DBS-C01 Database Security Practice Test 2 — 15 Questions

Question 1

A financial services company runs a critical application on Amazon RDS for PostgreSQL with Multi-AZ and automated backups enabled. The database stores sensitive customer data, and the security team recently audited the environment and found that the database master user password is stored in plain text in a configuration file on the application server. Additionally, the security team noted that the database security group allows inbound traffic from 0.0.0.0/0 on port 5432. The company needs to remediate these issues immediately without downtime and must ensure that access to the database is restricted to only the application servers, and that password management follows AWS best practices. The application connects to the database using the master user credentials. What should the database specialist do to meet these requirements?

Accepted Answer

Modify the security group to allow inbound traffic on port 5432 only from the private IP address of the application server. Store the database password in AWS Secrets Manager and configure automatic rotation. Update the application to retrieve the password from Secrets Manager.. Option A is correct because it restricts inbound traffic to the application server's private IP address, which is the secure approach for traffic within AWS, and it uses AWS Secrets Manager to store the master password with automatic rotation, following AWS best practices for secrets management. This eliminates the plain-text password exposure and ensures no downtime by updating the application to retrieve credentials dynamically from Secrets Manager.

Answer

Modify the security group to allow inbound traffic on port 5432 only from the public IP address of the application server. Rotate the password using the AWS CLI and store the new password in an encrypted file on the application server. Update the application to read the password from the encrypted file.

Answer

Modify the security group to allow inbound traffic on port 5432 only from the private IP address of the application server. Rotate the master password by modifying the DB instance and store the new password in AWS Systems Manager Parameter Store as a SecureString. Update the application to retrieve the password from Parameter Store.

Answer

Modify the security group to allow inbound traffic on port 5432 only from the private IP address of the application server. Rotate the password using the AWS CLI and store the new password in an encrypted file on the application server. Update the application to read the password from the encrypted file.

Question 2

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all connections to the database be encrypted in transit. Which TWO steps should be taken to enforce this requirement?

Accepted Answer

Set the rds.force_ssl parameter to 1 in the DB parameter group.. Setting the rds.force_ssl parameter to 1 in the DB parameter group forces all connections to the Oracle RDS instance to use SSL/TLS encryption. This is the direct method to enforce encryption in transit for Amazon RDS for Oracle, as it rejects any non-SSL connections at the database level.

Answer

Enable Oracle native network encryption (NNE) in the sqlnet.ora file.

Answer

Use AWS Secrets Manager to store database credentials and enable Kerberos authentication.

Answer

Use AWS Direct Connect or a VPN to connect to the VPC.

Question 3

Refer to the exhibit. A security engineer has applied this key policy to a customer managed KMS key used to encrypt a Secrets Manager secret containing database credentials. An application running on an Amazon EC2 instance in the same account and region is unable to decrypt the secret. What is the MOST likely cause?

Accepted Answer

The condition kms:ViaService restricts the decryption to requests made via Secrets Manager, but the application is calling KMS directly.. The condition `kms:ViaService` in the key policy restricts the `Decrypt` permission to requests that originate specifically from the AWS Secrets Manager service. When the application on the EC2 instance calls KMS directly (e.g., via the `Decrypt` API) to decrypt the secret, the request does not come through Secrets Manager, so the condition is not satisfied and the request is denied. This is the most likely cause of the decryption failure.

Answer

The KMS key ARN in the resource field is incorrect.

Answer

The policy is missing an encryption context that matches the secret's encryption context.

Answer

The policy only allows Decrypt, but the application needs Encrypt permission.

Question 4

A company runs an e-commerce application on AWS using an Aurora MySQL database cluster. The security team mandates that all database audit logs must be stored in Amazon S3 for at least one year for compliance. The database is currently configured to publish audit logs to Amazon CloudWatch Logs. The security team wants to use AWS Database Migration Service (DMS) to migrate the database to a new Aurora MySQL cluster, and during the migration, the audit logs must continue to be captured uninterrupted. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Enable the Aurora MySQL advanced audit feature with file-based output, and configure the DMS task to use these log files as a source for ongoing replication.. Option D is correct because the Aurora MySQL advanced audit feature can output audit logs directly to files on the DB instance, and DMS can be configured to read these files as a source for ongoing replication. This ensures that audit logs are continuously captured and stored in S3 (via file-based output or subsequent upload) without interruption during the migration, minimizing operational overhead by avoiding additional services or manual log forwarding.

Answer

Enable Performance Insights on the source cluster and export the data to S3.

Answer

Create an Aurora MySQL read replica and enable audit logs on the replica, then migrate from the replica.

Answer

Use AWS CloudTrail to capture SQL queries and deliver them to S3.

Question 5

Arrange the steps to troubleshoot a connection timeout issue from an EC2 instance to an Amazon RDS for SQL Server DB instance in the correct order.

Question 6

Arrange the steps to restore an Amazon RDS for MySQL DB instance to a new instance from a manual snapshot in the correct order.

Question 7

Match each DynamoDB concept to its definition.

Question 8

Match each AWS database migration tool/service to its function.

Question 9

A company is using an RDS for MySQL DB instance encrypted at rest with AWS KMS. The security team requires that all access to the database be logged, including queries that fail due to authentication errors. Which configuration meets this requirement?

Accepted Answer

Enable the RDS audit log by setting the 'audit_log_enabled' parameter to 1 in the DB parameter group and export logs to CloudWatch Logs.. Option C is correct because enabling RDS Enhanced Monitoring does not log queries; RDS does not have native query logging for authentication failures. The correct approach is to enable RDS audit logs by setting the 'audit_log_enabled' parameter to 1 in the DB parameter group, and enabling log exports to CloudWatch Logs. However, for MySQL, audit logs capture connection attempts and queries. But none of the options directly mention that. The best answer is to use AWS CloudTrail for RDS API calls and RDS audit logs for database-level logs. Option C enables audit logs and exports to CloudWatch Logs, which captures authentication failures. Option A is wrong because CloudTrail logs only control plane operations, not data plane queries. Option B is wrong because Enhanced Monitoring provides OS metrics, not query logs. Option D is wrong because storing logs in S3 requires enabling audit logs and exporting them. The correct answer is not listed perfectly, but C is closest.

Answer

Enable RDS Enhanced Monitoring and publish metrics to CloudWatch.

Answer

Enable AWS CloudTrail for the RDS instance and store logs in S3.

Answer

Use S3 server access logs to capture database connection attempts.

Question 10

A developer needs to allow an application running on an EC2 instance to read and write data to a DynamoDB table named 'Orders'. The EC2 instance is configured with an IAM role. Which IAM policy should be attached to the role?

Accepted Answer

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:GetItem", "dynamodb:PutItem" ], "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders" } ] }. Option B is correct because the policy grants dynamodb:GetItem and dynamodb:PutItem on the specified table. Option A is wrong because 'Allow' is misspelled as 'Allow' (typo) but also DynamoDB actions are not 'Ec2:*'. Option C is wrong because it grants full DynamoDB access to all tables. Option D is wrong because it uses s3:* instead of DynamoDB.

Answer

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "dynamodb:*", "Resource": "*" } ] }

Answer

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "ec2:*", "Resource": "*" } ] }

Answer

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "s3:*", "Resource": "arn:aws:s3:::example-bucket/*" } ] }

Question 11

A company's security team wants to encrypt data at rest for an existing RDS for PostgreSQL DB instance. The instance is currently unencrypted. Which steps should the team take to enable encryption with minimal downtime?

Accepted Answer

Take a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore a new DB instance from the encrypted snapshot.. Option D is correct because Amazon RDS does not support direct encryption of an existing unencrypted DB instance. The only way is to create a snapshot, copy it with encryption, and restore a new encrypted instance. Option A is wrong because you cannot enable encryption on an existing instance directly. Option B is wrong because modifying the DB instance does not allow enabling encryption. Option C is wrong because creating a read replica does not enable encryption.

Answer

Modify the DB instance and enable encryption in the RDS console.

Answer

Create a read replica of the DB instance and promote it to a standalone instance.

Answer

Create a new option group with encryption enabled and associate it with the DB instance.

Question 12

A company uses Amazon Redshift for data warehousing. The security team requires that all data loaded into the cluster be encrypted at rest using a customer-managed KMS key. The cluster is currently unencrypted. What is the most efficient way to achieve this requirement with minimal data loss?

Accepted Answer

Unload the data from the existing cluster to S3, create a new encrypted cluster using the KMS key, and reload the data from S3.. Option B is correct because you cannot enable encryption on an existing Redshift cluster. You must unload data from the existing cluster, create a new encrypted cluster, and reload the data. Option A is wrong because encryption can only be set at cluster creation. Option C is wrong because modifying the cluster does not enable encryption. Option D is wrong because Redshift does not support enabling encryption via parameter groups.

Answer

Change the cluster parameter group to enable encryption.

Answer

Modify the cluster and enable encryption in the Redshift console.

Answer

Take a snapshot of the cluster, copy the snapshot with encryption, and restore from the encrypted snapshot.

Question 13

A company has an RDS for SQL Server DB instance that stores sensitive data. The database administrator needs to ensure that all connections to the database use SSL/TLS encryption. What should the administrator do?

Accepted Answer

Set the 'rds.force_ssl' parameter to 1 in the DB parameter group.. Option C is correct because the 'rds.force_ssl' parameter forces all connections to use SSL. Option A is wrong because CloudTrail logs API calls, not connections. Option B is wrong because the security group controls network access, not encryption. Option D is wrong because deleting the DB instance is drastic.

Answer

Configure the security group to only allow traffic from specific IP addresses.

Answer

Enable AWS CloudTrail to monitor connections.

Answer

Delete the DB instance and create a new one with encryption enabled.

Question 14

A company uses Amazon DynamoDB with AWS KMS customer managed keys for encryption at rest. The security team wants to audit who is using the KMS key to encrypt and decrypt data. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. Option B is correct because CloudTrail logs all KMS API calls, including encrypt and decrypt. Option A is wrong because CloudWatch Logs can store logs but does not capture KMS API calls by itself. Option C is wrong because AWS Config tracks resource configuration changes, not API calls. Option D is wrong because S3 access logs are for S3.

Answer

Amazon S3 access logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 15

A company has a multi-AZ RDS for PostgreSQL DB instance. The security team wants to ensure that database audit logs are stored in CloudWatch Logs for real-time monitoring. The team enabled the 'pgaudit.log' parameter and set 'log_destination' to 'csvlog'. However, logs are not appearing in CloudWatch. What is the most likely cause?

Accepted Answer

The 'rds.logs_to_cloudwatch' parameter is not set to 1.. Option D is correct because RDS publishes logs to CloudWatch only if the 'rds.logs_to_cloudwatch' parameter is set to 1. Option A is wrong because the instance is multi-AZ, which does not affect log delivery. Option B is wrong because the parameter group is associated; the issue is the missing parameter. Option C is wrong because CloudTrail is not involved.

Answer

The DB instance is multi-AZ, which prevents log delivery to CloudWatch.

Answer

AWS CloudTrail is not enabled for the RDS instance.

Answer

The DB parameter group is not associated with the DB instance.