DBS-C01 Database Security Practice Test 15 — 15 Questions

Question 1

A company uses Amazon Aurora MySQL and wants to implement fine-grained access control using IAM database authentication. They have enabled IAM database authentication on the cluster and created an IAM user with the necessary permissions. The security team wants to ensure that the IAM user can only connect to the database using a temporary token and that the token is valid for no more than 15 minutes. Which action should a database specialist take to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Generate an authentication token using the AWS CLI command generate-db-auth-token, which produces a token valid for 15 minutes.. For Aurora MySQL IAM database authentication, authentication tokens are generated using the AWS CLI generate-db-auth-token command or programmatically. These tokens are valid for 15 minutes by default. There is no parameter to adjust the lifetime; it is fixed. The IAM user must have the rds-db:connect permission. The token is used in place of a password. Therefore, simply generating the token with the CLI meets the requirement of a token valid for no more than 15 minutes. Other options incorrectly assume configurable token lifetime or confuse setup steps with token generation.

Answer

Use the AWS CLI command generate-db-auth-token with the --duration-seconds parameter set to 900.

Answer

Create a database user with the REQUIRE SSL attribute and grant the user the rds_iam role.

Answer

Configure the IAM user's policy to include the rds-db:connect action with a condition that limits the token lifetime to 900 seconds.

Question 2

A company uses Amazon DynamoDB to store session data for a web application. The security team wants to ensure that only the application's EC2 instances can read and write to a specific DynamoDB table named UserSessions. The EC2 instances assume an IAM role. Which IAM policy condition should be used to restrict access to the table?

Accepted Answer

Use the aws:PrincipalArn condition key to allow access only when the principal ARN matches the IAM role used by the EC2 instances.. To restrict access to a DynamoDB table to only the EC2 instances that assume a specific IAM role, you can use the aws:PrincipalArn condition key in the IAM policy attached to the role or in a resource-based policy on the table. This condition checks the ARN of the principal making the request and allows access only if it matches the specified role. This approach is secure, scalable, and does not rely on network identifiers.

Answer

Use the dynamodb:LeadingKeys condition key to restrict access to items where the partition key matches the EC2 instance ID.

Answer

Use the aws:SourceVpc condition key to allow access only from the VPC where the EC2 instances reside.

Answer

Use the aws:SourceIp condition key to allow access only from the EC2 instances' private IP addresses.

Question 3

A company is using Amazon RDS for SQL Server with Transparent Data Encryption (TDE) enabled. The security team wants to ensure that TDE certificates and private keys are securely managed and rotated. Which two actions should they take? (Choose two.)

Accepted Answer

Periodically rotate the TDE certificate by creating a new certificate and re-encrypting the database encryption key.. For RDS for SQL Server with TDE, the TDE certificate and private key must be backed up to a secure location, such as an encrypted S3 bucket with strict access controls, to enable restoration and disaster recovery. Additionally, to rotate the TDE certificate, you must manually create a new certificate and re-encrypt the database encryption key. These two actions ensure secure management and rotation of TDE certificates.

Answer

Enable automatic rotation of the TDE certificate using SQL Server Agent jobs.

Answer

Store the TDE certificate and private key in AWS Secrets Manager and configure automatic rotation.

Answer

Use AWS Key Management Service (KMS) to create and manage the TDE certificate, and enable automatic rotation of the KMS key.

Question 4

A company runs an Amazon RDS for MySQL DB instance in a VPC. Security requirements mandate that only specific EC2 instances in the same VPC can connect to the database. The security group attached to the RDS instance currently allows inbound traffic on port 3306 from 0.0.0.0/0. Which combination of steps should a database specialist take to meet the security requirement without impacting existing application connectivity? (Choose two.)

Accepted Answer

Remove the inbound rule for 0.0.0.0/0 on the RDS security group.. Removing the overly permissive inbound rule for 0.0.0.0/0 on the RDS security group eliminates unrestricted access, which is a direct violation of the security requirement. Option C is correct because adding an inbound rule that references the security group ID of the EC2 instances allows traffic only from those instances, leveraging security group referencing for granular, stateful access control within the same VPC.

Answer

Modify the network ACL for the DB subnet to allow inbound port 3306 from the EC2 instance's private IP.

Answer

Modify the DB subnet group to place the RDS instance in a public subnet with a route to the EC2 instance.

Answer

Add an inbound rule to the RDS security group allowing traffic from the VPC CIDR on port 3306.

Question 5

A company uses Amazon ElastiCache for Redis to cache session data. The security team requires that all data in transit be encrypted. The Redis cluster currently does not have encryption in transit enabled. The database specialist needs to enable encryption in transit with minimal downtime. Which action should the specialist take?

Accepted Answer

Create a new Redis cluster with encryption in transit enabled, and migrate the data from the existing cluster.. Encryption in transit for ElastiCache for Redis can only be enabled at cluster creation time; it cannot be added to an existing cluster. Therefore, the correct approach is to create a new Redis cluster with encryption in transit enabled, migrate the session data from the existing cluster (e.g., using replication or a manual export/import), and then redirect application traffic to the new cluster. This ensures minimal downtime if the migration is performed during a maintenance window or using a blue/green deployment strategy.

Answer

Update the Redis parameter group to enable the 'encryption-in-transit' parameter and reboot the cluster.

Answer

Use a security group to enforce encrypted connections by allowing only TLS traffic.

Answer

Modify the existing Redis cluster to enable encryption in transit using the AWS CLI.

Answer

Enable encryption in transit on the existing cluster by using the AWS Management Console.

Question 6

A company is designing a multi-tier application that uses Amazon RDS for PostgreSQL. The application must encrypt data at rest and in transit. Which combination of steps should be taken to meet these requirements? (Choose the single best answer.)

Accepted Answer

Enable encryption at rest when launching the RDS instance, and configure the DB parameter group to require SSL connections.. Amazon RDS for PostgreSQL supports encryption at rest only when enabled at instance launch, and SSL/TLS encryption in transit is enforced by configuring the DB parameter group to require SSL connections (e.g., setting `rds.force_ssl=1`). Encryption at rest cannot be added after creation, and SSL ensures data is encrypted between the application and the database.

Answer

Use client-side encryption for data before sending to RDS, and enable encryption at rest after the instance is created.

Answer

Launch the RDS instance without encryption, then enable encryption at rest using the AWS Console.

Answer

Use AWS KMS to encrypt the connection between the application and RDS.

Question 7

A company is using Amazon RDS for MySQL with Multi-AZ deployment. The security team wants to ensure that database administrators cannot view sensitive data. Which TWO actions should be taken to achieve this goal?

Accepted Answer

Use IAM database authentication for application access.. IAM database authentication allows you to authenticate to your RDS MySQL instance using an IAM user or role instead of a traditional database password. This eliminates the need for database administrators to know or manage database credentials, as they can only access the database through IAM policies that grant specific, auditable permissions. By using IAM authentication, you enforce a separation of duties where DBAs cannot view sensitive data unless explicitly authorized by IAM policies.

Answer

Enable audit logging to capture all data access.

Answer

Enable encryption at rest using a customer-managed KMS key.

Answer

Disable query logging to prevent sensitive data from being written to logs.

Question 8

Arrange the steps to restore an Amazon RDS for MySQL DB instance to a new instance from a manual snapshot in the correct order.

Accepted Answer

Select the manual snapshot from the list, then configure the new DB instance details, then initiate the restore, then wait for the restore to complete.. Restoring from a manual snapshot involves selecting the snapshot, configuring the new instance, and waiting for completion.

Answer

Configure the new DB instance details, then select the manual snapshot from the list, then initiate the restore, then wait for the restore to complete.

Answer

Select the manual snapshot from the list, then initiate the restore, then configure the new DB instance details, then wait for the restore to complete.

Answer

Wait for the restore to complete, then select the manual snapshot from the list, then configure the new DB instance details, then initiate the restore.

Question 9

Match each AWS database migration tool/service to its function.

Accepted Answer

AWS DMS: Migrates databases to AWS with minimal downtime. AWS DMS is for minimal-downtime database migration, AWS SCT for schema conversion, and AWS Snowball for physical data transfer. Common confusions involve swapping these functions.

Answer

AWS DMS: Converts database schema to target engine

Answer

AWS Snowball: Migrates databases to AWS with minimal downtime

Question 10

A developer needs to allow an application running on an EC2 instance to read and write data to a DynamoDB table named 'Orders'. The EC2 instance is configured with an IAM role. Which IAM policy should be attached to the role?

Accepted Answer

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:GetItem", "dynamodb:PutItem" ], "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders" } ] }. The policy grants exactly the required DynamoDB actions (GetItem and PutItem) on the specific 'Orders' table, following the principle of least privilege. Option A is incorrect because it grants full DynamoDB access to all tables, which is overly permissive. Option B is incorrect because it grants EC2 actions, not DynamoDB actions. Option D is incorrect because it grants S3 actions instead of DynamoDB actions.

Answer

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "dynamodb:*", "Resource": "*" } ] }

Answer

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "ec2:*", "Resource": "*" } ] }

Answer

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "s3:*", "Resource": "arn:aws:s3:::example-bucket/*" } ] }

Question 11

A company's security team wants to encrypt data at rest for an existing RDS for PostgreSQL DB instance. The instance is currently unencrypted. Which steps should the team take to enable encryption with minimal downtime?

Accepted Answer

Take a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore a new DB instance from the encrypted snapshot.. Amazon RDS does not support enabling encryption directly on an existing unencrypted DB instance. The only supported method is to take a snapshot of the instance, copy the snapshot with encryption enabled, and restore a new DB instance from the encrypted snapshot. Option A is incorrect because the RDS console does not allow enabling encryption on an existing instance. Option B is incorrect because a read replica of an unencrypted instance is also unencrypted; promoting it does not add encryption. Option C is incorrect because option groups control database engine configuration, not encryption at rest. Encryption at rest is a storage-level feature that can only be enabled during instance creation or via snapshot operations.

Answer

Modify the DB instance and enable encryption in the RDS console.

Answer

Create a read replica of the DB instance and promote it to a standalone instance.

Answer

Create a new option group with encryption enabled and associate it with the DB instance.

Question 12

A company uses Amazon DynamoDB with AWS KMS customer managed keys for encryption at rest. The security team wants to audit who is using the KMS key to encrypt and decrypt data. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail logs all KMS API calls, including Encrypt and Decrypt, enabling auditing of who used the KMS key. Amazon S3 access logs (option A) are for S3 bucket access, not KMS. AWS Config (option B) tracks resource configuration changes, not API calls. Amazon CloudWatch Logs (option D) can store logs but does not capture KMS API calls by itself.

Answer

Amazon S3 access logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 13

A company has a multi-AZ RDS for PostgreSQL DB instance. The security team wants to ensure that database audit logs are stored in CloudWatch Logs for real-time monitoring. The team enabled the 'pgaudit.log' parameter and set 'log_destination' to 'csvlog'. However, logs are not appearing in CloudWatch. What is the most likely cause?

Accepted Answer

The 'rds.logs_to_cloudwatch' parameter is not set to 1.. RDS publishes logs to CloudWatch only if the 'rds.logs_to_cloudwatch' parameter is set to 1. Option A is wrong because multi-AZ does not prevent log delivery. Option B is wrong because CloudTrail is not involved in log delivery to CloudWatch; it's about API activity logging. Option C is wrong because the DB parameter group is associated; the issue is that the specific parameter 'rds.logs_to_cloudwatch' is not set.

Answer

The DB instance is multi-AZ, which prevents log delivery to CloudWatch.

Answer

AWS CloudTrail is not enabled for the RDS instance.

Answer

The DB parameter group is not associated with the DB instance.

Question 14

A developer is writing an AWS Lambda function that needs to access a Secrets Manager secret to retrieve database credentials. The Lambda function has an IAM role. Which action must be allowed in the IAM policy?

Accepted Answer

secretsmanager:GetSecretValue. The Lambda function needs to retrieve the secret value, which is done via the Secrets Manager API action GetSecretValue. This action returns the decrypted secret content (if the caller has permission) and is the standard way to read a secret. The IAM role attached to the Lambda function must explicitly allow secretsmanager:GetSecretValue on the secret's ARN. Without this permission, the function cannot fetch the credentials.

Answer

kms:Decrypt

Answer

secretsmanager:PutSecretValue

Answer

secretsmanager:ListSecrets

Question 15

A company is using Amazon Aurora MySQL-Compatible Edition. The database administrator wants to restrict a specific user to only execute SELECT statements on a specific database. Which SQL command should the administrator use?

Accepted Answer

GRANT SELECT ON db_name.* TO 'user'@'%';. The GRANT statement is the standard SQL command to assign privileges to a user. GRANT SELECT ON db_name.* TO 'user'@'%' grants only SELECT privileges on all tables in the specified database, which exactly matches the requirement to restrict the user to SELECT statements on a specific database. This is the least-privilege approach.

Answer

ALTER USER 'user'@'%' WITH GRANT OPTION;

Answer

CREATE USER 'user'@'%' IDENTIFIED BY 'password';

Answer

REVOKE ALL PRIVILEGES ON db_name.* FROM 'user'@'%';