DBS-C01 Database Security Practice Test 18 — 15 Questions

Question 1

A company needs to comply with PCI DSS requirements for an Amazon RDS for Oracle DB instance. The requirements include encryption of sensitive data at rest and in transit, and automated key rotation. Which combination of services and configurations should be used? (Select THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable encryption at rest on the RDS instance using AWS KMS.. Options B, C, and D are correct. Option B: Enable encryption at rest on the RDS instance using AWS KMS. Option C: Use AWS Secrets Manager to automatically rotate database credentials. Option D: Enable SSL/TLS for connections to the database. Option A is incorrect because AWS CloudHSM is not required for key rotation; KMS can handle key rotation automatically. Option E is incorrect because VPC Flow Logs are for network traffic monitoring, not encryption.

Answer

Use AWS CloudHSM to generate and store encryption keys.

Answer

Enable VPC Flow Logs to audit database connections.

Question 2

A company has an Amazon DynamoDB table with a global secondary index (GSI). The security team wants to ensure that the table and the GSI are encrypted at rest. How can this be achieved?

Accepted Answer

Nothing; DynamoDB encrypts all data at rest by default.. DynamoDB encrypts all tables and GSIs at rest by default. Option B is wrong because encryption is always on. Option C is wrong because encryption cannot be disabled. Option D is wrong because GSIs are automatically encrypted with the table.

Answer

Create the table with encryption disabled to avoid performance impact.

Answer

Enable encryption at rest on the table and the GSI separately.

Answer

Enable encryption on the GSI using a KMS key.

Question 3

A company is designing a security strategy for an Amazon Aurora MySQL database. They need to ensure that database activity is monitored for suspicious behavior and that alerts are sent when anomalies are detected. Which AWS services should be combined to achieve this? (Select TWO.)

Accepted Answer

Amazon GuardDuty. Options A and B are correct. Amazon GuardDuty (A) is a threat detection service that monitors for suspicious activity and anomalous behavior. Amazon RDS Database Activity Streams (B) provide a near-real-time stream of database activity, which can be integrated with GuardDuty for monitoring. Option C (AWS WAF) is a web application firewall, not for database activity monitoring. Option D (Amazon EventBridge) is an event bus service that can trigger alerts but does not itself detect anomalies. Option E (Amazon Inspector) is for vulnerability assessment on EC2 instances.

Answer

AWS WAF

Answer

Amazon EventBridge

Answer

Amazon Inspector

Question 4

A company has an Amazon RDS for MySQL DB instance that is publicly accessible. The security team wants to restrict access to only specific IP addresses. Which configuration should be used?

Accepted Answer

Configure a security group associated with the RDS instance to allow inbound traffic only from the specific IP addresses.. A security group associated with the RDS instance can be configured to restrict inbound traffic to specific IP addresses, even if the instance is publicly accessible. Option A is incorrect because a VPC endpoint is used for private connectivity from within a VPC, not for restricting public access. Option B is incorrect because IAM policies control permissions for API actions, not network-level access. Option D is incorrect because network ACLs are stateless and applied at the subnet level, and while they can filter IP traffic, security groups are the more appropriate and granular control for individual RDS instances.

Answer

Create a VPC endpoint for RDS and attach a policy that allows only the specific IP addresses.

Answer

Use an IAM policy with a condition that restricts the source IP address.

Answer

Configure a network ACL to allow inbound traffic from the specific IP addresses.

Question 5

A company wants to encrypt an existing unencrypted Amazon RDS for PostgreSQL DB instance. What is the correct procedure?

Accepted Answer

Take a snapshot of the instance, create an encrypted copy of the snapshot, and restore the encrypted snapshot to a new DB instance.. Encryption for an existing unencrypted Amazon RDS for PostgreSQL DB instance cannot be enabled directly. The correct procedure is to take a snapshot of the instance, create an encrypted copy of that snapshot, and then restore the encrypted snapshot to a new DB instance. Option A accurately describes this process. Option B is incorrect because restoring a snapshot does not allow enabling encryption during the restore; encryption must be applied at the time of snapshot copy. Option C is incorrect because you cannot modify a running DB instance to enable encryption. Option D is incorrect because creating a read replica does not encrypt the primary instance; encryption must be set up before replica creation.

Answer

Take a snapshot of the instance and restore it with encryption enabled.

Answer

Modify the DB instance and enable encryption in the RDS console.

Answer

Create a read replica of the instance and enable encryption on the replica.

Question 6

A company is using Amazon DynamoDB with client-side encryption using the DynamoDB Encryption Client. The encryption keys are stored in AWS KMS. The security team wants to ensure that the encryption keys can be used only by authorized applications. What should be done?

Accepted Answer

Use a KMS key policy that grants access only to the specific IAM roles used by the applications.. A KMS key policy that restricts decryption permissions to specific IAM roles ensures only authorized applications can use the client-side encryption keys. Option A is incorrect because storing keys in CloudHSM does not by itself enforce application-level authorization; key policies are still needed. Option B is incorrect because Secrets Manager is for storing secrets, not for managing key permissions; it does not replace KMS key policies. Option C is incorrect because IAM policies alone cannot deny DynamoDB access based on encryption keys; access control is managed via the key policy and IAM permissions.

Answer

Store the encryption keys in AWS CloudHSM instead of KMS.

Answer

Use AWS Secrets Manager to store the encryption keys and rotate them automatically.

Answer

Use an IAM policy that denies access to the DynamoDB table unless the request includes the correct key.

Question 7

A company is using Amazon RDS for MySQL and needs to encrypt data at rest for an existing DB instance. Which approach meets this requirement with minimal downtime?

Accepted Answer

Take a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore from the encrypted snapshot.. To encrypt an existing unencrypted RDS MySQL DB instance, you cannot directly modify the instance. The standard approach is to take a snapshot, create an encrypted copy of the snapshot, and then restore that encrypted snapshot to a new DB instance. This method typically involves minimal downtime compared to other options. Option A correctly describes this process. Option B is incorrect because encryption cannot be enabled directly on an existing instance. Option C is incorrect because the AWS CLI modify-db-instance command does not support enabling encryption on an existing instance; the --storage-encrypted flag only applies to new instances. Option D is incorrect because creating a read replica with encryption does not encrypt the primary instance; you would still need to perform a snapshot restore for the primary's encryption.

Answer

Enable encryption directly on the existing DB instance by modifying it.

Answer

Use the AWS CLI command modify-db-instance with the --storage-encrypted flag.

Answer

Create a read replica of the DB instance with encryption enabled, then promote it.

Question 8

A security team is auditing IAM policies for Amazon RDS. They want to ensure that all RDS snapshots shared with other AWS accounts are encrypted. Which IAM policy condition key should be used to enforce this?

Accepted Answer

rds:Encrypted. Rds:Encrypted. This condition key verifies that a snapshot is encrypted when sharing with other AWS accounts. Option B (rds:SnapshotEncrypted) is not a valid condition key. Option C (rds:StorageEncrypted) is used to check if the DB instance's storage is encrypted, not the snapshot. Option D (s3:x-amz-server-side-encryption) is an S3 condition key and not applicable to RDS snapshots.

Answer

rds:SnapshotEncrypted

Answer

rds:StorageEncrypted

Answer

s3:x-amz-server-side-encryption

Question 9

A developer needs to allow an application running on EC2 to access an Amazon RDS database without storing database credentials in the application code. Which solution is the MOST secure?

Accepted Answer

Use IAM database authentication for the RDS instance and assign an IAM role to the EC2 instance.. IAM database authentication allows the EC2 instance to use an IAM role to authenticate to the RDS database, eliminating the need to store any credentials in the application code. This is the most secure method. Options B and C still rely on storing and retrieving a password, which introduces risk. Option D stores credentials in a config file, which is insecure.

Answer

Store the database password in AWS Systems Manager Parameter Store as a SecureString.

Answer

Store the database password in the application configuration file.

Answer

Store the database password in AWS Secrets Manager and enable automatic rotation.

Question 10

A company wants to enforce that all new Amazon RDS DB instances are created with encryption at rest enabled. Which approach should be taken?

Accepted Answer

Use an IAM policy that denies the rds:CreateDBInstance action unless rds:StorageEncrypted is set to true.. An IAM policy with a condition key `rds:StorageEncrypted` set to `true` can deny the `rds:CreateDBInstance` action when encryption is not enabled, enforcing encryption at rest at creation time. Option B is wrong because CloudTrail is an auditing service; it logs API calls but cannot automatically delete unencrypted instances without additional services like Lambda. Option C is wrong because AWS Config detects and reports noncompliant resources but does not prevent creation; it is reactive. Option D is wrong because Amazon RDS does not offer a default encryption setting at the account level; encryption must be explicitly enabled per instance.

Answer

Use AWS CloudTrail to detect unencrypted instance creation and automatically delete them.

Answer

Use AWS Config rules to mark unencrypted instances as noncompliant.

Answer

Enable encryption by default in the RDS console.

Question 11

A company needs to securely store and manage the master password for their Amazon RDS for PostgreSQL instance. Which AWS service is purpose-built for managing secrets with automatic rotation?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is designed for secret management with built-in rotation. Option A is wrong because KMS is for encryption keys, not secret management. Option C is wrong because IAM is for identity and access management, not secret storage. Option D is wrong because CloudHSM provides hardware security modules but not secret rotation.

Answer

AWS Key Management Service (KMS)

Answer

AWS Identity and Access Management (IAM)

Answer

AWS CloudHSM

Question 12

An application uses an Amazon RDS for MySQL database. The security team requires that all traffic to the database be encrypted in transit. Which configuration ensures this?

Accepted Answer

Create a custom DB parameter group with the require_secure_transport parameter set to ON.. Setting require_secure_transport to ON in a custom DB parameter group enforces SSL/TLS for all connections to the RDS MySQL database, ensuring encryption in transit. Option A is wrong because the default parameter group does not enforce SSL. Option C is wrong because security groups control network access at the port level, not encryption. Option D is wrong because network ACLs are stateless and do not enforce encryption.

Answer

Use the default RDS parameter group.

Answer

Configure the security group to allow only port 3306 from the application.

Answer

Use a network ACL to restrict inbound traffic to port 3306.

Question 13

A company has an Amazon RDS for Oracle DB instance that needs to be encrypted at rest. The instance currently uses Oracle Transparent Data Encryption (TDE) with a key stored in the database. The company wants to use AWS KMS for key management. What is the correct migration path?

Accepted Answer

Take a snapshot of the DB instance, copy the snapshot with KMS encryption, and restore from the encrypted snapshot.. To change the encryption key from Oracle TDE to AWS KMS, you must take a snapshot of the DB instance, copy the snapshot with KMS encryption, and restore from the encrypted snapshot. This process enables encryption at rest with KMS. Option B is incorrect because you cannot directly enable KMS encryption on an existing TDE instance; this is not supported. Option C is incorrect because creating a read replica does not allow changing the encryption key; read replicas inherit the source instance's encryption. Option D is incorrect because you cannot modify the encryption key in place on an existing instance.

Answer

Enable KMS encryption directly on the existing DB instance using the AWS CLI.

Answer

Create a read replica with KMS encryption.

Answer

Modify the DB instance and select the KMS key.

Question 14

A company wants to audit all SQL statements executed on their Amazon Aurora MySQL database for compliance. Which AWS feature should be enabled?

Accepted Answer

Database Activity Streams. Database Activity Streams provide a stream of database activities including SQL queries. Option B is wrong because VPC Flow Logs capture network traffic, not SQL statements. Option C is wrong because CloudWatch Logs can store logs but the source should be Database Activity Streams; CloudWatch Logs alone does not audit SQL statements. Option D is wrong because CloudTrail logs API calls, not SQL statements.

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 15

Which TWO actions should a company take to secure an Amazon RDS for MySQL database that is accessible from the internet? (Choose two.)

Accepted Answer

Use a security group that restricts inbound traffic to only the required IP addresses.. Options A and E are correct. Option A: Using a security group to restrict inbound traffic to only required IP addresses limits exposure to the internet. Option E: Placing the DB instance in a private subnet without a public IP address ensures it is not directly accessible from the internet. Option B is incorrect because disabling encryption at rest reduces security and does not address internet accessibility. Option C is incorrect because using the default VPC with a public subnet and a network ACL that allows all traffic increases exposure. Option D is incorrect because launching the DB instance in a public subnet with a public IP address makes it directly reachable from the internet.

Answer

Disable encryption at rest to reduce latency.

Answer

Use the default VPC with a public subnet and a network ACL that allows all traffic.

Answer

Launch the DB instance in a public subnet with a public IP address.