DBS-C01 Database Security Practice Test 16 — 15 Questions

Question 1

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security policy requires that all connections to the database use SSL/TLS. What should the database administrator do to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Download the RDS certificate bundle and set the 'rds.force_ssl' parameter to 1 in the DB parameter group.. To enforce SSL/TLS connections to Amazon RDS for Oracle, you must download the RDS certificate bundle and set the 'rds.force_ssl' parameter to 1 in the DB parameter group. This forces all connections to use SSL/TLS. Option B is incorrect because IAM database authentication controls access but does not enforce SSL encryption. Option C is incorrect because security groups control network access at the instance level, not database-level encryption. Option D is incorrect because making the DB instance publicly accessible increases exposure and does not enforce SSL; a VPN encrypts traffic but SSL enforcement is still needed at the database level.

Answer

Enable IAM database authentication for the DB instance.

Answer

Modify the DB instance security group to only allow traffic on port 443.

Answer

Set the DB instance to be publicly accessible and use a VPN connection.

Question 2

A company is using Amazon DynamoDB Accelerator (DAX) for caching. The security team is concerned about data in transit between the application and DAX. What should the team do to ensure that all traffic to DAX is encrypted?

Accepted Answer

Enable encryption in transit when creating the DAX cluster.. DAX supports encryption in transit, which must be enabled when creating the cluster. Option A is incorrect because launching in a private subnet with a VPC endpoint does not encrypt traffic; it only provides private connectivity. Option C is incorrect because DAX manages its own encryption certificates and does not use AWS Certificate Manager. Option D is incorrect because client-side encryption encrypts data at the application layer, but it does not ensure encryption in transit between the application and DAX; enabling encryption in transit on the DAX cluster is required.

Answer

Launch the DAX cluster in a private subnet with a VPC endpoint.

Answer

Use AWS Certificate Manager to issue a certificate for the DAX cluster.

Answer

Use client-side encryption to encrypt data before sending it to DAX.

Question 3

A security engineer needs to restrict access to an Amazon DynamoDB table so that only users from a specific AWS account can read and write data. Which of the following can be used to achieve this? (Choose TWO.)

Accepted Answer

Use a VPC endpoint policy for DynamoDB.. To restrict access to a DynamoDB table from a specific AWS account, you can use a VPC endpoint policy for DynamoDB (Option A) to control access through VPC endpoints, and an IAM policy with a condition key such as 'aws:SourceAccount' (Option C) to restrict API calls to those originating from the specified account. Option B is incorrect because DynamoDB does not support resource-based policies. Option D is incorrect because security groups are used for network-level access to EC2 instances, not DynamoDB. Option E is incorrect because S3 bucket policies apply only to S3 resources, not DynamoDB.

Answer

Use a resource-based policy on the DynamoDB table.

Answer

Use a security group to restrict access to the DynamoDB table.

Answer

Use an S3 bucket policy to allow access to the DynamoDB table.

Question 4

A company is running an Amazon RDS for SQL Server DB instance with Multi-AZ deployment. The security team wants to ensure that all data at rest is encrypted using a customer-managed key stored in AWS KMS. Which steps must be taken to achieve this? (Choose THREE.)

Accepted Answer

Copy the snapshot and specify encryption with a KMS key.. To encrypt an existing unencrypted RDS instance, you must create a manual snapshot (D), copy the snapshot with encryption using a KMS key (C), and then restore the DB instance from the encrypted snapshot (E). Option A is incorrect because you cannot enable encryption on an existing DB instance directly. Option B is incorrect because Multi-AZ deployment does not automatically encrypt data.

Answer

Modify the DB instance and enable encryption.

Answer

Enable Multi-AZ deployment to encrypt data at rest.

Question 5

A company is using Amazon Aurora MySQL and needs to audit database logins. Which of the following can be used to capture login events? (Choose TWO.)

Accepted Answer

Database Activity Streams. Options B and E are correct. Database Activity Streams (DAS) in Amazon Aurora capture login events and other database activities. Additionally, the Aurora MySQL audit plugin can be enabled to log connections, including login attempts. Option A (VPC Flow Logs) captures network traffic, not database logins. Option C (Enhanced Monitoring) captures OS-level metrics from the database host. Option D (AWS CloudTrail) records API calls made to AWS services, not database-level events.

Answer

VPC Flow Logs

Answer

Enhanced Monitoring

Answer

AWS CloudTrail

Question 6

An IAM policy is attached to a user. What does this policy allow the user to do?

Accepted Answer

Get an item from the Orders table but only return the order_id, customer_id, and status attributes.. The IAM policy allows the GetItem action on the Orders table, with a condition that restricts the returned attributes to order_id, customer_id, and status. This matches option D. Option A is incorrect because the policy does not allow UpdateItem. Option B is incorrect because the policy does not allow Scan (it only allows GetItem). Option C is incorrect because the policy does not allow DeleteItem.

Answer

Update an item in the Orders table.

Answer

Scan the entire Orders table and return all attributes.

Answer

Delete an item from the Orders table.

Question 7

A database administrator runs the described command. What does the output indicate about the RDS instance?

Accepted Answer

The DB instance is not encrypted at rest.. The output shows 'StorageEncrypted: false' and 'KmsKeyId: null', which indicates the DB instance is not encrypted at rest. Option B is incorrect because the output does not indicate any failed state; it's a valid status showing encryption configuration. Option C is incorrect because the output does not mention the database engine type. Option D is incorrect because an encrypted instance would show 'StorageEncrypted: true' and a non-null KmsKeyId.

Answer

The DB instance is in a failed state.

Answer

The DB instance is running PostgreSQL.

Answer

The DB instance is encrypted at rest using a KMS key.

Question 8

An IAM policy is attached to a user. Which of the following actions will be allowed?

Accepted Answer

Create a new DB instance named 'prod-db'.. The question does not include the IAM policy text, so it is impossible to determine which actions are allowed. Without the policy, we cannot evaluate whether any specific action is permitted or denied. Therefore, none of the options can be confirmed as correct.

Answer

Delete a DB instance named 'prod-db'.

Answer

Delete a DB instance named 'test-db'.

Answer

Delete a DB instance named 'dev-db'.

Question 9

A company is migrating an Oracle database to Amazon RDS for Oracle. Security policy requires that all database connections be encrypted in transit. The security team wants to enforce that clients must use TLS 1.2 or higher. How can this be achieved?

Accepted Answer

Set the rds.force_ssl parameter to 1 in the DB parameter group.. Amazon RDS for Oracle supports SSL/TLS encryption, and setting the rds.force_ssl parameter to 1 in the DB parameter group enforces SSL connections, which ensures all connections use TLS 1.2 or higher (as per Oracle's implementation). Option A is incorrect because modifying the DB subnet group controls network-level access, not encryption requirements. Option B is incorrect because IAM policies cannot enforce encryption in transit at the database level; they can only control authentication and authorization. Option C is incorrect because require_secure_transport is a MySQL parameter, not applicable to Oracle.

Answer

Modify the DB subnet group to only allow traffic from specific IP ranges.

Answer

Create an IAM policy that denies access unless the connection uses TLS.

Answer

Set the require_secure_transport parameter to ON in the DB parameter group.

Question 10

A financial services company uses Amazon RDS for MySQL to store sensitive customer data. The compliance team requires that all database administrators (DBAs) must authenticate using IAM database authentication, and no static database passwords should be used. A junior DBA has been granted the rds_iam role in the database. However, the junior DBA is unable to connect using the AWS CLI command: aws rds generate-db-auth-token --hostname mydb.xyz.us-east-1.rds.amazonaws.com --port 3306 --username jdba. The error message says 'Access denied'. What is the most likely cause?

Accepted Answer

The RDS instance does not have IAM database authentication enabled.. For IAM database authentication to work, the RDS instance must have the 'IAM DB authentication' setting enabled. If it is not enabled, the authentication token generated by `generate-db-auth-token` will be rejected with an 'Access denied' error. Option A is incorrect because RDS does not use resource-based policies; IAM policies are attached to users/roles. Option B is incorrect because SSL is required for IAM auth, but a missing SSL connection would result in a different error (e.g., 'SSL required'). Option C is incorrect because network issues would typically cause a timeout or connection refused, not an authentication error.

Answer

The RDS instance does not have a resource-based policy that grants the junior DBA access.

Answer

The junior DBA is not using an SSL connection to the database.

Answer

The security group does not allow inbound traffic on port 3306 from the junior DBA's IP address.

Question 11

A company is using Amazon RDS for PostgreSQL to store application data. The security team wants to ensure that database audit logs are stored securely and cannot be modified after creation. Which AWS service should be used to meet this requirement?

Accepted Answer

Amazon CloudWatch Logs. Amazon RDS for PostgreSQL can publish database audit logs to Amazon CloudWatch Logs. CloudWatch Logs provides immutability through IAM policies that prevent log modification and deletion, combined with log group encryption using AWS KMS. Option D is correct. Option A (AWS KMS) is wrong because KMS manages encryption keys, not log storage. Option B (AWS CloudTrail) is wrong because CloudTrail records API activity, not database audit logs. Option C (Amazon S3) can store logs, but enabling immutability requires additional configuration like S3 Object Lock, making CloudWatch Logs the more straightforward and recommended service for this requirement.

Answer

AWS Key Management Service (KMS)

Answer

AWS CloudTrail

Answer

Amazon S3

Question 12

A company uses Amazon DynamoDB to store session data. The security team has enabled DynamoDB Accelerator (DAX) for performance. However, they are concerned about data encryption at rest. DAX encrypts data at rest by default. The security team wants to use a customer managed key (CMK) in AWS KMS. How can this be configured?

Accepted Answer

Create a DAX cluster and specify the KMS key ID of a symmetric customer managed key during creation.. DAX supports encryption at rest using a KMS key. You must specify a symmetric customer managed key (CMK) at cluster creation time; encryption configuration cannot be modified after creation. Option A is wrong because DAX does support encryption with a CMK, and asymmetric keys are not supported for DAX; only symmetric keys are allowed. Option B is wrong because DAX does allow the use of customer managed keys; it is not limited to AWS managed keys. Option C is wrong because encryption cannot be enabled after cluster creation; it must be configured during creation.

Answer

Use an asymmetric customer managed key because it provides better security.

Answer

DAX does not support encryption at rest with a customer managed key; only AWS managed keys are supported.

Answer

Enable encryption at rest on the DAX cluster after creation by modifying the cluster settings.

Question 13

A company is using Amazon Aurora MySQL and needs to audit all database logins and query activity. Which feature should be enabled to meet this requirement?

Accepted Answer

Enable Advanced Auditing through the DB cluster parameter group by setting the server_audit_logging parameter and related parameters.. Amazon Aurora MySQL's Advanced Auditing feature, enabled by setting the server_audit_logging parameter and related parameters in the DB cluster parameter group, captures all database logins and query activity. Option A (audit_log_enabled) is a different, less detailed audit log feature, not the full advanced auditing. Option B (Enhanced Monitoring) monitors OS-level metrics, not database activity. Option C (CloudTrail) logs AWS API calls, not database queries.

Answer

Enable database audit logs by setting the audit_log_enabled parameter to 1.

Answer

Enable RDS Enhanced Monitoring.

Answer

Enable AWS CloudTrail to log database queries.

Question 14

A company is using Amazon RDS for MySQL and wants to restrict access to a specific database so that an application user can only perform SELECT and INSERT operations on tables within that database. The application user already exists. Which SQL statement should be executed?

Accepted Answer

GRANT SELECT, INSERT ON app_db.* TO 'app_user'@'%';. It grants exactly the required SELECT and INSERT privileges on all tables within the app_db database. Option A is incorrect because it only grants SELECT, missing INSERT. Option B is incorrect because it includes unnecessary DDL privileges (CREATE, ALTER) which are not needed and could be a security risk. Option D is incorrect because it grants ALL PRIVILEGES, which is too permissive for an application user.

Answer

GRANT SELECT ON app_db.* TO 'app_user'@'%';

Answer

GRANT CREATE, ALTER, SELECT, INSERT ON app_db.* TO 'app_user'@'%';

Answer

GRANT ALL PRIVILEGES ON app_db.* TO 'app_user'@'%';

Question 15

A company is using Amazon DynamoDB with AWS Lambda to process data. The Lambda function needs to read and write items to a DynamoDB table. The security team wants to follow the principle of least privilege. Which IAM policy statement should be attached to the Lambda execution role?

Accepted Answer

{"Effect":"Allow","Action":["dynamodb:GetItem","dynamodb:PutItem","dynamodb:UpdateItem","dynamodb:DeleteItem"],"Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/MyTable"}. It grants only the necessary DynamoDB actions (GetItem, PutItem, UpdateItem, DeleteItem) on the specific table. Option A is wrong because it grants full DynamoDB access on all resources, which is too permissive. Option B is wrong because it only allows DescribeTable and ListTables on all tables, which does not provide the read/write permissions needed. Option D is wrong because it allows all DynamoDB actions on a specific table, which is overly permissive and violates least privilege.

Answer

{"Effect":"Allow","Action":"dynamodb:*","Resource":"*"}

Answer

{"Effect":"Allow","Action":["dynamodb:DescribeTable","dynamodb:ListTables"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":"dynamodb:*","Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/MyTable"}