DBS-C01 Database Security Practice Test 19 — 15 Questions

Question 1

Which THREE components are required to set up IAM database authentication for an Amazon RDS for MySQL DB instance? (Choose three.)

Accepted Answer

An IAM role that the application can assume.. The three required components for setting up IAM database authentication for an Amazon RDS for MySQL DB instance are: (A) an IAM role that the application can assume to retrieve an authentication token from IAM; (C) a database user that is mapped to the IAM role in the RDS MySQL database; and (D) a DB parameter group with `require_secure_transport` set to ON to enforce SSL/TLS connections, which are mandatory for IAM authentication. Option B (AWS KMS key) is not required because the authentication token is signed by IAM, not encrypted with KMS. Option E (RDS Proxy) is optional and not a requirement; while it can provide connection pooling, it is not needed to set up IAM authentication itself.

Answer

An AWS KMS key to encrypt the authentication token.

Answer

An RDS Proxy to manage connections.

Question 2

Which TWO AWS services can be used to centrally manage database credentials and automate rotation for Amazon RDS? (Choose two.)

Accepted Answer

AWS Secrets Manager. Options A and D are correct. AWS Secrets Manager provides native automated rotation for RDS credentials, while AWS Systems Manager Parameter Store (SecureString) can centrally store encrypted credentials and support automated rotation when combined with a custom AWS Lambda function. Both services allow centralized management of database credentials, and with additional configuration, both can automate rotation. Option B (AWS KMS) is incorrect because KMS manages encryption keys, not secrets. Option C (IAM database authentication) is incorrect because it eliminates the need for stored credentials but does not centrally manage or rotate them. Option E (AWS CloudHSM) is incorrect because it provides hardware security modules for key storage, not secret management.

Answer

AWS Key Management Service (KMS)

Answer

IAM database authentication

Answer

AWS CloudHSM

Question 3

A security engineer runs the commands shown in the exhibit for an RDS MySQL DB instance. The engineer wants to enforce SSL connections to the database. What should the engineer do?

Accepted Answer

Create a custom DB parameter group with require_secure_transport set to ON, associate it with the DB instance, and reboot the instance.. Enforcing SSL for MySQL requires setting require_secure_transport to ON in a custom DB parameter group, then associating it with the DB instance and rebooting. Option A is wrong because the default parameter group cannot be modified. Option B is wrong because there is no --require-ssl-transport flag; the setting is a parameter group parameter, not an instance-level flag. Option D is wrong because IAM database authentication does not enforce SSL connections.

Answer

Modify the default.mysql8.0 parameter group to set require_secure_transport to ON and reboot the instance.

Answer

Run the modify-db-instance command with --require-ssl-transport.

Answer

Modify the DB instance and set the --enable-iam-database-authentication flag.

Question 4

An IAM policy is shown in the exhibit. What is the effect of this policy when a user tries to create an unencrypted RDS DB instance?

Accepted Answer

The user is denied from creating the unencrypted instance because of the Deny statement.. The IAM policy includes an Allow statement for 'rds:CreateDBInstance' and a Deny statement with a condition 'rds:StorageEncrypted=false'. When the user attempts to create an unencrypted RDS instance, the Deny statement explicitly denies the action because the condition is met (encryption is not enabled). Explicit Deny always overrides any Allow, so the user is denied. Option B is incorrect because the Deny statement is valid under IAM policy evaluation logic. Option C is incorrect because the Deny is explicit, not implicit, and only applies to unencrypted instances, not all DB instances. Option D is incorrect because the Deny explicitly overrides the Allow for unencrypted instances.

Answer

The user is allowed to create the unencrypted instance because the Deny statement is not valid.

Answer

The user is denied from creating any DB instance because of an implicit deny.

Answer

The user is allowed to create the unencrypted instance because of the Allow statement.

Question 5

A snapshot of an Amazon RDS DB instance is shown in the exhibit. What does the output indicate?

Accepted Answer

The snapshot is encrypted and the encryption process is complete.. The snapshot is encrypted (Encrypted: true) and the status is 'encrypted', indicating that the encryption process is complete. Option A is incorrect because the snapshot exists and is not in progress. Option C is incorrect because the snapshot is indeed encrypted. Option D is incorrect because the status shows 'encrypted', not 'encrypting'.

Answer

The snapshot creation is still in progress.

Answer

The snapshot is not encrypted.

Answer

The snapshot is in the process of being encrypted.

Question 6

A company is using Amazon RDS for MySQL with automated backups enabled. The security team requires that all backups be encrypted at rest. Which configuration ensures that new automated backups are encrypted?

Accepted Answer

Create a new encrypted DB instance and migrate the data. Automated backups will inherit encryption.. Encryption at rest must be enabled at creation time on an RDS instance. When you enable encryption at rest on a new DB instance, all automated backups, snapshots, and replicas inherit that encryption automatically. Option B is incorrect because you cannot enable encryption at rest on an existing RDS instance after creation; you must create a new encrypted instance and migrate. Option C is incorrect because automated backups are stored in an S3 bucket managed by RDS, but you cannot directly encrypt the bucket or backups separately; encryption is tied to the DB instance. Option D is incorrect because it incorrectly suggests both enabling encryption on the instance and a separate DBSnapshot option; encryption on the instance already covers backups, and there is no separate DBSnapshot option for enabling encryption.

Answer

Modify the DB instance to enable encryption at rest after creation.

Answer

Use AWS KMS to encrypt the S3 bucket where automated backups are stored.

Answer

Enable encryption at rest on the DB instance and also enable encryption on automated backups using the DBSnapshot option.

Question 7

A developer wants to grant an IAM user read-only access to an Amazon DynamoDB table named 'Orders' in the 'us-east-1' region. Which IAM policy should be attached to the user?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["dynamodb:GetItem","dynamodb:Query","dynamodb:Scan"],"Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/Orders"}]}. It grants only the read-only actions GetItem, Query, and Scan on the specified DynamoDB table. Option B is incorrect because it grants full DynamoDB access (dynamodb:*) to the table, allowing write and delete operations. Option C is incorrect because it includes PutItem and UpdateItem, which are write operations. Option D is incorrect because it uses a Deny effect for write operations, but an explicit deny is not necessary and could conflict with other policies; additionally, it does not explicitly allow read actions, so the user would have no access.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["dynamodb:*"],"Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/Orders"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["dynamodb:GetItem","dynamodb:PutItem","dynamodb:UpdateItem"],"Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/Orders"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":["dynamodb:PutItem","dynamodb:UpdateItem","dynamodb:DeleteItem"],"Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/Orders"}]}

Question 8

A financial company uses Amazon RDS for PostgreSQL with a custom parameter group. The security team wants to ensure that all connections to the database are encrypted in transit. Which action should the database administrator take?

Accepted Answer

Set the parameter 'rds.force_ssl' to 1 in the custom parameter group.. Setting the parameter 'rds.force_ssl' to 1 in the RDS for PostgreSQL custom parameter group forces all connections to use SSL/TLS, ensuring encryption in transit. Option A is incorrect because IAM roles provide authentication, not transport encryption. Option B is incorrect because changing the port does not encrypt data. Option C is incorrect because setting 'ssl' to off disables encryption. Option E is incorrect because modifying a security group to allow inbound traffic on port 5432 does not enforce encryption; the '--ssl' option is a client-side parameter, not enforceable via security groups.

Answer

Attach an IAM role to the RDS instance to authenticate users.

Answer

Change the database port to 8432 to use a non-standard port.

Answer

Set 'ssl' to 'off' in the parameter group.

Answer

Modify the security group to allow inbound traffic only on port 5432 with the '--ssl' option.

Question 9

A developer is troubleshooting an issue where an IAM user cannot perform a 'DescribeTable' action on a DynamoDB table. The IAM policy attached to the user is: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["dynamodb:GetItem","dynamodb:PutItem"],"Resource":"*"}]}. What is the most likely reason for the failure?

Accepted Answer

The policy does not include the 'dynamodb:DescribeTable' action.. The IAM policy only includes the actions 'dynamodb:GetItem' and 'dynamodb:PutItem', but does not include 'dynamodb:DescribeTable'. Therefore, the IAM user is denied the DescribeTable action by default. Option A is incorrect because although action names are case-sensitive, the policy uses the correct lowercase 'dynamodb' and the actions are properly cased. Option B is incorrect because there is no implicit Deny; the policy grants access to GetItem and PutItem, and DescribeTable is simply not allowed. Service control policies could apply, but they are not the most likely reason given the policy's explicit lack of the required action. Option D is incorrect because the resource '*' does include all tables; the problem is the missing action, not the resource specification.

Answer

The policy uses lowercase 'dynamodb' but the action is case-sensitive.

Answer

There is an implicit Deny for DescribeTable due to a service control policy.

Answer

The resource specified in the policy is '*' which does not include the table.

Question 10

A company is migrating its Oracle database to Amazon RDS for Oracle. The security team requires that all data be encrypted at rest using a customer-managed AWS KMS key. Which TWO steps are necessary to achieve this?

Accepted Answer

Migrate the data using Oracle Data Pump to the new encrypted instance.. To enable encryption at rest with a customer-managed KMS key in Amazon RDS for Oracle, you must create a new DB instance and specify the KMS key for encryption (Option C). Encryption cannot be enabled on an existing RDS instance without migrating to a new encrypted instance (Options B and D are incorrect). After creating the encrypted instance, you can migrate the Oracle database using Oracle Data Pump to the new encrypted instance (Option A). Using the default RDS encryption key (Option E) does not meet the requirement of a customer-managed key. Therefore, the two necessary steps are A and C.

Answer

Modify the DB instance to enable encryption using a KMS key.

Answer

Enable encryption at rest on the existing RDS instance by modifying the DB instance.

Answer

Use the default RDS encryption key (aws/rds) to encrypt the instance.

Question 11

A company uses Amazon DynamoDB with a global secondary index (GSI). The security team requires that only specific IAM users can query the GSI. Which THREE conditions must be met to restrict access to the GSI?

Accepted Answer

The user must have permission to query the base table as well.. The correct answers are C, D, and E. To restrict access to a GSI, you must ensure the user has permission to query the base table (C), allow the dynamodb:Query action on the index (D), and specify the index ARN in the Resource element (E). Option A is incorrect because the dynamodb:IndexName condition key is not used for IAM authorization; access to a GSI is controlled via the resource ARN, not a condition key. Option B is incorrect because the dynamodb:Attributes condition key restricts which attributes are returned, not access to the GSI itself.

Answer

The policy must include a condition 'dynamodb:IndexName' with the index name.

Answer

The policy must include a condition key 'dynamodb:Attributes' to restrict which attributes are returned.

Question 12

A database administrator runs the command shown in the exhibit. The security team requires that the database be encrypted at rest. What should the administrator do to enable encryption?

Accepted Answer

Create a snapshot of the DB instance, copy the snapshot with encryption, and restore from the encrypted snapshot.. Encryption cannot be enabled on an existing unencrypted instance; you must create a snapshot, copy it with encryption, and restore. Option A is wrong because encryption is at the storage level, not table level. Option C is wrong because modifying the instance does not add encryption. Option D is wrong because the command shows StorageEncrypted is false, so it is not encrypted.

Answer

Enable encryption at the table level using MySQL's built-in encryption.

Answer

Modify the DB instance and set StorageEncrypted to true.

Answer

The instance is already encrypted because the output shows 'StorageEncrypted' as false.

Question 13

A company uses Amazon RDS for SQL Server with Multi-AZ deployment. The security team wants to ensure that all data at rest is encrypted using a customer-managed KMS key in both the primary and standby instances. Which THREE actions are required?

Accepted Answer

Specify a customer-managed KMS key during creation.. Options B, D, and E are correct. To encrypt data at rest with a customer-managed KMS key, you must specify the KMS key during DB instance creation (B). Multi-AZ with encryption enabled (D) ensures both primary and standby instances are encrypted. Encryption at rest must be enabled when creating the DB instance (E); it cannot be added later. Option A is wrong because a separate KMS key is not required—the same key encrypts both instances. Option C is wrong because Transparent Data Encryption (TDE) is a SQL Server feature for encrypting the database files, but RDS handles encryption at the storage layer using KMS, not TDE. TDE is not applicable when using RDS encryption with KMS.

Answer

Create a separate KMS key for the standby instance.

Answer

Enable Transparent Data Encryption (TDE) on the instance.

Question 14

A company wants to restrict access to an Amazon RDS for MySQL DB instance so that only applications running in a specific VPC can connect. Which solution should be implemented?

Accepted Answer

Configure the DB instance's security group to allow inbound traffic only from the application's security group.. Security groups act as a virtual firewall for the DB instance, and by allowing inbound traffic only from the application's security group, access is restricted to resources in that VPC. Option A is incorrect because IAM policies control API-level permissions, not network-level access. Option C is incorrect because network ACLs are stateless and apply at the subnet level, not at the instance level. Option D is incorrect because security groups are not attached to subnets; they are attached to network interfaces.

Answer

Use an IAM policy to restrict database connections based on source IP.

Answer

Configure the subnet's network ACL to allow inbound traffic only from the application's IP range.

Answer

Attach a security group to the subnet that allows inbound traffic from the application's VPC.

Question 15

A user is unable to list the contents of the S3 bucket 'my-db-backups' using the AWS CLI. The IAM policy attached to the user is shown in the exhibit. What is the likely cause?

Accepted Answer

The policy does not grant 's3:ListBucket' permission.. The IAM policy must include the 's3:ListBucket' action to allow listing the contents of an S3 bucket. The given policy lacks this action, so the user cannot list the bucket's objects. Option A is incorrect because there is no indication the bucket name is wrong. Option C is incorrect because the resource ARN in the policy includes the bucket-level ARN (e.g., 'arn:aws:s3:::my-db-backups'), which is sufficient for listing. Option D is incorrect because the policy syntax is valid JSON.

Answer

The user is using the wrong bucket name.

Answer

The resource ARN is missing the bucket-level ARN needed for listing.

Answer

The policy has a syntax error.