DBS-C01 Database Security Practice Test 15 — 15 Questions

Question 1

A company uses Amazon Redshift for data warehousing. The security team requires that all data be encrypted at rest with a customer-managed key, and that the key be rotated every year. Which configuration meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Launch the Redshift cluster with encryption enabled using a customer-managed KMS key with automatic annual rotation.. Amazon Redshift supports encryption at rest using a KMS key. You can enable automatic key rotation on a customer-managed KMS key. Option A is wrong because launching without encryption and enabling later using CloudHSM is not supported; Redshift does not support enabling encryption after launch without reloading data, and CloudHSM requires manual key rotation. Option B is wrong because Redshift does not use S3-managed keys for encryption; you must use a KMS key or HSM. Option C is correct because it meets the requirements. Option D is wrong because using an HSM for key storage does not provide automatic key rotation; you would need to rotate the key manually.

Answer

Launch the Redshift cluster without encryption and enable encryption later using AWS CloudHSM.

Answer

Launch the Redshift cluster with encryption enabled using an S3-managed key.

Answer

Launch the Redshift cluster with encryption enabled using a KMS key and configure the cluster to use an HSM for key storage.

Question 2

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all connections to the database use Oracle Native Network Encryption (NNE). How should this be configured?

Accepted Answer

Create a custom DB parameter group with the encryption parameters set to REQUIRED.. RDS for Oracle supports Oracle Native Network Encryption (NNE) through custom DB parameter groups. You must set the SQLNET.ENCRYPTION_SERVER parameter to REQUIRED and optionally specify encryption types. Option A (IAM database authentication) does not encrypt the network connection. Option B is incorrect because RDS does not allow direct editing of sqlnet.ora files; parameter groups are the correct method. Option D (encryption at rest) protects stored data, not data in transit.

Answer

Enable IAM database authentication.

Answer

Modify the sqlnet.ora file on the RDS instance to require encryption.

Answer

Enable encryption at rest using Oracle TDE.

Question 3

Which TWO actions will help protect an Amazon RDS for MySQL database from a SQL injection attack? (Select TWO.)

Accepted Answer

Use parameterized queries in the application code.. Using parameterized queries (prepared statements) prevents SQL injection. Also, restricting database user permissions to only necessary operations limits damage. Enabling encryption at rest does not prevent injection. Using a VPC does not prevent injection. Enabling auto minor version upgrade does not prevent injection.

Answer

Enable encryption at rest for the RDS instance.

Answer

Place the RDS instance in a private VPC subnet.

Answer

Enable auto minor version upgrade on the RDS instance.

Question 4

Which THREE practices should be implemented to secure an Amazon DynamoDB table that stores personally identifiable information (PII)? (Select THREE.)

Accepted Answer

Enable encryption at rest using an AWS KMS customer-managed key.. Using IAM policies to restrict access is a security best practice. Encrypting the table at rest with a KMS key protects data. Monitoring with CloudTrail provides audit trail. VPC endpoints help but are not a security practice for the table itself. Encryption in transit is done by DynamoDB automatically via HTTPS. Fine-grained access control can be achieved with IAM conditions, not attribute-based access control on the table itself.

Answer

Use a VPC endpoint to access the table.

Answer

Enable encryption in transit using SSL/TLS.

Question 5

Which TWO methods can be used to securely connect to an Amazon RDS for PostgreSQL DB instance from an EC2 instance in the same VPC? (Select TWO.)

Accepted Answer

Use IAM database authentication.. Using SSL/TLS encrypts the connection. Using IAM database authentication provides a secure authentication mechanism. A security group allows traffic but does not encrypt. A VPC peering connection does not encrypt. A bastion host may add encryption but is not a method itself.

Answer

Configure a security group that allows all traffic from the EC2 instance.

Answer

Use a bastion host to proxy the connection.

Answer

Set up a VPC peering connection between the EC2 VPC and the RDS VPC.

Question 6

Refer to the exhibit. An IAM policy is attached to a user. What is the effect when the user attempts to delete the RDS DB instance named 'prod-db'?

Accepted Answer

The user cannot delete the instance because of the explicit Deny statement.. The policy explicitly denies the rds:DeleteDBInstance action on the specific resource. Even though there is an Allow on other actions, an explicit Deny overrides any Allow. The user cannot delete the instance. Option A is wrong because the Deny takes precedence. Option B is wrong because the policy explicitly prevents deletion. Option D is wrong because the Deny is on the specific instance.

Answer

The user can delete any other instance except 'prod-db'.

Answer

The user can delete the instance because the Deny statement only applies to snapshots.

Answer

The user can delete the instance because of the Allow on DescribeDBInstances.

Question 7

Refer to the exhibit. The output is from the AWS CLI for an RDS instance. The security team suspects that the encryption key used for this DB instance has been compromised. What is the required action to re-encrypt the instance with a new key?

Accepted Answer

Create a snapshot of the DB instance, copy the snapshot with a new KMS key, and restore the DB instance from the copied snapshot.. RDS does not allow changing the encryption key of an existing encrypted DB instance directly. The correct method is to create a snapshot of the DB instance, copy the snapshot with a new KMS key, and then restore the DB instance from the copied snapshot. Option B is incorrect because modifying the DB instance does not allow changing the KMS key. Option C is incorrect because restoring to a point in time uses the same encryption key as the original instance. Option D is incorrect because this instance is already encrypted; to use a new key, a snapshot copy and restore is required.

Answer

Modify the DB instance to use a new KMS key.

Answer

Restore the DB instance to a point in time and specify a new KMS key.

Answer

Enable encryption on a new DB instance and migrate the data.

Question 8

Refer to the exhibit. A developer created an IAM policy with the above command and attached it to a user. What is the security implication of this policy?

Accepted Answer

The policy grants full administrative access to all RDS resources in the account.. The policy allows all RDS actions on all resources, granting full administrative access to all RDS resources in the account. This is overly permissive and violates the principle of least privilege. Option A is wrong because the policy does not restrict to a specific region. Option B is wrong because it does not restrict to a specific region. Option D is wrong because it does not restrict to read-only access.

Answer

The policy restricts access to only one specific DB instance.

Answer

The policy allows only actions in the us-east-1 region.

Answer

The policy only allows read-only access to RDS.

Question 9

A company wants to encrypt data at rest for an existing Amazon RDS for MySQL DB instance. The database is currently unencrypted. What is the most efficient way to enable encryption?

Accepted Answer

Create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the DB instance from the encrypted snapshot.. RDS does not support enabling encryption on an existing unencrypted DB instance directly. You must create a snapshot, copy it with encryption enabled, and restore from that encrypted snapshot. Option A is incorrect because you cannot modify the DB instance to enable encryption. Option C is incorrect because AWS KMS does not automatically encrypt the DB instance. Option D is incorrect because you cannot directly configure encryption on the existing instance.

Answer

Enable encryption on the existing DB instance by modifying the parameter group.

Answer

Use AWS KMS to automatically encrypt the DB instance.

Answer

Modify the DB instance and enable encryption from the RDS console.

Question 10

A security team needs to audit all SQL statements executed against an Amazon Aurora MySQL DB cluster. Which combination of actions should be taken to achieve this? (Choose TWO.)

Accepted Answer

Set the server_audit_logging parameter to 1 in the DB cluster parameter group.. Options D and E are correct. To audit SQL statements in an Aurora MySQL DB cluster, you need to enable the Aurora MySQL audit plugin. This is done by setting the `server_audit_logging` parameter to 1 in the DB cluster parameter group (option D). Then you can configure the DB cluster to publish the audit logs to Amazon CloudWatch Logs (option E) for centralized monitoring and analysis. Option A is incorrect because AWS CloudTrail captures API calls, not SQL statements. Option B is incorrect because Enhanced Monitoring captures OS-level metrics, not SQL queries. Option C is incorrect because RDS event subscriptions notify about events like DB instance changes, not SQL execution.

Answer

Enable AWS CloudTrail for the Aurora DB cluster.

Answer

Enable Enhanced Monitoring for the DB cluster.

Answer

Enable RDS event subscription for the DB cluster.

Question 11

A company has an Amazon DynamoDB table with a global secondary index (GSI). The security team wants to ensure that only certain attributes are returned in query results based on the IAM policy of the calling user. What is the most secure and scalable approach?

Accepted Answer

Use IAM condition keys with 'dynamodb:Attributes' to restrict access to specific attributes.. Using IAM condition keys with 'dynamodb:Attributes' allows fine-grained access control at the attribute level. This is the recommended way to restrict access to specific attributes. Option A is incorrect because using a Lambda middleware adds latency and complexity, and it is not the most secure or scalable approach compared to native IAM attribute-level conditions. Option B is incorrect because creating multiple GSIs for attribute access would be costly and not scalable, and GSIs are not designed for attribute-level access control; they are for querying. Option D is incorrect because VPC endpoints do not control attribute access; they provide network-level security. A bucket policy is for S3, not DynamoDB.

Answer

Use an AWS Lambda function as a middleware to filter attributes before returning results.

Answer

Create multiple global secondary indexes that include only the allowed attributes for each user group.

Answer

Create a VPC endpoint for DynamoDB and attach a bucket policy that limits attribute access.

Question 12

A developer needs to connect to an Amazon RDS for PostgreSQL DB instance from an EC2 instance in the same VPC. What is the most secure way to authenticate the connection without storing database credentials in the application code?

Accepted Answer

Enable IAM database authentication and generate an authentication token.. IAM database authentication for RDS PostgreSQL allows the application to connect using an IAM user or role without storing any database credentials. The authentication token is generated by the AWS SDK and is valid for 15 minutes. This eliminates the need to store credentials in the application code. Option A is incorrect because a hardcoded password is not secure. Option B (Secrets Manager) and Option D (Systems Manager Parameter Store SecureString) both require the application to retrieve a secret at runtime, which still introduces credential management overhead and potential exposure. IAM authentication is the most secure option as it removes static credentials entirely.

Answer

Use a hardcoded password in the application configuration file.

Answer

Store the database password in AWS Secrets Manager and retrieve it at runtime.

Answer

Store the password in AWS Systems Manager Parameter Store as a SecureString.

Question 13

A security engineer is designing a solution to encrypt data at rest for an Amazon Redshift cluster. The company requires that the encryption key be rotated automatically every year. Which solution meets these requirements?

Accepted Answer

Enable encryption for the Redshift cluster using an AWS KMS key with automatic rotation.. Amazon Redshift supports encryption at rest using AWS KMS with automatic key rotation. When you enable encryption for a Redshift cluster, you can choose a KMS key with automatic rotation enabled, which meets the requirement of rotating the encryption key automatically every year.

Option A is incorrect because manual rotation using a Lambda function is not the recommended approach when automatic rotation is available. Redshift does not support custom manual rotation; it relies on KMS for key management.

Option C is incorrect because Redshift does not support CloudHSM for encryption at rest; it uses AWS KMS. CloudHSM does not provide automatic rotation as a built-in feature in the same way KMS does.

Option D is incorrect because Redshift does not store cluster data in an S3 bucket; S3 server-side encryption is not applicable to the Redshift cluster itself. Redshift uses its own encryption mechanism integrated with KMS.

Answer

Use a Lambda function to rotate the encryption key manually every year.

Answer

Use a CloudHSM key to encrypt the Redshift cluster and configure automatic rotation in CloudHSM.

Answer

Store the Redshift cluster data in an S3 bucket with server-side encryption enabled.

Question 14

A company is using an Amazon DynamoDB table with a global table configuration across two AWS regions. The security team wants to ensure that all data is encrypted in transit between the regions. What should the team do?

Accepted Answer

No additional action is required; DynamoDB global tables encrypt all replication traffic in transit by default.. DynamoDB global tables automatically encrypt all replication traffic in transit using TLS, so no additional configuration is required. Option A is incorrect because internet gateways are not involved in inter-region replication; DynamoDB global tables use the AWS backbone network. Option B is incorrect because CloudFront is a content delivery network and does not handle DynamoDB replication traffic. Option C is incorrect because VPC peering is not required; global tables operate outside of VPCs and do not traverse VPC peering connections.

Answer

Configure an Internet gateway in each region and enforce HTTPS for all traffic.

Answer

Use AWS CloudFront to route traffic between the regions with SSL/TLS termination.

Answer

Set up a VPC peering connection between the two regions and route DynamoDB traffic through it.

Question 15

A company wants to audit all API calls made to its Amazon RDS DB instances. Which AWS service should be used to capture these API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API calls made to AWS services, including RDS, providing an audit trail of actions taken. Option B is incorrect because AWS Config tracks resource configuration changes and compliance, not API calls. Option C is incorrect because Amazon GuardDuty is a threat detection service that monitors for malicious activity, not an API audit tool. Option D is incorrect because Amazon Inspector is a vulnerability assessment service that scans for security issues, not an audit trail of API calls.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

Amazon Inspector