DBS-C01 Database Security Practice Test 20 — 15 Questions

Question 1

A company uses Amazon RDS for PostgreSQL and wants to audit all database login attempts. Which TWO services can be used together to achieve this?

Accepted Answer

Enable AWS CloudTrail.. To audit all database login attempts in RDS for PostgreSQL, you need to capture both the configuration changes (e.g., enabling audit logging) and the actual login events. AWS CloudTrail (Option A) records management API calls, such as modifying the DB parameter group to enable logging to CloudWatch Logs. Option E enables RDS for PostgreSQL to log login attempts directly to CloudWatch Logs. Together, they provide complete auditing: CloudTrail for the administrative actions and CloudWatch Logs for the login events. The other options do not capture login attempts.

Answer

Enable VPC Flow Logs.

Answer

Enable S3 access logs to capture API calls.

Answer

Enable RDS Enhanced Monitoring.

Question 2

A company runs a production Amazon DynamoDB table with on-demand capacity. The security team requires that all access to the table be logged for compliance. What is the most cost-effective way to log every DynamoDB API call?

Accepted Answer

Enable AWS CloudTrail and create a trail that delivers logs to Amazon CloudWatch Logs.. AWS CloudTrail logs all DynamoDB API calls (e.g., GetItem, PutItem, Query) and can deliver these logs to CloudWatch Logs for monitoring and compliance. Option A is incorrect because DynamoDB Streams capture data modifications (INSERT, MODIFY, DELETE), not the API calls themselves. Option B is incorrect because CloudWatch Logs is a destination for logs, not a service that captures API calls directly; it relies on CloudTrail or other sources to send logs. Option C is incorrect because VPC Flow Logs record network traffic metadata (IP addresses, ports), not API-level calls.

Answer

Enable DynamoDB Streams on the table and process the stream with AWS Lambda.

Answer

Enable Amazon CloudWatch Logs to capture DynamoDB API calls.

Answer

Enable VPC Flow Logs and analyze them with Amazon Athena.

Question 3

A company needs to encrypt an existing unencrypted Amazon RDS for Oracle DB instance. Which set of steps should be followed?

Accepted Answer

Take a snapshot of the instance, copy the snapshot with encryption enabled, and restore from the encrypted snapshot.. The correct procedure. To encrypt an existing unencrypted RDS DB instance, you must create a manual snapshot of the instance, then copy that snapshot with encryption enabled (specifying a KMS key), and finally restore a new DB instance from the encrypted snapshot. Option A is wrong because the console does not provide a direct 'Enable Encryption' action on an existing instance. Option B is wrong because you cannot modify an existing unencrypted instance to enable encryption directly; there is no such modification parameter. Option C is wrong because while it mentions copying the snapshot to an encrypted one, it does not clarify that encryption is applied during the copy operation, and the correct process explicitly requires taking the initial snapshot, copying with encryption, and then restoring; Option D includes all three steps.

Answer

Enable encryption using the AWS Management Console by selecting the instance and choosing 'Enable Encryption'.

Answer

Modify the DB instance and set the KMS key ID to enable encryption.

Answer

Copy the snapshot to an encrypted snapshot and then restore.

Question 4

A CloudFormation template is used to create an RDS DB instance with encryption, as shown in the exhibit. The stack creation fails because the DB instance creation fails. What is the most likely cause?

Accepted Answer

The DB instance depends on the KMS key, but there is no DependsOn clause to ensure the key is created first.. KMS key creation must be completed before the DB instance can use it; CloudFormation does not automatically order creation unless dependencies are defined. Option A is wrong because the KMS key policy allows the account root full access. Option B is wrong because the KMS key ID is passed correctly via !Ref. Option C is wrong because encryption is set to true and the KMS key is provided.

Answer

The DB instance has StorageEncrypted set to true but KmsKeyId is not a valid ARN.

Answer

The KMS key policy does not grant permissions to the RDS service principal.

Answer

The KmsKeyId property requires the key ARN, not a reference.

Question 5

A company uses Amazon RDS for MySQL and wants to ensure that database users are authenticated using IAM database authentication. Which action must be performed to enable this?

Accepted Answer

Set the parameter 'require_secure_transport' to ON and use the AWSAuthenticationPlugin.. IAM database authentication requires a specific parameter group setting (require_secure_transport=ON) and authentication plugin. Option A is wrong because native MySQL authentication is not IAM. Option B is wrong because IAM roles for RDS are for API access, not database authentication. Option C is wrong because the standard MySQL port is 3306.

Answer

Create database users with MySQL native password authentication.

Answer

Attach an IAM role to the RDS instance for database authentication.

Answer

Change the database port to 3306 to enable IAM authentication.

Question 6

A company wants to audit all SQL queries made to their Amazon RDS for MySQL database. Which AWS service should they use?

Accepted Answer

Database Activity Streams. Database Activity Streams (D) is the correct choice because it provides a near-real-time stream of database activity, including all SQL queries, directly from the RDS for MySQL engine. This service integrates with AWS services like Amazon Kinesis and third-party monitoring tools to capture and audit every SQL statement, user login, and schema change at the database engine level, which is essential for comprehensive auditing.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

AWS CloudTrail

Question 7

A company needs to encrypt data at rest for their Amazon Aurora PostgreSQL database. Which solution is the MOST secure and requires the least operational overhead?

Accepted Answer

Enable encryption at rest using AWS KMS when creating the Aurora cluster.. Enabling encryption at rest using AWS KMS during database creation is the simplest and most secure approach. Option A is correct. Option B is wrong because EBS encryption only protects the underlying storage, not the Aurora database engine layer, and it adds operational overhead. Option C is wrong because you cannot encrypt an existing unencrypted Aurora cluster directly; you must perform a manual snapshot and restore to a new encrypted cluster, which increases complexity. Option D is wrong because client-side encryption requires managing encryption keys in the application, increasing complexity and operational overhead.

Answer

Use Amazon EBS encryption on the underlying volumes.

Answer

Encrypt the database after creation by modifying the DB instance.

Answer

Use client-side encryption in the application.

Question 8

A security team is investigating a potential data breach in an Amazon RDS for SQL Server database. They need to determine which user executed a specific DELETE statement at a particular time. What should they do?

Accepted Answer

Enable audit logs for the RDS instance and send them to CloudWatch Logs.. Enabling audit logs for the RDS for SQL Server instance captures detailed SQL statement execution, including the users and timestamps. Sending these logs to CloudWatch Logs allows for easy searching and alerting. Option B is correct because it directly addresses the need to identify the user who executed a specific SQL statement. Option A is incorrect because AWS CloudTrail logs API actions (e.g., creating or modifying RDS instances), not SQL queries. Option C is incorrect because VPC Flow Logs capture network traffic metadata, not database-level activity. Option D is incorrect because AWS Trusted Advisor provides best-practice checks and does not offer fine-grained auditing.

Answer

Enable AWS CloudTrail for the RDS instance.

Answer

Enable VPC Flow Logs for the database subnet.

Answer

Enable AWS Trusted Advisor.

Question 9

A company wants to restrict access to an Amazon DynamoDB table so that only specific IAM users can read and write data. What is the BEST way to achieve this?

Accepted Answer

Create an IAM policy that grants access to the DynamoDB table and attach it to the specific IAM users.. Using an IAM policy attached to specific IAM users is the most precise method to restrict access to a DynamoDB table. Resource-based policies are not supported for DynamoDB (Option A is wrong). VPC endpoints control network traffic but do not restrict which users can access the table (Option D is wrong). DynamoDB Accelerator (DAX) with IAM authentication handles caching and authentication, not table-level access control (Option C is wrong).

Answer

Use a resource-based policy on the DynamoDB table.

Answer

Use DynamoDB Accelerator (DAX) with IAM authentication.

Answer

Create a VPC endpoint for DynamoDB and allow only traffic from that VPC.

Question 10

A company hosts a critical application on Amazon RDS for PostgreSQL. The security team requires that all database connections be encrypted in transit. Which configuration step is necessary?

Accepted Answer

Set the rds.force_ssl parameter to 1 in the DB parameter group.. Enforcing SSL/TLS for connections is required for encryption in transit. Option B is correct. Option A is wrong because a VPN encrypts network traffic but does not enforce database-level SSL. Option C is wrong because modifying security group rules to allow only port 5432 does not encrypt connections. Option D is wrong because enabling encryption at rest does not encrypt data in transit.

Answer

Create a VPN connection between the application and the database.

Answer

Modify the security group to allow only port 5432 from the application.

Answer

Enable encryption at rest using AWS KMS.

Question 11

A company is using Amazon RDS for Oracle with Transparent Data Encryption (TDE) enabled. They need to rotate the TDE master key. What is the correct procedure?

Accepted Answer

Use the AWS KMS RotateKey operation to rotate the customer master key (CMK) that is used for TDE.. In Amazon RDS for Oracle with TDE, the master key is stored in AWS KMS. To rotate the TDE master key, you can call the AWS KMS RotateKey operation on the customer master key (CMK) used for TDE, or use the Amazon RDS procedure rds.rds_rotate_tde_key. Option B is correct. Option A is incorrect because Oracle's ALTER SYSTEM SET ENCRYPTION KEY command rotates the Oracle-internal master key, not the KMS CMK, and RDS does not support direct Oracle TDE key rotation. Option C is incorrect because full migration is unnecessary. Option D is incorrect because modifying the DB instance to use a new KMS key changes the key, but does not rotate the existing TDE key.

Answer

Use Oracle's ALTER SYSTEM SET ENCRYPTION KEY command to rotate the key.

Answer

Create a new encrypted RDS instance and migrate the data.

Answer

Modify the DB instance to use a new KMS key.

Question 12

A company wants to ensure that an Amazon RDS for MySQL database is automatically backed up daily and backups are encrypted. What should they do?

Accepted Answer

Enable automated backups and encryption at rest on the RDS instance.. Automated backups with encryption at rest ensure that backups are automatically taken daily and encrypted. Option C is correct because it enables both features: automated backups and encryption at rest. Option A is incorrect because manual snapshots are not automatic; they require manual intervention and enabling encryption on the snapshot copy is an extra step. Option B is incorrect because using CloudWatch Events and Lambda to export to S3 is not the standard automated backup mechanism for RDS; RDS automated backups are handled natively and do not require custom Lambda functions. Option D is incorrect because AWS Backup is not the default automated backup service for RDS; RDS has its own automated backup feature. Additionally, encryption for RDS backups is managed by AWS KMS, not S3 default encryption.

Answer

Take manual snapshots daily and enable encryption on the snapshot copy.

Answer

Use Amazon CloudWatch Events to trigger a Lambda function that exports the database to S3 with encryption.

Answer

Configure AWS Backup to back up the RDS instance to an S3 bucket with default encryption.

Question 13

A company is using Amazon DynamoDB with encryption at rest using an AWS managed key. The security team now requires that the encryption key be rotated every 90 days. What should they do?

Accepted Answer

Use a customer managed key and manually rotate it every 90 days by creating a new key and updating the DynamoDB table.. DynamoDB encryption at rest using an AWS managed key does not support customer-controlled rotation. Option D is correct because using a customer managed key allows you to manually rotate the key every 90 days by creating a new key and updating the DynamoDB table. Option A is incorrect because AWS managed keys rotate automatically every year, not on a 90-day schedule. Option B is incorrect because KMS automatic rotation for customer managed keys is also yearly and cannot be set to 90 days. Option C is incorrect because disabling encryption at rest is not a valid solution and adds security risk.

Answer

Enable automatic key rotation in AWS KMS for the default DynamoDB key.

Answer

Create a new customer managed key and enable automatic rotation every 90 days.

Answer

Disable encryption at rest and implement client-side encryption.

Question 14

Which TWO actions can be used to encrypt an existing unencrypted Amazon RDS for MySQL DB instance? (Choose 2.)

Accepted Answer

Create a new encrypted DB instance and migrate data using database dump and restore.. To encrypt an existing unencrypted RDS for MySQL DB instance, you cannot modify the instance directly (option E is incorrect). You can either take a snapshot, copy it with encryption enabled, and restore from the encrypted snapshot (option D), or create a new encrypted DB instance and migrate data using database dump and restore (option C). Option A is incorrect because creating a read replica with encryption enabled does not encrypt the source instance. Option B is incorrect because enabling SSL encrypts data in transit, not at rest.

Answer

Create a read replica with encryption enabled.

Answer

Enable SSL on the DB instance.

Answer

Modify the DB instance and enable encryption.

Question 15

Which THREE measures can help protect an Amazon RDS database from a DDoS attack? (Choose 3.)

Accepted Answer

Place the RDS instance in a private subnet without direct internet access.. Placing the RDS instance in a private subnet without direct internet access (Option A) prevents any external traffic from reaching the database endpoint, removing the attack surface entirely. Using security groups to restrict inbound traffic to known IP addresses (Option B) limits the sources that can initiate connections, reducing the potential for volumetric attacks. AWS Shield Advanced (Option D) provides additional DDoS mitigation capabilities, including detection and automatic application-layer protections. These three measures work together to defend against different attack vectors.

Answer

Make the RDS instance publicly accessible for easy monitoring.

Answer

Disable audit logging to reduce resource usage.