DBS-C01 Database Security Practice Test 17 — 15 Questions

Question 1

A company is using Amazon RDS for Oracle and needs to comply with regulatory requirements that mandate encryption of all data at rest and in transit. Which TWO actions should be taken to meet these requirements?

Accepted Answer

Enable encryption at rest by specifying a KMS key when creating the DB instance.. Options A and C are correct. Option A: Encryption at rest is enabled via the console or API when creating the instance. Option C: Encryption in transit is enforced by setting rds.force_ssl=1 and using SSL certificates. Option B is wrong because native network encryption is an alternative but not the recommended approach; RDS supports Oracle native network encryption but it is less secure than SSL/TLS. Option D is wrong because TDE is for encryption at rest but is a separate feature; however, enabling encryption at rest via RDS is sufficient. Option E is wrong because CloudWatch Logs encryption is for logs, not the database itself.

Answer

Use Oracle Transparent Data Encryption (TDE) to encrypt the data at rest.

Answer

Enable encryption for CloudWatch Logs.

Answer

Configure Oracle Native Network Encryption in the sqlnet.ora file.

Question 2

A company wants to ensure that an Amazon RDS for MySQL DB instance is encrypted at rest. Which action should be taken to enable encryption for the first time?

Accepted Answer

Create a new encrypted DB instance using AWS KMS.. Option A is correct because RDS encryption at rest can only be enabled when creating a new DB instance, not on an existing one. Option B is wrong because enabling encryption requires creating an encrypted snapshot and restoring as a new instance, not just modifying. Option C is wrong because encryption cannot be enabled on an existing instance. Option D is wrong because encryption is configured at instance creation, not through parameter groups.

Answer

Enable encryption on the existing DB instance using the AWS CLI.

Answer

Set the rds.encrypted parameter to true in the DB parameter group.

Answer

Modify the existing DB instance and enable encryption.

Question 3

A database administrator needs to audit all SQL statements executed on an Amazon Aurora MySQL DB cluster, including SELECT queries. Which AWS service should be used to capture and store these logs?

Accepted Answer

Amazon RDS Database Activity Streams. Option C is correct because RDS Database Activity Streams sends database activity to CloudWatch Logs and Kinesis Data Streams for auditing. Option A is wrong because Enhanced Monitoring provides OS-level metrics, not SQL statements. Option B is wrong because RDS Performance Insights monitors performance, not audit SQL. Option D is wrong because CloudWatch Logs can store logs but does not capture SQL statements directly; it requires a source like Database Activity Streams.

Answer

Amazon RDS Enhanced Monitoring

Answer

Amazon CloudWatch Logs

Answer

Amazon RDS Performance Insights

Question 4

A company has an Amazon DynamoDB table that stores sensitive user data. The security team requires that all data is encrypted at rest using a customer-managed AWS KMS key. Additionally, they want to ensure that the table can only be accessed by a specific IAM role. Which combination of steps should be taken to meet these requirements? (Select TWO.)

Accepted Answer

Specify a customer-managed KMS key in the DynamoDB table creation.. Options A and B are correct. Option A: You can specify a customer-managed KMS key when creating the table. Option B: To restrict access to a specific IAM role, you should use an IAM policy that denies access unless the request comes from that role. Option C is wrong because SSE-C is for S3, not DynamoDB. Option D is wrong because encryption cannot be enabled after table creation without recreating the table. Option E is wrong because bucket policies are for S3, not DynamoDB.

Answer

Enable server-side encryption with S3-managed keys (SSE-S3) on the DynamoDB table.

Answer

Attach a bucket policy to restrict access to the DynamoDB table.

Answer

Modify the existing DynamoDB table to enable encryption at rest.

Question 5

A company needs to enforce that all new Amazon RDS DB instances are automatically encrypted at rest. What is the most efficient way to achieve this?

Accepted Answer

Use an AWS Organizations service control policy (SCP) to deny creation of unencrypted RDS instances.. Option B is correct because enabling the 'RDS_DB_INSTANCE_ENCRYPTION' SCP at the AWS Organizations level will enforce encryption for all new RDS instances. Option A is wrong because an IAM policy with a condition key only applies to users and roles, not to all accounts. Option C is wrong because a CloudFormation StackSet would require manual deployment. Option D is wrong because enabling encryption in each account manually is not efficient.

Answer

Create an IAM policy that denies rds:CreateDBInstance unless encryption is enabled, and attach it to all users.

Answer

Enable the 'encryption at rest' default in each AWS account's RDS console.

Answer

Use AWS CloudFormation StackSets to deploy a template that creates encrypted instances in every account.

Question 6

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database contains personally identifiable information (PII). The security team requires that all PII columns be transparently encrypted and that the encryption keys be stored in AWS CloudHSM. Which solution meets these requirements?

Accepted Answer

Use Oracle Transparent Data Encryption (TDE) with AWS CloudHSM as the key store.. Option D is correct because Oracle TDE with CloudHSM integration allows transparent encryption and stores keys in CloudHSM. Option A is wrong because RDS Encryption uses KMS, not CloudHSM. Option B is wrong because Oracle Data Pump does not encrypt columns. Option C is wrong because RDS does not support custom encryption at the column level natively.

Answer

Enable Amazon RDS encryption at rest using a KMS key and rely on that encryption.

Answer

Modify the Oracle database to use AWS KMS for column-level encryption.

Answer

Use Oracle Data Pump to export data with encryption and store the encryption key in AWS Secrets Manager.

Question 7

A company has an Amazon RDS for PostgreSQL DB instance that needs to be accessed by an application running on an Amazon EC2 instance. Both resources are in the same VPC. The security team insists that all traffic between the application and the database be encrypted in transit. Which configuration ensures this?

Accepted Answer

Enable SSL/TLS on the RDS instance and configure the application to connect using SSL.. Option B is correct because enabling SSL/TLS on the RDS instance and configuring the application to use SSL ensures encryption in transit. Option A is wrong because security group rules control access, not encryption. Option C is wrong because VPC peering is for inter-VPC communication. Option D is wrong because a VPN is not needed for same-VPC communication.

Answer

Add a security group rule that allows traffic only from the EC2 instance's private IP.

Answer

Create an AWS Site-to-Site VPN connection between the EC2 instance and the RDS instance.

Answer

Set up VPC peering between the EC2 instance's VPC and the RDS instance's VPC.

Question 8

A company wants to store database credentials for an Amazon RDS instance securely. Which AWS service should be used to rotate the credentials automatically?

Accepted Answer

AWS Secrets Manager. Option B is correct because AWS Secrets Manager can automatically rotate database credentials. Option A is wrong because Systems Manager Parameter Store stores parameters but does not natively rotate RDS credentials. Option C is wrong because IAM roles are for authentication, not for storing credentials. Option D is wrong because CloudHSM is for encryption keys, not credential storage.

Answer

AWS CloudHSM

Answer

AWS Systems Manager Parameter Store

Answer

AWS IAM roles

Question 9

A company needs to audit access to an Amazon DynamoDB table. The audit should capture which IAM user or role performed each action. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. Option A is correct because AWS CloudTrail records API calls including the identity of the caller. Option B is wrong because VPC Flow Logs capture network traffic, not API calls. Option C is wrong because Amazon GuardDuty is a threat detection service. Option D is wrong because AWS Config tracks resource configuration changes, not API calls.

Answer

VPC Flow Logs

Answer

Amazon GuardDuty

Answer

AWS Config

Question 10

A company has an Amazon RDS for SQL Server DB instance that stores financial data. The security team requires that the data be encrypted at rest using a customer-managed key stored in AWS KMS. Additionally, they want to ensure that the key cannot be deleted without authorization. What should be done?

Accepted Answer

Create a customer-managed KMS key, enable key rotation, and set a deletion protection policy.. Option D is correct because enabling key rotation and deletion protection on the KMS key provides the required controls. Option A is wrong because enabling encryption on RDS does not by itself protect the key from deletion. Option B is wrong because CloudHSM keys are not managed through KMS. Option C is wrong because CloudTrail only logs actions, it does not prevent deletion.

Answer

Enable encryption on the RDS instance and use the default KMS key.

Answer

Use AWS CloudHSM to generate and store the encryption key, and associate it with the RDS instance.

Answer

Enable AWS CloudTrail to log key deletion attempts.

Question 11

A company wants to restrict access to an Amazon DynamoDB table so that only requests from a specific VPC endpoint are allowed. Which policy should be attached to the table?

Accepted Answer

A VPC endpoint policy that allows only the specific VPC endpoint to access the DynamoDB table.. Option C is correct because a VPC endpoint policy can restrict access based on the source VPC endpoint. Option A is wrong because an IAM policy attached to a user would not restrict the source VPC. Option B is wrong because bucket policies are for S3. Option D is wrong because security groups are for EC2 and RDS, not DynamoDB.

Answer

A security group rule that allows traffic only from the VPC endpoint.

Answer

An IAM policy that denies access unless the request comes from the specific VPC.

Answer

An S3 bucket policy that references the DynamoDB table.

Question 12

A company is using Amazon RDS for PostgreSQL with a read replica. The security team wants to ensure that data in transit between the primary DB instance and the read replica is encrypted. What should be done?

Accepted Answer

Enable encryption at rest on the primary DB instance using AWS KMS.. Option A is correct because enabling encryption at rest on the primary instance automatically encrypts the replication traffic. Option B is wrong because encryption in transit between primary and replica is automatically encrypted if the primary is encrypted. Option C is wrong because SSL/TLS is for client connections, not replication. Option D is wrong because a VPN is not needed.

Answer

Set up a VPN connection between the primary and the replica.

Answer

Configure the read replica to use a different KMS key.

Answer

Enable SSL/TLS on the read replica and configure the primary to use it.

Question 13

A company needs to comply with PCI DSS requirements for an Amazon RDS for Oracle DB instance. The requirements include encryption of sensitive data at rest and in transit, and automated key rotation. Which combination of services and configurations should be used? (Select THREE.)

Accepted Answer

Enable encryption at rest on the RDS instance using AWS KMS.. Options A, C, and D are correct. Option A: Enable encryption at rest with KMS. Option C: Enable encrypted replication for read replicas if used. Option D: Use Secrets Manager for automated credential rotation. Option B is wrong because CloudHSM is not required for key rotation; KMS can rotate keys automatically. Option E is wrong because VPC Flow Logs are for network monitoring, not encryption.

Answer

Use AWS CloudHSM to generate and store encryption keys.

Answer

Enable VPC Flow Logs to audit database connections.

Question 14

A company has an Amazon DynamoDB table with a global secondary index (GSI). The security team wants to ensure that the table and the GSI are encrypted at rest. How can this be achieved?

Accepted Answer

Nothing; DynamoDB encrypts all data at rest by default.. Option A is correct because DynamoDB encrypts all tables and GSIs at rest by default. Option B is wrong because encryption is always on. Option C is wrong because encryption cannot be disabled. Option D is wrong because GSIs are automatically encrypted with the table.

Answer

Create the table with encryption disabled to avoid performance impact.

Answer

Enable encryption at rest on the table and the GSI separately.

Answer

Enable encryption on the GSI using a KMS key.

Question 15

A company is designing a security strategy for an Amazon Aurora MySQL database. They need to ensure that database activity is monitored for suspicious behavior and that alerts are sent when anomalies are detected. Which AWS services should be combined to achieve this? (Select TWO.)

Accepted Answer

Amazon GuardDuty. Options A and D are correct. Option A: Database Activity Streams send activity to CloudWatch Logs and Kinesis. Option D: Amazon GuardDuty can analyze the stream for threats. Option B is wrong because AWS WAF is for web application firewall. Option C is wrong because Amazon Inspector is for EC2 vulnerabilities. Option E is wrong because EventBridge can trigger alerts but is not a monitoring service for anomalies.

Answer

AWS WAF

Answer

Amazon EventBridge

Answer

Amazon Inspector