DBS-C01 Database Security Practice Test 19 — 15 Questions

Question 1

A financial services company stores sensitive data in an Amazon DynamoDB table. The security team requires that all data at rest be encrypted with a customer-managed key that is rotated automatically every 12 months. The company also needs to audit key usage. Which solution meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable encryption at rest using an AWS KMS customer-managed CMK. Configure automatic key rotation with a 12-month period. Use AWS CloudTrail to audit key usage.. DynamoDB supports encryption at rest with AWS KMS customer-managed CMKs. Automatic key rotation every 12 months is a feature of KMS for CMKs. CloudTrail logs KMS API calls for auditing. Option A is incorrect because SSE-S3 is for S3, not DynamoDB. Option B is incorrect because CloudHSM does not provide automatic key rotation every 12 months and requires application-side encryption. Option C is incorrect because the default DynamoDB encryption uses an AWS owned key, which is not customer-managed and rotates automatically every 3 years, not 12 months. Option D is correct: it uses a customer-managed CMK with yearly rotation and CloudTrail for auditing.

Answer

Use server-side encryption with S3-managed keys (SSE-S3) for the DynamoDB table.

Answer

Use AWS CloudHSM to generate and store the encryption key. Configure the application to encrypt data before writing to DynamoDB.

Answer

Enable encryption at rest using the default DynamoDB encryption option (AWS owned key). Use AWS CloudTrail to audit key usage.

Question 2

A company uses Amazon Redshift for its data warehouse. The security team wants to encrypt the data at rest and ensure that only authorized users can access the encryption keys. Which AWS service should be used to manage the encryption keys?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is the native AWS service for creating, rotating, and controlling access to encryption keys used by services like Amazon Redshift. Redshift integrates directly with KMS for encryption at rest, and IAM policies plus key policies restrict who can use the keys. This satisfies both encryption and authorized-access requirements.

Answer

AWS CloudHSM

Answer

AWS Secrets Manager

Answer

AWS Systems Manager Parameter Store

Question 3

A company is using Amazon RDS for MySQL and wants to restrict access to the database based on the source IP address. Which AWS feature should be used to achieve this?

Accepted Answer

VPC Security Groups. VPC Security Groups can be used to restrict access to an Amazon RDS for MySQL database based on the source IP address. Security groups act as virtual firewalls that control inbound and outbound traffic at the instance level. You can create rules that allow traffic only from specific IP addresses or CIDR ranges to the database port.

Answer

DB Parameter Groups

Answer

IAM Database Authentication

Answer

Network ACLs

Question 4

A company is deploying an Amazon DynamoDB table with server-side encryption using a customer-managed AWS KMS key. The security team requires that the key be automatically rotated every year and that access to the key be logged. Which THREE steps should be taken?

Accepted Answer

Enable automatic key rotation for the KMS key.. Option A is correct because enabling automatic key rotation on a customer-managed KMS key causes AWS KMS to rotate the backing key material once per year (the default rotation period) without changing the key ID or requiring re-encryption of data, satisfying the annual rotation requirement. Option C is correct because AWS KMS API calls such as Encrypt, Decrypt, and GenerateDataKey are recorded by AWS CloudTrail, which is the mechanism that provides the required logging of key access. Option D is correct because a KMS key policy is the primary access control document for a KMS key, and restricting its use to specific IAM roles enforces least-privilege access to the key. Option B is incorrect because AWS CloudHSM is a separate dedicated hardware security module service and is not used to store or rotate KMS keys. Option E is incorrect because client-side encryption moves encryption outside DynamoDB and KMS-managed server-side encryption, which contradicts the stated requirement for DynamoDB server-side encryption with a customer-managed KMS key.

Answer

Use AWS CloudHSM to store the key and manage rotation.

Answer

Configure the DynamoDB table to use client-side encryption.

Question 5

A company has an Amazon Redshift cluster that contains sensitive data. The security team wants to ensure that all data is encrypted at rest and that the encryption keys are managed by AWS. Which configuration should be used?

Accepted Answer

Enable encryption at rest using the default AWS-managed KMS key for Redshift.. Amazon Redshift supports encryption at rest using AWS KMS. When you enable encryption, you can choose to use the default AWS-managed key (aws/redshift) or a customer-managed key. The default key is managed by AWS, meeting the requirement that keys are managed by AWS. Option A is incorrect because CloudHSM is used for customer-managed keys, not AWS-managed keys. Option B is incorrect because SSE-S3 is for S3 objects, not Redshift clusters. Option D is incorrect because client-side encryption is not supported for Redshift at rest.

Answer

Use AWS CloudHSM to generate and store encryption keys.

Answer

Use server-side encryption with S3-managed keys (SSE-S3) for the Redshift cluster.

Answer

Use client-side encryption with the AWS Encryption SDK.

Question 6

A company uses an Amazon RDS for PostgreSQL database with Multi-AZ deployment. The security team wants to audit all SQL queries executed against the database for compliance purposes. Which solution should be implemented to capture and store the queries?

Accepted Answer

Enable PostgreSQL query logging and publish logs to Amazon CloudWatch Logs.. To audit all SQL queries executed against an RDS for PostgreSQL database, you must enable PostgreSQL's native query logging (via the log_statement parameter, typically set to 'all') and publish those logs to Amazon CloudWatch Logs. RDS supports exporting PostgreSQL logs to CloudWatch, where they can be retained, searched with CloudWatch Logs Insights, and archived for compliance. This captures the actual SQL text executed against the database.

Answer

Use AWS CloudTrail to capture SQL queries.

Answer

Enable Performance Insights and store the data in CloudWatch Logs.

Answer

Enable RDS event notifications for database queries.

Question 7

A security engineer is investigating an Amazon RDS for MySQL database that was compromised. The engineer finds that the compromise was due to a SQL injection vulnerability in a web application. The web application uses a database user with full administrative privileges. What is the BEST practice to prevent such incidents in the future?

Accepted Answer

Create dedicated database users with minimal privileges required for each application function.. The best practice is to use dedicated database users with minimal privileges for each application function (Option A). This principle of least privilege limits the damage a SQL injection attack can cause because the compromised user cannot perform unauthorized actions beyond its specific scope. Option B is incorrect because the 'sql_mode' parameter can reject certain dangerous queries but does not address the root cause of excessive privileges and may not prevent all injection attacks. Option C is incorrect because audit logs only help detect incidents after they occur, not prevent them. Option D is incorrect because while placing the RDS instance in a private subnet and restricting inbound traffic reduces the network attack surface, it does not prevent SQL injection attacks that originate from the application itself; the vulnerability lies in how the application interacts with the database.

Answer

Configure the DB parameter group to use the 'sql_mode' option to reject dangerous queries.

Answer

Enable RDS audit logs to capture all SQL queries.

Answer

Place the RDS instance in a private subnet with a security group that restricts inbound traffic.

Question 8

A company uses Amazon DynamoDB for its critical application. The security team requires that all access to DynamoDB tables be logged and monitored for suspicious activity. The company also needs to be alerted when a user deletes a table. Which combination of AWS services should be used?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Events.. AWS CloudTrail logs all API activity on DynamoDB tables, including DeleteTable calls, providing the audit trail. Amazon CloudWatch Events (now Amazon EventBridge) can match the DeleteTable API call and trigger an alert via SNS or Lambda. Together they satisfy logging, monitoring, and alerting on table deletion.

Answer

AWS CloudTrail and Amazon DynamoDB Streams.

Answer

AWS Config and Amazon Simple Notification Service (SNS).

Answer

Amazon VPC Flow Logs and Amazon CloudWatch Logs.

Question 9

A company's security policy requires that all database passwords be rotated every 90 days. The company uses AWS Secrets Manager to store database credentials for Amazon RDS. Which feature can be used to automate password rotation?

Accepted Answer

Configure automatic rotation in Secrets Manager with a rotation interval of 90 days.. Secrets Manager has built-in rotation support for RDS databases. Option B is wrong because Lambda can be used but is not a feature of Secrets Manager itself; the managed rotation is the simplest. Option C is wrong because IAM Access Analyzer is for analyzing resource policies, not password rotation. Option D is wrong because Systems Manager Parameter Store does not have built-in rotation for RDS.

Answer

Use an AWS Lambda function triggered by Amazon CloudWatch Events every 90 days to rotate the password.

Answer

Use IAM Access Analyzer to detect unused passwords and rotate them.

Answer

Store the password in AWS Systems Manager Parameter Store and use automatic rotation.

Question 10

A company is deploying a new Amazon RDS for MySQL database in a VPC. The database must be accessible only from an application server running in the same VPC. The security team also wants to ensure that the database is not accessible from the internet. Which TWO configurations are required? (Choose TWO.)

Accepted Answer

Configure the security group to allow inbound traffic only from the application server's security group.. Option C is correct because an RDS security group must explicitly permit inbound traffic on the database port (e.g., 3306 for MySQL), and referencing the application server's security group as the source restricts access to only that application server rather than an entire subnet or CIDR range. Option D is correct because setting the DB instance's PubliclyAccessible attribute to false ensures RDS does not assign a publicly resolvable DNS endpoint or allow internet-originated connections, keeping the instance reachable only from within the VPC. Option A is wrong because placing the DB in a public subnet does not by itself make it internet-accessible and is not required for same-VPC access; a private subnet is the recommended placement. Option B is wrong because DB parameter groups control engine-level settings, not network access. Option E is wrong because a network ACL denying 0.0.0.0/0 is not a required configuration and is unnecessary when the security group and PubliclyAccessible setting already block internet access.

Answer

Place the DB instance in a public subnet.

Answer

Modify the DB parameter group to restrict network access.

Answer

Configure a network ACL to deny inbound traffic from 0.0.0.0/0.

Question 11

A company is using an Amazon RDS for PostgreSQL database to store sensitive customer data. The security team requires that all data be encrypted at rest and in transit, and that access to the database is restricted to only specific applications. Currently, the database is encrypted at rest using AWS KMS, and connections are made over SSL. However, the security team wants to ensure that even if the database credentials are compromised, an attacker cannot access the database from unauthorized IP addresses. What should be done to meet this requirement?

Accepted Answer

Modify the security group associated with the RDS instance to allow inbound traffic only from the application's IP addresses.. Modifying the security group associated with the RDS instance to allow inbound traffic only from the application's IP addresses restricts network access at the instance level, preventing unauthorized IP addresses from connecting even if credentials are compromised. Option A (attaching a resource-based policy) does not restrict network access—it controls IAM permissions. Option B (creating a new RDS instance in a VPC with a network ACL) is unnecessarily complex and involves migrating data; the requirement can be met by modifying the existing security group without creating a new instance. Option D (enabling IAM database authentication) authenticates database users via IAM but does not restrict source IP addresses, so it does not meet the stated requirement.

Answer

Attach a resource-based policy to the RDS instance to allow only specific IAM roles.

Answer

Create a new RDS instance in a VPC with a network ACL that allows inbound traffic only from specific IP ranges, and migrate the data.

Answer

Enable IAM database authentication for the RDS instance.

Question 12

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database contains personally identifiable information (PII). The security team requires that the data be encrypted at rest using a customer-managed key stored in AWS KMS. Additionally, the team wants to ensure that the key can be rotated automatically every year. What should the company do to meet these requirements?

Accepted Answer

Create a customer-managed key in AWS KMS, enable automatic rotation, and enable encryption on the RDS instance using that key.. The correct approach is to create a customer-managed key in AWS KMS with automatic rotation enabled, then enable encryption on the RDS instance using that key. This meets the requirements for encryption at rest with a customer-managed key and automatic annual rotation. Option A is incorrect because AWS Secrets Manager is used for storing secrets, not encryption keys. Option C lacks automatic rotation. Option D uses an AWS managed key, not customer-managed, and requires a manual Lambda function, not automatic rotation.

Answer

Enable encryption on the RDS instance using the default RDS encryption and use AWS Secrets Manager to store the key.

Answer

Create a customer-managed key in AWS KMS without automatic rotation, and manually rotate the key using the RDS console.

Answer

Use an AWS managed key for RDS and create an AWS Lambda function to rotate the key manually each year.

Question 13

A company uses Amazon Redshift for data warehousing. The security team has implemented column-level security using Redshift's column-level access controls. However, during a security audit, it is discovered that a user with SELECT privilege on a table can still see the content of a column that should be restricted. The column is defined with a GRANT statement that only allows SELECT on certain columns to specific users. What is the most likely cause of this issue?

Accepted Answer

The user was previously granted SELECT on the entire table, and the column-level GRANT did not revoke that broader permission.. In Redshift, column-level GRANTs are additive and do not automatically revoke a pre-existing table-wide SELECT privilege. If the user was previously granted SELECT on the entire table, that broader grant still applies, so the user can read the restricted column despite the narrower column-level grant. The fix is to REVOKE the table-level SELECT first, then grant only the specific columns.

Answer

The column is part of a distribution key that bypasses security controls.

Answer

The user is accessing the table via a stored procedure that bypasses column-level security.

Answer

The column-level security is not supported in Redshift; it must be implemented using views.

Question 14

A company is using Amazon DynamoDB with fine-grained access control using IAM policies. The security team wants to ensure that a specific IAM role can only read the 'status' attribute from items in a table. The table is named 'Orders'. Which IAM policy statement should be used?

Accepted Answer

Condition: { 'ForAllValues:StringEquals': { 'dynamodb:Attributes': ['status'] } }. It uses the `dynamodb:Attributes` condition key with `ForAllValues:StringEquals` to restrict the request to only access the 'status' attribute. This ensures the role can only read the 'status' attribute, meeting the requirement. Option A incorrectly uses the condition to match the literal value 'active' as an attribute name. Options C and D use invalid or irrelevant condition keys.

Answer

Condition: { 'ForAllValues:StringEquals': { 'dynamodb:Attributes': ['active'] } }

Answer

Condition: { 'ForAllValues:StringEquals': { 'dynamodb:ReturnValues': 'ALL_OLD' } }

Answer

Condition: { 'StringEquals': { 'dynamodb:Select': 'SPECIFIC_ATTRIBUTES' } }

Question 15

A company is using an Amazon RDS for MySQL DB instance. The security team requires that all database connections be encrypted in transit. Which configuration step ensures this requirement is met?

Accepted Answer

Set the 'require_secure_transport' parameter to 1 in the DB parameter group.. For Amazon RDS for MySQL, encryption in transit is enforced by setting the require_secure_transport parameter to 1 in the DB parameter group. This forces all client connections to use SSL/TLS, rejecting any unencrypted connection attempts. The parameter is dynamic and can be applied without a reboot in most cases.

Answer

Enable encryption at rest for the RDS instance.

Answer

Store the database password in AWS Secrets Manager.

Answer

Modify the network ACL to only allow traffic on port 3306.