DBS-C01 Database Security Practice Test 24 — 15 Questions

Question 1

A company wants to encrypt an existing unencrypted Amazon RDS for PostgreSQL DB instance. What is the correct procedure?

Accepted Answer

Take a snapshot of the instance, create an encrypted copy of the snapshot, and restore the encrypted snapshot to a new DB instance.. Amazon RDS does not allow enabling encryption on an existing unencrypted DB instance in place. The only supported method is to take a snapshot of the unencrypted instance, create an encrypted copy of that snapshot (specifying a KMS key), and then restore the encrypted snapshot to a new DB instance. This new instance will have encryption at rest enabled.

Answer

Take a snapshot of the instance and restore it with encryption enabled.

Answer

Modify the DB instance and enable encryption in the RDS console.

Answer

Create a read replica of the instance and enable encryption on the replica.

Question 2

A company is using Amazon DynamoDB with client-side encryption using the DynamoDB Encryption Client. The encryption keys are stored in AWS KMS. The security team wants to ensure that the encryption keys can be used only by authorized applications. What should be done?

Accepted Answer

Use a KMS key policy that grants access only to the specific IAM roles used by the applications.. The correct approach is to use a KMS key policy that grants access only to the specific IAM roles used by the applications. This ensures that only authorized applications can use the KMS key to encrypt and decrypt data. The DynamoDB Encryption Client uses KMS keys to protect data encryption keys, so restricting access to the KMS key via its policy is the most direct way to control which applications can use it. Other options do not provide the same level of access control.

Answer

Store the encryption keys in AWS CloudHSM instead of KMS.

Answer

Use AWS Secrets Manager to store the encryption keys and rotate them automatically.

Answer

Use an IAM policy that denies access to the DynamoDB table unless the request includes the correct key.

Question 3

A company is using Amazon RDS for MySQL and needs to encrypt data at rest for an existing DB instance. Which approach meets this requirement with minimal downtime?

Accepted Answer

Take a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore from the encrypted snapshot.. To encrypt an existing unencrypted RDS MySQL DB instance, you cannot directly modify the instance. The standard approach is to take a snapshot, create an encrypted copy of the snapshot, and then restore that encrypted snapshot to a new DB instance. This method typically involves minimal downtime compared to other options. Option A correctly describes this process. Option B is incorrect because encryption cannot be enabled directly on an existing instance. Option C is incorrect because the AWS CLI modify-db-instance command does not support enabling encryption on an existing instance; the --storage-encrypted flag only applies to new instances. Option D is incorrect because creating a read replica with encryption does not encrypt the primary instance; you would still need to perform a snapshot restore for the primary's encryption.

Answer

Enable encryption directly on the existing DB instance by modifying it.

Answer

Use the AWS CLI command modify-db-instance with the --storage-encrypted flag.

Answer

Create a read replica of the DB instance with encryption enabled, then promote it.

Question 4

A company uses Amazon Aurora MySQL and needs to audit all database logins, including failed attempts. Which feature should be enabled?

Accepted Answer

Database Activity Streams. Database Activity Streams (option A) is correct because it provides a near-real-time stream of all database activity in Aurora MySQL, including logins and failed authentication attempts, pushed to Amazon Kinesis for auditing. It captures connection-level and SQL-level events at the database engine level, which is exactly what auditing all logins and failed attempts requires. Enhanced Monitoring (B) only reports OS-level metrics such as CPU, memory, and disk I/O, not individual login events. VPC Flow Logs (C) capture IP traffic metadata at the network interface level and cannot identify database logins or authentication failures. AWS CloudTrail (D) records AWS API calls (e.g., RDS management actions), not database-level login activity.

Answer

Enhanced Monitoring

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Question 5

A company needs to securely store and manage the master password for their Amazon RDS for PostgreSQL instance. Which AWS service is purpose-built for managing secrets with automatic rotation?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is purpose-built for storing, managing, and automatically rotating secrets such as database credentials. It natively integrates with Amazon RDS for PostgreSQL to rotate master passwords on a schedule using a Lambda rotation function, eliminating hardcoded credentials. KMS encrypts the secret at rest, but Secrets Manager provides the rotation and lifecycle management.

Answer

AWS Key Management Service (KMS)

Answer

AWS Identity and Access Management (IAM)

Answer

AWS CloudHSM

Question 6

An application uses an Amazon RDS for MySQL database. The security team requires that all traffic to the database be encrypted in transit. Which configuration ensures this?

Accepted Answer

Create a custom DB parameter group with the require_secure_transport parameter set to ON.. The require_secure_transport parameter in a custom DB parameter group enforces SSL/TLS encryption for all connections to the RDS for MySQL instance. Setting it to ON ensures that unencrypted connections are rejected, meeting the security requirement for encryption in transit. This is the correct configuration because it directly controls transport-layer security at the database level.

Answer

Use the default RDS parameter group.

Answer

Configure the security group to allow only port 3306 from the application.

Answer

Use a network ACL to restrict inbound traffic to port 3306.

Question 7

A company wants to audit all SQL statements executed on their Amazon Aurora MySQL database for compliance. Which AWS feature should be enabled?

Accepted Answer

Database Activity Streams. Database Activity Streams provide a stream of database activities including SQL queries. Option B is wrong because VPC Flow Logs capture network traffic, not SQL statements. Option C is wrong because CloudWatch Logs can store logs but the source should be Database Activity Streams; CloudWatch Logs alone does not audit SQL statements. Option D is wrong because CloudTrail logs API calls, not SQL statements.

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 8

Which TWO actions should a company take to secure an Amazon RDS for MySQL database that is accessible from the internet? (Choose two.)

Accepted Answer

Use a security group that restricts inbound traffic to only the required IP addresses.. Option A is correct because an RDS security group acts as a virtual firewall controlling inbound traffic to the DB instance, so restricting it to only the required source IP addresses (or CIDR ranges) on the MySQL port (3306) prevents arbitrary internet access. Option E is correct because placing the DB instance in a private subnet with no public IP address removes the route to the internet entirely, so the database can only be reached from within the VPC or via controlled paths such as a bastion host, VPN, or Direct Connect. Option B is wrong because disabling encryption at rest weakens security and does not meaningfully reduce latency; encryption at rest should remain enabled. Option C is wrong because a default VPC public subnet with a network ACL allowing all traffic is permissive and exposes the database. Option D is wrong because launching the instance in a public subnet with a public IP address directly exposes it to the internet, which is the opposite of the desired hardening.

Answer

Disable encryption at rest to reduce latency.

Answer

Use the default VPC with a public subnet and a network ACL that allows all traffic.

Answer

Launch the DB instance in a public subnet with a public IP address.

Question 9

Which THREE components are required to set up IAM database authentication for an Amazon RDS for MySQL DB instance? (Choose three.)

Accepted Answer

An IAM role that the application can assume.. The three required components for setting up IAM database authentication for an Amazon RDS for MySQL DB instance are: (A) an IAM role that the application can assume to retrieve an authentication token from IAM; (C) a database user that is mapped to the IAM role in the RDS MySQL database; and (D) a DB parameter group with `require_secure_transport` set to ON to enforce SSL/TLS connections, which are mandatory for IAM authentication. Option B (AWS KMS key) is not required because the authentication token is signed by IAM, not encrypted with KMS. Option E (RDS Proxy) is optional and not a requirement; while it can provide connection pooling, it is not needed to set up IAM authentication itself.

Answer

An AWS KMS key to encrypt the authentication token.

Answer

An RDS Proxy to manage connections.

Question 10

A security engineer runs the commands shown in the exhibit for an RDS MySQL DB instance. The engineer wants to enforce SSL connections to the database. What should the engineer do?

Accepted Answer

Create a custom DB parameter group with require_secure_transport set to ON, associate it with the DB instance, and reboot the instance.. To enforce SSL connections on an RDS MySQL instance, you must set the `require_secure_transport` parameter to ON. Since default parameter groups cannot be modified, you must create a custom DB parameter group, set the parameter, associate it with the instance, and reboot for the change to take effect. This is the standard AWS-recommended approach for enforcing SSL/TLS on RDS MySQL.

Answer

Modify the default.mysql8.0 parameter group to set require_secure_transport to ON and reboot the instance.

Answer

Run the modify-db-instance command with --require-ssl-transport.

Answer

Modify the DB instance and set the --enable-iam-database-authentication flag.

Question 11

A company is using Amazon RDS for MySQL with automated backups enabled. The security team requires that all backups be encrypted at rest. Which configuration ensures that new automated backups are encrypted?

Accepted Answer

Create a new encrypted DB instance and migrate the data. Automated backups will inherit encryption.. For RDS, encryption at rest must be enabled at instance creation time — you cannot enable it on an existing unencrypted instance. Creating a new encrypted DB instance and migrating data ensures that the instance's automated backups inherit the same KMS encryption, satisfying the security requirement.

Answer

Modify the DB instance to enable encryption at rest after creation.

Answer

Use AWS KMS to encrypt the S3 bucket where automated backups are stored.

Answer

Enable encryption at rest on the DB instance and also enable encryption on automated backups using the DBSnapshot option.

Question 12

A financial company uses Amazon RDS for PostgreSQL with a custom parameter group. The security team wants to ensure that all connections to the database are encrypted in transit. Which action should the database administrator take?

Accepted Answer

Set the parameter 'rds.force_ssl' to 1 in the custom parameter group.. Setting the parameter 'rds.force_ssl' to 1 in the custom parameter group enforces SSL/TLS for all connections to the RDS for PostgreSQL instance. This ensures that connections are encrypted in transit.

Answer

Attach an IAM role to the RDS instance to authenticate users.

Answer

Change the database port to 8432 to use a non-standard port.

Answer

Set 'ssl' to 'off' in the parameter group.

Answer

Modify the security group to allow inbound traffic only on port 5432 with the '--ssl' option.

Question 13

A developer is troubleshooting an issue where an IAM user cannot perform a 'DescribeTable' action on a DynamoDB table. The IAM policy attached to the user is: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["dynamodb:GetItem","dynamodb:PutItem"],"Resource":"*"}]}. What is the most likely reason for the failure?

Accepted Answer

The policy does not include the 'dynamodb:DescribeTable' action.. The IAM policy explicitly allows only dynamodb:GetItem and dynamodb:PutItem. Because IAM policies are deny-by-default, any action not explicitly allowed is implicitly denied. Since dynamodb:DescribeTable is not listed in the Action array, the user cannot perform it, regardless of the Resource being '*'. This is the most likely and direct cause of the failure.

Answer

The policy uses lowercase 'dynamodb' but the action is case-sensitive.

Answer

There is an implicit Deny for DescribeTable due to a service control policy.

Answer

The resource specified in the policy is '*' which does not include the table.

Question 14

A company wants to restrict access to an Amazon RDS for MySQL DB instance so that only applications running in a specific VPC can connect. Which solution should be implemented?

Accepted Answer

Configure the DB instance's security group to allow inbound traffic only from the application's security group.. RDS security groups control inbound traffic at the instance/ENI level, and referencing the application's security group as the source is the canonical way to allow only that application tier to connect. This creates a dynamic, identity-based rule that follows the application instances regardless of their IP addresses. It is the standard AWS pattern for tiered VPC architectures and satisfies the requirement to restrict access to a specific VPC's applications.

Answer

Use an IAM policy to restrict database connections based on source IP.

Answer

Configure the subnet's network ACL to allow inbound traffic only from the application's IP range.

Answer

Attach a security group to the subnet that allows inbound traffic from the application's VPC.

Question 15

A company needs to encrypt an existing unencrypted Amazon RDS for Oracle DB instance. Which set of steps should be followed?

Accepted Answer

Take a snapshot of the instance, copy the snapshot with encryption enabled, and restore from the encrypted snapshot.. To encrypt an existing unencrypted RDS for Oracle DB instance, you must take a snapshot, copy the snapshot with encryption enabled, and then restore from the encrypted snapshot. This creates a new encrypted DB instance. Encryption cannot be enabled directly on an existing unencrypted instance.

Answer

Enable encryption using the AWS Management Console by selecting the instance and choosing 'Enable Encryption'.

Answer

Modify the DB instance and set the KMS key ID to enable encryption.

Answer

Copy the snapshot to an encrypted snapshot and then restore.