DBS-C01 Database Security Practice Test 17 — 15 Questions

Question 1

A company is using Amazon RDS for PostgreSQL and needs to ensure that all connections to the database use encryption in transit. The database is accessible over the internet. Which configuration is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the rds.force_ssl parameter to 1 and configure the client to use the AWS RDS SSL certificate.. To enforce encryption in transit for Amazon RDS for PostgreSQL, you must set the `rds.force_ssl` parameter to 1 in the DB parameter group. Additionally, clients need to be configured to use the AWS RDS SSL certificate (downloaded from AWS) to establish a secure connection. Option A is incorrect because security groups only control network traffic based on IP addresses, they do not enforce encryption. Option B is incorrect because changing the port to 443 does not enforce SSL; SSL is enforced through parameter settings and client configuration. Option D is incorrect because while a self-signed certificate could technically be used, the recommended and simpler method is to use the AWS-provided SSL certificate, especially since clients need to trust the certificate authority.

Answer

Restrict the security group to only allow traffic from trusted IP addresses.

Answer

Modify the DB instance to use a custom port 443 instead of 5432.

Answer

Use a self-signed certificate on the server and configure the client to trust it.

Question 2

A company is designing a security strategy for an Amazon RDS for MySQL instance that stores Personally Identifiable Information (PII). Which TWO measures should be implemented to protect the data at rest?

Accepted Answer

Enable automatic backups with encryption.. Options A and D are correct. Option A: Enabling automatic backups with encryption ensures that backup data is encrypted at rest. Option D: Enabling encryption at rest using AWS KMS encrypts the underlying storage of the DB instance. Option B is wrong because Amazon GuardDuty is a threat detection service, not for data at rest protection. Option C is wrong because deletion protection prevents accidental deletion but does not protect data at rest. Option E is wrong because encryption in transit (SSL/TLS) protects data in motion, not at rest.

Answer

Enable Amazon GuardDuty to monitor for suspicious activity.

Answer

Enable deletion protection on the DB instance.

Answer

Enable encryption in transit using SSL/TLS.

Question 3

A company uses Amazon DynamoDB with DAX and wants to implement fine-grained access control using IAM. Which THREE conditions can be used in an IAM policy to restrict access to specific items based on the primary key?

Accepted Answer

dynamodb:Attributes. Options A, D, and E are correct. DynamoDB supports fine-grained access control using IAM conditions: dynamodb:LeadingKeys restricts access based on partition key, dynamodb:Attributes controls access to specific attributes, and dynamodb:Select restricts the use of Select parameters. Option B (dynamodb:ReturnValues) is a write operation parameter, not a condition for access control. Option C (dynamodb:TableName) identifies the table, not specific items.

Answer

dynamodb:ReturnValues

Answer

dynamodb:TableName

Question 4

A company is using Amazon RDS for Oracle and needs to comply with regulatory requirements that mandate encryption of all data at rest and in transit. Which TWO actions should be taken to meet these requirements?

Accepted Answer

Enable encryption at rest by specifying a KMS key when creating the DB instance.. Options A and E are correct. Option A enables encryption at rest by specifying a KMS key when creating the DB instance. Option E enables encryption in transit by setting the rds.force_ssl parameter and using the RDS SSL certificate. Option B is incorrect because Oracle TDE is not required when RDS encryption at rest is used; RDS native encryption with KMS is sufficient. Option C is incorrect because CloudWatch Logs encryption does not encrypt the database data. Option D is incorrect because Oracle Native Network Encryption is less secure than SSL/TLS and is not the recommended method for encryption in transit.

Answer

Use Oracle Transparent Data Encryption (TDE) to encrypt the data at rest.

Answer

Enable encryption for CloudWatch Logs.

Answer

Configure Oracle Native Network Encryption in the sqlnet.ora file.

Question 5

A company wants to ensure that an Amazon RDS for MySQL DB instance is encrypted at rest. Which action should be taken to enable encryption for the first time?

Accepted Answer

Create a new encrypted DB instance using AWS KMS.. Encryption at rest for Amazon RDS can only be enabled when creating a new DB instance. To enable encryption for the first time, you must create a new encrypted DB instance using AWS KMS. Option A is incorrect because encryption cannot be enabled on an existing DB instance via the AWS CLI; it requires creating a new instance. Option C is incorrect because there is no rds.encrypted parameter in a DB parameter group; encryption is set at instance creation, not via parameters. Option D is incorrect because modifying an existing DB instance does not allow enabling encryption; you must create a new encrypted instance.

Answer

Enable encryption on the existing DB instance using the AWS CLI.

Answer

Set the rds.encrypted parameter to true in the DB parameter group.

Answer

Modify the existing DB instance and enable encryption.

Question 6

A database administrator needs to audit all SQL statements executed on an Amazon Aurora MySQL DB cluster, including SELECT queries. Which AWS service should be used to capture and store these logs?

Accepted Answer

Amazon RDS Database Activity Streams. Amazon RDS Database Activity Streams (Option A) is the correct service to capture and store audit logs of SQL statements, including SELECT queries, on an Aurora MySQL DB cluster. It streams database activity to Amazon CloudWatch Logs and Amazon Kinesis Data Streams for further analysis and storage. Option B (Amazon RDS Enhanced Monitoring) provides OS-level metrics, not SQL statements. Option C (Amazon CloudWatch Logs) can store logs but does not capture SQL statements directly; it requires a source like Database Activity Streams. Option D (Amazon RDS Performance Insights) monitors database performance, not SQL audit logs.

Answer

Amazon RDS Enhanced Monitoring

Answer

Amazon CloudWatch Logs

Answer

Amazon RDS Performance Insights

Question 7

A company has an Amazon DynamoDB table that stores sensitive user data. The security team requires that all data is encrypted at rest using a customer-managed AWS KMS key. Which step should be taken to meet this requirement?

Accepted Answer

Specify a customer-managed KMS key in the DynamoDB table creation.. You can specify a customer-managed AWS KMS key when creating a DynamoDB table to enable encryption at rest with that key. Option E is incorrect because while you can restrict access to a specific IAM role, the question specifically asks about encryption at rest. Option A is wrong because DynamoDB uses KMS keys, not S3-managed keys. Option B is wrong because bucket policies are for S3, not DynamoDB. Option D is wrong because encryption at rest cannot be enabled after table creation; it must be specified at creation time.

Answer

Enable server-side encryption with S3-managed keys (SSE-S3) on the DynamoDB table.

Answer

Attach a bucket policy to restrict access to the DynamoDB table.

Answer

Modify the existing DynamoDB table to enable encryption at rest.

Answer

Create an IAM policy that allows dynamodb:GetItem and dynamodb:PutItem only when the request is made by the specific IAM role.

Question 8

A company needs to enforce that all new Amazon RDS DB instances are automatically encrypted at rest. What is the most efficient way to achieve this?

Accepted Answer

Use an AWS Organizations service control policy (SCP) to deny creation of unencrypted RDS instances.. Using an AWS Organizations service control policy (SCP) to deny creation of unencrypted RDS instances is the most efficient way to enforce encryption at rest for all new RDS DB instances across multiple accounts. SCPs are applied at the organization, organizational unit, or account level and cannot be overridden by users, ensuring consistent enforcement. Option A is wrong because IAM policies with condition keys only affect specified users or roles, not service-linked roles or resources, and can be bypassed if users have permissions to modify policies. Option B is wrong because there is no 'encryption at rest' default setting in the RDS console; encryption must be enabled per instance or via other mechanisms. Option D is wrong because CloudFormation StackSets require manual creation and maintenance of templates, and do not enforce encryption if users launch instances outside the stack.

Answer

Create an IAM policy that denies rds:CreateDBInstance unless encryption is enabled, and attach it to all users.

Answer

Enable the 'encryption at rest' default in each AWS account's RDS console.

Answer

Use AWS CloudFormation StackSets to deploy a template that creates encrypted instances in every account.

Question 9

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database contains personally identifiable information (PII). The security team requires that all PII columns be transparently encrypted and that the encryption keys be stored in AWS CloudHSM. Which solution meets these requirements?

Accepted Answer

Use Oracle Transparent Data Encryption (TDE) with AWS CloudHSM as the key store.. Oracle Transparent Data Encryption (TDE) with AWS CloudHSM as the key store enables transparent encryption of PII columns and stores the encryption keys in CloudHSM, meeting the security requirements. Option A is wrong because Amazon RDS encryption at rest uses AWS KMS, not CloudHSM, and it encrypts the entire database instance, not specific columns. Option B is wrong because modifying an Oracle database to use AWS KMS for column-level encryption is not supported natively in RDS; Oracle TDE is required for transparent column encryption. Option C is wrong because Oracle Data Pump is an export/import utility, not a column-level encryption solution; it does not provide transparent encryption of PII columns in the live database.

Answer

Enable Amazon RDS encryption at rest using a KMS key and rely on that encryption.

Answer

Modify the Oracle database to use AWS KMS for column-level encryption.

Answer

Use Oracle Data Pump to export data with encryption and store the encryption key in AWS Secrets Manager.

Question 10

A company has an Amazon RDS for PostgreSQL DB instance that needs to be accessed by an application running on an Amazon EC2 instance. Both resources are in the same VPC. The security team insists that all traffic between the application and the database be encrypted in transit. Which configuration ensures this?

Accepted Answer

Enable SSL/TLS on the RDS instance and configure the application to connect using SSL.. Enabling SSL/TLS on the RDS for PostgreSQL DB instance and configuring the application to connect using SSL ensures encryption in transit. Option A is incorrect because security group rules control access (firewall), not encryption. Option B is incorrect because a Site-to-Site VPN is used for on-premises to VPC connectivity, not for same-VPC communication. Option D is incorrect because VPC peering is for connecting separate VPCs, and both resources are already in the same VPC.

Answer

Add a security group rule that allows traffic only from the EC2 instance's private IP.

Answer

Create an AWS Site-to-Site VPN connection between the EC2 instance and the RDS instance.

Answer

Set up VPC peering between the EC2 instance's VPC and the RDS instance's VPC.

Question 11

A company wants to store database credentials for an Amazon RDS instance securely. Which AWS service should be used to rotate the credentials automatically?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it can automatically rotate database credentials for Amazon RDS, simplifying credential management and improving security. AWS Systems Manager Parameter Store can store parameters but does not natively rotate RDS credentials. AWS IAM roles are used for authentication and authorization, not for storing credentials. AWS CloudHSM provides hardware security module (HSM) for encryption key management, not credential storage or rotation.

Answer

AWS CloudHSM

Answer

AWS Systems Manager Parameter Store

Answer

AWS IAM roles

Question 12

A company needs to audit access to an Amazon DynamoDB table. The audit should capture which IAM user or role performed each action. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API calls made to DynamoDB and captures the IAM user or role that performed each action. VPC Flow Logs (Option A) capture network traffic metadata, not API calls. Amazon GuardDuty (Option C) is a threat detection service that monitors for malicious activity, not API auditing. AWS Config (Option D) tracks resource configuration changes, not API call details.

Answer

VPC Flow Logs

Answer

Amazon GuardDuty

Answer

AWS Config

Question 13

A company has an Amazon RDS for SQL Server DB instance that stores financial data. The security team requires that the data be encrypted at rest using a customer-managed key stored in AWS KMS. Additionally, they want to ensure that the key cannot be deleted without authorization. What should be done?

Accepted Answer

Create a customer-managed KMS key, enable key rotation, and set a deletion protection policy.. Creating a customer-managed KMS key allows you to control key rotation and deletion protection, meeting the security requirements. Option B is wrong because using the default KMS key does not provide a customer-managed key. Option C is wrong because AWS CloudHSM is not directly used for RDS encryption at rest; KMS is the required service. Option D is wrong because AWS CloudTrail only logs actions but does not prevent key deletion.

Answer

Enable encryption on the RDS instance and use the default KMS key.

Answer

Use AWS CloudHSM to generate and store the encryption key, and associate it with the RDS instance.

Answer

Enable AWS CloudTrail to log key deletion attempts.

Question 14

A company wants to restrict access to an Amazon DynamoDB table so that only requests from a specific VPC endpoint are allowed. Which policy should be attached to the table?

Accepted Answer

A VPC endpoint policy that allows only the specific VPC endpoint to access the DynamoDB table.. A VPC endpoint policy attached to the VPC endpoint can restrict which DynamoDB tables are accessible through that endpoint. Option A is incorrect because security groups apply to EC2 instances and other network interfaces, not to DynamoDB tables. Option B is incorrect because while IAM policies can include conditions to restrict access based on source VPC, they are attached to IAM users or roles, not directly to the DynamoDB table. Option D is incorrect because bucket policies are used for Amazon S3, not DynamoDB.

Answer

A security group rule that allows traffic only from the VPC endpoint.

Answer

An IAM policy that denies access unless the request comes from the specific VPC.

Answer

An S3 bucket policy that references the DynamoDB table.

Question 15

A company is using Amazon RDS for PostgreSQL and needs to ensure that all connections to the database use encryption in transit. The database is accessible over the internet. Which configuration is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable encryption at rest on the primary DB instance using AWS KMS.. Enabling encryption at rest on the primary DB instance using AWS KMS automatically encrypts the replication traffic between the primary and the read replica. Options A, B, and C are incorrect: A VPN is not required as RDS handles encryption in transit for replication when the primary is encrypted; using a different KMS key for the replica does not affect replication encryption; SSL/TLS is for client connections, not for replication traffic.

Answer

Set up a VPN connection between the primary and the replica.

Answer

Configure the read replica to use a different KMS key.

Answer

Enable SSL/TLS on the read replica and configure the primary to use it.