DBS-C01 Database Security Practice Test 16 — 15 Questions

Question 1

Which TWO actions should be taken to protect sensitive data in an Amazon RDS for Oracle DB instance? (Choose two.)

Accepted Answer

Use Oracle Transparent Data Encryption (TDE) for sensitive columns.. The correct answers are C and E. Option C, using Oracle Transparent Data Encryption (TDE), encrypts sensitive data at the column level within the database. Option E, enabling encryption at rest using AWS KMS, protects data stored on disk. Option A is incorrect because storing credentials in application configuration files is insecure. Option B is incorrect because disabling automated backups does not enhance security. Option D is incorrect because assigning a public IP increases exposure to attacks.

Answer

Store database credentials in the application configuration file.

Answer

Disable automated backups to reduce storage costs.

Answer

Assign a public IP address to the DB instance for easier access.

Question 2

Which TWO AWS services can be used to centrally manage database credentials securely? (Choose two.)

Accepted Answer

AWS Secrets Manager. Options A and E are correct. AWS Secrets Manager is specifically designed to centrally manage secrets, including database credentials, with features like automatic rotation. AWS Systems Manager Parameter Store can also securely store secrets (e.g., using SecureString parameters). Option B (AWS CloudFormation) is incorrect because it is an infrastructure-as-code service, not a secrets manager. Option C (Amazon S3) is incorrect because it is an object storage service, not designed for secret storage. Option D (AWS IAM) is incorrect because it manages access permissions and identities, not secrets.

Answer

AWS CloudFormation

Answer

Amazon S3

Answer

AWS Identity and Access Management (IAM)

Question 3

A database administrator runs the AWS CLI command shown in the exhibit. The administrator wants to enable encryption at rest for the RDS instance. What should the administrator do?

Accepted Answer

Take a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore a new instance.. To enable encryption at rest for an existing unencrypted RDS instance, you cannot simply modify the instance to set StorageEncrypted to true. Instead, you must take a snapshot of the unencrypted instance, copy the snapshot with encryption enabled, and then restore a new instance from the encrypted snapshot. This is the only way to encrypt an existing unencrypted RDS instance.

Answer

Modify the DB instance and set StorageEncrypted to true.

Answer

Create a new KMS key and associate it with the DB instance.

Answer

Create a new DB parameter group with encryption enabled.

Question 4

A company wants to encrypt data at rest for an existing Amazon RDS for Oracle DB instance. The database is currently unencrypted. What is the simplest way to enable encryption with minimal downtime?

Accepted Answer

Create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance.. RDS does not allow enabling encryption in place on an existing unencrypted DB instance. The supported path is to snapshot the instance, copy the snapshot with the encryption option enabled (choosing a KMS key), and restore that encrypted snapshot as a new DB instance. This achieves encryption at rest with minimal downtime because the source instance keeps running until you cut over.

Answer

Create an encrypted read replica and promote it to a standalone instance.

Answer

Modify the DB instance and enable encryption using the RDS console.

Answer

Enable encryption directly on the existing DB instance by modifying the DB instance settings.

Question 5

A company is using Amazon Aurora MySQL-Compatible Edition. The security team wants to ensure that database credentials are not stored in application configuration files. They decide to use AWS Secrets Manager to manage credentials. The application is hosted on Amazon EC2 instances that have an IAM role attached. What is the most secure way to grant the application access to the secret?

Accepted Answer

Grant the IAM role attached to the EC2 instance permissions to read the secret, and use the Secrets Manager API to retrieve it at runtime.. The most secure approach is to grant the EC2 IAM role permission to read the secret using an IAM policy attached to the role, and then have the application call the Secrets Manager API to retrieve the secret at runtime. This avoids storing secrets in code or configuration files. Option B is wrong because storing the secret in application code is insecure. Option C is wrong because resource-based policies are not attached to EC2 instances; IAM roles are the correct mechanism. Option D is wrong because storing secrets in an S3 bucket introduces additional complexity and potential exposure; using Secrets Manager with IAM roles is more secure.

Answer

Store the secret in the application code and rotate it periodically.

Answer

Attach a resource-based policy to the EC2 instance allowing access to the secret.

Answer

Store the secret in an encrypted S3 bucket and have the application download it at startup.

Question 6

A company is using Amazon DynamoDB to store sensitive customer data. They need to ensure that all data is encrypted at rest using a customer-managed AWS KMS key. The company also wants to rotate the KMS key every year. What is the simplest way to achieve key rotation?

Accepted Answer

Enable automatic key rotation in AWS KMS for the customer-managed key.. AWS KMS supports automatic annual key rotation for customer-managed KMS keys, which rotates the backing key material while preserving the same key ID, ARN, and aliases. Because DynamoDB references the key by ARN/ID, enabling rotation requires no changes to the DynamoDB table configuration. This is the simplest, least disruptive way to satisfy the yearly rotation requirement.

Answer

Create a new KMS key every year and update the DynamoDB table to use the new key.

Answer

Manually rotate the key by deleting and recreating the KMS key each year.

Answer

Import new key material into the existing KMS key every year.

Question 7

A company uses Amazon RDS for SQL Server with Multi-AZ deployment. The security team has mandated that all connections to the database must use SSL/TLS. The database is accessed by multiple applications running on EC2 instances. Which configuration ensures that all connections use SSL/TLS?

Accepted Answer

Set the parameter rds.force_ssl to 1 in the DB parameter group.. Setting the rds.force_ssl parameter to 1 in the DB parameter group enforces SSL/TLS for all connections to the RDS for SQL Server instance. No additional steps are needed; this parameter alone ensures that any connection attempt without SSL is rejected. Option B is incorrect because it includes an unnecessary step of revoking permissions from users that do not use SSL; the rds.force_ssl setting already forces SSL for all users and revoking permissions is redundant. Option A is incorrect because the 'Require SSL' option does not exist in the RDS console; SSL enforcement is controlled via parameter group settings. Option D is incorrect because configuring applications to use a trusted certificate only addresses the client side; the server must also require SSL, which is achieved through the parameter group setting.

Answer

Modify the DB instance by enabling the 'Require SSL' option in the RDS console.

Answer

Set the parameter rds.force_ssl to 1 in the DB parameter group and revoke permissions from users that do not use SSL.

Answer

Configure the applications to use a certificate from a trusted certificate authority and connect using SSL.

Question 8

A company uses Amazon DynamoDB with a global secondary index (GSI) on a table that contains sensitive data. The security team requires that the GSI be encrypted with a different AWS KMS key than the base table. Can this be achieved, and if so, how?

Accepted Answer

No, DynamoDB encrypts the entire table and all its indexes with the same KMS key.. DynamoDB encrypts all data at rest using a single KMS key per table. The base table and all of its GSIs are encrypted with the same key. It is not possible to use a different KMS key for a GSI. Option A is wrong because the GSI cannot have a separate key. Option B is wrong because KMS key policies do not allow per-index encryption. Option D is wrong because the table and its GSIs always use the same key.

Answer

Yes, by using a custom KMS key policy that differentiates between table and index.

Answer

Yes, by specifying a different KMS key ID when creating the GSI.

Answer

No, but you can use a different KMS key for the table and then the GSI will automatically use a different key.

Question 9

A company is deploying a new application on Amazon RDS for PostgreSQL. The security policy requires that all data be encrypted at rest and in transit. Which TWO actions should the company take to meet these requirements?

Accepted Answer

Enable encryption at rest by specifying a KMS key when creating the DB instance.. To encrypt data at rest, you must enable encryption when creating the DB instance by specifying a KMS key (Option C). RDS automatically encrypts automated backups for encrypted instances, so Option B is unnecessary. To encrypt data in transit, you must enforce SSL/TLS connections by setting the parameter rds.force_ssl to 1 in the DB parameter group (Option E). Option A is incorrect because client-side encryption is not required when using RDS encryption and SSL; the requirement is to use RDS features. Option D is incorrect because creating an encrypted read replica does not encrypt the original master instance; you need to enable encryption on the master from the start.

Answer

Use a client-side encryption library to encrypt data before sending to the database.

Answer

Enable encryption for automated backups separately.

Answer

Create an encrypted read replica and promote it to master.

Question 10

A company uses Amazon Aurora MySQL-Compatible Edition. The security team wants to implement database activity streams to monitor database activity. Which THREE statements are true about Aurora database activity streams?

Accepted Answer

Activity streams can be started and stopped without restarting the database.. Options A, B, and E are correct. Activity streams can be started and stopped without a database restart (A). They are encrypted using a KMS key (B). They publish database activity to Amazon CloudWatch Logs and Amazon Kinesis Firehose (E). Option C is incorrect because activity streams do not automatically mask sensitive data; they capture the actual queries. Option D is incorrect because activity streams capture all SQL statements, including DDL, DML, and SELECT.

Answer

Activity streams automatically mask sensitive data in the logs.

Answer

Activity streams only capture DDL statements, not DML or SELECT.

Question 11

A company is using Amazon DynamoDB and wants to restrict access to a specific table so that only users in a particular IAM group can perform read and write operations. Which THREE steps should be taken to achieve this?

Accepted Answer

Create an IAM policy that allows dynamodb:GetItem, dynamodb:PutItem, etc. on the specific table ARN.. The correct answers are A, B, and D. To restrict access to a specific DynamoDB table, you create an IAM policy that allows the required DynamoDB actions on that table's ARN (A). You then attach that policy to an IAM group (B), and add the users who need access to that group (D). Options C and E are incorrect because DynamoDB does not support resource-based policies, and IAM roles are not directly assigned to tables for access control.

Answer

Attach a resource-based policy to the DynamoDB table allowing access from the group.

Answer

Create an IAM role and assign it to the table.

Question 12

A company is migrating its on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all data at rest be encrypted using a customer-managed key stored in AWS KMS, and that the key be rotated automatically every year. The company also needs to ensure that only specific IAM roles can access the key. Which combination of steps should the database administrator take to meet these requirements?

Accepted Answer

Create the RDS instance with encryption enabled using a customer-managed KMS key, and configure the key policy to restrict access to the required IAM roles.. To meet all requirements — encryption at rest with a customer-managed KMS key, automatic annual rotation, and restricted IAM access — the administrator must create the RDS instance with encryption enabled using a customer-managed KMS key and configure the key policy to limit access to specific IAM roles. Customer-managed keys support automatic rotation, and the key policy controls which principals can use the key.

Answer

Create the RDS instance without encryption, then use the AWS Console to enable encryption after creation using a customer-managed key.

Answer

Create the RDS instance with encryption using the default AWS managed service key, and set up automatic key rotation in KMS.

Answer

Use AWS CloudHSM to generate and store the encryption key, and configure RDS to use the CloudHSM key for encryption.

Question 13

A company is using Amazon RDS for PostgreSQL. The security team wants to ensure that all connections to the database are encrypted in transit. Currently, applications connect using the PostgreSQL native encryption (SSL/TLS). What is the MOST secure way to enforce encrypted connections?

Accepted Answer

Enable the 'rds.force_ssl' parameter in the DB parameter group and restart the instance.. The rds.force_ssl parameter, when set to 1 in a custom DB parameter group and applied with a reboot, makes the PostgreSQL engine reject any non-SSL connection at the server level. This enforces encryption in transit regardless of client configuration, which is the most secure and reliable enforcement mechanism. It is the documented RDS approach for PostgreSQL and works uniformly for all connecting applications.

Answer

Configure the security group to only allow traffic on port 5432 from trusted IP addresses.

Answer

Use a custom database port that is not commonly used, such as 5433, to avoid unencrypted traffic.

Answer

Modify the DB parameter group to set 'ssl' to 'on' and 'require_ssl' to 'on', then reboot the instance.

Question 14

A company is using Amazon DynamoDB to store customer session data. The security team requires that all data is encrypted at rest using a customer-managed KMS key, and that access to the key is restricted to specific IAM roles. The company also wants to ensure that DynamoDB Accelerator (DAX) cluster is encrypted. Which steps should be taken to meet these requirements?

Accepted Answer

Create the DynamoDB table with encryption using a customer-managed KMS key. Create the DAX cluster and enable encryption at rest using the same KMS key.. DynamoDB tables can be encrypted at rest with a customer-managed KMS key at creation, and DAX clusters also support encryption at rest using the same or a different KMS key, meeting the requirement. Option B is wrong because DynamoDB encryption cannot be enabled after table creation; it must be specified at creation. Option C is wrong because it uses default encryption (AWS managed key) for the table, not a customer-managed key. Option D is wrong because it refers to encryption in transit (TLS) for DAX, but the requirement is for encryption at rest; DAX encryption at rest is not addressed.

Answer

Create the DynamoDB table without encryption, then use the AWS CLI to enable encryption after creation.

Answer

Create the DynamoDB table with default encryption, and create the DAX cluster with a separate customer-managed KMS key.

Answer

Create the DynamoDB table with encryption using a customer-managed key, and enable encryption in transit on the DAX cluster using TLS.

Question 15

A company is using Amazon RDS for PostgreSQL and needs to implement column-level encryption for sensitive data. The application must be able to encrypt and decrypt data transparently. Which approach should be taken?

Accepted Answer

Install the pgcrypto extension on the RDS instance and use its functions to encrypt data at the column level.. Pgcrypto is a PostgreSQL extension that provides column-level encryption functions, allowing the application to encrypt and decrypt data transparently at the column level. Option A is incorrect because RDS encryption at rest encrypts the entire database storage, not individual columns. Option B is incorrect because using AWS Lambda would require application modifications and introduce additional latency. Option C is incorrect because AWS KMS is a key management service, not a direct column-level encryption solution for databases, and using its APIs would require building encryption logic in the application.

Answer

Enable RDS encryption at rest using a KMS key, which will automatically encrypt all columns.

Answer

Use AWS Lambda to encrypt data before writing to the database and decrypt after reading.

Answer

Use the AWS KMS Encrypt and Decrypt APIs directly in the application code.