DBS-C01 Database Security Practice Test 12 — 15 Questions

Question 1

A security engineer runs the AWS CLI command shown in the exhibit. The engineer wants to ensure that all RDS DB instances in the account are encrypted at rest. What should the engineer do to remediate the unencrypted read replica?

Accepted Answer

Delete the unencrypted read replica and create a new read replica from the encrypted source, enabling encryption on the new replica.. Option D is correct because the read replica is unencrypted, and to encrypt it, you must create a new encrypted read replica from the encrypted source. Option A is wrong because modifying the replica directly does not support enabling encryption. Option B is wrong because you cannot encrypt an existing read replica in place. Option C is wrong because the source is encrypted, so the new replica can be encrypted.

Answer

Modify the read replica by setting the StorageEncrypted parameter to true.

Answer

Enable encryption on the source DB instance and the read replica will automatically become encrypted.

Answer

Create a snapshot of the read replica, encrypt the snapshot, and restore it as a new instance.

Question 2

A financial company uses Amazon DynamoDB to store customer transaction data. The compliance team requires that all data be encrypted at rest using a customer-managed AWS KMS key. Additionally, they need to ensure that the key is used only for DynamoDB and no other AWS service. How can the company meet these requirements?

Accepted Answer

Create a KMS key with a key policy that includes a condition such as "kms:ViaService": "dynamodb.amazonaws.com" to restrict usage to DynamoDB.. Option D is correct because a KMS key policy with a condition that restricts usage to DynamoDB and prevents other services is the proper way. Option A is wrong because SCPs do not control KMS key permissions. Option B is wrong because IAM policies alone cannot restrict the key usage; the key policy must also enforce it. Option C is wrong because you cannot prevent other services from using the key via IAM if the key policy allows them.

Answer

Use a KMS key with no key policy, and rely on IAM policies to restrict access to only DynamoDB.

Answer

Use an AWS Organizations service control policy (SCP) to deny all AWS services except DynamoDB from using the KMS key.

Answer

Create a KMS key with a key policy that allows DynamoDB to use the key, and attach an IAM policy to deny all other services.

Question 3

A developer needs to allow an application running on an EC2 instance to connect to an Amazon RDS for MySQL DB instance securely. Which combination of steps should the developer take?

Accepted Answer

Attach an IAM role to the EC2 instance with permissions to use RDS IAM authentication, and configure the database to use an authentication token.. Option B is correct because using IAM roles for EC2 and IAM database authentication for RDS is the most secure approach. Option A is wrong because hardcoding credentials in the application is insecure. Option C is wrong because opening the database to the world is insecure. Option D is wrong because storing credentials in S3 without encryption is insecure.

Answer

Store the database password in the application code.

Answer

Open the RDS security group to allow traffic from 0.0.0.0/0.

Answer

Store the credentials in an S3 bucket and download them at runtime.

Question 4

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all network traffic between the application servers and the database be encrypted using TLS. The application servers are in a different VPC connected via VPC Peering. What is the simplest way to enforce encryption in transit?

Accepted Answer

Enable the rds.force_ssl parameter in the DB parameter group and configure the application to use SSL connections.. Option A is correct because enabling the rds.force_ssl parameter ensures that Oracle connections require SSL, and using SSL certificates on the client side establishes encrypted connections. Option B is wrong because a VPN adds complexity and is not necessary. Option C is wrong because the default parameter group may not have SSL enabled. Option D is wrong because the security group does not enforce encryption.

Answer

Modify the security group for the RDS instance to only allow traffic on port 443.

Answer

Use a default DB parameter group, as it already enforces SSL.

Answer

Set up a VPN connection between the two VPCs and route all traffic through it.

Question 5

A company is running an RDS for MySQL database and needs to ensure that all connections to the database use SSL encryption. Which configuration step is required?

Accepted Answer

Set 'require_secure_transport' to ON in the DB parameter group.. Option A is correct because setting 'require_secure_transport' to ON in the DB parameter group forces all connections to the RDS for MySQL database to use SSL/TLS encryption. This parameter is supported in MySQL 5.7 and later, and when enabled, the server rejects non-encrypted connections, ensuring compliance with security policies.

Answer

Enable 'Enable SSL' in the RDS console.

Answer

Set 'rds.force_ssl' to 1 in the DB parameter group.

Answer

Set 'ssl' to 'require' in the DB parameter group.

Question 6

A security engineer is designing a VPC with an RDS instance. The database must not be accessible from the internet, but EC2 instances in a private subnet must connect. Which security group configuration is MOST secure?

Accepted Answer

Set the RDS security group inbound rule to allow traffic from the EC2 security group on port 3306.. Option D is the most secure because it uses a security group reference instead of a CIDR block. By referencing the EC2 security group as the source in the RDS security group inbound rule, only instances associated with that specific security group can communicate with the database on port 3306. This approach adheres to the principle of least privilege and automatically scales as instances are added or removed from the EC2 security group, without needing to update CIDR ranges.

Answer

Set the RDS security group inbound rule to allow traffic from the VPC CIDR on port 3306.

Answer

Set the RDS security group inbound rule to allow traffic from 0.0.0.0/0 on port 3306.

Answer

Set the RDS security group inbound rule to allow traffic from the private subnet CIDR on port 3306.

Question 7

A company wants to audit all SQL statements executed on their RDS for PostgreSQL database. Which AWS service should they use?

Accepted Answer

CloudWatch Logs with PostgreSQL audit logs. Option B is correct. Amazon RDS for PostgreSQL integrates with AWS CloudTrail for API calls, but for SQL-level auditing, you must use the database's native audit logging (e.g., pgaudit extension) and log files to CloudWatch Logs. Option A is for VPC flow logs. Option C is for database activity streams, but that's for Aurora, not RDS PostgreSQL. Option D is for monitoring performance.

Answer

AWS Database Migration Service (DMS)

Answer

VPC Flow Logs

Answer

Amazon RDS Performance Insights

Question 8

A company is using DynamoDB with a VPC endpoint. They want to restrict access to only requests originating from their VPC. Which policy condition should be used?

Accepted Answer

'aws:SourceVpce': 'vpce-12345678'. Option A is correct because the 'aws:SourceVpce' condition key allows you to restrict access to requests originating from a specific VPC endpoint (interface endpoint) in your VPC. This ensures that only traffic coming through that VPC endpoint can access the DynamoDB table, providing a network-level security boundary. The condition must reference the exact VPC endpoint ID (e.g., 'vpce-12345678') to enforce this restriction.

Answer

'aws:VpcSourceIp': '10.0.0.0/16'

Answer

's3:x-amz-server-side-encryption': 'AES256'

Answer

'aws:SourceVpc': 'vpc-12345678'

Question 9

A company has a compliance requirement to encrypt all RDS snapshots at rest using a customer-managed KMS key. The RDS instance is already encrypted with an AWS-managed key. What is the correct procedure to ensure snapshots use the customer-managed key?

Accepted Answer

Take a snapshot of the RDS instance, copy the snapshot specifying the customer-managed KMS key, and restore from the copied snapshot.. Option C is correct. You cannot change the encryption key of an existing RDS instance; you must create a snapshot, copy it with a new key, and restore. Option A is not possible. Option B is not possible. Option D is not possible without copying.

Answer

Create a new RDS instance with the customer-managed KMS key and migrate data using DMS.

Answer

Change the default KMS key for the AWS account to the customer-managed key.

Answer

Modify the RDS instance to use the customer-managed KMS key directly.

Question 10

A developer accidentally deleted an RDS database. Which action will allow the database to be restored with the least data loss?

Accepted Answer

Restore from the latest automated backup using point-in-time recovery.. Point-in-time recovery (PITR) allows you to restore an RDS DB instance to any second within the automated backup retention period, typically up to the last five minutes. This minimizes data loss because it replays transaction logs from the latest automated backup to the specified time, recovering changes made right up to the deletion moment. Automated backups are enabled by default with a 7-day retention, making PITR the most granular recovery option.

Answer

Use the 'Recycle Bin' feature to recover the RDS instance.

Answer

Restore from the latest manual snapshot.

Answer

Create a new RDS instance and hope for the best.

Question 11

A company wants to enforce encryption in transit for all connections to their ElastiCache for Redis cluster. Which security measure should they implement?

Accepted Answer

Enable Encryption in-transit when creating the cluster.. Option B is correct because ElastiCache for Redis enforces encryption in transit by enabling the feature at cluster creation time. This uses TLS to encrypt data moving between clients and the Redis nodes, ensuring that all connections are secured against eavesdropping or man-in-the-middle attacks. The setting cannot be changed after the cluster is provisioned, so it must be enabled during the initial setup.

Answer

Set a parameter group with 'require_secure_transport' to ON.

Answer

Use VPC Flow Logs to monitor connections.

Answer

Enable encryption at rest using KMS.

Question 12

A security team needs to grant an IAM user permission to modify only the 'db_secrets' secret in AWS Secrets Manager. Which IAM policy statement is correct?

Accepted Answer

{ 'Effect': 'Allow', 'Action': 'secretsmanager:PutSecretValue', 'Resource': 'arn:aws:secretsmanager:us-east-1:123456789012:secret:db_secrets-??????' }. Option D is correct because it restricts to the specific secret ARN. Option A allows all secrets. Option B allows all secrets with 'db_secrets' in name. Option C allows all secrets.

Answer

{ 'Effect': 'Allow', 'Action': 'secretsmanager:UpdateSecret', 'Resource': '*' }

Answer

{ 'Effect': 'Allow', 'Action': 'secretsmanager:*', 'Resource': '*' }

Answer

{ 'Effect': 'Allow', 'Action': 'secretsmanager:PutSecretValue', 'Resource': 'arn:aws:secretsmanager:us-east-1:123456789012:secret:*' }

Question 13

A company is using Amazon RDS for Oracle and wants to integrate with AWS CloudTrail to log database API calls. Which action is necessary?

Accepted Answer

Enable CloudTrail for the RDS instance.. AWS CloudTrail is the service that logs API calls made to AWS services, including Amazon RDS. To capture database API calls (e.g., CreateDBInstance, ModifyDBInstance) for an RDS for Oracle instance, you must enable CloudTrail for the RDS instance by creating a trail that covers the RDS service. This logs management events at the AWS control plane level, not the database engine level.

Answer

Create a VPC endpoint for CloudTrail.

Answer

Configure Oracle Fine-Grained Auditing (FGA).

Answer

Install the pgAudit extension.

Question 14

Which TWO actions can help protect an RDS database from SQL injection attacks? (Choose 2.)

Accepted Answer

Use parameterized SQL statements in the application.. Option C is correct because parameterized SQL statements (also known as prepared statements) ensure that user input is treated strictly as data, not executable code. By separating SQL logic from data, the database engine compiles the query template once and safely binds parameters, preventing an attacker from injecting malicious SQL fragments. This is the most effective defense against SQL injection at the application layer.

Answer

Enable Multi-AZ for the RDS instance.

Answer

Enable encryption at rest using KMS.

Answer

Restrict network access using security groups.

Question 15

Which THREE are valid methods to encrypt data at rest in Amazon DynamoDB? (Choose 3.)

Accepted Answer

Use an AWS-owned CMK.. Option C is correct because DynamoDB encrypts data at rest by default using an AWS-owned customer master key (CMK), which is a key managed by AWS on behalf of the customer. This key is used to protect the table data, backups, and replicas without requiring any customer configuration.

Answer

Use a customer managed CMK.

Answer

Use S3 server-side encryption.