DBS-C01 Database Security Practice Test 20 — 15 Questions

Question 1

A company is using Amazon Redshift for data warehousing. The security team requires column-level access control so that certain users cannot view specific columns containing PII. Which approach should the data engineer implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create views that exclude the sensitive columns and grant SELECT on the views to the users.. The correct approach is to create views that exclude sensitive columns and grant SELECT on those views to the users (Option A). Amazon Redshift supports column-level security via views; you grant access to the view rather than the underlying table. Option B is incorrect because row-level security policies (e.g., in PostgreSQL) are not available in Redshift. Option C is incorrect because although Redshift does support column-level GRANT (e.g., GRANT SELECT ON table (col1) TO user), creating views is the more standard and manageable approach for column-level access control. Option D is incorrect because column-level encryption with AWS KMS does not provide fine-grained access control; it only protects data at rest and requires application changes for decryption.

Answer

Implement row-level security policies using CREATE ROW LEVEL SECURITY POLICY.

Answer

Use GRANT SELECT ON table (col1, col2) TO user.

Answer

Encrypt the sensitive columns using AWS KMS and decrypt in the application.

Question 2

A company is using Amazon Redshift and needs to encrypt data at rest with a customer-managed key. Which TWO steps are required to enable encryption with a customer-managed AWS KMS key?

Accepted Answer

Create a customer-managed key in AWS KMS.. Option A is correct because enabling encryption with a customer-managed key requires first creating that key in AWS KMS, since Redshift cannot use a key that does not yet exist in the account. Option B is correct because the KMS key must be supplied as part of the cluster's encryption configuration when the Redshift cluster is created, for example via the CreateCluster API's Encrypted=true and KmsKeyId parameters. Option C is not required because encryption with a KMS key is specified at cluster creation; you cannot simply modify an existing unencrypted cluster to enable KMS encryption, and the AWS CLI is only a tool, not a required step. Option D is wrong because HSM (CloudHSM) is a separate encryption option, not the customer-managed KMS key scenario described. Option E is wrong because enabling Redshift encryption does not require an AWS Support request.

Answer

Use the AWS CLI to modify the cluster to enable encryption.

Answer

Configure the Redshift cluster to use an HSM.

Answer

Request AWS Support to enable encryption.

Question 3

A developer is checking the encryption status of an RDS MySQL instance. The CLI output shows StorageEncrypted is true. What does this indicate?

Accepted Answer

The database is encrypted at rest using a KMS key.. The StorageEncrypted attribute in the RDS describe-db-instances output reflects whether encryption at rest is enabled for the DB instance's underlying storage. When true, it confirms the database storage is encrypted using an AWS KMS customer master key (either the default aws/rds AWS managed key or a customer managed key). This setting is configured at instance creation and cannot be changed afterward without restoring from a snapshot.

Answer

Connections to the database are encrypted in transit.

Answer

The database is encrypted using the AWS managed key for RDS.

Answer

The database does not have encryption at rest enabled.

Question 4

A financial services company runs a critical application on Amazon RDS for PostgreSQL. The database stores sensitive customer financial data. The security team has mandated that all access to the database must be through IAM database authentication to eliminate the need for passwords. The application currently uses a master user password stored in AWS Secrets Manager. The DBA needs to implement IAM authentication without downtime. The application is deployed on Amazon ECS and connects to the database using a connection string. The DBA has already created an IAM role for the ECS task with a policy that allows rds-db:connect. The DBA has also modified the DB instance to require SSL. However, after making these changes, the application cannot connect. The error message indicates 'IAM authentication is not enabled for this user'. What step did the DBA miss?

Accepted Answer

The DBA did not create a database user that is set to use IAM authentication.. IAM database authentication requires that a database user be created with the IAM authentication method. Specifically, the user must be created with the CREATEROLE privilege and granted the rds_iam role. Without this step, the authentication fails even if the IAM role is correctly configured. Option B is incorrect because the IAM policy was already attached. Option C is incorrect because IAM authentication does not require a password; it uses authentication tokens. Option D is incorrect because the security group and port are not related to IAM authentication.

Answer

The DBA did not attach the IAM policy to the ECS task role.

Answer

The DBA did not enable the 'password' authentication method.

Answer

The DBA did not update the security group to allow traffic on port 5432.

Question 5

A small business runs a web application on a single Amazon RDS for MySQL DB instance. The application uses a master user account for all database operations. The security team is concerned about the risk of SQL injection and wants to implement the principle of least privilege. They want to create separate database users for read-only and read-write operations. The application currently uses a single connection string. The developer needs to modify the application to use two separate users. What is the correct approach to implement this securely?

Accepted Answer

Create a read-only user and a read-write user in the database, grant minimal privileges, and modify the application to use the appropriate user for each operation.. Creating separate users with minimal privileges and modifying the application to use the appropriate user for each operation reduces the risk of SQL injection and enforces least privilege. Option A is wrong because using stored procedures with a single master user does not eliminate the need for separate users for different privilege levels. Option B is wrong because restricting IP address does not address the need for granular permissions. Option C is wrong because enabling IAM database authentication with a single IAM role does not provide separate read-only and read-write capabilities.

Answer

Use stored procedures for all database operations and grant execute only to the master user.

Answer

Keep using the master user but restrict its IP address.

Answer

Enable IAM database authentication and use a single IAM role.

Question 6

A healthcare company is migrating its patient records database to Amazon RDS for SQL Server. The database contains Protected Health Information (PHI). The compliance team requires that all PHI data be encrypted at rest and that the encryption keys be stored in a dedicated AWS CloudHSM cluster. Additionally, the database must be replicated to a second AWS region for disaster recovery. The DBA has enabled RDS encryption at rest using a KMS key, but the compliance team insists on using CloudHSM. What should the DBA do to meet the compliance requirement while maintaining disaster recovery?

Accepted Answer

Enable Transparent Data Encryption (TDE) using a CloudHSM key and create a cross-region read replica for DR.. RDS for SQL Server supports Transparent Data Encryption (TDE) with CloudHSM as the key store, and RDS read replicas can be created across regions for disaster recovery. Option A is incorrect because RDS encryption at rest with a KMS key does not meet the CloudHSM requirement; KMS custom key stores (backed by CloudHSM) are not supported for RDS encryption at rest. Option B is incorrect because DynamoDB encryption with CloudHSM via KMS custom key store is possible but unnecessary and does not maintain the existing SQL Server database. Option C is incorrect because using RDS Custom with TDE and manual log shipping is more complex and not the standard approach for cross-region disaster recovery with RDS.

Answer

Use RDS encryption at rest with a KMS key backed by CloudHSM (custom key store).

Answer

Migrate the database to Amazon DynamoDB with encryption using CloudHSM via KMS custom key store.

Answer

Use an RDS Custom for SQL Server instance and configure TDE with CloudHSM, then set up log shipping to another region.

Question 7

A company stores sensitive data in an Amazon RDS for PostgreSQL DB instance. The security team requires that all data at rest be encrypted. The instance is currently unencrypted. What is the simplest way to enable encryption with minimal downtime?

Accepted Answer

Create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the snapshot to a new encrypted DB instance.. An existing unencrypted Amazon RDS instance cannot be directly encrypted. The standard approach to enable encryption with minimal downtime is to create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the snapshot to a new encrypted DB instance. This process typically involves a brief outage during the restore but is simpler than other methods. Option B is incorrect because the AWS CLI does not support enabling encryption on an existing instance. Option C is incorrect because migrating to RDS Custom adds unnecessary complexity and does not directly enable encryption on the current instance. Option D is incorrect because the AWS Management Console also does not allow enabling encryption on an existing instance.

Answer

Use the AWS CLI to modify the DB instance and enable encryption.

Answer

Migrate the data to an Amazon RDS for PostgreSQL DB instance using RDS Custom.

Answer

Modify the DB instance and enable encryption in the console.

Question 8

A company uses an Amazon RDS for MySQL DB instance that needs to be accessed by a Lambda function. Which TWO steps should be taken to ensure secure access?

Accepted Answer

Create an IAM role for the Lambda function with permissions to use RDS IAM database authentication.. Option A is correct because RDS for MySQL supports IAM database authentication, which lets the Lambda function use a short-lived authentication token generated from an IAM role instead of a static password; the role must include the rds-db:connect permission for the DB user. Option B is correct because placing the Lambda function in the same VPC as the RDS instance allows private connectivity over the VPC network, so database traffic never traverses the public internet and security groups can tightly control access. Option C is not recommended because Lambda environment variables are not a secure secret store; credentials should be kept in AWS Secrets Manager or Systems Manager Parameter Store. Option D is wrong because using the master user for an application violates least privilege and increases blast radius if compromised. Option E is unnecessary and does not provide secure database access, since a NAT gateway only enables outbound internet traffic and is not needed for in-VPC RDS connectivity.

Answer

Store the database credentials in the Lambda environment variables.

Answer

Use the database master user account for the Lambda function.

Answer

Attach a NAT gateway to the Lambda function's VPC for outbound internet access.

Question 9

A company is designing a secure strategy for managing Amazon RDS for Oracle encryption keys. They want to use AWS KMS with Customer Master Keys (CMKs) for encryption at rest. Which THREE best practices should they follow?

Accepted Answer

Grant the RDS service principal (rds.amazonaws.com) only the necessary KMS permissions to use the CMK.. Option A is correct because the RDS service principal (rds.amazonaws.com) must be granted only the specific KMS permissions it needs (such as kms:Decrypt, kms:GenerateDataKey, kms:CreateGrant, and kms:DescribeKey) via the key policy, following least-privilege so the CMK cannot be misused by other services or principals. Option B is correct because using separate KMS CMKs per environment (production, development) provides cryptographic isolation and blast-radius containment, ensuring that a key compromise or policy change in one environment does not affect the other, and it supports distinct access controls and audit trails. Option E is correct because enabling automatic annual rotation of the KMS CMK (a 365-day rotation period) limits the amount of data protected by a single key version and aligns with AWS KMS best practice, while RDS transparently re-wraps data keys so existing encrypted DB instances and snapshots remain accessible. Option C is incorrect because disabling key rotation weakens security and is not required for snapshot consistency; KMS rotation preserves the ability to decrypt older data. Option D is incorrect because the CMK never leaves AWS KMS and must never be stored inside the Oracle database; only the encrypted data keys are used by RDS.

Answer

Disable key rotation to maintain consistent encryption across all snapshots.

Answer

Store the KMS CMK inside the Oracle database for faster encryption.

Question 10

A financial company uses Amazon DynamoDB to store customer transaction data. The compliance team requires that all data be encrypted at rest using a customer-managed AWS KMS key. Additionally, they need to ensure that the key is used only for DynamoDB and no other AWS service. How can the company meet these requirements?

Accepted Answer

Create a KMS key with a key policy that includes a condition such as "kms:ViaService": "dynamodb.amazonaws.com" to restrict usage to DynamoDB.. The correct approach is to create a KMS key with a key policy that includes a condition like "kms:ViaService": "dynamodb.amazonaws.com" (C). This condition restricts the use of the key to requests that come through the DynamoDB service, ensuring the key is used only for DynamoDB and not other AWS services. This is a precise, least-privilege method to meet the requirement.

Answer

Use a KMS key with no key policy, and rely on IAM policies to restrict access to only DynamoDB.

Answer

Use an AWS Organizations service control policy (SCP) to deny all AWS services except DynamoDB from using the KMS key.

Answer

Create a KMS key with a key policy that allows DynamoDB to use the key, and attach an IAM policy to deny all other services.

Question 11

A developer needs to allow an application running on an EC2 instance to connect to an Amazon RDS for MySQL DB instance securely. Which combination of steps should the developer take?

Accepted Answer

Attach an IAM role to the EC2 instance with permissions to use RDS IAM authentication, and configure the database to use an authentication token.. The most secure method to allow an EC2 instance to connect to an RDS for MySQL DB instance is to use IAM roles for EC2 combined with IAM database authentication. By attaching an IAM role to the EC2 instance that has permissions to generate RDS authentication tokens, and configuring the DB instance to accept authentication tokens instead of passwords, the application can obtain temporary credentials without hardcoding or storing any secrets. Option A is insecure because storing credentials in application code exposes them to anyone with access to the code. Option B is insecure because opening the security group to all traffic (0.0.0.0/0) exposes the database to the internet. Option C is insecure because storing credentials in S3 and downloading them at runtime still involves storing static credentials and adds potential risk from S3 access misconfiguration.

Answer

Store the database password in the application code.

Answer

Open the RDS security group to allow traffic from 0.0.0.0/0.

Answer

Store the credentials in an S3 bucket and download them at runtime.

Question 12

A security engineer is designing a VPC with an RDS instance. The database must not be accessible from the internet, but EC2 instances in a private subnet must connect. Which security group configuration is MOST secure?

Accepted Answer

Set the RDS security group inbound rule to allow traffic from the EC2 security group on port 3306.. The most secure because it uses a security group reference instead of a CIDR block. By referencing the EC2 security group as the source in the RDS security group inbound rule, only instances associated with that specific security group can communicate with the database on port 3306. This approach adheres to the principle of least privilege and automatically scales as instances are added or removed from the EC2 security group, without needing to update CIDR ranges.

Answer

Set the RDS security group inbound rule to allow traffic from the VPC CIDR on port 3306.

Answer

Set the RDS security group inbound rule to allow traffic from 0.0.0.0/0 on port 3306.

Answer

Set the RDS security group inbound rule to allow traffic from the private subnet CIDR on port 3306.

Question 13

A company wants to audit all SQL statements executed on their RDS for PostgreSQL database. Which AWS service should they use?

Accepted Answer

CloudWatch Logs with PostgreSQL audit logs. Amazon RDS for PostgreSQL can publish PostgreSQL audit logs (e.g., pgaudit extension logs) to CloudWatch Logs. Enabling the pgaudit extension and configuring the RDS instance to export logs to CloudWatch allows auditing of all SQL statements. CloudWatch Logs provides centralized storage, search, and analysis. This is the correct AWS service for auditing SQL statements on RDS.

Answer

AWS Database Migration Service (DMS)

Answer

VPC Flow Logs

Answer

Amazon RDS Performance Insights

Question 14

A company has a compliance requirement to encrypt all RDS snapshots at rest using a customer-managed KMS key. The RDS instance is already encrypted with an AWS-managed key. What is the correct procedure to ensure snapshots use the customer-managed key?

Accepted Answer

Take a snapshot of the RDS instance, copy the snapshot specifying the customer-managed KMS key, and restore from the copied snapshot.. Because an RDS instance's encryption key cannot be changed after creation, the correct procedure is to take a snapshot of the encrypted instance, copy the snapshot while specifying the customer-managed KMS key (snapshot copy allows re-encryption with a different key), and then restore a new instance from that copied snapshot. This yields an RDS instance whose data and subsequent snapshots are encrypted with the customer-managed key, satisfying the compliance requirement.

Answer

Create a new RDS instance with the customer-managed KMS key and migrate data using DMS.

Answer

Change the default KMS key for the AWS account to the customer-managed key.

Answer

Modify the RDS instance to use the customer-managed KMS key directly.

Question 15

A developer accidentally deleted an RDS database. Which action will allow the database to be restored with the least data loss?

Accepted Answer

Restore from the latest automated backup using point-in-time recovery.. Point-in-time recovery (PITR) allows you to restore an RDS DB instance to any second within the automated backup retention period, typically up to the last five minutes. This minimizes data loss because it replays transaction logs from the latest automated backup to the specified time, recovering changes made right up to the deletion moment. Automated backups are enabled by default with a 7-day retention, making PITR the most granular recovery option.

Answer

Use the 'Recycle Bin' feature to recover the RDS instance.

Answer

Restore from the latest manual snapshot.

Answer

Create a new RDS instance and hope for the best.