DBS-C01 Database Security Practice Test 21 — 15 Questions

Question 1

A company wants to enforce encryption in transit for all connections to their ElastiCache for Redis cluster. Which security measure should they implement?

Accepted Answer

Enable Encryption in-transit when creating the cluster.. ElastiCache for Redis enforces encryption in transit by enabling the feature at cluster creation time. This uses TLS to encrypt data moving between clients and the Redis nodes, ensuring that all connections are secured against eavesdropping or man-in-the-middle attacks. The setting cannot be changed after the cluster is provisioned, so it must be enabled during the initial setup.

Answer

Set a parameter group with 'require_secure_transport' to ON.

Answer

Use VPC Flow Logs to monitor connections.

Answer

Enable encryption at rest using KMS.

Question 2

A security team needs to grant an IAM user permission to modify only the 'db_secrets' secret in AWS Secrets Manager. Which IAM policy statement is correct?

Accepted Answer

{ 'Effect': 'Allow', 'Action': 'secretsmanager:PutSecretValue', 'Resource': 'arn:aws:secretsmanager:us-east-1:123456789012:secret:db_secrets-??????' }. It grants the specific `secretsmanager:PutSecretValue` action on the exact ARN of the `db_secrets` secret, including the required six-character random suffix (`-??????`) that AWS Secrets Manager appends to secret names. This ensures the IAM user can only modify that single secret, meeting the security requirement of least privilege.

Answer

{ 'Effect': 'Allow', 'Action': 'secretsmanager:UpdateSecret', 'Resource': '*' }

Answer

{ 'Effect': 'Allow', 'Action': 'secretsmanager:*', 'Resource': '*' }

Answer

{ 'Effect': 'Allow', 'Action': 'secretsmanager:PutSecretValue', 'Resource': 'arn:aws:secretsmanager:us-east-1:123456789012:secret:*' }

Question 3

Which TWO actions can help protect an RDS database from SQL injection attacks? (Choose 2.)

Accepted Answer

Use parameterized SQL statements in the application.. Parameterized SQL statements (also known as prepared statements) ensure that user input is treated strictly as data, not executable code, preventing SQL injection at the application layer. Option E is correct because input validation and sanitization filter out malicious characters or patterns before they reach the database, adding an extra layer of defense. Both measures are essential; network controls (security groups) and encryption do not prevent injection attacks.

Answer

Enable Multi-AZ for the RDS instance.

Answer

Enable encryption at rest using KMS.

Answer

Restrict network access using security groups.

Question 4

A developer needs to connect to the RDS instance from an EC2 instance in the same VPC. The EC2 instance's security group allows outbound traffic to 0.0.0.0/0. The RDS security group inbound rules currently allow traffic from 0.0.0.0/0 on port 3306. After a security review, the company decides to restrict inbound traffic to the VPC only. Which inbound rule should be added to the RDS security group?

Accepted Answer

An inbound rule allowing traffic from the EC2 instance's security group ID on port 3306.. Referencing the EC2 instance's security group ID as the source in the RDS security group inbound rule is the AWS-recommended pattern for instance-to-instance access within a VPC. It creates a logical reference that automatically follows instances as they are added or replaced, and it satisfies the requirement to restrict access to VPC resources only. This avoids hardcoding IP ranges that could drift or be spoofed.

Answer

An inbound rule allowing traffic from the RDS endpoint address on port 3306.

Answer

An inbound rule allowing traffic from 10.0.0.0/8 on port 3306.

Answer

An inbound rule allowing traffic from the VPC CIDR (e.g., 10.0.0.0/16) on port 3306.

Question 5

A developer retrieved a database secret using the AWS CLI as shown. What is the MOST secure way to store and rotate this secret?

Accepted Answer

Store the secret in AWS Secrets Manager and enable automatic rotation with a Lambda function.. AWS Secrets Manager is purpose-built for storing and rotating secrets, with native support for automatic rotation via a Lambda function on a schedule. This satisfies both the secure storage and rotation requirements with minimal operational effort. It also integrates with RDS, Redshift, and DocumentDB for managed rotation templates.

Answer

Store the secret in AWS Systems Manager Parameter Store as a SecureString.

Answer

Store the secret in a configuration file on the EC2 instance.

Answer

Use the secret as-is and change it manually every 90 days.

Question 6

A company is storing sensitive customer data in an Amazon RDS for MySQL DB instance. They need to ensure that data is encrypted at rest. What is the simplest way to achieve this?

Accepted Answer

Launch a new encrypted DB instance and migrate the data.. For Amazon RDS, encryption at rest can only be enabled when the DB instance is created. To encrypt an existing unencrypted instance, you must create a new encrypted instance and migrate the data. Modifying an existing instance to enable encryption is not supported. Therefore, launching a new encrypted DB instance and migrating data is the simplest way.

Answer

Enable encryption on the existing DB instance by modifying the DB instance settings.

Answer

Enable Transparent Data Encryption (TDE) on the MySQL instance.

Answer

Use client-side encryption with AWS KMS to encrypt data before inserting into the database.

Question 7

A company uses Amazon RDS for PostgreSQL and needs to ensure that only specific IP addresses can connect to the database. Which configuration should be used?

Accepted Answer

Modify the VPC security group associated with the DB instance to allow inbound traffic only from specific IP addresses.. A VPC security group acts as a virtual firewall for the RDS instance and controls inbound traffic at the network layer, so modifying its inbound rules to allow only specific CIDR ranges is the correct way to restrict which IP addresses can connect. RDS instances reside in a VPC subnet and are governed by the security group attached to them. This is the standard, supported method for IP-based access control to RDS.

Answer

Configure the DB subnet group to allow only specific IP addresses.

Answer

Set the rds.force_ssl parameter in the DB parameter group.

Answer

Create an IAM policy that restricts access to the RDS API based on source IP.

Question 8

A company is designing a multi-tenant application using Amazon Aurora MySQL. Each tenant's data must be isolated from others. They need to encrypt data at rest with a unique AWS KMS key per tenant. How can this be achieved?

Accepted Answer

Launch separate Aurora clusters for each tenant, each with its own KMS key for encryption at rest.. To encrypt each tenant's data with a unique KMS key, you must launch separate Aurora clusters for each tenant, because encryption at rest is applied at the cluster level using a single KMS key. Each cluster can be configured with its own KMS key, providing tenant isolation. This approach ensures that data for each tenant is encrypted with a distinct key.

Answer

Create separate databases within the same Aurora cluster and assign a different KMS key to each database.

Answer

Use client-side encryption with different KMS keys per tenant before inserting data into the database.

Answer

Use a single Aurora cluster with row-level encryption using different KMS keys per tenant.

Question 9

A company is using Amazon DynamoDB with server-side encryption enabled. They need to ensure that all access to the table is audited. Which service should be used to capture data-plane API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail, when configured to capture data events, can record DynamoDB data-plane API calls such as GetItem and PutItem. Option A (VPC Flow Logs) captures network traffic, not API calls. Option B (AWS Config) records configuration changes, not data-plane actions. Option C (Amazon CloudWatch Logs) can store logs but does not directly capture API calls; it would require another service to send logs to it.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 10

A company needs to rotate the master user password for an Amazon RDS for MySQL DB instance. What is the recommended way to do this without downtime?

Accepted Answer

Use the AWS Management Console, CLI, or API to modify the DB instance with a new master password.. The recommended way to rotate the RDS master password without downtime is to use the AWS Management Console, CLI, or API to modify the DB instance with a new master password. This operation applies the new credentials immediately without requiring a reboot, so existing connections continue to work and the instance stays available. RDS handles the credential change at the engine level, so no restart of the DB instance is needed.

Answer

Modify the DB instance and set a new password, which will cause a reboot for the change to take effect.

Answer

Update the DB parameter group with the new password.

Answer

Delete the DB instance and launch a new one with the new password.

Question 11

A security engineer needs to ensure that all access to an Amazon DynamoDB table is encrypted in transit. Which configuration achieves this?

Accepted Answer

Ensure all client applications use the DynamoDB HTTPS endpoint.. DynamoDB uses HTTPS for all API calls by default, ensuring encryption in transit. Option A is incorrect because configuring a VPC endpoint does not enable encryption; it provides private connectivity, but encryption in transit is already handled by HTTPS. Option C is incorrect because placing DynamoDB behind CloudFront is not a valid configuration; CloudFront is a CDN for content delivery, not for securing database access. Option D is incorrect because DynamoDB does not have an 'ssl_enabled' parameter; encryption in transit is always enforced via HTTPS.

Answer

Configure a VPC endpoint for DynamoDB and enable encryption.

Answer

Place the DynamoDB table behind Amazon CloudFront.

Answer

Enable SSL on the DynamoDB table by setting the 'ssl_enabled' parameter.

Question 12

Which TWO of the following are methods to control access to an Amazon RDS DB instance? (Select TWO.)

Accepted Answer

VPC security groups. Options A and B are correct. VPC security groups control network access to the RDS instance at the instance level, acting as a virtual firewall. IAM policies can control who can perform administrative actions on the RDS instance via the AWS API, such as creating, modifying, or deleting the instance. Option C is incorrect because CloudWatch alarms monitor performance metrics and trigger actions, but do not control access. Option D is incorrect because database passwords are a form of authentication for users connecting to the database, not a method to control access to the RDS instance itself. Option E is incorrect because S3 bucket policies control access to Amazon S3 resources, not RDS.

Answer

Amazon CloudWatch alarms

Answer

Database passwords

Answer

Amazon S3 bucket policies

Question 13

Which THREE of the following are best practices for securing an Amazon Aurora MySQL database? (Select THREE.)

Accepted Answer

Enable encryption at rest using AWS KMS.. Option A is correct because enabling encryption at rest with AWS KMS protects Aurora MySQL storage volumes, snapshots, and automated backups using customer-managed or AWS-managed keys, ensuring data cannot be read if the underlying storage is compromised. Option B is correct because Aurora MySQL advanced auditing (via the server_audit_plugins or Database Activity Streams) logs connections, queries, and DDL/DML events to CloudWatch Logs, enabling detection of suspicious activity and supporting compliance requirements. Option D is correct because IAM database authentication lets Aurora MySQL use short-lived authentication tokens instead of long-lived passwords, eliminating stored credentials and integrating access control with IAM policies and roles. Option C is not recommended because hardcoding credentials in application code exposes secrets in source control and build artifacts; AWS Secrets Manager or IAM auth should be used instead. Option E is not recommended because disabling automated backups removes point-in-time recovery and increases risk from accidental deletion or ransomware, which does not meaningfully reduce attack surface.

Answer

Store database credentials in application code for simplicity.

Answer

Disable automated backups to reduce attack surface.

Question 14

An IAM policy is attached to a user. What is the effect of this policy on the user's ability to delete the DB instance named prod-db?

The policy is:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "rds:DeleteDBInstance",
      "Resource": "arn:aws:rds:us-east-1:123456789012:db:prod-db"
    },
    {
      "Effect": "Allow",
      "Action": "rds:*",
      "Resource": "*"
    }
  ]
}
```

Accepted Answer

The user cannot delete the DB instance because the Deny statement explicitly denies it.. AWS IAM evaluates policies with an explicit-deny-wins rule: if any statement in any applicable policy has Effect: Deny for the action/resource, the request is denied regardless of any Allow statements. Here, the Deny statement targets rds:DeleteDBInstance on the specific ARN of prod-db, so the user cannot delete that instance even though a broader Allow exists.

Answer

The user can delete the DB instance only after creating a final snapshot.

Answer

The user can delete the DB instance because the Allow statement grants all actions.

Answer

The user can delete the DB instance because the Allow statement is broader and applies to all resources.

Question 15

An RDS DB instance has two security groups attached. Security group sg-12345678 allows inbound traffic on port 3306 from 0.0.0.0/0. Security group sg-87654321 allows inbound traffic on port 3306 from 10.0.0.0/16. What is the effective inbound access to the DB instance?

Accepted Answer

All IP addresses (0.0.0.0/0) are allowed to connect.. Security groups in AWS are additive and allow-only; when multiple security groups are attached to an RDS DB instance, the effective inbound rules are the union of all rules across all attached security groups. Since sg-12345678 allows 0.0.0.0/0 on port 3306, that rule is in effect regardless of the other group. Therefore, all IP addresses can connect on port 3306, making option D correct.

Answer

No IP addresses are allowed because the rules conflict.

Answer

Only the 0.0.0.0/0 range is allowed because sg-12345678 is more permissive.

Answer

Only the 10.0.0.0/16 range is allowed because sg-87654321 is more restrictive.