DBS-C01 Database Security Practice Test 13 — 15 Questions

Question 1

A security team needs to grant an IAM user permission to modify only the 'db_secrets' secret in AWS Secrets Manager. Which IAM policy statement is correct?

Accepted Answer

{ 'Effect': 'Allow', 'Action': 'secretsmanager:PutSecretValue', 'Resource': 'arn:aws:secretsmanager:us-east-1:123456789012:secret:db_secrets-??????' }. It grants the specific `secretsmanager:PutSecretValue` action on the exact ARN of the `db_secrets` secret, including the required six-character random suffix (`-??????`) that AWS Secrets Manager appends to secret names. This ensures the IAM user can only modify that single secret, meeting the security requirement of least privilege.

Answer

{ 'Effect': 'Allow', 'Action': 'secretsmanager:UpdateSecret', 'Resource': '*' }

Answer

{ 'Effect': 'Allow', 'Action': 'secretsmanager:*', 'Resource': '*' }

Answer

{ 'Effect': 'Allow', 'Action': 'secretsmanager:PutSecretValue', 'Resource': 'arn:aws:secretsmanager:us-east-1:123456789012:secret:*' }

Question 2

A company is using Amazon RDS for Oracle and wants to integrate with AWS CloudTrail to log database API calls. Which action is necessary?

Accepted Answer

Enable CloudTrail for the RDS instance.. AWS CloudTrail is the service that logs API calls made to AWS services, including Amazon RDS. To capture database API calls (e.g., CreateDBInstance, ModifyDBInstance) for an RDS for Oracle instance, you must enable CloudTrail for the RDS instance by creating a trail that covers the RDS service. This logs management events at the AWS control plane level, not the database engine level.

Answer

Create a VPC endpoint for CloudTrail.

Answer

Configure Oracle Fine-Grained Auditing (FGA).

Answer

Install the pgAudit extension.

Question 3

Which TWO actions can help protect an RDS database from SQL injection attacks? (Choose 2.)

Accepted Answer

Use parameterized SQL statements in the application.. Parameterized SQL statements (also known as prepared statements) ensure that user input is treated strictly as data, not executable code, preventing SQL injection at the application layer. Option E is correct because input validation and sanitization filter out malicious characters or patterns before they reach the database, adding an extra layer of defense. Both measures are essential; network controls (security groups) and encryption do not prevent injection attacks.

Answer

Enable Multi-AZ for the RDS instance.

Answer

Enable encryption at rest using KMS.

Answer

Restrict network access using security groups.

Question 4

Which THREE are valid methods to encrypt data at rest in Amazon DynamoDB? (Choose 3.)

Accepted Answer

Use a customer managed CMK.. DynamoDB encryption at rest is implemented through AWS KMS, supporting three types of customer master keys (CMKs): AWS-owned CMKs (default), AWS managed CMKs, and customer managed CMKs. Option A is correct because customer managed CMKs are fully supported, allowing you to create, manage, and control key policies and rotation. Option C (AWS-owned) and D (AWS managed) are also correct. Option E (client-side encryption with DynamoDB Encryption Client) is not an encryption-at-rest method provided by DynamoDB; it encrypts data before transmission, but data at rest is still encrypted by DynamoDB's server-side encryption. Option B is irrelevant as S3 server-side encryption does not apply to DynamoDB.

Answer

Use S3 server-side encryption.

Answer

Use client-side encryption with the DynamoDB Encryption Client.

Question 5

Which TWO AWS services can be used to monitor database security events in real time? (Choose 2.)

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty (Option B) is a threat detection service that continuously monitors for malicious activity and unauthorized behavior, including database security events such as suspicious API calls or potential credential compromise. It uses machine learning, anomaly detection, and integrated threat intelligence to analyze AWS CloudTrail logs, VPC Flow Logs, and DNS logs in real time, making it suitable for monitoring database security events.

Answer

AWS WAF

Answer

Amazon RDS Performance Insights

Answer

AWS CloudTrail

Question 6

A database administrator has the IAM policy shown in the exhibit. Which action will be allowed by this policy?

Accepted Answer

Create a snapshot of the prod-db instance.. The policy explicitly allows CreateDBSnapshot on the resource. Option A is denied. Option C is not in the policy. Option D is not in the policy.

Answer

Modify the prod-db instance.

Answer

Delete the prod-db instance.

Answer

Describe all DB instances in the account.

Question 7

A developer needs to connect to the RDS instance from an EC2 instance in the same VPC. The EC2 instance's security group allows outbound traffic to 0.0.0.0/0. The RDS security group inbound rules currently allow traffic from 0.0.0.0/0 on port 3306. After a security review, the company decides to restrict inbound traffic to the VPC only. Which inbound rule should be added to the RDS security group?

Accepted Answer

An inbound rule allowing traffic from the EC2 instance's security group ID on port 3306.. Referencing the EC2 instance's security group ID in the RDS inbound rule is the most secure and specific method to restrict access to only that EC2 instance within the VPC. Option A is incorrect because the RDS endpoint is a DNS name for the database instance, not a source IP or security group. Option C is too broad, allowing any traffic from the 10.0.0.0/8 range, which may include subnets outside the VPC. Option D is less specific than using the security group ID and could permit access from any resource within the VPC CIDR, whereas the security group approach provides granular control.

Answer

An inbound rule allowing traffic from the RDS endpoint address on port 3306.

Answer

An inbound rule allowing traffic from 10.0.0.0/8 on port 3306.

Answer

An inbound rule allowing traffic from the VPC CIDR (e.g., 10.0.0.0/16) on port 3306.

Question 8

A developer retrieved a database secret using the AWS CLI as shown. What is the MOST secure way to store and rotate this secret?

Accepted Answer

Store the secret in AWS Secrets Manager and enable automatic rotation with a Lambda function.. Secrets Manager can automatically rotate secrets, and the secret should be retrieved using IAM permissions. Option B is insecure. Option C is not best practice. Option D is not needed.

Answer

Store the secret in AWS Systems Manager Parameter Store as a SecureString.

Answer

Store the secret in a configuration file on the EC2 instance.

Answer

Use the secret as-is and change it manually every 90 days.

Question 9

A company is storing sensitive customer data in an Amazon RDS for MySQL DB instance. They need to ensure that data is encrypted at rest. What is the simplest way to achieve this?

Accepted Answer

Launch a new encrypted DB instance and migrate the data.. Amazon RDS for MySQL does not allow enabling encryption at rest on an existing unencrypted DB instance. The simplest way to achieve encryption at rest is to launch a new encrypted DB instance and migrate the data. Option A is incorrect because encryption cannot be enabled on an existing DB instance via modification; it requires creating a new instance. Option B is incorrect because RDS for MySQL does not support Transparent Data Encryption (TDE). Option D is incorrect because client-side encryption with AWS KMS is more complex and not the simplest approach.

Answer

Enable encryption on the existing DB instance by modifying the DB instance settings.

Answer

Enable Transparent Data Encryption (TDE) on the MySQL instance.

Answer

Use client-side encryption with AWS KMS to encrypt data before inserting into the database.

Question 10

A company uses Amazon RDS for PostgreSQL and needs to ensure that only specific IP addresses can connect to the database. Which configuration should be used?

Accepted Answer

Modify the VPC security group associated with the DB instance to allow inbound traffic only from specific IP addresses.. VPC security groups act as a virtual firewall that controls inbound and outbound traffic to the DB instance. By modifying the security group to allow inbound traffic only from specific IP addresses, you restrict database access to those IPs. Option A is incorrect because DB subnet groups define which subnets the RDS instance can reside in, not IP filtering. Option B is incorrect because the rds.force_ssl parameter enforces SSL connections, not IP restrictions. Option C is incorrect because IAM policies control permissions to AWS API actions, not network-level access to the database.

Answer

Configure the DB subnet group to allow only specific IP addresses.

Answer

Set the rds.force_ssl parameter in the DB parameter group.

Answer

Create an IAM policy that restricts access to the RDS API based on source IP.

Question 11

A company is designing a multi-tenant application using Amazon Aurora MySQL. Each tenant's data must be isolated from others. They need to encrypt data at rest with a unique AWS KMS key per tenant. How can this be achieved?

Accepted Answer

Launch separate Aurora clusters for each tenant, each with its own KMS key for encryption at rest.. Aurora MySQL encryption at rest is applied at the cluster level using a single AWS KMS key. You cannot assign different KMS keys to individual databases or tables within the same cluster. Therefore, the only way to achieve unique per-tenant encryption keys is to use separate Aurora clusters, each with its own KMS key. Option A is incorrect because RDS encryption is cluster-wide, not per-database. Option B implements client-side encryption, not encryption at rest. Option C is not supported by Aurora MySQL, as there is no row-level encryption with per-tenant KMS keys. Thus, Option D is correct.

Answer

Create separate databases within the same Aurora cluster and assign a different KMS key to each database.

Answer

Use client-side encryption with different KMS keys per tenant before inserting data into the database.

Answer

Use a single Aurora cluster with row-level encryption using different KMS keys per tenant.

Question 12

A security team is auditing an Amazon RDS for SQL Server DB instance. They notice that SSL connections are not enforced. Which configuration change will enforce SSL for all connections?

Accepted Answer

Set the 'rds.force_ssl' parameter to 1 in the DB parameter group.. For Amazon RDS for SQL Server, you can enforce SSL connections by setting the 'rds.force_ssl' parameter to 1 in the DB parameter group. This forces all connections to use SSL. Option A is incorrect because security groups control network access but do not enforce encryption. Option B is incorrect because the option group manages features such as Transparent Data Encryption (TDE) and native backup/restore, not SSL enforcement. Option D is incorrect because changing the subnet to public would expose the instance to the internet and does not enforce SSL.

Answer

Modify the security group to only allow inbound traffic on port 443.

Answer

Add the SQL Server SSL option to the option group.

Answer

Change the DB subnet group to a public subnet.

Question 13

A developer needs to grant an IAM user permission to perform automated backups of an Amazon RDS DB instance. Which IAM action should be allowed?

Accepted Answer

rds:ModifyDBInstance. The question asks for the IAM action to perform automated backups of an Amazon RDS DB instance. Automated backups are managed by setting the backup retention period, which is configured using the ModifyDBInstance API call. Therefore, the correct IAM action is rds:ModifyDBInstance (option D). Option A (rds:BackupDBInstance) is not a valid IAM action. Option B (rds:CreateDBSnapshot) is for manual snapshots, not automated backups. Option C (rds:RestoreDBInstanceFromDBSnapshot) is for restoration.

Answer

rds:BackupDBInstance

Answer

rds:CreateDBSnapshot

Answer

rds:RestoreDBInstanceFromDBSnapshot

Question 14

A company is using Amazon DynamoDB with server-side encryption enabled. They need to ensure that all access to the table is audited. Which service should be used to capture data-plane API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail, when configured to capture data events, can record DynamoDB data-plane API calls such as GetItem and PutItem. Option A (VPC Flow Logs) captures network traffic, not API calls. Option B (AWS Config) records configuration changes, not data-plane actions. Option C (Amazon CloudWatch Logs) can store logs but does not directly capture API calls; it would require another service to send logs to it.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 15

A company has an Amazon RDS for Oracle DB instance that is publicly accessible. They want to restrict access to only a specific CIDR block. Which two actions must be taken together?

Accepted Answer

Modify the VPC security group to allow inbound traffic on the database port from the specific CIDR, and ensure the DB instance is publicly accessible with the correct security group.. You must modify the VPC security group to allow inbound traffic on the database port from the specific CIDR, and the DB instance must be configured as publicly accessible with that security group attached. Option B is wrong because the DB subnet group determines which subnets the instance can be deployed in, not inbound access restrictions. Option C is wrong because network ACLs operate at the subnet level and are less granular; security groups are the appropriate mechanism for RDS access control. Option D is wrong because the rds.force_ssl parameter enforces encrypted connections but does not restrict by source IP or CIDR.

Answer

Modify the DB subnet group to include only subnets from the allowed CIDR.

Answer

Add a rule to the network ACL to allow inbound traffic from the CIDR.

Answer

Set the rds.force_ssl parameter to force encrypted connections from the allowed CIDR.