DBS-C01 Database Security Practice Test 2 — 15 Questions

Question 1

A company uses Amazon ElastiCache for Redis to cache session data. The security team requires that all data in transit be encrypted. The Redis cluster currently does not have encryption in transit enabled. The database specialist needs to enable encryption in transit with minimal downtime. Which action should the specialist take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a new Redis cluster with encryption in transit enabled, and migrate the data from the existing cluster.. Encryption in transit for ElastiCache for Redis can only be enabled at cluster creation time; it cannot be added to an existing cluster. Therefore, the correct approach is to create a new Redis cluster with encryption in transit enabled, migrate the session data from the existing cluster (e.g., using replication or a manual export/import), and then redirect application traffic to the new cluster. This ensures minimal downtime if the migration is performed during a maintenance window or using a blue/green deployment strategy.

Answer

Update the Redis parameter group to enable the 'encryption-in-transit' parameter and reboot the cluster.

Answer

Use a security group to enforce encrypted connections by allowing only TLS traffic.

Answer

Modify the existing Redis cluster to enable encryption in transit using the AWS CLI.

Answer

Enable encryption in transit on the existing cluster by using the AWS Management Console.

Question 2

A company uses Amazon RDS for SQL Server with Multi-AZ deployment. The security team wants to ensure that all database connections use SSL/TLS encryption. Which TWO actions should the database specialist take to enforce SSL connections? (Choose two.)

Accepted Answer

Create a server-level trigger that requires SSL for all logins.. SQL Server allows you to create a server-level DDL trigger that checks the login event and enforces SSL by examining the `@@OPTIONS` or `encrypt_option` in `sys.dm_exec_connections`. This is a supported method to force SSL for all connections to an RDS for SQL Server instance. Option E is correct because setting the `rds.force_ssl` parameter to 1 in the DB parameter group is the native RDS mechanism to enforce SSL/TLS for all connections to the DB instance.

Answer

Use the RDS Console to enable 'Force SSL' on the DB instance.

Answer

Modify the DB parameter group to set 'require_secure_transport' to ON.

Answer

Add an inbound rule to the security group that only allows traffic on port 1433 from IP addresses that use SSL.

Question 3

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all data be encrypted at rest using a customer-managed KMS key. Additionally, the database should be accessible only from a specific VPC. Which THREE steps should the database specialist take to meet these requirements? (Choose three.)

Accepted Answer

Configure the security group for the RDS instance to allow inbound traffic only from the application security group.. Security groups act as a virtual firewall for RDS instances. By configuring the security group to allow inbound traffic only from the application security group, you restrict database access to specific application servers, meeting the requirement that the database be accessible only from a specific VPC.

Answer

Create a VPC endpoint for RDS and associate it with the DB instance.

Answer

Store the encryption key in Amazon S3 and configure RDS to use it.

Question 4

A company uses Amazon RDS for MySQL with encryption at rest enabled. The security team mandates that all access to the database must be authenticated using IAM database authentication. The database administrator has created a user 'app_user' and granted appropriate privileges. However, when the application tries to connect using an IAM authentication token, it receives an 'Access denied' error. Which action should be taken to resolve this issue?

Accepted Answer

Ensure the IAM role used by the application has a name that matches the database user 'app_user' and has the necessary policy attached.. IAM database authentication for RDS MySQL requires that the database user name matches the IAM role or user name used to generate the authentication token. The IAM role must have a policy that allows the `rds-db:connect` action with a resource ARN specifying the database user. Without this exact match, the authentication token is rejected, resulting in an 'Access denied' error.

Answer

Create a password for 'app_user' and use that password in the connection string.

Answer

Modify the security group to allow inbound traffic on port 3306 from the application's IP address.

Answer

Download the latest Amazon RDS CA certificate and add it to the application trust store.

Question 5

A company is designing a multi-tier application that uses Amazon RDS for PostgreSQL. The application must encrypt data at rest and in transit. Which combination of steps should be taken to meet these requirements? (Choose the single best answer.)

Accepted Answer

Enable encryption at rest when launching the RDS instance, and configure the DB parameter group to require SSL connections.. Amazon RDS for PostgreSQL supports encryption at rest only when enabled at instance launch, and SSL/TLS encryption in transit is enforced by configuring the DB parameter group to require SSL connections (e.g., setting `rds.force_ssl=1`). Encryption at rest cannot be added after creation, and SSL ensures data is encrypted between the application and the database.

Answer

Use client-side encryption for data before sending to RDS, and enable encryption at rest after the instance is created.

Answer

Launch the RDS instance without encryption, then enable encryption at rest using the AWS Console.

Answer

Use AWS KMS to encrypt the connection between the application and RDS.

Question 6

A financial services company uses Amazon DynamoDB to store sensitive customer data. The security team requires that all data at rest be encrypted using a customer-managed AWS KMS key (CMK) with automatic rotation enabled. The DynamoDB table was created with the default AWS-managed key. Which steps are necessary to transition to a customer-managed CMK while minimizing downtime and data loss?

Accepted Answer

Export the table data to Amazon S3, create a new DynamoDB table with the new CMK, import the data, and update the application to use the new table.. DynamoDB does not support in-place modification of the encryption key for an existing table. To transition from an AWS-managed key to a customer-managed CMK, you must export the table data to Amazon S3, create a new DynamoDB table configured with the new CMK, import the data, and update the application to point to the new table. This approach minimizes downtime by allowing the original table to serve reads/writes during the export and import process, and avoids data loss by using DynamoDB's native export and import features.

Answer

Modify the DynamoDB table to update the encryption key to the new CMK using the AWS Console.

Answer

Disable encryption at rest, then re-enable it with the new CMK.

Answer

Update the KMS key policy to grant DynamoDB access to the new CMK, then rotate the key.

Question 7

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The compliance team requires that all database connections use SSL/TLS and that users authenticate using IAM database authentication. The database migration is completed, but the application team reports that connections using IAM authentication are failing. The company has already enabled IAM database authentication on the RDS instance. What is the most likely cause of the failure?

Accepted Answer

The database user has not been granted the necessary privileges for IAM authentication.. IAM database authentication requires that the database user be created with the `IDENTIFIED WITH AWS_AUTHENTICATION` clause in Oracle. Without this privilege, the RDS instance will reject IAM-authenticated connections even if IAM authentication is enabled at the instance level. The application team must ensure the database user has been granted the `AWS_ORACLE_EXTENSIONS` role and that the user is mapped to an IAM policy allowing `rds-db:connect`.

Answer

The application is using an outdated root CA certificate for SSL.

Answer

The Security Group does not allow inbound traffic from the application.

Answer

The RDS instance is using a different KMS key for encryption.

Question 8

A company is using Amazon RDS for MySQL with Multi-AZ deployment. The security team wants to ensure that database administrators cannot view sensitive data. Which TWO actions should be taken to achieve this goal?

Accepted Answer

Use IAM database authentication for application access.. IAM database authentication allows you to authenticate to your RDS MySQL instance using an IAM user or role instead of a traditional database password. This eliminates the need for database administrators to know or manage database credentials, as they can only access the database through IAM policies that grant specific, auditable permissions. By using IAM authentication, you enforce a separation of duties where DBAs cannot view sensitive data unless explicitly authorized by IAM policies.

Answer

Enable audit logging to capture all data access.

Answer

Enable encryption at rest using a customer-managed KMS key.

Answer

Disable query logging to prevent sensitive data from being written to logs.

Question 9

A security engineer is troubleshooting an issue where an application using IAM role 'app-role' with a trust policy to assume the 'app-user' user is unable to decrypt an RDS database that uses a customer-managed KMS key. The above key policy is attached to the KMS key. What is the likely cause of the failure?

Accepted Answer

The principal in the policy is 'app-user', but the application uses an IAM role that does not have the necessary permissions.. The KMS key policy specifies the principal as 'app-user', which is an IAM user. However, the application uses an IAM role 'app-role' to make the decryption requests. Since the principal in the key policy does not include the role or its associated permissions, the KMS key policy denies access to the role, causing the decryption failure. The trust policy on the role allows the user to assume it, but that does not grant the role any KMS permissions unless explicitly added.

Answer

The 'kms:ViaService' condition requires the request to come from RDS, but the application is making KMS API calls directly.

Answer

The policy has a missing 'Effect': 'Deny' statement that is blocking access.

Answer

The condition 'kms:ViaService' restricts the key to be used only with RDS, but the application is using a different service.

Question 10

A company has a production Amazon RDS for SQL Server database that stores financial data. The database administrator wants to audit all access to sensitive columns (e.g., credit card numbers) using the SQL Server Audit feature. The database is part of a Multi-AZ deployment. The administrator has enabled audit logging to the 'DEFAULT' file audit target, but the audit files are being written to the local instance storage and are not being retained after failover. The compliance team requires that audit logs be stored in Amazon S3 for at least 7 years. The administrator has set up an event subscription to send database events to an S3 bucket using AWS DMS, but the audit logs are not being captured. What should the administrator do to meet the compliance requirements?

Accepted Answer

Create a new SQL Server Audit target using the Amazon S3 option and configure the audit to write to an S3 bucket.. Amazon RDS for SQL Server supports writing SQL Server Audit logs directly to an Amazon S3 bucket as an audit target. This is the only native method that persists audit logs beyond the instance lifecycle, ensuring they survive Multi-AZ failover and meet the 7-year retention requirement. The DEFAULT file target writes to ephemeral instance storage, which is lost on failover, and RDS event subscriptions or DMS cannot capture SQL Server Audit output.

Answer

Use RDS event subscriptions to send database audit logs to an S3 bucket.

Answer

Configure AWS DMS to continuously replicate the audit database to an S3 bucket.

Answer

Enable RDS Enhanced Monitoring and configure it to send logs to CloudWatch Logs.

Question 11

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all connections to the database be encrypted in transit. Which TWO steps should be taken to enforce this requirement?

Accepted Answer

Set the rds.force_ssl parameter to 1 in the DB parameter group.. The correct steps are A and B. Setting the rds.force_ssl parameter to 1 in the DB parameter group forces all connections to use SSL/TLS on the server side. Additionally, configuring the database to require a client-side SSL/TLS certificate provides mutual authentication and ensures that only clients with valid certificates can connect, thereby enforcing encryption in transit from both ends.

Answer

Enable Oracle native network encryption (NNE) in the sqlnet.ora file.

Answer

Use AWS Secrets Manager to store database credentials and enable Kerberos authentication.

Answer

Use AWS Direct Connect or a VPN to connect to the VPC.

Question 12

Refer to the exhibit. A security engineer has applied this key policy to a customer managed KMS key used to encrypt a Secrets Manager secret containing database credentials. An application running on an Amazon EC2 instance in the same account and region is unable to decrypt the secret. What is the MOST likely cause?

Accepted Answer

The condition kms:ViaService restricts the decryption to requests made via Secrets Manager, but the application is calling KMS directly.. The condition `kms:ViaService` in the key policy restricts the `Decrypt` permission to requests that originate specifically from the AWS Secrets Manager service. When the application on the EC2 instance calls KMS directly (e.g., via the `Decrypt` API) to decrypt the secret, the request does not come through Secrets Manager, so the condition is not satisfied and the request is denied. This is the most likely cause of the decryption failure.

Answer

The KMS key ARN in the resource field is incorrect.

Answer

The policy is missing an encryption context that matches the secret's encryption context.

Answer

The policy only allows Decrypt, but the application needs Encrypt permission.

Question 13

A company runs an e-commerce application on AWS using an Aurora MySQL database cluster. The security team mandates that all database audit logs must be stored in Amazon S3 for at least one year for compliance. The database is currently configured to publish audit logs to Amazon CloudWatch Logs. The security team wants to use AWS Database Migration Service (DMS) to migrate the database to a new Aurora MySQL cluster, and during the migration, the audit logs must continue to be captured uninterrupted. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Enable the Aurora MySQL advanced audit feature with file-based output, and configure the DMS task to use these log files as a source for ongoing replication.. Enabling the Aurora MySQL advanced audit feature allows audit logs to be output to files on the DB instance. These files can then be exported to Amazon S3 (e.g., via a scheduled script or Lambda function) for compliance. During the DMS migration, change data capture is handled by binary logs, not audit logs, so the audit logging remains uninterrupted. This approach minimizes operational overhead by using the built-in audit feature and a simple export mechanism, without requiring additional services like CloudTrail or Performance Insights.

Answer

Enable Performance Insights on the source cluster and export the data to S3.

Answer

Create an Aurora MySQL read replica and enable audit logs on the replica, then migrate from the replica.

Answer

Use AWS CloudTrail to capture SQL queries and deliver them to S3.

Question 14

Arrange the steps to troubleshoot a connection timeout issue from an EC2 instance to an Amazon RDS for SQL Server DB instance in the correct order.

Accepted Answer

First, verify security group inbound rules. Second, check network ACLs. Third, verify EC2 network configuration. Finally, test connectivity using telnet.. Troubleshooting connectivity involves checking security groups, network ACLs, network configuration, and testing with telnet.

Answer

First, check network ACLs. Second, verify security group inbound rules. Third, test connectivity using telnet. Finally, verify EC2 network configuration.

Answer

First, test connectivity using telnet. Second, verify security group inbound rules. Third, check network ACLs. Finally, verify EC2 network configuration.

Answer

First, verify EC2 network configuration. Second, verify security group inbound rules. Third, check network ACLs. Finally, test connectivity using telnet.

Question 15

Arrange the steps to restore an Amazon RDS for MySQL DB instance to a new instance from a manual snapshot in the correct order.

Accepted Answer

Select the manual snapshot from the list, then configure the new DB instance details, then initiate the restore, then wait for the restore to complete.. Restoring from a manual snapshot involves selecting the snapshot, configuring the new instance, and waiting for completion.

Answer

Configure the new DB instance details, then select the manual snapshot from the list, then initiate the restore, then wait for the restore to complete.

Answer

Select the manual snapshot from the list, then initiate the restore, then configure the new DB instance details, then wait for the restore to complete.

Answer

Wait for the restore to complete, then select the manual snapshot from the list, then configure the new DB instance details, then initiate the restore.