DBS-C01 Database Security Practice Test 2 — 15 Questions

Question 1

Arrange the steps to troubleshoot a connection timeout issue from an EC2 instance to an Amazon RDS for SQL Server DB instance in the correct order.

Accepted Answer

First, verify security group inbound rules. Second, check network ACLs. Third, verify EC2 network configuration. Finally, test connectivity using telnet.. Troubleshooting connectivity involves checking security groups, network ACLs, network configuration, and testing with telnet.

Answer

First, check network ACLs. Second, verify security group inbound rules. Third, test connectivity using telnet. Finally, verify EC2 network configuration.

Answer

First, test connectivity using telnet. Second, verify security group inbound rules. Third, check network ACLs. Finally, verify EC2 network configuration.

Answer

First, verify EC2 network configuration. Second, verify security group inbound rules. Third, check network ACLs. Finally, test connectivity using telnet.

Question 2

Match each DynamoDB concept to its definition.

Accepted Answer

Partition key: A simple primary key that determines the partition where the item is stored.. This matching exercise tests understanding of core DynamoDB concepts. The partition key distributes items across partitions, while the sort key enables ordering. Global secondary indexes (GSIs) allow queries on different partition keys, while local secondary indexes (LSIs) share the same partition key but different sort keys.

Answer

Sort key: A simple primary key that determines the partition where the item is stored.

Answer

Global secondary index: An index that uses the same partition key as the base table but a different sort key.

Question 3

A company is using an RDS for MySQL DB instance encrypted at rest with AWS KMS. The security team requires that all access to the database be logged, including queries that fail due to authentication errors. Which configuration meets this requirement?

Accepted Answer

Enable the RDS audit log by setting the 'audit_log_enabled' parameter to 1 in the DB parameter group and export logs to CloudWatch Logs.. For RDS for MySQL, the audit log is enabled by setting the 'audit_log_enabled' parameter to 1 in the DB parameter group, and then exporting the audit logs to CloudWatch Logs. This captures all connections and queries, including failed authentication attempts, because the audit log plugin logs connection events regardless of success. This is the only option that provides query-level logging including authentication failures.

Answer

Enable RDS Enhanced Monitoring and publish metrics to CloudWatch.

Answer

Enable AWS CloudTrail for the RDS instance and store logs in S3.

Answer

Use S3 server access logs to capture database connection attempts.

Question 4

A company uses Amazon Redshift for data warehousing. The security team requires that all data loaded into the cluster be encrypted at rest using a customer-managed KMS key. The cluster is currently unencrypted. What is the most efficient way to achieve this requirement with minimal data loss?

Accepted Answer

Unload the data from the existing cluster to S3, create a new encrypted cluster using the KMS key, and reload the data from S3.. An existing unencrypted Redshift cluster cannot be encrypted in place. The only way to achieve encryption using a customer-managed KMS key is to unload the data to S3, create a new encrypted cluster with the desired KMS key, and reload the data. Options B, C, and D are incorrect because Redshift does not support enabling encryption on an existing cluster, modifying an existing cluster to enable encryption, or adding encryption to an unencrypted snapshot.

Answer

Change the cluster parameter group to enable encryption.

Answer

Modify the cluster and enable encryption in the Redshift console.

Answer

Take a snapshot of the cluster, copy the snapshot with encryption, and restore from the encrypted snapshot.

Question 5

A company has an RDS for SQL Server DB instance that stores sensitive data. The database administrator needs to ensure that all connections to the database use SSL/TLS encryption. What should the administrator do?

Accepted Answer

Set the 'rds.force_ssl' parameter to 1 in the DB parameter group.. Setting 'rds.force_ssl' to 1 in the DB parameter group forces all connections to the RDS for SQL Server DB instance to use SSL/TLS encryption. Option A is incorrect because security group rules control network access, not encryption. Option C is incorrect because AWS CloudTrail logs API calls, not database connections. Option D is incorrect because deleting and recreating the instance would not, by itself, enforce SSL; encryption at rest is separate from SSL enforcement.

Answer

Configure the security group to only allow traffic from specific IP addresses.

Answer

Enable AWS CloudTrail to monitor connections.

Answer

Delete the DB instance and create a new one with encryption enabled.

Question 6

Which THREE methods can be used to authenticate users to an Amazon RDS for MySQL DB instance? (Choose three.)

Accepted Answer

MySQL native password authentication.. Options B, D, and E are correct. MySQL native password authentication (B) is the standard method. Kerberos authentication (D) is supported for RDS for MySQL. IAM database authentication (E) allows IAM users and roles to authenticate to the DB instance using an authentication token. Option A is incorrect because AWS Managed Microsoft AD authentication is not supported for RDS for MySQL; it is supported for RDS for SQL Server and Oracle. Option C is incorrect because Lambda is not an authentication method; it is a compute service that cannot directly authenticate users to a database.

Answer

AWS Managed Microsoft AD authentication.

Answer

AWS Lambda function authentication.

Question 7

A security engineer creates the IAM policy shown in the exhibit and attaches it to an IAM user. What is the effect of this policy?

Accepted Answer

The user can modify 'prod-db' but cannot delete it.. The IAM policy allows DescribeDBInstances and ModifyDBInstance on all resources, but explicitly denies DeleteDBInstance on the database 'prod-db'. Since an explicit deny overrides any allow, the user cannot delete 'prod-db'. However, the policy does not allow DeleteDBInstance on any database, so the user cannot delete any database. For 'prod-db', the user can still modify and describe it because the deny is only for the delete action. Thus, the user can modify 'prod-db' but cannot delete it.

Answer

The user can delete any database except 'prod-db'.

Answer

The user can describe all databases except 'prod-db'.

Answer

The user can modify any database except 'prod-db'.

Question 8

A developer runs the AWS CLI command shown in the exhibit. What is the output indicating?

Accepted Answer

The secret contains a username and password in JSON format.. The AWS CLI command (likely `aws secretsmanager get-secret-value`) returns a SecretString containing a JSON object with keys such as 'username' and 'password'. This indicates the secret stores credentials in JSON format, which is the standard structure for RDS and other database secrets managed by Secrets Manager. The output confirms the secret value is retrievable and structured, not that it is inaccessible or unencrypted.

Answer

The secret value is not accessible.

Answer

The secret is not encrypted.

Answer

The secret has been rotated.

Question 9

A company is using Amazon RDS for MySQL with encryption at rest enabled. The security team requires that all access to the database be authenticated using IAM database authentication. Which combination of steps must the company take to meet this requirement?

Accepted Answer

Create an IAM policy that allows the rds-db:connect action and map the IAM role to a database user created with the AWSAuthenticationPlugin.. IAM database authentication for RDS requires creating an IAM policy that allows the rds-db:connect action, and then mapping that policy to a database user that has been created using the AWSAuthenticationPlugin. This plugin enables the database to accept IAM credentials for authentication. The IAM role or user must have the policy attached, and the database user must be configured to use the plugin.

Answer

Create an IAM role with a policy that allows rds:Connect and attach it to the RDS instance.

Answer

Create a database user with a password and attach an IAM role that allows rds-db:connect to the database user.

Answer

Enable SSL on the RDS instance and create an IAM policy that allows rds:Connect.

Question 10

A financial services company runs a critical application on Amazon RDS for PostgreSQL. They must ensure that database activity logs are sent to Amazon CloudWatch Logs for real-time monitoring. The logs must include all SQL queries, including SELECT statements. Which configuration will meet these requirements?

Accepted Answer

Set log_statement = 'all' and log_min_duration_statement = 0 in the DB parameter group. Enable CloudWatch Logs export.. To log all SQL queries including SELECT statements, you must set 'log_statement = all' (which logs all statements) and 'log_min_duration_statement = 0' (which logs all statements that run in 0 ms or longer, effectively all). Enabling CloudWatch Logs export for PostgreSQL logs sends these logs to CloudWatch. This combination ensures every SQL statement is captured.

Answer

Install the pgAudit extension and configure it to log all statements. Enable CloudWatch Logs export in the RDS console.

Answer

Set the parameter log_statement = 'ddl' in the DB parameter group. Enable CloudWatch Logs export.

Answer

Set log_min_duration_statement = -1 in the DB parameter group. Enable CloudWatch Logs export.

Question 11

A company is using Amazon Redshift for data warehousing. They need to ensure that data is encrypted at rest using a customer-managed AWS KMS key. The cluster is currently unencrypted. What is the simplest way to enable encryption?

Accepted Answer

Create a new Redshift cluster with encryption enabled and migrate the data.. Amazon Redshift does not allow enabling encryption on an existing unencrypted cluster directly. The only supported method to encrypt an existing unencrypted cluster is to create a new encrypted cluster and migrate the data, or restore from an unencrypted snapshot into an encrypted cluster. Option A states the simplest approach: create a new cluster with encryption enabled and migrate data, which is a valid and straightforward method. Option C is also valid but involves snapshot and restore, which is not necessarily simpler than creating a new cluster and migrating. However, the question asks for the simplest way, and creating a new cluster with encryption and migrating data is a direct method. Note: In reality, you cannot modify an existing unencrypted cluster to enable encryption; you must create a new encrypted cluster or restore from a snapshot. So A is correct.

Answer

Enable encryption directly on the existing cluster using AWS CLI.

Answer

Create a snapshot of the existing cluster and restore it to a new encrypted cluster.

Answer

Modify the existing cluster and enable encryption using the Redshift console.

Question 12

A company is using Amazon RDS for MySQL. They want to audit all database logins and failed login attempts. Which option should they enable?

Accepted Answer

Set the parameter audit_log = 'ON' in the DB parameter group.. The audit_log parameter in Amazon RDS for MySQL enables the MariaDB Audit Plugin, which records connection events (successful and failed logins), as well as DDL/DML activity depending on configuration. This is the only option that specifically captures authentication events like logins and failed login attempts. The other parameters control query logging or performance-related logging, not security auditing.

Answer

Set the parameter log_queries_not_using_indexes = 'ON' in the DB parameter group.

Answer

Set the parameter general_log = 'ON' in the DB parameter group.

Answer

Set the parameter slow_query_log = 'ON' in the DB parameter group.

Question 13

A company has an Amazon RDS for MySQL Multi-AZ DB instance that stores sensitive financial data. The security team has enabled encryption at rest using a KMS key. They also need to ensure that database audit logs are encrypted and stored in an S3 bucket. The logs must be accessible only by the security team via a VPC endpoint. The log data must be retained for 7 years. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Enable MySQL audit logs and publish them to Amazon CloudWatch Logs. Use a CloudWatch Logs subscription filter to stream logs to an S3 bucket encrypted with KMS, with a bucket policy that restricts access via VPC endpoint.. It is the most efficient: enabling MySQL audit logs, publishing them to CloudWatch Logs, and using a CloudWatch Logs subscription filter to stream encrypted logs to S3 with access restricted via VPC endpoint. This uses managed services with minimal configuration. Option A is wrong because RDS cannot publish audit logs directly to S3; it requires an intermediate step. Option B is wrong because installing a custom audit plugin and using Lambda to export logs adds significant operational overhead and complexity. Option D is wrong because RDS does not natively support sending audit logs to Kinesis Data Firehose; setting that up would require additional components and overhead.

Answer

Configure RDS to publish audit logs directly to an S3 bucket with a bucket policy that restricts access to the security team's IAM roles.

Answer

Install a custom audit plugin on the RDS instance that writes logs to a separate RDS table, then use AWS Lambda to export the table to S3 periodically.

Answer

Enable RDS audit logs and send them to Amazon Kinesis Data Firehose, which writes to an S3 bucket with encryption and VPC endpoint restrictions.

Question 14

A company has an Amazon RDS for SQL Server Multi-AZ DB instance with a standby replica in a different AWS Region. The database is encrypted with a KMS key. The company needs to implement automated backups that are also encrypted and stored in a cross-region S3 bucket. The backups must be retained for 3 years. Which solution meets these requirements with the LEAST administrative effort?

Accepted Answer

Configure RDS to send automated backups directly to the cross-region S3 bucket using the AWS Backup service.. AWS Backup can be used to manage automated backups of RDS instances and store them in a cross-region S3 bucket. AWS Backup natively supports RDS and allows you to create backup plans that automatically take snapshots and copy them to a different region, storing them in S3. The backups are encrypted using the KMS key, and you can set retention policies for 3 years. This solution requires minimal administrative effort as AWS Backup automates the entire process. Option B is incorrect because RDS cross-Region backup copy stores backups in the destination region's RDS-managed storage, not in an S3 bucket as required. Option C is incorrect because AWS DMS is designed for migrations, not for ongoing backup management. Option D is incorrect because manual snapshots require manual intervention and do not provide automated backups.

Answer

Enable automated backups on the RDS instance, configure cross-Region backup copy to a destination Region, and store the backups in an S3 bucket with S3 Object Lock enabled for retention.

Answer

Use AWS Database Migration Service (DMS) to continuously replicate the database to an S3 bucket in the target region.

Answer

Create manual snapshots of the RDS instance, copy them to the cross-region S3 bucket using AWS CLI, and set a lifecycle policy for retention.

Question 15

A company is using Amazon Redshift for data warehousing. The security team requires that all data is encrypted at rest using a hardware security module (HSM). Additionally, the team wants to ensure that only specific IAM roles can access the database. Which configuration will meet these requirements?

Accepted Answer

Create the Redshift cluster with encryption enabled using an HSM, and attach an IAM role to the cluster to control access.. Redshift supports encryption at rest using either AWS KMS or a customer-managed CloudHSM (HSM) via a custom key store. To satisfy the HSM requirement, the cluster must be created with HSM encryption enabled, and IAM roles attached to the cluster control which principals can access the database via the Redshift Data API or query editor. Option B is the only configuration that combines HSM-based encryption with IAM role-based access control.

Answer

Create the Redshift cluster with encryption enabled using a KMS key, and configure the cluster to use an HSM for key storage.

Answer

Create the Redshift cluster without encryption, then use the AWS CLI to enable encryption using a KMS key.

Answer

Create the Redshift cluster with encryption using a KMS key, and then import the HSM certificate into the cluster.