DBS-C01 Database Security Practice Test 14 — 15 Questions

Question 1

A company needs to rotate the master user password for an Amazon RDS for MySQL DB instance. What is the recommended way to do this without downtime?

Accepted Answer

Use the AWS Management Console, CLI, or API to modify the DB instance with a new master password.. Using the AWS Management Console, CLI, or API to modify the DB instance with a new master password updates the password without any downtime or reboot. Option A is incorrect because modifying the DB instance and setting a new password does not cause a reboot; password changes take effect immediately. Option B is incorrect because updating the DB parameter group does not change the master password. Option D is incorrect because deleting and relaunching the instance is unnecessary and would cause downtime.

Answer

Modify the DB instance and set a new password, which will cause a reboot for the change to take effect.

Answer

Update the DB parameter group with the new password.

Answer

Delete the DB instance and launch a new one with the new password.

Question 2

A security engineer needs to ensure that all access to an Amazon DynamoDB table is encrypted in transit. Which configuration achieves this?

Accepted Answer

Ensure all client applications use the DynamoDB HTTPS endpoint.. DynamoDB uses HTTPS for all API calls by default, ensuring encryption in transit. Option A is incorrect because configuring a VPC endpoint does not enable encryption; it provides private connectivity, but encryption in transit is already handled by HTTPS. Option C is incorrect because placing DynamoDB behind CloudFront is not a valid configuration; CloudFront is a CDN for content delivery, not for securing database access. Option D is incorrect because DynamoDB does not have an 'ssl_enabled' parameter; encryption in transit is always enforced via HTTPS.

Answer

Configure a VPC endpoint for DynamoDB and enable encryption.

Answer

Place the DynamoDB table behind Amazon CloudFront.

Answer

Enable SSL on the DynamoDB table by setting the 'ssl_enabled' parameter.

Question 3

Which TWO of the following are methods to control access to an Amazon RDS DB instance? (Select TWO.)

Accepted Answer

VPC security groups. Options A and B are correct. VPC security groups control network access to the RDS instance at the instance level, acting as a virtual firewall. IAM policies can control who can perform administrative actions on the RDS instance via the AWS API, such as creating, modifying, or deleting the instance. Option C is incorrect because CloudWatch alarms monitor performance metrics and trigger actions, but do not control access. Option D is incorrect because database passwords are a form of authentication for users connecting to the database, not a method to control access to the RDS instance itself. Option E is incorrect because S3 bucket policies control access to Amazon S3 resources, not RDS.

Answer

Amazon CloudWatch alarms

Answer

Database passwords

Answer

Amazon S3 bucket policies

Question 4

Which THREE of the following are best practices for securing an Amazon Aurora MySQL database? (Select THREE.)

Accepted Answer

Enable encryption at rest using AWS KMS.. Options A, B, and D are correct. Enabling encryption at rest with AWS KMS (A) protects data stored on disk. Audit logging (B) tracks database activity for security monitoring. IAM database authentication (D) provides a secure, managed method for access control without storing credentials. Option C is wrong because storing credentials in application code is insecure and violates best practices. Option E is wrong because disabling automated backups reduces data durability and recovery capabilities.

Answer

Store database credentials in application code for simplicity.

Answer

Disable automated backups to reduce attack surface.

Question 5

Which TWO of the following are valid ways to encrypt data at rest in Amazon DynamoDB? (Select TWO.)

Accepted Answer

Use AWS owned CMK for server-side encryption.. Options A and E are correct. DynamoDB offers server-side encryption at rest using AWS owned CMK (A) or customer managed CMK from AWS KMS (E). Option B is incorrect because Transparent Data Encryption (TDE) is not supported by DynamoDB—it is used for relational databases. Option C is incorrect because DynamoDB is serverless and does not provision EBS volumes; its encryption is handled internally. Option D is incorrect because client-side encryption is applied before data is sent to DynamoDB, not encryption at rest of the DynamoDB service itself.

Answer

Enable Transparent Data Encryption (TDE).

Answer

Enable EBS encryption on the underlying storage.

Answer

Implement client-side encryption before sending data to DynamoDB.

Question 6

An IAM policy is attached to a user. What is the effect of this policy on the user's ability to delete the DB instance named prod-db?

The policy is:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "rds:DeleteDBInstance",
      "Resource": "arn:aws:rds:us-east-1:123456789012:db:prod-db"
    },
    {
      "Effect": "Allow",
      "Action": "rds:*",
      "Resource": "*"
    }
  ]
}
```

Accepted Answer

The user cannot delete the DB instance because the Deny statement explicitly denies it.. In IAM policy evaluation, an explicit Deny overrides any Allow. The policy explicitly denies the `rds:DeleteDBInstance` action on the `prod-db` resource, so the user cannot delete the DB instance, regardless of the Allow statement granting all RDS actions.

Answer

The user can delete the DB instance only after creating a final snapshot.

Answer

The user can delete the DB instance because the Allow statement grants all actions.

Answer

The user can delete the DB instance because the Allow statement is broader and applies to all resources.

Question 7

An RDS DB instance has two security groups attached. Security group sg-12345678 allows inbound traffic on port 3306 from 0.0.0.0/0. Security group sg-87654321 allows inbound traffic on port 3306 from 10.0.0.0/16. What is the effective inbound access to the DB instance?

Accepted Answer

All IP addresses (0.0.0.0/0) are allowed to connect.. When multiple security groups are attached to an RDS instance, the rules are combined, and the most permissive inbound rule applies. Security group sg-12345678 allows all IP addresses (0.0.0.0/0), so the effective inbound access is from all IPs. Option A is wrong because the rules do not conflict; they are additive. Option B is wrong because the more restrictive rule does not override the more permissive one. Option C is wrong because the less restrictive rule (0.0.0.0/0) applies, not just the 10.0.0.0/16 range.

Answer

No IP addresses are allowed because the rules conflict.

Answer

Only the 0.0.0.0/0 range is allowed because sg-12345678 is more permissive.

Answer

Only the 10.0.0.0/16 range is allowed because sg-87654321 is more restrictive.

Question 8

A KMS key has the grant shown. An IAM role named AdminRole is the grantee. What additional permission does this grant provide to AdminRole beyond what the role's IAM policy allows?

Accepted Answer

The role can use the key to encrypt and decrypt, regardless of its IAM policy.. A KMS grant allows the grantee to perform the specified operations (in this case, Encrypt and Decrypt) on the KMS key without needing additional permissions in the IAM policy. The grant provides these permissions directly to the grantee, independent of IAM policies. Option B is incorrect because the grant's permissions are effective regardless of the IAM policy; they do not require IAM policy to also allow the operations. Option C is incorrect because the grant does not include permission to delete the key; deletion requires separate IAM permissions. Option D is incorrect because creating new grants is a separate permission (CreateGrant) that is not included in a grant that only allows Encrypt and Decrypt.

Answer

The role can use the key to encrypt and decrypt, but only if its IAM policy also allows it.

Answer

The role can delete the KMS key.

Answer

The role can create new grants for this key.

Question 9

A company is using an Amazon RDS for MySQL DB instance to store sensitive customer data. A security audit reveals that all database traffic between the application and the database is transmitted in plaintext. Which configuration change would encrypt data in transit for new connections?

Accepted Answer

Modify the DB instance to require SSL/TLS connections and update the application connection string to use SSL.. To encrypt data in transit for new connections to an Amazon RDS for MySQL DB instance, you must modify the DB instance to require SSL/TLS connections. This forces all connections to use SSL/TLS, encrypting the data transmitted between the application and the database. After enabling this, the application connection string must be updated to use SSL (e.g., by adding ssl=true or equivalent). The other options do not encrypt data in transit: VPC peering (B) does not encrypt traffic; encryption at rest using AWS KMS (C) only protects stored data; and IAM database authentication (D) manages authentication but does not encrypt the connection itself.

Answer

Configure the DB instance to be in a VPC with a VPC peering connection to the application's VPC.

Answer

Enable encryption at rest for the RDS DB instance using AWS KMS.

Answer

Enable IAM database authentication for the DB instance.

Question 10

A financial services company uses Amazon DynamoDB to store transaction records. The security team requires that all items be encrypted at rest using a customer-managed AWS KMS key. Additionally, the company must be able to audit key usage and rotation. What is the MOST secure and auditable approach?

Accepted Answer

Use SSE-KMS with a customer-managed key, enable automatic key rotation, and enable CloudTrail data events for the key.. Using a customer-managed KMS key with automatic annual rotation and enabling CloudTrail logging of key usage provides encryption control and auditing. Option A is wrong because SSE-S3 does not provide customer control or audit. Option B is wrong because manual rotation is less secure and auditable than automatic rotation. Option D is wrong because client-side encryption would require managing encryption keys on the client side, which does not leverage the AWS KMS infrastructure for automatic key rotation and auditing, and is not as integrated or auditable as server-side encryption with KMS.

Answer

Enable default encryption on the DynamoDB table using SSE-S3.

Answer

Use SSE-KMS with a customer-managed key and manually rotate the key every 90 days.

Answer

Use client-side encryption with the AWS Encryption SDK.

Question 11

A developer needs to grant an IAM user the ability to perform all operations on an Amazon RDS DB instance except the ability to delete it. Which IAM policy action should be explicitly denied?

Accepted Answer

rds:DeleteDBInstance. To prevent deletion, you must explicitly deny the rds:DeleteDBInstance action. Option A (rds:RebootDBInstance) is incorrect because it only reboots the instance. Option B (rds:StopDBInstance) is incorrect because it only stops the instance. Option C (rds:ModifyDBInstance) is incorrect because it only modifies the instance. Option D (rds:DeleteDBInstance) is the correct action to deny to prevent deletion.

Answer

rds:RebootDBInstance

Answer

rds:StopDBInstance

Answer

rds:ModifyDBInstance

Question 12

A company uses Amazon RDS for PostgreSQL with Multi-AZ deployment. The security team wants to ensure that any access to the database is logged, including SELECT queries. What should be done to capture these logs?

Accepted Answer

Modify the DB parameter group to enable query logging and publish logs to Amazon CloudWatch Logs.. Enabling RDS Enhanced Monitoring does not capture query logs. Enabling automatic backups does not log queries. Enabling RDS Performance Insights does not log queries. To capture SELECT queries, you need to enable PostgreSQL query logging by setting the appropriate parameter group parameters (e.g., log_statement = 'all' or 'mod') and then export logs to CloudWatch Logs.

Answer

Enable automated backups and export logs to Amazon S3.

Answer

Enable RDS Performance Insights.

Answer

Enable RDS Enhanced Monitoring.

Question 13

A company runs an Amazon Aurora MySQL-compatible database cluster. The security team requires that all database credentials be rotated automatically every 30 days. Which combination of AWS services can meet this requirement with minimal operational overhead?

Accepted Answer

Store the password in AWS Secrets Manager and enable automatic rotation with a 30-day interval.. AWS Secrets Manager provides built-in automatic rotation for RDS database credentials. Option A is incorrect because IAM database authentication does not involve password rotation. Option C is incorrect because CloudHSM does not manage password rotation. Option D is incorrect because Systems Manager Parameter Store lacks built-in rotation capabilities for RDS credentials.

Answer

Use IAM database authentication and rotate the IAM user keys every 30 days.

Answer

Use AWS CloudHSM to generate a new password and a Lambda function to update the database.

Answer

Store the password in AWS Systems Manager Parameter Store and use a scheduled Lambda function to update the password.

Question 14

A developer accidentally exposed an Amazon RDS snapshot to the public. What is the quickest way to remediate this issue?

Accepted Answer

Modify the snapshot permissions to set it to private.. The quickest remediation is to modify the snapshot permissions to make it private. This immediately revokes public access. Option A is incorrect because deleting the snapshot would remove the backup entirely, which is unnecessary and could risk data loss if no other backup exists. Option B is incorrect because copying the snapshot does not change the original's permissions; the original remains public. Option C is incorrect because sharing with a specific account does not revoke public access; it only adds an additional permission. Therefore, modifying the snapshot to private is the direct and fastest fix.

Answer

Delete the snapshot and create a new one from the source DB instance.

Answer

Copy the snapshot to a new snapshot and delete the original.

Answer

Share the snapshot with only the required AWS account.

Question 15

A company uses Amazon DynamoDB with a global secondary index (GSI) and client-side encryption using the AWS Encryption SDK. The security team requires that the partition key and sort key be searchable by the application but not stored in plaintext in the table. Which approach should be taken?

Accepted Answer

Encrypt the entire item client-side and use a secondary index on the encrypted keys.. The requirement is to prevent partition and sort keys from being stored in plaintext while still allowing the application to search by them. Option A achieves this by using client-side deterministic encryption (supported by the AWS Encryption SDK) for the entire item, which encrypts the keys. Because the encryption is deterministic, the same plaintext key always produces the same ciphertext, so a global secondary index can be built on the encrypted key attributes. The application encrypts the search key and queries the GSI using that encrypted value, enabling search without exposing plaintext keys. Option C leaves keys in plaintext, violating the requirement. Options B and D do not address client-side encryption and cannot prevent plaintext key storage in the database.

Answer

Use server-side encryption with a KMS key and enable DynamoDB Streams to decrypt on read.

Answer

Use client-side encryption to encrypt only the non-key attributes, leaving the partition and sort keys in plaintext.

Answer

Use DynamoDB encryption at rest with a customer-managed KMS key.