DBS-C01 Database Security Practice Test 21 — 15 Questions

Question 1

Refer to the exhibit. An IAM policy is attached to a user. The user attempts to delete a DB instance named 'prod-db'. What will happen?

Accepted Answer

The delete will fail because of the explicit Deny statement.. The Deny statement explicitly denies delete on any instance matching 'prod-*'. Since an explicit deny overrides any allow, the delete will fail. Option B is correct. Option A is wrong because the deny overrides. Option C is wrong because the policy does not require MFA. Option D is wrong because the user cannot delete the instance.

Answer

The delete will succeed because the Allow statement grants modify permission.

Answer

The delete will succeed because the resource is 'prod-db' which does not match the deny pattern.

Answer

The delete will succeed only if the user has MFA enabled.

Question 2

Refer to the exhibit. An engineer runs the CLI command to check security groups attached to the RDS instance 'mydb'. The output shows only one security group. The engineer wants to ensure that only traffic from an application server with IP 10.0.1.5 is allowed to the database port 3306. Which security group rule should be added?

Accepted Answer

Add an inbound rule to allow traffic from 10.0.1.5/32 on port 3306.. To allow only specific IP, an inbound rule for MySQL port 3306 from source 10.0.1.5/32 is needed. Option C is correct. Option A is wrong because outbound rules control egress. Option B is wrong because a rule allowing all traffic (0.0.0.0/0) would be insecure. Option D is wrong because HTTP port is not relevant.

Answer

Add an inbound rule to allow traffic from 10.0.1.5/32 on port 80.

Answer

Add an outbound rule to allow traffic to 10.0.1.5 on port 3306.

Answer

Add an inbound rule to allow traffic from 0.0.0.0/0 on port 3306.

Question 3

Refer to the exhibit. A company has an S3 bucket with server-side encryption using AWS KMS. The bucket policy allows access to a user, but the user receives 'Access Denied' when trying to download an object. The IAM policy for the user is shown. What is the MOST likely cause?

Accepted Answer

The policy has a condition that limits kms:Decrypt to when the request is made through the S3 service, but the user might be using a different service to access the object (e.g., directly via KMS API).. The policy restricts kms:Decrypt to requests coming via S3 service only. If the user is using the AWS CLI with the S3 API directly (not via S3 service principal), the condition fails. Option A is correct. Option B is wrong because the key ID is correct in the policy. Option C is wrong because condition is the issue, not MFA. Option D is wrong because the policy allows kms:Decrypt for S3.

Answer

The user does not have MFA enabled.

Answer

The KMS key ID in the policy is incorrect.

Answer

The policy does not allow kms:Decrypt for the S3 bucket.

Question 4

A company is launching a new application that requires an Amazon RDS for PostgreSQL database. The database will store highly sensitive data, and the security team mandates that all data at rest must be encrypted. The company also requires that the encryption keys be managed by the security team using AWS CloudHSM. What is the MOST efficient way to meet these requirements?

Accepted Answer

Enable Transparent Data Encryption (TDE) using a CloudHSM key in the RDS instance.. Option C is correct because RDS for PostgreSQL supports TDE with CloudHSM, allowing the security team to manage keys while encrypting data at rest. Option A is wrong because EBS encryption is not supported for RDS instances. Option B is wrong because KMS does not allow customer-managed HSMs. Option D is wrong because client-side encryption requires application changes and does not protect data at rest in the database.

Answer

Enable EBS encryption on the RDS instance's underlying volumes using a KMS key.

Answer

Use AWS KMS with a customer-managed key (CMK) for RDS encryption.

Answer

Implement client-side encryption in the application before writing data to the database.

Question 5

A security audit reveals that an Amazon RDS for MySQL DB instance is accessible from the internet. The security team requires that the database be accessible only from a specific set of application servers within the same VPC. Which solution should be implemented?

Accepted Answer

Modify the DB instance's security group to allow inbound traffic only from the application servers' security group.. Option B is correct because a security group with an inbound rule that references the application servers' security group restricts access to only those instances. Option A is wrong because network ACLs are stateless and block all traffic if not correctly configured, but security groups are more appropriate for instance-level access. Option C is wrong because changing the subnet to private and using a bastion host is unnecessary if the app servers are in the same VPC. Option D is wrong because enabling encryption does not restrict network access.

Answer

Apply a network ACL that denies inbound traffic from 0.0.0.0/0 and allows from the application servers' IP range.

Answer

Enable encryption at rest on the DB instance to prevent unauthorized access.

Answer

Move the DB instance to a private subnet and configure a bastion host for access.

Question 6

A company uses Amazon DynamoDB with fine-grained access control using IAM policies. A developer reports that an application role can read and write to the 'orders' table but cannot perform a Scan operation on a Global Secondary Index (GSI). The IAM policy attached to the role includes 'dynamodb:Scan' and the resource ARN for the table. What is the likely reason for this failure?

Accepted Answer

The IAM policy does not include the GSI's ARN in the resource statement.. Option B is correct because DynamoDB GSIs have separate ARNs, and the policy must include the GSI ARN. Option A is wrong because the Scan action is allowed on the table, but the GSI requires its own resource. Option C is wrong because condition keys are not relevant if the action is denied. Option D is wrong because the role is allowed to read and write, but Scan is a read action.

Answer

The policy has a condition that restricts Scan operations based on the time of day.

Answer

The role does not have permission to read from the base table.

Answer

The IAM policy does not allow the 'dynamodb:Scan' action on the table.

Question 7

A company wants to centrally manage database user credentials and rotate them automatically. The database is an Amazon RDS for MySQL instance. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. Option C is correct because AWS Secrets Manager can rotate RDS database credentials automatically. Option A is wrong because Systems Manager Parameter Store can store secrets but does not automatically rotate RDS credentials. Option B is wrong because IAM controls access to AWS services, not database users. Option D is wrong because CloudHSM is for hardware-based key storage, not credential rotation.

Answer

AWS CloudHSM

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Systems Manager Parameter Store

Question 8

A database administrator needs to audit all SQL statements executed on an Amazon RDS for Oracle DB instance. The audit logs must be stored in Amazon S3 for long-term retention and analysis with Amazon Athena. Which solution meets these requirements?

Accepted Answer

Configure Oracle's unified auditing and stream audit logs to CloudWatch Logs, then export to S3.. Option D is correct because Oracle's unified auditing can be configured to write logs to S3 via the database activity stream, which integrates with CloudWatch Logs and then to S3. Option A is wrong because RDS Enhanced Monitoring provides OS metrics, not SQL audit. Option B is wrong because CloudTrail does not capture SQL statements. Option C is wrong because enabling detailed billing does not provide SQL audit.

Answer

Enable Enhanced Monitoring on the RDS instance and publish logs to CloudWatch Logs.

Answer

Enable AWS CloudTrail to capture RDS API calls and store them in S3.

Answer

Enable detailed billing reports and configure them to include database queries.

Question 9

A security engineer is designing a disaster recovery plan for an Amazon DynamoDB table that contains sensitive data. The table is encrypted using an AWS KMS customer managed key (CMK). The engineer needs to ensure that the table can be restored in a different AWS Region. Which TWO actions must be taken to enable cross-region restores with the same encryption? (Choose TWO.)

Accepted Answer

Enable point-in-time recovery (PITR) on the table.. Option B and D are correct. DynamoDB cross-region restores require the KMS key to be available in the destination region, which means creating a replica key. The table must also have point-in-time recovery (PITR) enabled. Option A is wrong because cross-region replication is for live data, not backups. Option C is wrong because CloudHSM keys are not supported for DynamoDB encryption. Option E is wrong because the key must be in the destination region.

Answer

Enable DynamoDB global tables.

Answer

Export the table to S3 and copy the S3 objects to the destination Region.

Answer

Create a CloudHSM key and use it for encryption.

Question 10

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database contains sensitive personally identifiable information (PII). The security team requires that the data be encrypted in transit between the application and the RDS instance, and also encrypted at rest using a key managed by the company. Which THREE actions should the company take? (Choose THREE.)

Accepted Answer

Configure the RDS instance to require SSL/TLS connections.. Options A, C, and D are correct. Option A: enabling SSL/TLS encrypts data in transit. Option C: KMS customer managed key allows the company to manage the key for at-rest encryption. Option D: RDS encryption must be enabled at launch. Option B is wrong because RDS does not support TDE with CloudHSM for Oracle. Option E is wrong because forcing SSL is a parameter, not an option group level action.

Answer

Modify the DB parameter group to set the 'rds.force_ssl' parameter to 1.

Answer

Enable Transparent Data Encryption (TDE) using CloudHSM.

Question 11

A developer is building a serverless application that uses Amazon DynamoDB. The application needs to access the database from an AWS Lambda function. The security team mandates that the Lambda function should not use long-term AWS credentials. Which TWO steps should be taken to securely grant access? (Choose TWO.)

Accepted Answer

Create an IAM role with a policy that allows DynamoDB actions.. Options A and C are correct. Option A: creating an IAM role for Lambda with appropriate permissions allows temporary credentials. Option C: attaching the role to the Lambda function provides access without hardcoding credentials. Option B is wrong because storing credentials in Secrets Manager still requires handling secrets. Option D is wrong because environment variables are not secure for long-term credentials. Option E is wrong because the Lambda function should not have internet access for security; VPC endpoints are used for private access.

Answer

Hardcode the AWS access key ID and secret access key in the Lambda environment variables.

Answer

Configure the Lambda function to access the internet for authentication.

Answer

Store the database credentials in AWS Secrets Manager and retrieve them in the Lambda function.

Question 12

A database administrator has the IAM policy shown above attached to their user. When they try to run the AWS CLI command `aws rds describe-db-instances --region us-west-2`, they receive an access denied error. Why does this fail?

Accepted Answer

The policy explicitly restricts the resource to a specific DB instance ARN in us-east-1, and the command specifies a different region.. Option B is correct. The resource statement in the first Allow explicitly limits access to the specific DB instance ARN in us-east-1. The second Allow allows rds:DescribeDBInstances on any resource, but the explicit resource restriction in the first statement does not grant access to resources in other regions. Since the command specifies us-west-2, the instance is not in that region, and the policy does not allow DescribeDBInstances on any resource in us-west-2. Option A is wrong because DescribeDBInstances is allowed on the specific resource, but not in us-west-2. Option C is wrong because there is no condition. Option D is wrong because the policy does not require MFA.

Answer

The user must use multi-factor authentication (MFA) to perform the describe action.

Answer

The user does not have permission to describe DB instances in any region.

Answer

The policy includes a condition key that denies access when the region is not us-east-1.

Question 13

A company has an Amazon RDS for SQL Server DB instance that stores financial data. The security team requires that all database activity be monitored in real-time for suspicious queries. Which AWS service should be used to meet this requirement?

Accepted Answer

Amazon GuardDuty with RDS Protection. Option A is correct because Amazon GuardDuty with RDS Protection can monitor database activity for threats in real-time. Option B is wrong because AWS CloudTrail captures API calls, not SQL queries. Option C is wrong because Amazon Inspector is for vulnerability assessment. Option D is wrong because Security Hub aggregates findings from other services.

Answer

AWS CloudTrail

Answer

AWS Security Hub

Answer

Amazon Inspector

Question 14

A company runs an e-commerce platform on AWS using an Amazon Aurora MySQL database. The database is accessed by multiple microservices, each using a separate database user. The security team recently discovered that a developer accidentally committed database credentials to a public GitHub repository. The credentials were for a user that had write access to the database. The team immediately revoked the credentials and rotated them. However, they want to prevent such incidents from happening again. They need a solution that ensures credentials are not hardcoded in application code, are rotated automatically, and are accessible only to authorized microservices. What should they do?

Accepted Answer

Use AWS Secrets Manager to store the credentials, configure automatic rotation, and attach a resource-based policy to allow access only from the microservices' IAM roles.. Option B is correct. AWS Secrets Manager allows storing credentials, automatic rotation, and fine-grained access control via IAM policies. Each microservice can assume an IAM role that grants access to Secrets Manager. Option A is wrong because Systems Manager Parameter Store does not support automatic rotation for RDS credentials. Option C is wrong because IAM database authentication does not eliminate the need for secrets; it uses IAM roles for authentication, but the microservices still need to obtain temporary credentials. Option D is wrong because storing secrets in S3 with encryption does not provide automatic rotation or easy access control.

Answer

Use IAM database authentication for Aurora and eliminate the use of database passwords.

Answer

Use AWS Systems Manager Parameter Store to store the credentials and grant access via IAM roles.

Answer

Store the credentials in an encrypted S3 bucket and grant access to the microservices via bucket policies.

Question 15

A financial services company uses Amazon DynamoDB to store transaction data. The table is encrypted with an AWS managed KMS key. The compliance team requires that the encryption key be rotated every 90 days. The current key was created 6 months ago and has not been rotated. The company also needs to ensure that all access to the table is logged for audit purposes. The security engineer proposes to enable DynamoDB Streams and AWS CloudTrail. However, the compliance team notes that CloudTrail only logs management plane events (e.g., CreateTable) and not data plane events (e.g., GetItem, PutItem). What should the engineer do to meet both requirements?

Accepted Answer

Create a customer managed KMS key, enable automatic key rotation, and configure CloudTrail to log data events for the DynamoDB table.. Option C is correct. DynamoDB can use a customer managed KMS key, which allows the customer to enable automatic key rotation (every year) or manual rotation. However, automatic rotation is not every 90 days; the engineer can create a new key every 90 days and update the table to use it. Additionally, to log data plane events, they must enable Amazon CloudWatch Logs for DynamoDB or use AWS CloudTrail data events. Option A is wrong because AWS managed keys do not support rotation. Option B is wrong because CloudTrail can log data events if configured. Option D is wrong because streaming logs to CloudWatch does not log data plane events.

Answer

Use AWS CloudTrail data events to capture DynamoDB data plane operations and store the logs in S3.

Answer

Switch to an AWS managed KMS key and enable automatic rotation.

Answer

Enable DynamoDB Streams and stream write events to CloudWatch Logs for auditing.

DBS-C01 Database Security Practice Test 21 — 15 Questions

Exhibit

DBS-C01 Database Security Practice Test 21 — 15 Questions

Exhibit