DBS-C01 Database Security Practice Test 18 — 15 Questions

Question 1

A company is migrating its on-premises Oracle database to Amazon RDS for Oracle. The database contains sensitive data that must be encrypted at rest and in transit. The security team also requires that the encryption keys be rotated every year. The DBA has enabled encryption at rest using a customer-managed KMS key and SSL/TLS for in-transit encryption. What additional step is needed to meet the key rotation requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable automatic KMS key rotation for the customer-managed key.. For a customer-managed KMS key, you can enable automatic key rotation, which rotates the key material every year (or a custom period). This meets the requirement without manual intervention. The RDS instance continues to use the same key ID, but the underlying key material is rotated, and old data remains decryptable.

Answer

Manually create a new KMS key every year and update the RDS instance to use the new key.

Answer

Configure the RDS option group to rotate the encryption key.

Answer

Use an AWS CloudHSM key and configure automatic rotation.

Question 2

A company is using Amazon RDS for SQL Server with Multi-AZ deployment. The security team requires that all database activity be monitored for suspicious queries. The database specialist enabled RDS Database Activity Streams and configured AWS Lambda to process the stream. However, the Lambda function fails to process some events when the database fails over to the standby instance. What is the most likely cause?

Accepted Answer

The Lambda function does not re-establish the stream session after a failover event.. When a failover occurs, the RDS Database Activity Stream session is tied to the original primary instance. The Lambda function must re-establish the stream session to the new primary instance to continue processing events. If it does not, events during failover are lost. Option A is incorrect because the security group controls network access to the RDS endpoint, which remains the same after failover; connectivity is not the issue. Option C is incorrect because parameter group settings apply to both primary and standby instances; the activity stream setting is not parameter group-dependent. Option D is incorrect because the KMS key used for encryption is available in the same region; region unavailability is not a factor in Multi-AZ deployments within a single region.

Answer

The security group does not allow the Lambda function to connect to the new primary instance.

Answer

The parameter group for the standby instance does not have the activity stream enabled.

Answer

The KMS key used to encrypt the activity stream is not available in the standby instance's Region.

Question 3

A company is using Amazon Aurora MySQL-Compatible Edition. The security team wants to restrict access to the database so that only specific applications running on Amazon EC2 instances can connect. The EC2 instances are in the same VPC as the Aurora cluster. Which combination of steps should be taken to enforce this restriction?

Accepted Answer

Configure the Aurora cluster's security group to allow inbound traffic from the EC2 instances' security group.. Configuring the Aurora cluster's security group to allow inbound traffic from the EC2 instances' security group is the correct approach because security groups can reference other security groups as a source, enabling dynamic, instance-level access control without managing individual IP addresses. Option A is incorrect because IAM database authentication manages user authentication at the database level, not network access. Option B is incorrect because the DB subnet group defines the subnets where the Aurora cluster can be placed, not traffic filtering rules. Option C is incorrect because network ACLs are stateless and operate at the subnet boundary, making them less granular and harder to manage for instance-specific access compared to security group references.

Answer

Enable IAM database authentication and create database users for each application.

Answer

Modify the DB subnet group to include only subnets where the EC2 instances reside.

Answer

Use a network ACL to allow traffic only from the EC2 instances' IP addresses.

Question 4

A company is using Amazon RDS for MySQL to host a web application. The security team has identified that the application is vulnerable to SQL injection attacks. The team wants to implement a defense-in-depth strategy to protect the database. Which THREE measures should be taken to mitigate SQL injection risks?

Accepted Answer

Grant the minimum required permissions to the database user used by the application.. Options A, C, and E are correct. Parameterized queries (C) prevent SQL injection by separating SQL logic from data. Least privilege (A) reduces the impact if injection occurs. AWS WAF (E) provides a web application firewall to filter malicious input before it reaches the database. Option B is incorrect because stored procedures alone do not prevent SQL injection unless they use parameterized queries. Option D is incorrect because encryption at rest protects data at rest but does not prevent SQL injection.

Answer

Move all SQL logic into stored procedures.

Answer

Enable encryption at rest for the RDS instance.

Question 5

A company has an Amazon RDS for MySQL DB instance that stores sensitive customer data. The security team requires that all data at rest be encrypted using a customer-managed AWS KMS key. The DB instance was originally launched without encryption. Which combination of steps will meet the requirement with the least downtime?

Accepted Answer

Take a snapshot of the DB instance, copy the snapshot with encryption enabled using the desired KMS key, and restore the encrypted snapshot to a new DB instance.. RDS does not support enabling encryption in place on an existing unencrypted instance. The supported path is to snapshot the instance, copy the snapshot with encryption enabled using the customer-managed KMS key, and restore that encrypted snapshot as a new DB instance. This achieves encryption at rest with minimal downtime because the source keeps running until cutover.

Answer

Create a read replica of the DB instance with encryption enabled, and then promote the read replica to become the primary instance.

Answer

Modify the DB instance and enable encryption using the AWS Management Console.

Answer

Take a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the encrypted snapshot to the same DB instance ID.

Question 6

A database administrator needs to audit all SQL statements executed on an Amazon RDS for PostgreSQL DB instance. Which service should be used to capture and log the SQL statements?

Accepted Answer

Amazon RDS for PostgreSQL database activity streams. Amazon RDS for PostgreSQL supports database activity streams, which can be integrated with services like Amazon CloudWatch and AWS CloudTrail to provide a near real-time stream of database activities. The other options do not capture SQL statements: CloudTrail records API calls to RDS, Config records resource configuration changes, and Inspector is for vulnerability assessment.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon Inspector

Question 7

A company is using Amazon DynamoDB with a global table that replicates data across two AWS Regions. The security team requires that all data be encrypted at rest with a customer-managed AWS KMS key. How should the company configure the KMS keys to meet this requirement?

Accepted Answer

Create a separate KMS key in each region and assign each replica table its regional KMS key.. For DynamoDB global tables, each replica table can use a different KMS key. You must create a KMS key in each region and configure the table to use the regional key. Option A is incorrect because a single KMS key cannot be used across regions; KMS keys are region-specific. Option B is incorrect because using the same key across regions is not possible. Option D is incorrect because DynamoDB global tables support encryption with customer managed keys.

Answer

Create a single KMS key in the primary region and use it for both replicas.

Answer

Use AWS managed encryption as DynamoDB does not support customer managed KMS keys for global tables.

Answer

Create a multi-Region KMS key and use it for both replicas.

Question 8

A company has an Amazon Redshift cluster that contains sensitive data. The security team requires that data be encrypted at rest using a customer-managed AWS KMS key. The cluster was initially launched without encryption. How can the company enable encryption with minimal downtime?

Accepted Answer

Take a snapshot of the cluster and restore it to a new cluster with encryption enabled.. Amazon Redshift does not allow enabling encryption in place on an existing unencrypted cluster. The supported path is to take a snapshot of the unencrypted cluster and restore it to a new cluster with encryption enabled using a customer-managed KMS key. This preserves data and requires only the cutover downtime.

Answer

Unload the data to Amazon S3, create a new encrypted cluster, and reload the data from S3.

Answer

Use the AWS CLI to update the cluster encryption setting.

Answer

Modify the cluster and enable encryption using the AWS Management Console.

Question 9

A company wants to ensure that only specific IAM users can perform certain operations on an Amazon RDS DB instance, such as creating snapshots or modifying the instance. Which AWS feature should be used to define these permissions?

Accepted Answer

IAM policies. IAM policies are the AWS feature used to define permissions for IAM users, groups, and roles, specifying what actions they can perform on which resources. For RDS, you can create IAM policies that allow or deny specific operations like rds:CreateDBSnapshot or rds:ModifyDBInstance, and attach them to IAM users or roles. This provides fine-grained access control to RDS management operations.

Answer

VPC security groups

Answer

DB parameter groups

Answer

DB subnet groups

Question 10

A company stores sensitive data in an Amazon S3 bucket that is accessed by an Amazon Redshift cluster. The security team requires that the data in transit between Redshift and S3 be encrypted. Which configuration ensures this?

Accepted Answer

Ensure that the Redshift cluster has SSL enabled, which encrypts data in transit by default for COPY/UNLOAD operations to S3.. Redshift automatically uses SSL encryption for data in transit when moving data to and from S3 using COPY/UNLOAD commands. Option A is incorrect because server-side encryption (SSE-S3) encrypts data at rest, not in transit. Option C is incorrect because client-side encryption encrypts data before sending, but Redshift handles this automatically with SSL. Option D is incorrect because VPC endpoints do not encrypt data in transit; they provide private connectivity.

Answer

Enable server-side encryption (SSE-S3) on the S3 bucket.

Answer

Configure a VPC endpoint for S3.

Answer

Use client-side encryption on the data before uploading to S3.

Question 11

Which THREE of the following are best practices for securing an Amazon DynamoDB table? (Select THREE.)

Accepted Answer

Enable point-in-time recovery (PITR) to protect against accidental writes or deletes.. Options A, B, and D are correct. Point-in-time recovery (PITR) protects against accidental writes or deletes by allowing you to restore the table to any point within the last 35 days. Encryption at rest using AWS KMS secures data at rest. IAM policies based on least privilege restrict access to only necessary actions and resources. Option C (public access) is not a best practice; DynamoDB tables are private by default and should not be exposed publicly. Option E (limiting item size) is a performance consideration, not a security best practice.

Answer

Enable public access to the table to allow easy data sharing.

Answer

Limit the maximum item size to 100 KB to reduce storage costs.

Question 12

Which TWO of the following are methods to encrypt data at rest for an Amazon RDS for Oracle DB instance? (Select TWO.)

Accepted Answer

Enable encryption at rest using AWS KMS when creating the DB instance.. Options A and B are correct. Amazon RDS for Oracle supports encryption at rest via two methods: enabling encryption using AWS KMS when creating the DB instance (Option A) or using Oracle Transparent Data Encryption (TDE) with a customer-managed Oracle wallet (Option B). Option C (SSL/TLS) encrypts data in transit, not at rest. Option D (S3 SSE) is irrelevant as S3 is not used for RDS storage. Option E (client-side encryption) is an application-level approach and not a native RDS encryption method.

Answer

Enable SSL/TLS for the DB instance.

Answer

Configure Amazon S3 server-side encryption on the DB instance's storage.

Answer

Use client-side encryption in the application before sending data to RDS.

Question 13

An IAM policy is attached to a role used by an application to access an Amazon RDS for MySQL DB instance. The DB instance is encrypted with a customer-managed KMS key. The application is unable to create a snapshot of the encrypted DB instance. Which missing permission is the most likely cause?

Accepted Answer

kms:CreateGrant. To create a snapshot of an encrypted RDS DB instance, the IAM role must have the kms:CreateGrant permission on the customer-managed KMS key. This permission allows RDS to create a grant that enables it to use the key for encrypting the snapshot. Without kms:CreateGrant, the snapshot creation fails. Options A (kms:ReEncrypt), B (kms:DescribeKey), and D (kms:Encrypt) are not required for this operation.

Answer

kms:ReEncrypt

Answer

kms:DescribeKey

Answer

kms:Encrypt

Question 14

A database administrator is troubleshooting connectivity to an Amazon RDS for MySQL DB instance. The application is running on an EC2 instance in the same VPC and security group. The application can connect using the endpoint shown in the exhibit. However, the security team requires that all connections be encrypted using SSL. The DBA has enabled SSL on the DB instance and modified the parameter group to set require_secure_transport to ON. The application is now failing to connect. What is the most likely cause?

Accepted Answer

The application's JDBC connection string does not include SSL parameters such as useSSL=true.. When `require_secure_transport` is set to ON, the MySQL server rejects any connection that does not use SSL/TLS. The application's JDBC connection string must include SSL parameters such as `useSSL=true` (or `sslMode=REQUIRED` in newer drivers) to initiate an encrypted connection. Without these parameters, the connection attempt fails because the server requires secure transport. This is the most likely cause of the failure after enabling SSL enforcement.

Answer

The DB instance endpoint is not resolving to the correct IP address.

Answer

The database user account does not have the SSL privilege granted.

Answer

The security group does not allow inbound traffic on port 3307, which is used for SSL connections.

Question 15

A company is running an Amazon RDS for MySQL DB instance in a VPC. The security team requires that all connections to the database use SSL/TLS. Which combination of steps should be taken to enforce this? (Choose two.)

Accepted Answer

Require database users to connect using the --ssl-ca parameter with the RDS certificate.. Option D is correct because setting the 'rds.force_ssl' parameter to 1 in the DB parameter group makes the RDS for MySQL instance reject any non-SSL connections, which directly enforces SSL/TLS for all clients. Option C is correct because clients must supply the RDS certificate authority using the --ssl-ca parameter (along with --ssl-mode=REQUIRED or equivalent) so the MySQL client can establish a verified TLS connection to the instance. Option A is not correct because placing the DB in a private subnet only restricts network reachability; it does not enforce SSL/TLS on port 3306. Option B is not correct because security groups cannot inspect whether a connection is encrypted, so they cannot deny traffic based on SSL usage. Option E is not correct because SSL/TLS enforcement for RDS for MySQL is controlled through the parameter group (rds.force_ssl), not through an option group SSL option.

Answer

Create a new DB subnet group that isolates the DB instance in a private subnet without internet access.

Answer

Update the security group for the DB instance to deny inbound traffic on port 3306 from sources that do not have SSL.

Answer

Modify the DB option group associated with the DB instance, enabling the SSL option.