DBS-C01 Database Security Practice Test 14 — 15 Questions

Question 1

A company uses Amazon Redshift for its data warehouse. The security team wants to ensure that all data in the cluster is encrypted at rest using a hardware security module (HSM) to manage the encryption keys. The Redshift cluster is currently unencrypted. Which action should a database specialist take to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a new Redshift cluster with encryption enabled using an HSM, then use the UNLOAD and COPY commands to migrate data from the old cluster to the new one.. Amazon Redshift requires encryption to be enabled at cluster creation time. To encrypt an existing unencrypted cluster using an HSM, you must create a new cluster with encryption enabled and an HSM connection, then migrate data using UNLOAD and COPY. This approach ensures the new cluster is encrypted as required, and the old cluster can be decommissioned after migration.

Answer

Modify the existing Redshift cluster to enable encryption using an HSM, which will apply the encryption without requiring a cluster restart.

Answer

Enable encryption on the existing cluster by taking a snapshot and restoring it with encryption using an HSM, which will replace the existing cluster in place.

Answer

Use AWS KMS to encrypt the Redshift cluster's storage volumes directly, then enable HSM key management on the KMS key.

Question 2

A company runs an Amazon RDS for Oracle DB instance in a private subnet. The security team wants to enforce that all connections to the database are encrypted in transit using SSL/TLS, and that any client that attempts an unencrypted connection is rejected. The DB instance uses a custom option group. Which configuration should a database specialist implement to meet these requirements?

Accepted Answer

Add the SSL option to the custom option group, and set the Oracle database parameter sqlnet.ora parameter SSL_VERSION to 1.2 and the parameter SQLNET.SSL_CLIENT_AUTHENTICATION to FALSE, then set the listener parameter SSL_CLIENT_AUTHENTICATION to TRUE.. The requirement is to enforce SSL/TLS and reject unencrypted connections. For RDS for Oracle, you enable SSL by adding the SSL option to the option group, then configure sqlnet.ora parameters. Setting SSL_VERSION to 1.2 and SQLNET.SSL_CLIENT_AUTHENTICATION to FALSE allows SSL connections without client certificates. The listener parameter SSL_CLIENT_AUTHENTICATION set to TRUE ensures that the listener only accepts SSL connections, effectively rejecting unencrypted clients. This combination enforces encryption in transit and meets the security team's requirement.

Answer

Add the SSL option to the custom option group, and set the Oracle database parameter sqlnet.ora parameter SSL_CLIENT_AUTHENTICATION to FALSE.

Answer

Set the Oracle database parameter SQLNET.ENCRYPTION_CLIENT to REQUIRED in a custom parameter group and reboot the DB instance.

Answer

Add the SSL option to the custom option group with SQLNET.SSL_VERSION set to 1.2, and set the sqlnet.ora parameter SSL_CLIENT_AUTHENTICATION to TRUE.

Question 3

A company uses Amazon Redshift for a data warehouse. The security team needs to enforce column-level access control so that users in the finance group can see salary data, while users in the marketing group cannot. The solution must integrate with existing IAM roles. Which two actions should be taken? (Choose two.)

Accepted Answer

Configure Redshift to use IAM authentication, and map IAM roles to Redshift database roles using the Redshift IAM role mapping feature.. Column-level access control in Amazon Redshift is implemented by granting SELECT on specific columns to roles. To integrate with IAM, you map IAM roles to Redshift roles using the IAM role mapping feature. This allows IAM-authenticated users to inherit the column-level privileges. Together, these actions enforce that only the finance group can access salary data, while marketing cannot, and leverage existing IAM roles.

Answer

Create a view that excludes the salary column for the marketing group, and grant SELECT on the view to the marketing group while granting SELECT on the base table to the finance group.

Answer

Enable Redshift audit logging to track column access, and use AWS Lake Formation to enforce column-level permissions on Redshift tables.

Answer

Create a Redshift role, grant SELECT on the salary column to that role, and grant the role to the finance group's IAM role using Redshift Spectrum.

Question 4

A healthcare company uses Amazon DynamoDB to store patient records. The security team wants to ensure that all data is encrypted at rest using a customer managed key in AWS KMS, and that the key is used only for this DynamoDB table. They also need to audit all API calls that use the key. Which combination of actions should the database specialist take?

Accepted Answer

Create a customer managed KMS key, configure the DynamoDB table to use it for encryption at rest, and enable AWS CloudTrail logging for KMS.. DynamoDB encryption at rest can use a customer managed KMS key, which can be scoped to a specific table. To audit key usage, CloudTrail must be enabled for KMS, as it logs all API calls to KMS, including those made by DynamoDB on behalf of the table. This combination ensures the key is used only for the table and that all key usage is auditable.

Answer

Enable DynamoDB encryption at rest with the default AWS owned key, and use AWS CloudTrail to log all DynamoDB API calls.

Answer

Use an AWS managed key for DynamoDB and enable DynamoDB Streams to capture key usage.

Answer

Create a customer managed KMS key, configure the DynamoDB table to use it, and enable AWS Config to record KMS key usage.

Question 5

A company runs an Amazon Aurora PostgreSQL cluster with an AWS-managed KMS key for encryption at rest. A security policy now requires that all data at rest be encrypted with a customer-managed AWS KMS key so that key rotation and access can be audited and controlled by the company. The database team must implement this without changing the application endpoint or losing any data. What should they do?

Accepted Answer

Create a new cluster encrypted with a customer-managed KMS key, migrate the data, and repoint the application to the new cluster endpoint.. Aurora encryption at rest is set when the cluster is created and cannot be changed afterward, and AWS-managed keys cannot be customer-audited. The compliant approach is to create a new cluster encrypted with a customer-managed KMS key, migrate the data, and cut the application over to the new endpoint, which is the only way to guarantee the data is protected by a key the company controls.

Answer

Take a snapshot of the cluster, encrypt the snapshot with a customer-managed KMS key, and restore it over the existing cluster.

Answer

Modify the existing Aurora cluster in place and select a new customer-managed KMS key for encryption.

Answer

Enable automatic key rotation on the existing AWS-managed key used by the cluster.

Question 6

A healthcare company uses Amazon DynamoDB to store patient records. The security team wants to ensure that all data written to a specific table is encrypted using a customer managed key in AWS KMS, and that the key is rotated annually. The table is currently encrypted with an AWS owned key. What is the MOST operationally efficient way to meet these requirements?

Accepted Answer

Modify the table's encryption settings to use the customer managed key and enable automatic key rotation on the KMS key.. DynamoDB supports updating the encryption configuration of an existing table to use a customer managed key in AWS KMS. After updating the table, you can enable automatic rotation for that KMS key. This is the most operationally efficient method because it avoids data migration and table recreation. Other options either do not encrypt the table itself or involve unnecessary overhead.

Answer

Enable DynamoDB Streams and use an AWS Lambda function to encrypt each item with the customer managed key before writing to the table.

Answer

Create a new DynamoDB table with encryption using the customer managed key and migrate the data using AWS Database Migration Service.

Answer

Use an AWS KMS customer managed key to encrypt a DynamoDB Accelerator (DAX) cluster and enable rotation on the key.

Question 7

A security engineer is configuring access control for an Amazon DynamoDB table named SensitiveData. The table contains attributes including a partition key CustomerId, a sort key OrderDate, and an attribute Department. The engineer needs to grant an IAM role read-only access to only the items where the Department attribute equals 'Finance'. The role must not be able to read any other items. Which two actions should the engineer take to meet these requirements? (Choose two.)

Accepted Answer

Attach an IAM policy that allows dynamodb:Query on the GSI and includes a Condition element with dynamodb:LeadingKeys for the Department attribute.. DynamoDB fine-grained access control can restrict access based on partition key values using the dynamodb:LeadingKeys condition. However, this only works for key attributes. To restrict based on a non-key attribute like Department, you must create a GSI with Department as the partition key and then use dynamodb:LeadingKeys on that index. This allows the role to query only items with Department='Finance'.

Answer

Attach an IAM policy with a dynamodb:Query action and a Condition element that uses dynamodb:Attributes to allow only the Department attribute to be returned.

Answer

Attach an IAM policy with a dynamodb:Query action and a Condition element that uses dynamodb:FilterExpression to restrict access to items where Department equals 'Finance'.

Answer

Attach an IAM policy with a dynamodb:Query action and a Condition element that uses dynamodb:LeadingKeys to restrict access to items where the partition key is 'Finance'.

Question 8

A company uses Amazon Redshift for a data warehouse. The security team wants to implement fine-grained access control to restrict access to specific columns containing sensitive data, such as credit card numbers, for certain users. They also want to ensure that these restrictions are enforced even when users run queries through BI tools. Which two features should they use? (Choose two.)

Accepted Answer

Column-level access control using GRANT and REVOKE statements on specific columns.. Redshift provides column-level access control via GRANT and REVOKE on columns, and dynamic data masking via masking policies. Both enforce restrictions at the database level, ensuring that users cannot access sensitive columns even when using BI tools. Row-level security, Lake Formation, and audit logging do not directly restrict column access in Redshift.

Answer

Row-level security policies using CREATE POLICY statements.

Answer

Enabling audit logging to track access to sensitive columns.

Answer

Using AWS Lake Formation to manage column-level permissions on Redshift tables.

Question 9

A company uses Amazon DocumentDB (with MongoDB compatibility) to store sensitive customer data. The security team requires that all connections to the cluster use TLS and that the cluster's audit logs capture all authentication attempts. Which combination of actions should a database specialist take to meet these requirements?

Accepted Answer

Enable TLS on the cluster by setting the tls parameter to enabled in the cluster parameter group, and enable auditing by setting audit_logs to enabled and configuring the audit log to capture authentication events.. To enforce TLS on Amazon DocumentDB, set the tls parameter to enabled in the cluster parameter group. To capture authentication attempts, enable auditing by setting audit_logs to enabled and configure the audit log to include authentication events. This combination ensures that all connections are encrypted and that authentication attempts are logged for security auditing.

Answer

Enable TLS by modifying the cluster to use an SSL certificate, and enable auditing by turning on Amazon CloudWatch Logs export for the cluster's audit logs.

Answer

Use IAM database authentication to enforce TLS and enable auditing by setting the audit_logs parameter to enabled, then configure the audit log to capture all connections.

Answer

Configure the cluster to use a security group that only allows TLS connections, and enable auditing by setting the audit_logs parameter to enabled and specifying the authentication events to log.

Question 10

A company runs an Amazon RDS for PostgreSQL DB instance in a private subnet. A security policy requires that all connections to the database use SSL/TLS. The database administrator has set the rds.force_ssl parameter to 1. A developer attempts to connect using the psql client without specifying SSL mode. What will happen?

Accepted Answer

The connection will succeed because psql automatically negotiates SSL when the server requires it, and the developer does not need to specify sslmode.. The rds.force_ssl parameter, when set to 1, requires all client connections to use SSL/TLS. The psql client defaults to sslmode=prefer, which means it will try SSL first and only fall back to non-SSL if SSL is unavailable. Since the server supports SSL, the connection will be established over SSL without the developer needing to specify sslmode=require. Therefore, the connection succeeds.

Answer

The connection will succeed because rds.force_ssl only enforces SSL for replication connections, not for regular client connections.

Answer

The connection will fail because the developer must explicitly set sslmode=require in the connection string when rds.force_ssl is enabled.

Answer

The connection will be rejected because rds.force_ssl requires all clients to use SSL, and psql defaults to prefer SSL but will attempt non-SSL if SSL fails.

Question 11

A company uses Amazon DynamoDB to store sensitive customer data. The security team wants to ensure that all data at rest is encrypted using a customer managed key (CMK) in AWS Key Management Service (KMS) and that they can audit all key usage. They also want to enforce that any attempt to access the table without encryption is denied. Which two actions should a database specialist take to meet these requirements? (Choose two.)

Accepted Answer

Use AWS CloudTrail to log all KMS API calls related to the CMK.. To encrypt a DynamoDB table at rest with a customer managed key, you must specify the KMS key when creating the table using the SSESpecification parameter with SSEType KMS and the CMK ARN. This ensures all data is encrypted with that key. To audit key usage, enable AWS CloudTrail to log KMS API calls. CloudTrail records all operations on the CMK, providing the required audit trail. These two actions together meet the encryption and auditing requirements.

Answer

Enable DynamoDB Streams on the table to capture all write operations for auditing.

Answer

Attach an IAM policy to the table that denies access if the request is not encrypted with the CMK.

Answer

Configure DynamoDB Accelerator (DAX) with encryption in transit enabled.

Question 12

A company is using Amazon RDS for SQL Server with a Multi-AZ deployment. The security team wants to audit all login attempts and capture both successful and failed logins. They have enabled auditing on the DB instance. Which TWO actions must be taken to ensure that audit logs are captured and retained for later analysis? (Choose two.)

Accepted Answer

Grant the DB instance an IAM role with permissions to write to CloudWatch Logs.. To capture and retain SQL Server audit logs for RDS, you must enable auditing (already done) and then publish the logs to CloudWatch Logs. Publishing requires an IAM role attached to the DB instance with permissions to write to CloudWatch Logs. Other options like forcing SSL or enabling backups do not address log capture and retention.

Answer

Create a custom DB parameter group with the audit log parameter set to 'on' and apply it to the DB instance.

Answer

Enable automated backups with a retention period of at least 7 days.

Answer

Set the rds.force_ssl parameter to 1 in the parameter group.

Question 13

A company uses Amazon Aurora MySQL for a critical application. The security team requires that all database activity be logged to Amazon CloudWatch Logs for auditing, and that the logs be retained for at least one year. They also want to ensure that only authorized IAM principals can access the logs. Which combination of steps should the database specialist take to meet these requirements? (Choose two.)

Accepted Answer

Enable the audit log, error log, and slow query log on the Aurora cluster and publish them to CloudWatch Logs.. To meet the requirements, enable the Aurora MySQL audit log and publish it to CloudWatch Logs, and set the log group retention to 365 days. These two actions ensure database activity is logged and retained for one year. Access control is managed via IAM policies attached to principals, not directly to the log group, so that is not a required step in the combination.

Answer

Use AWS CloudTrail to log all database activity and store the logs in an S3 bucket with a lifecycle policy.

Answer

Attach an IAM policy to the CloudWatch Logs log group that allows only specific IAM principals to perform logs:GetLogEvents and logs:FilterLogEvents.

Answer

Configure an AWS Lambda function to rotate the CloudWatch Logs log group and archive old logs to Amazon S3.

Question 14

A company uses Amazon Redshift and requires that all data at rest be encrypted using a hardware security module (HSM) to meet compliance. They also need to audit all access to the encryption keys. Which configuration should they implement?

Accepted Answer

Configure Redshift to use an AWS CloudHSM cluster for encryption and enable CloudTrail logging for CloudHSM API calls.. For Redshift encryption at rest using an HSM, you must configure a CloudHSM cluster and associate it with the Redshift cluster. This provides dedicated hardware security modules. To audit key access, enable CloudTrail logging for CloudHSM API calls. AWS KMS, Secrets Manager, and AWS owned keys do not meet the HSM requirement.

Answer

Use AWS Secrets Manager to store the Redshift master key and enable CloudTrail logging for Secrets Manager.

Answer

Enable Redshift encryption with an AWS owned key and enable Redshift audit logging to capture key access.

Answer

Enable Redshift encryption with AWS KMS using a customer-managed key and enable CloudTrail logging for KMS.

Question 15

A company uses Amazon Redshift and needs to implement row-level security to ensure that analysts can only see data for their own region. The security team must also ensure that the security policies are enforced at the database level and cannot be bypassed by users with query privileges. Which two actions should they take to achieve this? (Choose two.)

Accepted Answer

Enable row-level security on the table and ensure that users are not superusers or users with the sysadmin role, as those bypass RLS.. Amazon Redshift row-level security is implemented with CREATE RLS POLICY and ATTACH RLS POLICY, which enforce filtering at the database level. However, superusers and sysadmin users bypass RLS, so analysts must not have those roles. Combining the RLS policy with proper role management ensures that region-based filtering cannot be circumvented, meeting the security team's requirements.

Answer

Create a view for each region that filters rows and grant analysts access only to the view for their region.

Answer

Use column-level access control to hide the region column from analysts so they cannot filter by region.

Answer

Grant the analysts the sysadmin role so they can manage their own row-level security policies.