DBS-C01 Database Security Practice Test 22 — 15 Questions

Question 1

A financial services company uses Amazon DynamoDB to store transaction records. The security team requires that all items be encrypted at rest using a customer-managed AWS KMS key. Additionally, the company must be able to audit key usage and rotation. What is the MOST secure and auditable approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use SSE-KMS with a customer-managed key, enable automatic key rotation, and enable CloudTrail data events for the key.. Using a customer-managed KMS key with automatic annual rotation and enabling CloudTrail logging of key usage provides encryption control and auditing. Option A is wrong because SSE-S3 does not provide customer control or audit. Option B is wrong because manual rotation is less secure and auditable than automatic rotation. Option D is wrong because client-side encryption would require managing encryption keys on the client side, which does not leverage the AWS KMS infrastructure for automatic key rotation and auditing, and is not as integrated or auditable as server-side encryption with KMS.

Answer

Enable default encryption on the DynamoDB table using SSE-S3.

Answer

Use SSE-KMS with a customer-managed key and manually rotate the key every 90 days.

Answer

Use client-side encryption with the AWS Encryption SDK.

Question 2

A developer needs to grant an IAM user the ability to perform all operations on an Amazon RDS DB instance except the ability to delete it. Which IAM policy action should be explicitly denied?

Accepted Answer

rds:DeleteDBInstance. To prevent deletion, you must explicitly deny the rds:DeleteDBInstance action. Option A (rds:RebootDBInstance) is incorrect because it only reboots the instance. Option B (rds:StopDBInstance) is incorrect because it only stops the instance. Option C (rds:ModifyDBInstance) is incorrect because it only modifies the instance. Option D (rds:DeleteDBInstance) is the correct action to deny to prevent deletion.

Answer

rds:RebootDBInstance

Answer

rds:StopDBInstance

Answer

rds:ModifyDBInstance

Question 3

A company uses Amazon RDS for PostgreSQL with Multi-AZ deployment. The security team wants to ensure that any access to the database is logged, including SELECT queries. What should be done to capture these logs?

Accepted Answer

Modify the DB parameter group to enable query logging and publish logs to Amazon CloudWatch Logs.. Enabling RDS Enhanced Monitoring does not capture query logs. Enabling automatic backups does not log queries. Enabling RDS Performance Insights does not log queries. To capture SELECT queries, you need to enable PostgreSQL query logging by setting the appropriate parameter group parameters (e.g., log_statement = 'all' or 'mod') and then export logs to CloudWatch Logs.

Answer

Enable automated backups and export logs to Amazon S3.

Answer

Enable RDS Performance Insights.

Answer

Enable RDS Enhanced Monitoring.

Question 4

A company runs an Amazon Aurora MySQL-compatible database cluster. The security team requires that all database credentials be rotated automatically every 30 days. Which combination of AWS services can meet this requirement with minimal operational overhead?

Accepted Answer

Store the password in AWS Secrets Manager and enable automatic rotation with a 30-day interval.. AWS Secrets Manager provides built-in automatic rotation for RDS database credentials. Option A is incorrect because IAM database authentication does not involve password rotation. Option C is incorrect because CloudHSM does not manage password rotation. Option D is incorrect because Systems Manager Parameter Store lacks built-in rotation capabilities for RDS credentials.

Answer

Use IAM database authentication and rotate the IAM user keys every 30 days.

Answer

Use AWS CloudHSM to generate a new password and a Lambda function to update the database.

Answer

Store the password in AWS Systems Manager Parameter Store and use a scheduled Lambda function to update the password.

Question 5

A developer accidentally exposed an Amazon RDS snapshot to the public. What is the quickest way to remediate this issue?

Accepted Answer

Modify the snapshot permissions to set it to private.. The quickest remediation is to modify the snapshot permissions to make it private. This immediately revokes public access. Option A is incorrect because deleting the snapshot would remove the backup entirely, which is unnecessary and could risk data loss if no other backup exists. Option B is incorrect because copying the snapshot does not change the original's permissions; the original remains public. Option C is incorrect because sharing with a specific account does not revoke public access; it only adds an additional permission. Therefore, modifying the snapshot to private is the direct and fastest fix.

Answer

Delete the snapshot and create a new one from the source DB instance.

Answer

Copy the snapshot to a new snapshot and delete the original.

Answer

Share the snapshot with only the required AWS account.

Question 6

A company uses Amazon Redshift for data warehousing. The security team requires that all data be encrypted at rest with a customer-managed key, and that the key be rotated every year. Which configuration meets these requirements?

Accepted Answer

Launch the Redshift cluster with encryption enabled using a customer-managed KMS key with automatic annual rotation.. Amazon Redshift supports encryption at rest using AWS KMS customer-managed keys, and KMS customer-managed keys support automatic annual rotation. This combination satisfies both the customer-managed key requirement and the yearly rotation requirement without manual intervention.

Answer

Launch the Redshift cluster without encryption and enable encryption later using AWS CloudHSM.

Answer

Launch the Redshift cluster with encryption enabled using an S3-managed key.

Answer

Launch the Redshift cluster with encryption enabled using a KMS key and configure the cluster to use an HSM for key storage.

Question 7

Which TWO actions will help protect an Amazon RDS for MySQL database from a SQL injection attack? (Select TWO.)

Accepted Answer

Use parameterized queries in the application code.. Using parameterized queries (prepared statements) prevents SQL injection. Also, restricting database user permissions to only necessary operations limits damage. Enabling encryption at rest does not prevent injection. Using a VPC does not prevent injection. Enabling auto minor version upgrade does not prevent injection.

Answer

Enable encryption at rest for the RDS instance.

Answer

Place the RDS instance in a private VPC subnet.

Answer

Enable auto minor version upgrade on the RDS instance.

Question 8

Refer to the exhibit. The output is from the AWS CLI for an RDS instance. The security team suspects that the encryption key used for this DB instance has been compromised. What is the required action to re-encrypt the instance with a new key?

Accepted Answer

Create a snapshot of the DB instance, copy the snapshot with a new KMS key, and restore the DB instance from the copied snapshot.. RDS encryption keys cannot be changed in place on an existing instance. The supported method is to snapshot the instance, copy the snapshot while specifying a new KMS key (which re-encrypts the snapshot), and then restore a new DB instance from that copied snapshot. This produces an instance encrypted with the new key.

Answer

Modify the DB instance to use a new KMS key.

Answer

Restore the DB instance to a point in time and specify a new KMS key.

Answer

Enable encryption on a new DB instance and migrate the data.

Question 9

Refer to the exhibit. A developer created an IAM policy with the above command and attached it to a user. What is the security implication of this policy?

Accepted Answer

The policy grants full administrative access to all RDS resources in the account.. The policy allows all RDS actions on all resources, granting full administrative access to all RDS resources in the account. This is overly permissive and violates the principle of least privilege. Option A is wrong because the policy does not restrict to a specific region. Option B is wrong because it does not restrict to a specific region. Option D is wrong because it does not restrict to read-only access.

Answer

The policy restricts access to only one specific DB instance.

Answer

The policy allows only actions in the us-east-1 region.

Answer

The policy only allows read-only access to RDS.

Question 10

A company wants to encrypt data at rest for an existing Amazon RDS for MySQL DB instance. The database is currently unencrypted. What is the most efficient way to enable encryption?

Accepted Answer

Create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the DB instance from the encrypted snapshot.. RDS encryption at rest can only be enabled at DB instance creation time — you cannot enable it on an existing unencrypted instance by modifying it. The supported migration path is to snapshot the unencrypted instance, copy the snapshot with the encryption option enabled (specifying a KMS key), and then restore a new DB instance from that encrypted snapshot. This is the standard, most efficient AWS-documented approach.

Answer

Enable encryption on the existing DB instance by modifying the parameter group.

Answer

Use AWS KMS to automatically encrypt the DB instance.

Answer

Modify the DB instance and enable encryption from the RDS console.

Question 11

A security team needs to audit all SQL statements executed against an Amazon Aurora MySQL DB cluster. Which combination of actions should be taken to achieve this? (Choose TWO.)

Accepted Answer

Set the server_audit_logging parameter to 1 in the DB cluster parameter group.. Options D and E are correct. To audit SQL statements in an Aurora MySQL DB cluster, you need to enable the Aurora MySQL audit plugin. This is done by setting the `server_audit_logging` parameter to 1 in the DB cluster parameter group (option D). Then you can configure the DB cluster to publish the audit logs to Amazon CloudWatch Logs (option E) for centralized monitoring and analysis. Option A is incorrect because AWS CloudTrail captures API calls, not SQL statements. Option B is incorrect because Enhanced Monitoring captures OS-level metrics, not SQL queries. Option C is incorrect because RDS event subscriptions notify about events like DB instance changes, not SQL execution.

Answer

Enable AWS CloudTrail for the Aurora DB cluster.

Answer

Enable Enhanced Monitoring for the DB cluster.

Answer

Enable RDS event subscription for the DB cluster.

Question 12

A company is using an Amazon DynamoDB table with a global table configuration across two AWS regions. The security team wants to ensure that all data is encrypted in transit between the regions. What should the team do?

Accepted Answer

No additional action is required; DynamoDB global tables encrypt all replication traffic in transit by default.. DynamoDB global tables automatically encrypt all replication traffic between regions using TLS. No additional configuration is needed to ensure encryption in transit for cross-region replication. This is a built-in security feature of global tables.

Answer

Configure an Internet gateway in each region and enforce HTTPS for all traffic.

Answer

Use AWS CloudFront to route traffic between the regions with SSL/TLS termination.

Answer

Set up a VPC peering connection between the two regions and route DynamoDB traffic through it.

Question 13

A company wants to audit all API calls made to its Amazon RDS DB instances. Which AWS service should be used to capture these API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service that records API activity in an AWS account, including both management events (control plane) and data events. Every API call made to Amazon RDS — such as CreateDBInstance, ModifyDBInstance, or DeleteDBInstance — is captured as a CloudTrail event with the caller identity, source IP, timestamp, and request parameters. This makes CloudTrail the correct tool for auditing API calls against RDS DB instances.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Question 14

A company is using Amazon DynamoDB Accelerator (DAX) for caching. The security team is concerned about data in transit between the application and DAX. What should the team do to ensure that all traffic to DAX is encrypted?

Accepted Answer

Enable encryption in transit when creating the DAX cluster.. To ensure all traffic to DAX is encrypted in transit, you must enable encryption in transit when creating the DAX cluster. This setting enforces TLS for all connections between the application and the DAX cluster, protecting data as it travels over the network. It is a cluster-level configuration that cannot be changed after creation, so it must be set at launch.

Answer

Launch the DAX cluster in a private subnet with a VPC endpoint.

Answer

Use AWS Certificate Manager to issue a certificate for the DAX cluster.

Answer

Use client-side encryption to encrypt data before sending it to DAX.

Question 15

A company is running an Amazon RDS for SQL Server DB instance with Multi-AZ deployment. The security team wants to ensure that all data at rest is encrypted using a customer-managed key stored in AWS KMS. Which steps must be taken to achieve this? (Choose THREE.)

Accepted Answer

Copy the snapshot and specify encryption with a KMS key.. To encrypt an existing unencrypted RDS instance, you must create a manual snapshot (D), copy the snapshot with encryption using a KMS key (C), and then restore the DB instance from the encrypted snapshot (E). Option A is incorrect because you cannot enable encryption on an existing DB instance directly. Option B is incorrect because Multi-AZ deployment does not automatically encrypt data.

Answer

Modify the DB instance and enable encryption.

Answer

Enable Multi-AZ deployment to encrypt data at rest.