DBS-C01 Database Security Practice Test 21 — 15 Questions

Question 1

Which TWO AWS services can be used to monitor and alert on suspicious database access patterns in Amazon RDS? (Choose 2.)

Accepted Answer

Amazon CloudWatch. The correct answers are Amazon CloudWatch (B) and Amazon GuardDuty (E). Amazon CloudWatch can monitor RDS metrics and create alarms based on access patterns like failed login attempts. Amazon GuardDuty is a threat detection service that uses machine learning to identify suspicious database access activity. Option A (Amazon Inspector) is for vulnerability assessment, not monitoring access patterns. Option C (AWS Trusted Advisor) provides best practice checks and recommendations. Option D (AWS Config) is for resource configuration tracking and compliance.

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 2

Refer to the exhibit. An IAM policy is attached to a user. The user attempts to delete a DB instance named 'prod-db'. What will happen?

Accepted Answer

The delete will fail because of the explicit Deny statement.. The Deny statement explicitly denies delete on any instance matching 'prod-*'. Since an explicit deny overrides any allow, the delete will fail. Therefore, the correct answer is C. Option A is incorrect because the deny overrides the allow. Option B is incorrect because the resource 'prod-db' does match the deny pattern 'prod-*'. Option D is incorrect because the policy does not require MFA in this context, and even with MFA, the explicit deny would still apply.

Answer

The delete will succeed because the Allow statement grants modify permission.

Answer

The delete will succeed because the resource is 'prod-db' which does not match the deny pattern.

Answer

The delete will succeed only if the user has MFA enabled.

Question 3

Refer to the exhibit. An engineer runs the CLI command to check security groups attached to the RDS instance 'mydb'. The output shows only one security group. The engineer wants to ensure that only traffic from an application server with IP 10.0.1.5 is allowed to the database port 3306. Which security group rule should be added?

Accepted Answer

Add an inbound rule to allow traffic from 10.0.1.5/32 on port 3306.. To allow only the specific IP 10.0.1.5 to access the database, an inbound rule must be added to the security group allowing traffic on port 3306 (MySQL/Aurora) from source 10.0.1.5/32. Option B is correct. Option A is incorrect because it uses port 80 (HTTP) instead of the database port. Option C is incorrect because an outbound rule controls egress, not ingress; inbound rules are needed to allow incoming connections to the database. Option D is incorrect because it allows traffic from any IP (0.0.0.0/0), which is insecure and would violate the requirement to restrict access to a single IP.

Answer

Add an inbound rule to allow traffic from 10.0.1.5/32 on port 80.

Answer

Add an outbound rule to allow traffic to 10.0.1.5 on port 3306.

Answer

Add an inbound rule to allow traffic from 0.0.0.0/0 on port 3306.

Question 4

Refer to the exhibit. A company has an S3 bucket with server-side encryption using AWS KMS. The bucket policy allows access to a user, but the user receives 'Access Denied' when trying to download an object. The IAM policy for the user is shown. What is the MOST likely cause?

Accepted Answer

The policy has a condition that limits kms:Decrypt to when the request is made through the S3 service, but the user might be using a different service to access the object (e.g., directly via KMS API).. The IAM policy includes a condition that restricts kms:Decrypt to requests made through the S3 service (via the S3 service principal). If the user attempts to decrypt the object directly using the KMS API (e.g., using AWS CLI with `kms decrypt` command), the condition is not met, resulting in an 'Access Denied' error. Option A is incorrect because MFA is not mentioned in the policy. Option B is incorrect because the KMS key ID is assumed correct as per the scenario. Option C is incorrect because the policy does allow kms:Decrypt, but only conditionally.

Answer

The user does not have MFA enabled.

Answer

The KMS key ID in the policy is incorrect.

Answer

The policy does not allow kms:Decrypt for the S3 bucket.

Question 5

A company is launching a new application that requires an Amazon RDS for PostgreSQL database. The database will store highly sensitive data, and the security team mandates that all data at rest must be encrypted. The company also requires that the encryption keys be managed by the security team using AWS CloudHSM. What is the MOST efficient way to meet these requirements?

Accepted Answer

Use AWS KMS with a customer-managed key (CMK) for RDS encryption.. Amazon RDS for PostgreSQL does not support Transparent Data Encryption (TDE). TDE is only available for Oracle and SQL Server. The most efficient way to meet the requirements is to use RDS encryption with a customer-managed key (CMK) in AWS KMS, which encrypts the underlying storage and automated backups. The security team can manage the CMK via CloudHSM by using a KMS custom key store, thus satisfying the key management requirement. Option A is incorrect because EBS encryption is not directly applicable to RDS instances; RDS encryption uses KMS. Option B is incorrect because TDE is not supported for PostgreSQL. Option D is incorrect because client-side encryption introduces application changes and does not ensure encryption at rest within the database.

Answer

Enable EBS encryption on the RDS instance's underlying volumes using a KMS key.

Answer

Enable Transparent Data Encryption (TDE) using a CloudHSM key in the RDS instance.

Answer

Implement client-side encryption in the application before writing data to the database.

Question 6

A security audit reveals that an Amazon RDS for MySQL DB instance is accessible from the internet. The security team requires that the database be accessible only from a specific set of application servers within the same VPC. Which solution should be implemented?

Accepted Answer

Modify the DB instance's security group to allow inbound traffic only from the application servers' security group.. Modifying the DB instance's security group to allow inbound traffic only from the application servers' security group restricts access to only those instances, using the security group as a source for a more dynamic and manageable solution. Option B is incorrect because network ACLs are stateless and apply at the subnet level, not the instance level, and allowing from the application servers' IP range is less flexible and secure than using security group references. Option C is incorrect because enabling encryption at rest protects data at rest but does not control network access. Option D is incorrect because moving to a private subnet and using a bastion host is unnecessary when the application servers are in the same VPC; a security group rule is simpler and more appropriate.

Answer

Apply a network ACL that denies inbound traffic from 0.0.0.0/0 and allows from the application servers' IP range.

Answer

Enable encryption at rest on the DB instance to prevent unauthorized access.

Answer

Move the DB instance to a private subnet and configure a bastion host for access.

Question 7

A company uses Amazon DynamoDB with fine-grained access control using IAM policies. A developer reports that an application role can read and write to the 'orders' table but cannot perform a Scan operation on a Global Secondary Index (GSI). The IAM policy attached to the role includes 'dynamodb:Scan' and the resource ARN for the table. What is the likely reason for this failure?

Accepted Answer

The IAM policy does not include the GSI's ARN in the resource statement.. DynamoDB Global Secondary Indexes (GSIs) have their own Amazon Resource Names (ARNs) separate from the base table. When using IAM policies with fine-grained access control, the policy must explicitly include the ARN of the GSI in the resource statement to allow operations like Scan on that GSI. Without the GSI ARN, the Scan operation on the GSI is denied by default, even if the policy allows 'dynamodb:Scan' on the base table. Option A is incorrect because the policy does not mention time-of-day conditions. Option B is incorrect because the role can read from the base table, but the issue is with the GSI. Option D is incorrect because the action 'dynamodb:Scan' is allowed on the table but not on the GSI.

Answer

The policy has a condition that restricts Scan operations based on the time of day.

Answer

The role does not have permission to read from the base table.

Answer

The IAM policy does not allow the 'dynamodb:Scan' action on the table.

Question 8

A company wants to centrally manage database user credentials and rotate them automatically. The database is an Amazon RDS for MySQL instance. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager (option A) is the correct service because it is designed to centrally manage database credentials and can automatically rotate them for Amazon RDS for MySQL instances on a schedule you define. Option B (AWS CloudHSM) provides hardware security modules for cryptographic key storage, not credential management or rotation. Option C (IAM) is used for controlling access to AWS resources and supports IAM database authentication for RDS, but it does not manage database user passwords or provide automatic rotation of those passwords. Option D (AWS Systems Manager Parameter Store) can store secrets securely, but it does not offer native automatic rotation of RDS database credentials; that functionality requires Secrets Manager.

Answer

AWS CloudHSM

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Systems Manager Parameter Store

Question 9

A database administrator needs to audit all SQL statements executed on an Amazon RDS for Oracle DB instance. The audit logs must be stored in Amazon S3 for long-term retention and analysis with Amazon Athena. Which solution meets these requirements?

Accepted Answer

Configure Oracle's unified auditing and stream audit logs to CloudWatch Logs, then export to S3.. Oracle's unified auditing can be configured to stream audit logs to CloudWatch Logs, which can then be exported to Amazon S3 for long-term retention and analysis with Athena. Option A is incorrect because Enhanced Monitoring provides OS-level metrics, not SQL audit logs. Option C is incorrect because AWS CloudTrail captures API calls to RDS, not SQL statements executed within the database. Option D is incorrect because detailed billing reports do not include database query logs.

Answer

Enable Enhanced Monitoring on the RDS instance and publish logs to CloudWatch Logs.

Answer

Enable AWS CloudTrail to capture RDS API calls and store them in S3.

Answer

Enable detailed billing reports and configure them to include database queries.

Question 10

A security engineer is designing a disaster recovery plan for an Amazon DynamoDB table that contains sensitive data. The table is encrypted using an AWS KMS customer managed key (CMK). The engineer needs to ensure that the table can be restored in a different AWS Region. Which TWO actions must be taken to enable cross-region restores with the same encryption? (Choose TWO.)

Accepted Answer

Enable point-in-time recovery (PITR) on the table.. To enable cross-region restores of an encrypted DynamoDB table, you need to have the table's backups available in the destination region. Cross-region restores require point-in-time recovery (PITR) to be enabled on the source table (Option A). Additionally, because the table uses a customer managed KMS key, you must create a multi-Region KMS key (or replicate the key) in the destination region so that DynamoDB can use it to decrypt the backup during restore (Option D). Option B (global tables) is for live replication, not for backup/restore scenarios. Option C (export to S3 and copy) does not preserve the same encryption because the exported data is not encrypted with the KMS key. Option E (CloudHSM) is not supported for DynamoDB encryption.

Answer

Enable DynamoDB global tables.

Answer

Export the table to S3 and copy the S3 objects to the destination Region.

Answer

Create a CloudHSM key and use it for encryption.

Question 11

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database contains sensitive personally identifiable information (PII). The security team requires that the data be encrypted in transit between the application and the RDS instance, and also encrypted at rest using a key managed by the company. Which THREE actions should the company take? (Choose THREE.)

Accepted Answer

Configure the RDS instance to require SSL/TLS connections.. Options A, C, and E are correct. Option A: Configuring the RDS instance to require SSL/TLS encrypts data in transit, meeting the encryption-in-transit requirement. Option C: Enabling encryption at rest for the RDS instance at launch time allows use of AWS KMS for encryption, satisfying the at-rest encryption requirement. Option E: Creating a customer managed key (CMK) in AWS KMS enables the company to manage the encryption key, meeting the requirement for a key managed by the company. Option B is incorrect because setting rds.force_ssl to 1 in the DB parameter group is a step within configuring SSL/TLS, but the primary action is option A; moreover, the correct method to enforce SSL for Oracle RDS involves using the option group with the SSL option, not just the parameter group. Option D is incorrect because Transparent Data Encryption (TDE) using CloudHSM is not required; the at-rest encryption requirement is already fulfilled by enabling RDS encryption with a CMK (options C and E), and TDE with CloudHSM adds unnecessary complexity and potential licensing issues.

Answer

Modify the DB parameter group to set the 'rds.force_ssl' parameter to 1.

Answer

Enable Transparent Data Encryption (TDE) using CloudHSM.

Question 12

A developer is building a serverless application that uses Amazon DynamoDB. The application needs to access the database from an AWS Lambda function. The security team mandates that the Lambda function should not use long-term AWS credentials. Which TWO steps should be taken to securely grant access? (Choose TWO.)

Accepted Answer

Create an IAM role with a policy that allows DynamoDB actions.. To securely grant an AWS Lambda function access to DynamoDB without using long-term credentials, you should create an IAM role that grants the necessary DynamoDB permissions (option B) and then attach that IAM role to the Lambda function's execution role (option E). This allows Lambda to obtain temporary credentials via the IAM role, eliminating the need for hardcoded credentials. Option A is incorrect because hardcoding credentials in environment variables is not secure and uses long-term credentials. Option C is incorrect because the function does not need internet access for authentication; IAM roles provide temporary credentials internally. Option D is incorrect because while Secrets Manager can store credentials, it still requires managing secrets and may not align with the mandate to avoid long-term credentials; IAM roles are the preferred method.

Answer

Hardcode the AWS access key ID and secret access key in the Lambda environment variables.

Answer

Configure the Lambda function to access the internet for authentication.

Answer

Store the database credentials in AWS Secrets Manager and retrieve them in the Lambda function.

Question 13

A database administrator has the IAM policy shown above attached to their user. When they try to run the AWS CLI command `aws rds describe-db-instances --region us-west-2`, they receive an access denied error. Why does this fail?

Accepted Answer

The policy explicitly restricts the resource to a specific DB instance ARN in us-east-1, and the command specifies a different region.. The IAM policy includes two Allow statements. The first statement grants rds:DescribeDBInstances only on a specific DB instance ARN in us-east-1. The second statement grants the same action on any resource (*). Because IAM evaluates the effective permissions as the union of all statements, the user is only allowed to describe that specific instance in us-east-1; describing instances in any other region (such as us-west-2) is not explicitly allowed for that resource, so the request is denied. Option D is correct because it acknowledges that the resource ARN restriction from the first statement limits the allowed region. Option A is incorrect because there is no MFA condition in the policy. Option B is incorrect because the user can describe the specific instance in us-east-1. Option C is incorrect because the policy restricts access via a resource ARN, not a condition key.

Answer

The user must use multi-factor authentication (MFA) to perform the describe action.

Answer

The user does not have permission to describe DB instances in any region.

Answer

The policy includes a condition key that denies access when the region is not us-east-1.

Question 14

A company has an Amazon RDS for SQL Server DB instance that stores financial data. The security team requires that all database activity be monitored in real-time for suspicious queries. Which AWS service should be used to meet this requirement?

Accepted Answer

Amazon GuardDuty with RDS Protection. Amazon GuardDuty with RDS Protection provides real-time monitoring of database activity on Amazon RDS instances, analyzing SQL queries and detecting suspicious behavior such as SQL injection or unusual access patterns. Option A (AWS CloudTrail) is incorrect because it records API calls made to the AWS environment, not the database queries themselves. Option B (AWS Security Hub) is incorrect as it aggregates security findings from multiple AWS services but does not perform real-time database activity monitoring. Option D (Amazon Inspector) is incorrect because it is a vulnerability assessment service that scans for software vulnerabilities and unintended network exposure, not for database query threats.

Answer

AWS CloudTrail

Answer

AWS Security Hub

Answer

Amazon Inspector

Question 15

A financial services company uses Amazon DynamoDB to store transaction data. The table is encrypted with an AWS managed KMS key. The compliance team requires that the encryption key be rotated every 90 days. The current key was created 6 months ago and has not been rotated. The company also needs to ensure that all access to the table is logged for audit purposes. The security engineer proposes to enable DynamoDB Streams and AWS CloudTrail. However, the compliance team notes that CloudTrail only logs management plane events (e.g., CreateTable) and not data plane events (e.g., GetItem, PutItem). What should the engineer do to meet both requirements?

Accepted Answer

Create a customer managed KMS key, enable automatic key rotation, and configure CloudTrail to log data events for the DynamoDB table.. To meet both requirements, the engineer should create a customer managed KMS key, enable automatic key rotation (which rotates the key annually, but for 90-day rotation, the engineer can create a new key every 90 days and update the table), and configure CloudTrail to log data events for the DynamoDB table. CloudTrail data events capture data plane operations like GetItem and PutItem, which addresses the logging requirement. Option A is incorrect because AWS managed keys do not support automatic rotation; also, CloudTrail data events are not tied to key type. Option B is incorrect because switching to a customer managed key alone does not enable data event logging. Option C is incorrect because DynamoDB Streams are used for change data capture and streaming to other services, not for audit logging of data plane operations; CloudWatch Logs from Streams do not capture all API calls.

Answer

Use AWS CloudTrail data events to capture DynamoDB data plane operations and store the logs in S3.

Answer

Switch to an AWS managed KMS key and enable automatic rotation.

Answer

Enable DynamoDB Streams and stream write events to CloudWatch Logs for auditing.