that the key is used only for DynamoDB and no other AWS service. How can the company meet these requirements?

Accepted Answer

Create a KMS key with a key policy that includes a condition such as "kms:ViaService": "dynamodb.amazonaws.com" to restrict usage to DynamoDB.. A KMS key policy can use the 'kms:ViaService' condition key to restrict usage of the key to requests that originate from DynamoDB (dynamodb.amazonaws.com). This ensures the key is used only for DynamoDB and no other AWS service. Option A is incorrect because IAM policies alone cannot restrict key usage if the key policy allows all principals; the key policy must explicitly enforce the restriction. Option B is incorrect because AWS Organizations SCPs do not control KMS key permissions; they control permissions for IAM entities. Option D is incorrect because IAM policies cannot prevent other services from using the key if the key policy allows them; the key policy itself must include the restriction.

Answer

Use a KMS key with no key policy, and rely on IAM policies to restrict access to only DynamoDB.

Answer

Use an AWS Organizations service control policy (SCP) to deny all AWS services except DynamoDB from using the KMS key.

Answer

Create a KMS key with a key policy that allows DynamoDB to use the key, and attach an IAM policy to deny all other services.

Question 7

A developer needs to allow an application running on an EC2 instance to connect to an Amazon RDS for MySQL DB instance securely. Which combination of steps should the developer take?

Accepted Answer

Attach an IAM role to the EC2 instance with permissions to use RDS IAM authentication, and configure the database to use an authentication token.. The most secure method to allow an EC2 instance to connect to an RDS for MySQL DB instance is to use IAM roles for EC2 combined with IAM database authentication. By attaching an IAM role to the EC2 instance that has permissions to generate RDS authentication tokens, and configuring the DB instance to accept authentication tokens instead of passwords, the application can obtain temporary credentials without hardcoding or storing any secrets. Option A is insecure because storing credentials in application code exposes them to anyone with access to the code. Option B is insecure because opening the security group to all traffic (0.0.0.0/0) exposes the database to the internet. Option C is insecure because storing credentials in S3 and downloading them at runtime still involves storing static credentials and adds potential risk from S3 access misconfiguration.

Answer

Store the database password in the application code.

Answer

Open the RDS security group to allow traffic from 0.0.0.0/0.

Answer

Store the credentials in an S3 bucket and download them at runtime.

Question 8

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all network traffic between the application servers and the database be encrypted using TLS. The application servers are in a different VPC connected via VPC Peering. What is the simplest way to enforce encryption in transit?

Accepted Answer

Enable the rds.force_ssl parameter in the DB parameter group and configure the application to use SSL connections.. Enabling the rds.force_ssl parameter in the DB parameter group forces all connections to use SSL, satisfying the encryption-in-transit requirement. The application must be configured to connect using SSL with the appropriate certificate. Option A is wrong because changing the security group to port 443 does not enforce encryption; port 443 is for HTTPS, not for Oracle database traffic, and SSL is configured at the database level. Option C is wrong because the default parameter group does not enforce SSL; the rds.force_ssl parameter must be explicitly set. Option D is wrong because a VPN adds unnecessary complexity and does not directly enforce TLS encryption for database connections.

Answer

Modify the security group for the RDS instance to only allow traffic on port 443.

Answer

Use a default DB parameter group, as it already enforces SSL.

Answer

Set up a VPN connection between the two VPCs and route all traffic through it.

Question 9

A company is running an RDS for MySQL database and needs to ensure that all connections to the database use SSL encryption. Which configuration step is required?

Accepted Answer

Set 'require_secure_transport' to ON in the DB parameter group.. Setting 'require_secure_transport' to ON in the DB parameter group forces all connections to the RDS for MySQL database to use SSL/TLS encryption. This parameter is supported in MySQL 5.7 and later, and when enabled, the server rejects non-encrypted connections, ensuring compliance with security policies.

Answer

Enable 'Enable SSL' in the RDS console.

Answer

Set 'rds.force_ssl' to 1 in the DB parameter group.

Answer

Set 'ssl' to 'require' in the DB parameter group.

Question 10

A security engineer is designing a VPC with an RDS instance. The database must not be accessible from the internet, but EC2 instances in a private subnet must connect. Which security group configuration is MOST secure?

Accepted Answer

Set the RDS security group inbound rule to allow traffic from the EC2 security group on port 3306.. The most secure because it uses a security group reference instead of a CIDR block. By referencing the EC2 security group as the source in the RDS security group inbound rule, only instances associated with that specific security group can communicate with the database on port 3306. This approach adheres to the principle of least privilege and automatically scales as instances are added or removed from the EC2 security group, without needing to update CIDR ranges.

Answer

Set the RDS security group inbound rule to allow traffic from the VPC CIDR on port 3306.

Answer

Set the RDS security group inbound rule to allow traffic from 0.0.0.0/0 on port 3306.

Answer

Set the RDS security group inbound rule to allow traffic from the private subnet CIDR on port 3306.

Question 11

A company wants to audit all SQL statements executed on their RDS for PostgreSQL database. Which AWS service should they use?

Accepted Answer

CloudWatch Logs with PostgreSQL audit logs. For auditing SQL statements on Amazon RDS for PostgreSQL, you enable the PostgreSQL Audit Extension (pgaudit) and configure it to send logs to Amazon CloudWatch Logs. CloudWatch Logs can then be used to monitor, store, and access the SQL audit logs. Option A (AWS Database Migration Service) is used for migrating databases, not auditing. Option B (VPC Flow Logs) captures IP traffic metadata, not SQL statements. Option C (Amazon RDS Performance Insights) monitors database performance metrics, not individual SQL statements.

Answer

AWS Database Migration Service (DMS)

Answer

VPC Flow Logs

Answer

Amazon RDS Performance Insights

Question 12

A company is using DynamoDB with a VPC endpoint. They want to restrict access to only requests originating from their VPC. Which policy condition should be used?

Accepted Answer

'aws:SourceVpce': 'vpce-12345678'. The 'aws:SourceVpce' condition key allows you to restrict access to requests originating from a specific VPC endpoint (interface endpoint) in your VPC. This ensures that only traffic coming through that VPC endpoint can access the DynamoDB table, providing a network-level security boundary. The condition must reference the exact VPC endpoint ID (e.g., 'vpce-12345678') to enforce this restriction.

Answer

'aws:VpcSourceIp': '10.0.0.0/16'

Answer

's3:x-amz-server-side-encryption': 'AES256'

Answer

'aws:SourceVpc': 'vpc-12345678'

Question 13

A company has a compliance requirement to encrypt all RDS snapshots at rest using a customer-managed KMS key. The RDS instance is already encrypted with an AWS-managed key. What is the correct procedure to ensure snapshots use the customer-managed key?

Accepted Answer

Take a snapshot of the RDS instance, copy the snapshot specifying the customer-managed KMS key, and restore from the copied snapshot.. To encrypt RDS snapshots with a customer-managed KMS key, you must first take a snapshot of the existing instance (which uses an AWS-managed key). Then, copy that snapshot and specify the customer-managed KMS key during the copy operation. Finally, restore from the copied snapshot to create a new instance encrypted with the customer-managed key. Option A is incorrect because you cannot change the encryption key of an existing instance; you must copy the snapshot. Option B is correct and describes the proper procedure. Option C is incorrect because the default KMS key for the account does not affect existing instance snapshots. Option D is incorrect because you cannot modify an existing RDS instance to use a different encryption key directly; the encryption key is set at creation.

Answer

Create a new RDS instance with the customer-managed KMS key and migrate data using DMS.

Answer

Change the default KMS key for the AWS account to the customer-managed key.

Answer

Modify the RDS instance to use the customer-managed KMS key directly.

Question 14

A developer accidentally deleted an RDS database. Which action will allow the database to be restored with the least data loss?

Accepted Answer

Restore from the latest automated backup using point-in-time recovery.. Point-in-time recovery (PITR) allows you to restore an RDS DB instance to any second within the automated backup retention period, typically up to the last five minutes. This minimizes data loss because it replays transaction logs from the latest automated backup to the specified time, recovering changes made right up to the deletion moment. Automated backups are enabled by default with a 7-day retention, making PITR the most granular recovery option.

Answer

Use the 'Recycle Bin' feature to recover the RDS instance.

Answer

Restore from the latest manual snapshot.

Answer

Create a new RDS instance and hope for the best.

Question 15

A company wants to enforce encryption in transit for all connections to their ElastiCache for Redis cluster. Which security measure should they implement?

Accepted Answer

Enable Encryption in-transit when creating the cluster.. ElastiCache for Redis enforces encryption in transit by enabling the feature at cluster creation time. This uses TLS to encrypt data moving between clients and the Redis nodes, ensuring that all connections are secured against eavesdropping or man-in-the-middle attacks. The setting cannot be changed after the cluster is provisioned, so it must be enabled during the initial setup.

Answer

Set a parameter group with 'require_secure_transport' to ON.

Answer

Use VPC Flow Logs to monitor connections.

Answer

Enable encryption at rest using KMS.