DBS-C01 Database Security Practice Test 17 — 15 Questions

Question 1

A company is using Amazon RDS for MySQL and needs to comply with PCI DSS requirements. Which TWO actions should the company take to secure the database? (Choose TWO.)

Accepted Answer

Enable encryption at rest using AWS KMS.. Options A and C are correct. Enabling encryption at rest using AWS KMS protects data on disk, which is a PCI DSS requirement. Enabling audit logging helps track database activities for compliance. Options B and D are incorrect: writing audit logs directly to an S3 bucket is not supported; RDS audit logs are sent to CloudWatch Logs. Enabling public accessibility would violate security requirements. Option E is incorrect because changing the default port is not a PCI DSS requirement and may complicate management without adding meaningful security.

Answer

Configure the database to write audit logs directly to an S3 bucket.

Answer

Enable public accessibility on the RDS instance to allow access from anywhere.

Answer

Change the default database port to a non-standard port.

Question 2

A company is designing a security architecture for Amazon DynamoDB. They need to ensure that only authorized applications can access the data, and that data in transit is encrypted. Which THREE steps should be taken? (Choose THREE.)

Accepted Answer

Attach an IAM policy that grants access only to specific IAM roles or users.. Option B is correct because IAM policies are the primary authorization mechanism for DynamoDB, allowing you to grant least-privilege access to specific IAM roles or users via actions like dynamodb:GetItem and dynamodb:PutItem on specific table ARNs. Option C is correct because an AWS PrivateLink VPC endpoint (interface endpoint) lets applications reach DynamoDB over the AWS private network instead of the public internet, keeping traffic off the public internet and enabling endpoint policies and security-group control on the endpoint ENIs. Option E is correct because DynamoDB encrypts data in transit by requiring HTTPS/TLS for all API calls to endpoints like dynamodb.us-east-1.amazonaws.com, protecting data in transit. Option A is incorrect because KMS keys encrypt data at rest, not data in transit. Option D is incorrect because DynamoDB is a managed service without security groups on the table itself; security groups apply to the VPC endpoint ENIs, not to the DynamoDB table.

Answer

Use a customer-managed KMS key to encrypt data in transit.

Answer

Configure a security group to restrict inbound traffic to the DynamoDB table.

Question 3

An IAM policy is attached to an IAM user. The user wants to connect to an RDS MySQL database using IAM database authentication. What does this policy allow?

Accepted Answer

Allows the user to connect to the RDS instance with the database user name 'db_user1'.. IAM database authentication allows an IAM user to authenticate to an RDS MySQL database using an IAM user or role. The IAM policy must include the rds-db:connect action with a resource ARN specifying the RDS instance and the database user name. When the resource ARN includes 'db_user1', the policy only permits connection as that specific database user, not as any user. Option A is incorrect because the policy does not grant permissions to any database or any user; it is scoped to 'db_user1'. Option B is incorrect because the rds-db:connect action does not grant management of the RDS instance. Option D is incorrect because the resource ARN restricts to 'db_user1', so connecting with any other database user name would be denied.

Answer

Allows the user to connect to any database on the RDS instance as any user.

Answer

Allows the user to manage the RDS instance.

Answer

Allows the user to connect to the RDS instance with any database user name.

Question 4

A company is migrating its on-premises Oracle database to Amazon RDS for Oracle. As part of the migration, they need to ensure that all sensitive data is encrypted at rest using AWS Key Management Service (AWS KMS). Which configuration step is required to achieve this?

Accepted Answer

Create a new encrypted DB instance by enabling encryption and specifying a KMS key.. Amazon RDS encryption at rest can only be enabled at the time the DB instance is created; it cannot be turned on for an existing unencrypted instance. To encrypt an existing Oracle database, you must create a new encrypted DB instance (or restore from a snapshot with encryption enabled) and specify a KMS key. This is why option D is the required configuration step.

Answer

Modify the existing DB instance to enable encryption.

Answer

Configure SSL/TLS on the DB instance to encrypt data at rest.

Answer

Use AWS CloudHSM to generate and store the encryption keys.

Question 5

A company uses Amazon DynamoDB with AWS KMS-managed encryption at rest. The security team requires that all access to a particular DynamoDB table be logged for audit purposes. Which solution meets this requirement?

Accepted Answer

Enable CloudTrail data events for the DynamoDB table.. AWS CloudTrail logs all DynamoDB API calls, including data plane operations, when data events are enabled. Option A is wrong because VPC Flow Logs capture network traffic, not API calls. Option B is wrong because AWS Config records resource configuration changes, not API calls. Option D is wrong because Amazon GuardDuty is a threat detection service, not a logging service.

Answer

Enable VPC Flow Logs for the VPC where the DynamoDB endpoint is accessed.

Answer

Enable AWS Config rules for DynamoDB.

Answer

Enable Amazon GuardDuty with DynamoDB protection.

Question 6

A company is using Amazon RDS for MySQL and needs to restrict access to the database to only specific Amazon EC2 instances in the same VPC. Which security mechanism should be used?

Accepted Answer

Configure a VPC security group that allows inbound traffic from the EC2 security groups.. In a VPC, RDS instances use VPC security groups to control inbound traffic. Configuring a VPC security group that allows inbound traffic from the EC2 security groups is the correct mechanism. Option B is incorrect because IAM policies control API access, not network connectivity. Option C is incorrect because subnet groups define subnets for deployment, not security rules. Option D is incorrect because network ACLs are stateless, apply to entire subnets, and cannot reference security groups or specific instances.

Answer

Create an IAM policy that allows the EC2 instances to connect to the RDS instance.

Answer

Create a DB subnet group that includes only the subnets where the EC2 instances reside.

Answer

Modify the network ACL for the DB subnet to allow traffic from the EC2 instances' IP addresses.

Question 7

A company uses Amazon Aurora MySQL-Compatible Edition and needs to audit all SQL statements executed by database users. Which feature should be enabled?

Accepted Answer

Enable the database engine audit logs (advanced auditing).. Aurora MySQL supports advanced auditing through database engine audit logs. Option B is wrong because CloudTrail logs API calls, not SQL queries. Option C is wrong because RDS Enhanced Monitoring provides OS metrics, not SQL audit. Option D is wrong because database activity streams capture activity in near real-time but are designed for monitoring and not primarily for SQL audit logging; however, they can be used, but the most direct answer is advanced auditing.

Answer

Enable AWS CloudTrail data events for the DB instance.

Answer

Enable database activity streams.

Answer

Enable RDS Enhanced Monitoring.

Question 8

A company is using Amazon DynamoDB and wants to ensure that only authorized users can access a specific table. Which AWS service should be used to manage access control?

Accepted Answer

AWS Identity and Access Management (IAM).. AWS Identity and Access Management (IAM) is the service used to manage access control for DynamoDB tables by creating policies that grant or deny permissions. Option A (CloudHSM) provides hardware security modules for encryption keys, not access control. Option B (KMS) manages encryption keys but does not handle access control. Option C (VPC security groups) control network traffic at the instance level, not database-level access control.

Answer

AWS CloudHSM.

Answer

AWS Key Management Service (KMS).

Answer

Amazon VPC security groups.

Question 9

A company is using Amazon RDS for PostgreSQL with automated backups. The security team requires that backups be encrypted at rest. The DB instance is currently unencrypted. What is the most efficient way to enable encryption for future backups?

Accepted Answer

Create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance.. Amazon RDS does not allow you to enable encryption on an existing unencrypted DB instance directly. The only supported method is to create a snapshot of the unencrypted instance, copy that snapshot with encryption enabled (using the appropriate KMS key), and then restore the encrypted snapshot to a new DB instance. This new instance will have encryption at rest for all data and future automated backups. Option D correctly describes this process, which is the most efficient and AWS-recommended approach.

Answer

Enable encryption by setting the 'backup_encryption' parameter in the DB parameter group.

Answer

Modify the DB instance to enable encryption.

Answer

Enable encryption on the S3 bucket where backups are stored.

Question 10

A company uses Amazon ElastiCache for Redis and needs to encrypt data in transit between the application and the cache cluster. Which feature should be enabled?

Accepted Answer

Enable encryption in transit on the replication group.. Amazon ElastiCache for Redis supports encryption in transit using TLS (Transport Layer Security) when enabled on the replication group. This ensures data is encrypted between the application and the cache cluster. Option B is incorrect because encryption at rest protects data stored on disk, not data in transit. Option C is incorrect because AWS KMS customer master keys are used for encryption at rest, not for transit encryption. Option D is incorrect because VPC security groups control network access at the IP/port level, not encryption; allowing HTTPS traffic does not enable encryption for ElastiCache communication.

Answer

Enable encryption at rest.

Answer

Use AWS KMS customer master keys.

Answer

Configure the VPC security group to allow only HTTPS traffic.

Question 11

A company is using Amazon DynamoDB and wants to ensure that all data is automatically encrypted at rest. What is the default encryption status for a new DynamoDB table?

Accepted Answer

Encryption is enabled by default using an AWS-owned key.. Amazon DynamoDB encrypts all data at rest by default using an AWS-owned key managed by the service, with no configuration required from the customer. This default encryption covers tables, indexes, and backups, and it happens transparently without impacting performance or requiring key management on the customer side.

Answer

Encryption is optional and can be enabled during table creation.

Answer

Encryption is disabled by default and must be enabled manually.

Answer

Encryption is enabled by default using a customer-managed key.

Question 12

A company is designing a security strategy for Amazon RDS for SQL Server. Which TWO actions should be taken to encrypt data at rest? (Choose TWO.)

Accepted Answer

Enable Transparent Data Encryption (TDE) on the SQL Server database.. Option B is correct because Transparent Data Encryption (TDE) is the SQL Server-native feature that encrypts database files, log files, and backups at rest, and Amazon RDS for SQL Server supports enabling TDE so that data pages are encrypted before being written to storage. Option E is correct because RDS encryption at rest, when enabled at instance creation, uses AWS KMS customer master keys to encrypt the underlying storage volumes, snapshots, and automated backups for the DB instance. Option A is not correct because you cannot directly enable Amazon EBS encryption on the volumes underlying an RDS instance; RDS manages that storage and encryption is controlled through the RDS encryption-at-rest setting tied to KMS. Option C is not correct because CloudHSM is not the mechanism RDS uses to store encryption keys for RDS encryption at rest; RDS integrates with AWS KMS for key management. Option D is not correct because SSL/TLS encrypts data in transit between clients and the SQL Server instance, not data at rest.

Answer

Enable Amazon EBS encryption on the underlying volumes.

Answer

Use AWS CloudHSM to store encryption keys.

Answer

Enable SSL/TLS for connections.

Question 13

A company is running an Amazon RDS for MySQL DB instance in a VPC. The security team requires that all connections to the database use SSL/TLS. The DBA has enabled 'require_secure_transport' parameter in the DB parameter group. However, after applying the change and rebooting, some applications that were previously connecting successfully are now failing. What is the most likely cause?

Accepted Answer

The application is not configured to connect using SSL/TLS.. The most likely cause is that the application is not configured to connect using SSL/TLS. When 'require_secure_transport' is enabled, the database rejects any non-SSL connections. Applications that were previously connecting without SSL will fail until they are updated to use SSL/TLS in their connection strings. The parameter change itself is correct and does not require an option group modification for RDS MySQL.

Answer

The security group inbound rule for the database port is missing.

Answer

The option group does not have the SSL option enabled.

Answer

The DB subnet group does not include the application's subnet.

Question 14

A financial services company is using Amazon DynamoDB to store customer transaction data. The compliance team requires that all data be encrypted at rest using a customer-managed AWS KMS key, and that access to the key be auditable via AWS CloudTrail. Additionally, the security team wants to ensure that DynamoDB can only be accessed from within the VPC using a VPC endpoint. Which combination of steps should the company take to meet these requirements?

Accepted Answer

Enable server-side encryption with a customer-managed KMS key and create an interface VPC endpoint for DynamoDB.. Option C. To meet the encryption requirement, the company must use a customer-managed KMS key, not an AWS managed key. For VPC-only access, DynamoDB supports interface VPC endpoints (via AWS PrivateLink), which provide private connectivity. Option C correctly uses a customer-managed KMS key and an interface VPC endpoint. Option D is incorrect because it uses an AWS managed KMS key. Option A is incorrect because CloudHSM is unnecessary and VPC peering is not the correct method. Option B is incorrect because a NAT gateway still routes traffic over the internet.

Answer

Use a CloudHSM key for encryption and create a VPC peering connection to DynamoDB.

Answer

Enable server-side encryption with a customer-managed KMS key and route all traffic through a NAT gateway.

Answer

Use AWS managed KMS key and a gateway VPC endpoint for DynamoDB.

Question 15

A developer needs to securely store database credentials for an application that runs on Amazon EC2 and connects to an Amazon RDS for PostgreSQL database. The credentials must be automatically rotated every 90 days. Which AWS service should the developer use to meet these requirements?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager. Secrets Manager is designed to securely store and manage secrets such as database credentials. It natively supports automatic rotation of credentials for Amazon RDS databases, including PostgreSQL, with a customizable rotation interval (e.g., every 90 days). Option A (AWS Systems Manager Parameter Store) can store secrets but does not provide built-in automatic rotation for RDS credentials. Option B (AWS CloudHSM) provides hardware security modules for encryption key storage, not for managing database credentials. Option C (IAM roles) allow EC2 instances to assume roles for API access but do not store or rotate database credentials; while IAM database authentication can be used with RDS PostgreSQL, it does not meet the requirement to store and rotate credentials automatically.

Answer

AWS Systems Manager Parameter Store

Answer

AWS CloudHSM

Answer

AWS Identity and Access Management (IAM) roles