DBS-C01 Database Security Practice Test 13 — 15 Questions

Question 1

A company uses an Amazon Redshift cluster to store sensitive customer data. The security team wants to ensure that only authorized users can access specific columns containing credit card numbers, and that access is logged for auditing. They plan to use Redshift column-level access control. Which combination of features should the database specialist implement to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a column-level grant using GRANT SELECT(column) ON table TO user, and enable audit logging on the cluster.. Redshift column-level access control is implemented with GRANT SELECT(column) ON table TO user, which limits which columns a user can query. Enabling audit logging captures the queries for auditing. Row-level security, dynamic data masking, and Lake Formation do not provide the required column-level restriction on native Redshift tables.

Answer

Apply dynamic data masking to the credit card columns, and enable audit logging.

Answer

Use AWS Lake Formation to manage column-level permissions on the Redshift cluster, and enable audit logging.

Answer

Use row-level security policies to restrict rows based on user, and enable audit logging.

Question 2

A financial services company uses Amazon Aurora PostgreSQL for a customer-facing application. The security team needs to ensure that all connections to the Aurora cluster use TLS encryption and that the application's client certificate is validated. The application connects using the PostgreSQL JDBC driver. Which action should the database specialist take to enforce TLS and require client certificate verification?

Accepted Answer

Set the Aurora cluster parameter rds.force_ssl to 1 and modify the PostgreSQL parameter group to set ssl to on, then configure the client to present a certificate signed by a trusted CA and set the server to verify client certificates using ssl_ca_file.. To enforce TLS and require client certificate verification, the Aurora PostgreSQL cluster must force SSL and be configured to request and validate client certificates. Setting rds.force_ssl to 1 enforces TLS. Enabling ssl on the server and specifying ssl_ca_file allows the server to verify client certificates against a trusted CA. The client must present a valid certificate, completing mutual TLS authentication.

Answer

Configure the Aurora cluster to use the rds.force_ssl parameter and set the PostgreSQL ssl_ca_file parameter to the RDS certificate bundle, then set the client to require SSL with verify-full mode.

Answer

Modify the Aurora cluster parameter group to set rds.force_ssl to 1 and configure the PostgreSQL parameter ssl to on, then restart the cluster.

Answer

Enable IAM database authentication on the Aurora cluster and require the application to use IAM credentials for connections.

Question 3

A company uses Amazon RDS for SQL Server with Transparent Data Encryption (TDE) enabled using a customer-managed AWS KMS key. The security team wants to rotate the encryption key annually without downtime. What should they do?

Accepted Answer

Enable automatic key rotation on the existing customer-managed KMS key. RDS will automatically re-encrypt the database with the new key version.. For RDS for SQL Server with TDE using a customer-managed KMS key, enabling automatic key rotation on that KMS key rotates the key material annually without changing the key ID or requiring database changes. RDS continues to use the same key ID, so there is no downtime or need to recreate the instance. This satisfies the annual rotation requirement.

Answer

Take a snapshot, create a new KMS key, restore the snapshot with the new key, and then point the application to the new instance.

Answer

Create a new KMS key and modify the RDS instance to use the new key. The change requires a reboot but no downtime if using Multi-AZ.

Answer

Use AWS Certificate Manager (ACM) to rotate the key, and update the RDS instance's option group to reference the new certificate.

Question 4

A company is using Amazon RDS for Oracle with Transparent Data Encryption (TDE) to encrypt data at rest. The security team wants to ensure that the encryption keys are managed according to compliance requirements, including key rotation and separation of duties. Which two actions should a database specialist take to meet these requirements? (Choose two.)

Accepted Answer

Use AWS KMS customer-managed keys to encrypt the RDS instance's storage volumes, and configure automatic key rotation in KMS.. RDS for Oracle allows you to manage TDE master encryption keys through the RDS console or API, including rotating the key by specifying a new key alias or ARN. Additionally, you can use AWS KMS customer-managed keys for storage encryption and enable automatic rotation in KMS. These two actions provide key rotation and separation of duties. Other options involve unsupported tools or non-existent parameters.

Answer

Store the TDE master encryption key in AWS Secrets Manager and configure automatic rotation using a Lambda function.

Answer

Enable automatic rotation of the TDE master encryption key by setting the key_rotation_interval parameter in the Oracle parameter group.

Answer

Use Oracle Enterprise Manager to manage the TDE master encryption key and configure automatic rotation.

Question 5

A company runs an Amazon RDS for Oracle DB instance in a private subnet. The security team must ensure that all connections to the database are encrypted in transit and that the database rejects any unencrypted connection attempts. Which combination of actions will meet these requirements?

Accepted Answer

Modify the DB parameter group to set sqlnetora.ssl_version to 1.2 and set the Oracle native network encryption (NNE) parameter sqlnet.encryption_client to REQUIRED, then reboot the instance.. Oracle native network encryption (NNE) is configured through DB parameter group parameters. Setting sqlnet.encryption_client to REQUIRED ensures that the database refuses any connection that does not use encryption. Selecting a strong SSL/TLS version further hardens the transport. Together, these settings enforce encryption in transit and block unencrypted sessions, directly meeting the security team's mandate.

Answer

Enable Oracle Transparent Data Encryption (TDE) by adding the wallet to the DB instance, and set the sqlnet.encryption_client parameter to REQUESTED.

Answer

Create an AWS KMS customer managed key and enable encryption at rest on the DB instance, then reboot the instance.

Answer

Attach a security group that allows only port 1521 from the application subnet, and enable IAM database authentication on the DB instance.

Question 6

A company uses Amazon RDS for SQL Server with a Multi-AZ deployment. The security team wants to ensure that all connections to the database are encrypted in transit. Which action should they take?

Accepted Answer

Download the RDS certificate bundle and configure the SQL Server to force encryption by setting the Force Encryption option to Yes.. To enforce encryption in transit for RDS for SQL Server, you must set the Force Encryption option to Yes in the parameter group and ensure clients use the RDS certificate. This forces all connections to use SSL/TLS, meeting the security requirement.

Answer

Configure the RDS instance to use a certificate from AWS Certificate Manager (ACM) and require SSL in the client connection string.

Answer

Modify the RDS instance to enable encryption at rest and set the client to use SSL.

Answer

Enable SSL/TLS encryption by setting the rds.force_ssl parameter to 1 in the parameter group.

Question 7

A financial services company runs an Amazon RDS for Oracle DB instance in a private subnet. The security team wants to ensure that all connections to the database are encrypted in transit and that the database rejects any unencrypted connections. The team has already configured the DB instance to use an SSL certificate. Which additional step should they take to enforce encryption for all client connections?

Accepted Answer

Modify the DB parameter group to set the `sqlnet.ora` parameter `SQLNET.ENCRYPTION_CLIENT` to `REQUIRED` and set `SQLNET.SSL_VERSION` to `1.2`.. To enforce SSL encryption for all connections to an Amazon RDS for Oracle DB instance, you must modify the DB parameter group to set `SQLNET.ENCRYPTION_CLIENT` to `REQUIRED`. This parameter ensures that clients cannot connect without encryption. Additionally, setting `SQLNET.SSL_VERSION` to a secure version like 1.2 is recommended. This combination rejects any unencrypted connections, meeting the security requirement.

Answer

Modify the DB parameter group to set the `sqlnet.ora` parameter `SQLNET.ENCRYPTION_CLIENT` to `REJECTED`.

Answer

Modify the DB parameter group to set the `sqlnet.ora` parameter `SQLNET.ENCRYPTION_CLIENT` to `REQUIRED`.

Answer

Modify the DB parameter group to set the `sqlnet.ora` parameter `SQLNET.SSL_VERSION` to `1.2` and set `SSL_CLIENT_AUTHENTICATION` to `TRUE`.

Question 8

A company stores sensitive data in an Amazon Aurora MySQL database. The security team must ensure that data is encrypted at rest using a customer managed key in AWS KMS, and that the key can be rotated automatically. Which action should be taken?

Accepted Answer

Create a customer managed KMS key with automatic rotation enabled, and specify that key when creating or modifying the Aurora cluster to enable encryption.. To encrypt an Aurora MySQL cluster at rest with a customer managed key that supports automatic rotation, you must create a customer managed KMS key with rotation enabled and specify it during cluster creation. Aurora encryption must be enabled at creation time; you cannot enable it later on an existing unencrypted cluster. This satisfies both control and automatic rotation requirements.

Answer

Create a customer managed KMS key without rotation, and use it to encrypt the Aurora cluster; then manually rotate the key every year by creating a new key and re-encrypting the cluster.

Answer

Enable encryption at rest on the Aurora cluster using an AWS managed key, then enable automatic rotation on that key in KMS.

Answer

Enable encryption at rest on the Aurora cluster using the default AWS managed key aws/rds.

Question 9

A company runs an Amazon Aurora PostgreSQL cluster for a healthcare application. Compliance requires that all database connections be encrypted in transit. The security team has already configured the Aurora cluster to use a custom parameter group with rds.force_ssl = 1. However, they observe that some clients are still able to connect without TLS. What is the most likely reason?

Accepted Answer

The rds.force_ssl parameter requires a cluster reboot to take effect, and the cluster has not been rebooted.. The rds.force_ssl parameter in Aurora PostgreSQL is static and requires a cluster reboot to take effect. Until the reboot, the parameter change is not applied, so clients can still connect without TLS. The other options describe mechanisms that either do not exist or are not relevant to the scenario. Therefore, the cluster must be rebooted to enforce SSL.

Answer

The security group attached to the Aurora cluster allows traffic on port 5432, which bypasses SSL enforcement.

Answer

The clients are using the 'postgres' user, which is exempt from rds.force_ssl.

Answer

The clients are connecting via a proxy that terminates TLS and then forwards unencrypted traffic to the database.

Question 10

A company uses Amazon DynamoDB to store user session data. The security team wants to implement fine-grained access control so that users can only access items where the partition key value matches their own user ID. The application authenticates users with Amazon Cognito and uses IAM roles. Which two actions should the database specialist take to achieve this? (Choose two.)

Accepted Answer

Ensure that the IAM role used by the application has a policy that allows DynamoDB actions and includes the dynamodb:LeadingKeys condition with a value referencing the Cognito identity ID from the request context.. Fine-grained access control in DynamoDB is achieved using IAM policy conditions. The dynamodb:LeadingKeys condition key restricts access to items where the partition key matches a specified value. By using this condition with the Cognito identity ID from the request context, users can only access items where the partition key equals their own identity. This requires an IAM policy that grants DynamoDB actions and includes this condition, and the policy must be attached to the IAM role assumed by the application.

Answer

Enable DynamoDB Streams to capture changes and validate that each write operation matches the user's identity before committing.

Answer

Use an IAM policy with the dynamodb:Attributes condition key to limit access to specific attributes based on the user's role.

Answer

Configure a DynamoDB VPC endpoint and use security groups to restrict access to the table based on the user's IP address.

Question 11

A company uses Amazon Redshift for a data warehouse. The security team wants to implement row-level security (RLS) to restrict access to data based on user roles. They also want to ensure that users cannot bypass RLS by using COPY or UNLOAD commands. Which two actions should they take? (Choose two.)

Accepted Answer

Grant the users only the necessary SELECT privileges on the table and revoke any COPY and UNLOAD privileges.. To implement RLS and prevent bypass, you must create and attach RLS policies to roles, and also revoke COPY and UNLOAD privileges from users. RLS policies enforce row-level filtering for SELECT, UPDATE, and DELETE, but COPY and UNLOAD can bypass RLS if users have those privileges, so they must be restricted.

Answer

Use column-level access control to restrict access to sensitive columns.

Answer

Configure Redshift to use AWS Lake Formation for row-level security.

Answer

Enable the 'enable_rls' parameter in the Redshift cluster parameter group.

Question 12

A financial services company stores sensitive data in an Amazon RDS for Oracle DB instance. The security team requires that all data at rest be encrypted using a customer managed key in AWS KMS, and that the key be rotated annually. They also need to ensure that the DB instance cannot be restored from an unencrypted snapshot. Which set of actions should the database specialist take to meet these requirements?

Accepted Answer

Enable encryption on the DB instance using the customer managed key, and enable automatic key rotation on the KMS key.. To meet the requirements, the DB instance must be encrypted with a customer managed KMS key, and that key must have automatic rotation enabled. RDS encryption at rest using a customer managed key ensures the data is encrypted with a key the company controls. Enabling automatic key rotation on that key satisfies the annual rotation requirement. Encryption also inherently prevents restoring an unencrypted snapshot into the encrypted instance.

Answer

Enable encryption using the default AWS managed key for RDS, and enable automatic key rotation on that key.

Answer

Use AWS CloudHSM to store the encryption key, and configure RDS to use the CloudHSM key for encryption.

Answer

Encrypt the DB instance with a customer managed key, and create an IAM policy that denies rds:RestoreDBInstanceFromDBSnapshot for unencrypted snapshots.

Question 13

A financial services company runs an Amazon Aurora PostgreSQL DB cluster. The security team requires that all connections to the database be encrypted in transit, and that the database verify client certificates to prevent unauthorized access. The team has already created a certificate authority (CA) and client certificates signed by that CA. Which combination of steps must be taken to enforce mutual TLS authentication for the Aurora cluster?

Accepted Answer

Modify the DB cluster parameter group to set rds.force_ssl to 1, set the ssl_ca_file to the custom CA, and set cert_auth to 1, then reboot the cluster.. Mutual TLS for Aurora PostgreSQL requires enforcing SSL and verifying client certificates. This is achieved by setting rds.force_ssl=1, providing the custom CA via ssl_ca_file, and enabling cert_auth=1 in a custom cluster parameter group. These settings must be applied with a reboot. IAM authentication or ACM integration do not provide client certificate verification.

Answer

Enable IAM database authentication and require all users to connect with temporary credentials.

Answer

Set the parameter rds.force_ssl to 1 in a custom DB cluster parameter group and restart the cluster.

Answer

Attach an AWS Certificate Manager (ACM) certificate to the Aurora cluster and enable client certificate verification in the ACM console.

Question 14

A financial services company runs an Amazon Aurora PostgreSQL cluster. A compliance requirement mandates that all connections to the database must use TLS and that the database must reject any unencrypted connection attempts. A database specialist has already set the cluster parameter rds.force_ssl to 1. Which additional configuration step is required to ensure that clients cannot connect without TLS?

Accepted Answer

Set the parameter rds.force_ssl to 1 in a custom DB cluster parameter group and apply it to the cluster.. To enforce TLS for all connections in Aurora PostgreSQL, the rds.force_ssl parameter must be set to 1 in a custom DB cluster parameter group and applied to the cluster. This causes the database to reject any non-SSL connection. IAM authentication, IAM policies with aws:SecureTransport, and encryption at rest do not enforce TLS at the database connection level.

Answer

Modify the Aurora cluster to enable IAM database authentication.

Answer

Attach an IAM policy that denies rds:Connect without aws:SecureTransport.

Answer

Enable encryption at rest using an AWS KMS customer managed key for the Aurora cluster.

Question 15

A company runs an Amazon Aurora MySQL cluster and stores sensitive customer information. The security team requires that all connections to the cluster use TLS and that the TLS version be at least 1.2. They want to enforce this at the cluster level without modifying the application connection strings. Which configuration should they use?

Accepted Answer

Set both require_secure_transport to ON and tls_version to TLSv1.2 in a custom cluster parameter group and apply it to the cluster.. To enforce TLS for all connections and require a minimum TLS version on an Aurora MySQL cluster, you must set both require_secure_transport and tls_version in a custom cluster parameter group. The require_secure_transport parameter ensures that unencrypted connections are rejected, while tls_version sets the minimum acceptable protocol version. Applying these parameters at the cluster level enforces the policy centrally without modifying application connection strings.

Answer

Set the require_secure_transport parameter to ON in a custom cluster parameter group and apply it to the cluster.

Answer

Configure an AWS WAF rule to block connections that do not use TLS 1.2 or higher.

Answer

Set the tls_version parameter to TLSv1.2 in a custom cluster parameter group and apply it to the cluster.