DBS-C01 Database Security Practice Test 26 — 15 Questions

Question 1

A company runs an Amazon RDS for SQL Server DB instance in a private subnet. A security engineer must ensure that all connections to the database are encrypted in transit and that the DB instance rejects any unencrypted client connections. The company uses a self-signed certificate for the DB instance. What should the security engineer do to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the Force Encryption option to Yes in the DB parameter group, and restart the DB instance.. For RDS for SQL Server, encryption in transit is enforced by setting the Force Encryption option to Yes in the DB parameter group. This forces all client connections to use TLS. After changing the parameter group, the DB instance must be rebooted for the setting to take effect. Other engines like MySQL and PostgreSQL use the rds.force_ssl parameter, but that parameter is not available for SQL Server.

Answer

Attach an IAM policy that denies access to the DB instance unless the connection uses SSL, and apply it to all users.

Answer

Modify the DB instance to set the parameter rds.force_ssl to 1, and restart the DB instance.

Answer

Modify the DB parameter group to set rds.force_ssl to 1, and restart the DB instance.

Question 2

A company uses Amazon Aurora PostgreSQL and wants to implement fine-grained access control for a table containing sensitive data. The security team needs to allow users in the 'analysts' role to see only rows where the 'region' column matches their assigned region, which is stored in a session variable. They also need to ensure that the filtering cannot be bypassed by users with direct table access. Which approach should a database specialist recommend?

Accepted Answer

Enable row-level security (RLS) on the table, create a policy that uses the session variable to filter rows, and grant the analysts role access to the table.. Row-level security (RLS) in Aurora PostgreSQL allows you to define policies that filter rows based on the current user or session variables. By enabling RLS and creating a policy that uses a session variable, you can ensure that users only see rows matching their region. This enforcement happens at the database engine level and cannot be bypassed by direct table access, as long as RLS is enabled and the policy is applied.

Answer

Create a separate schema for each region, copy the data into each schema, and grant the analysts role access only to the schema for their region.

Answer

Create a view that filters rows based on the session variable, and grant the analysts role SELECT on the view only.

Answer

Use column-level encryption for the 'region' column, and provide the encryption key only to users in the correct region.

Question 3

A company stores sensitive data in an Amazon DynamoDB table. The security team wants to ensure that all data at rest is encrypted using a customer managed key in AWS KMS, and that the key is automatically rotated every year. They also need to monitor who uses the key. Which combination of actions should a database specialist take to meet these requirements?

Accepted Answer

Create a customer managed key in AWS KMS with automatic rotation enabled, and configure the DynamoDB table to use that key for encryption at rest.. To use a customer managed key with automatic rotation for DynamoDB encryption at rest, you create the key in AWS KMS, enable automatic rotation (which rotates yearly), and then configure the DynamoDB table to use that key. This provides control over the key and allows monitoring of key usage via CloudTrail. AWS owned and AWS managed keys do not offer the same customization and rotation control.

Answer

Use an AWS managed key for DynamoDB, and enable rotation on that key through the KMS console.

Answer

Enable DynamoDB encryption at rest with the default AWS owned key, and enable automatic key rotation on that key.

Answer

Enable DynamoDB encryption at rest with a customer managed key, and use AWS Certificate Manager to rotate the key annually.

Question 4

A company uses Amazon Redshift for its data warehouse. The security team wants to ensure that all data stored in the cluster is encrypted at rest using a hardware security module (HSM) to meet regulatory requirements. Which encryption option should be used?

Accepted Answer

AWS CloudHSM with a custom key.. Amazon Redshift supports encryption at rest using AWS CloudHSM, which provides dedicated HSMs. This allows the use of a custom key stored in CloudHSM and satisfies regulatory requirements for HSM-backed encryption. When creating a Redshift cluster, you can choose CloudHSM as the encryption option and specify the HSM connection details.

Answer

SSL/TLS encryption for data in transit.

Answer

Amazon S3 server-side encryption with AWS KMS.

Answer

AWS Key Management Service (KMS) with a customer managed key.

Question 5

A company uses Amazon DynamoDB with a table that contains sensitive customer records. The security team wants to implement fine-grained access control so that each application user can only read and write items where the partition key matches their own user ID. The team also wants to ensure that the user cannot access items belonging to other users even if they craft their own requests. Which TWO actions should a database specialist take to meet these requirements? (Choose two.)

Accepted Answer

Attach the IAM policy to the IAM principals (users or roles) that the application uses, ensuring that the policy is evaluated for every DynamoDB request.. DynamoDB fine-grained access control is implemented through IAM policies that use the dynamodb:LeadingKeys condition key to restrict access to items where the partition key matches a value derived from the user's identity. The policy must be attached to the IAM principal (user or role) that the application assumes, so that every request is authorized accordingly. This prevents users from accessing other users' items even with crafted requests.

Answer

Use DynamoDB Accelerator (DAX) with a custom authorizer to inspect each request and allow or deny based on the partition key.

Answer

Configure a VPC endpoint for DynamoDB and use a VPC endpoint policy to restrict access to items based on the user ID.

Answer

Enable DynamoDB Streams on the table and use an AWS Lambda function to filter out unauthorized read requests based on the user ID in the request context.

Question 6

A healthcare company stores sensitive patient data in an Amazon RDS for Oracle DB instance. The security team requires that all data at rest be encrypted using a customer-managed AWS KMS key (CMK) that they control, and that the key be rotated annually. They also need to ensure that if the CMK is disabled, the database becomes inaccessible. Which configuration should the database specialist implement?

Accepted Answer

Create a customer-managed CMK in AWS KMS, enable automatic key rotation, and specify that CMK when creating or modifying the RDS instance to enable encryption.. To meet the requirements, the database must be encrypted with a customer-managed CMK that the customer controls. Enabling automatic key rotation on that CMK satisfies the annual rotation requirement. Disabling the CMK prevents RDS from accessing the encryption key, making the database inaccessible, which is the desired security behavior. The other options either use AWS managed keys or Oracle TDE, which do not provide the same level of customer control and integration with AWS KMS.

Answer

Use Oracle Transparent Data Encryption (TDE) with a master key stored in Oracle Wallet on the DB instance.

Answer

Enable encryption at rest using an AWS managed key, and then use AWS KMS grants to allow the customer to rotate the key manually.

Answer

Enable encryption at rest on the RDS instance using the default AWS managed key for RDS.

Question 7

A company is using Amazon RDS for Oracle and needs to implement Transparent Data Encryption (TDE) for a new DB instance. The security team wants to use AWS KMS to manage the encryption keys. Which two actions must be performed to enable TDE with KMS for the RDS for Oracle instance? (Choose two.)

Accepted Answer

Create a KMS customer managed key and grant the RDS service the necessary permissions to use it.. To enable Oracle TDE with AWS KMS on RDS, you must create a custom option group with the Oracle Transparent Data Encryption option and associate it with the DB instance. Additionally, you must create a KMS customer managed key and grant the RDS service principal permissions to use it. These two actions are required. Instance-level encryption at rest, Multi-AZ, and IAM roles for the instance are not part of this process.

Answer

Restart the DB instance in a Multi-AZ configuration to activate TDE.

Answer

Create an IAM role that allows the DB instance to access the KMS key, and attach it to the DB instance.

Answer

Modify the DB instance to enable encryption at rest using the KMS key.

Question 8

A security engineer manages an Amazon Aurora PostgreSQL cluster that stores regulated data. Audit requirements mandate that all data at rest be encrypted with a customer-managed AWS KMS key, and that the key be automatically rotated every year. The engineer creates a new KMS customer-managed key with automatic rotation enabled and now needs to apply it to the existing cluster. The cluster currently uses an AWS-managed key (aws/rds). What should the engineer do to meet these requirements with the LEAST operational effort?

Accepted Answer

Create a snapshot of the cluster, copy the snapshot with the new customer-managed KMS key, restore a new cluster from that encrypted snapshot, and repoint applications to the new cluster.. Encryption keys on Aurora storage are fixed when the cluster is created and cannot be swapped by modifying or rebooting the cluster. The supported, low-effort method to move an encrypted cluster to a different customer-managed KMS key is to copy a snapshot using the target key and restore a new cluster from that copy, then redirect clients. This satisfies the customer-managed key and annual rotation requirements without a logical data migration.

Answer

Enable automatic rotation on the existing AWS-managed aws/rds key and continue using it for the cluster.

Answer

Use AWS Database Migration Service with change data capture to replicate the cluster into a new cluster that is encrypted with the customer-managed key.

Answer

Modify the existing Aurora cluster to use the new customer-managed KMS key, then reboot the writer instance to apply the change.

Question 9

A financial services company uses an Amazon Aurora PostgreSQL cluster to store account transaction records. A security policy mandates that all data be encrypted at rest with a customer-managed AWS KMS key, and that the company retain full control over key rotation and access policies. The database was created without encryption. What should a database specialist do to meet the encryption requirement with the LEAST operational effort?

Accepted Answer

Create a new encrypted Aurora cluster using the customer-managed KMS key, then migrate data using a logical dump and restore or snapshot copy as appropriate.. Aurora encryption at rest is selected when the cluster is created and cannot be enabled later on that same cluster. To satisfy a customer-managed KMS key requirement for an existing unencrypted cluster, you create a new encrypted cluster with that key and migrate the data. Copying an unencrypted snapshot with encryption creates an encrypted snapshot, but restoring it produces a new cluster rather than converting the original.

Answer

Enable encryption on the existing cluster by modifying the cluster and specifying the customer-managed KMS key.

Answer

Take a snapshot of the unencrypted cluster, enable encryption on the snapshot, and restore the snapshot to the existing cluster in place.

Answer

Attach an IAM policy that enforces encryption at rest and apply AWS KMS grants to the existing cluster's storage volumes.

Question 10

A financial services company runs an Amazon Aurora PostgreSQL cluster. The security team must ensure that all connections to the database use TLS and that the database rejects any unencrypted connections. The team has already obtained the rds-ca-2019 certificate and configured the client applications to use SSL. Which additional step is required to enforce TLS for all connections?

Accepted Answer

Set the rds.force_ssl parameter to 1 in a custom DB cluster parameter group and apply it to the cluster.. The rds.force_ssl parameter in Aurora PostgreSQL enforces SSL/TLS for all connections. Setting it to 1 in a custom cluster parameter group and associating it with the cluster ensures that any non-SSL connection attempt is rejected. This is the standard method to require encryption in transit. Other options address authentication, network filtering, or encryption at rest, none of which enforce TLS on connections.

Answer

Enable encryption at rest using an AWS KMS customer managed key for the DB cluster.

Answer

Modify the DB cluster to enable IAM database authentication and require all users to authenticate with IAM credentials.

Answer

Attach a security group to the DB cluster that only allows inbound traffic on port 5432 from IP addresses that support TLS.

Question 11

A company stores sensitive data in an Amazon DynamoDB table. The security team requires that all data be encrypted at rest using a customer managed AWS KMS key (CMK) and that they can audit all decryption attempts. Which combination of actions should be taken to meet these requirements?

Accepted Answer

Create a customer managed CMK in AWS KMS, configure the DynamoDB table to use this CMK for encryption at rest, and enable AWS CloudTrail logging for KMS.. Using a customer managed CMK in AWS KMS for DynamoDB encryption at rest gives the customer control over the key and enables auditing of key usage. Enabling CloudTrail for KMS logs all decryption attempts, providing the required audit trail. This combination meets both the encryption and auditability requirements.

Answer

Use DynamoDB Accelerator (DAX) with encryption at rest enabled and configure DAX to use a customer managed CMK.

Answer

Enable DynamoDB encryption at rest with the default AWS owned CMK and enable AWS CloudTrail logging for DynamoDB.

Answer

Enable DynamoDB Streams and use AWS Lambda to encrypt the data with a customer managed CMK before writing to the table.

Question 12

A company uses Amazon RDS for SQL Server with Transparent Data Encryption (TDE) enabled. The security team wants to ensure that the TDE certificates and private keys are managed by the company and not by AWS. What should the team do to meet this requirement?

Accepted Answer

Import a TDE certificate into the RDS instance using the rdsadmin stored procedure and then enable TDE with that certificate.. To use customer-managed TDE certificates with RDS for SQL Server, you must import the certificate and private key into the DB instance using the rdsadmin stored procedure. This allows the company to retain control over the certificate and keys. After import, you can enable TDE with that certificate. The other options incorrectly involve AWS KMS or do not provide the necessary control over the TDE certificate.

Answer

Use the RDS option group to configure TDE with a customer managed key stored in AWS KMS.

Answer

Enable TDE using the default RDS service-managed certificate, and then rotate the certificate using AWS KMS.

Answer

Create a symmetric key in the master database and use it to encrypt the TDE certificate, then store the key in AWS Secrets Manager.

Question 13

A financial services company runs an Amazon Aurora PostgreSQL cluster. The security team requires that all connections to the database be encrypted in transit. They have configured the cluster to use a custom parameter group. Which combination of steps should they take to enforce TLS for all client connections?

Accepted Answer

Set the rds.force_ssl parameter to 1 in the custom parameter group and reboot the cluster.. To enforce TLS for all connections to an Aurora PostgreSQL cluster, the rds.force_ssl parameter must be set to 1 in the cluster parameter group. This setting rejects non-SSL connections. Changing a parameter in a custom parameter group requires a reboot of the cluster to take effect. Other options, such as security group changes or IAM authentication, do not enforce encryption in transit.

Answer

Enable IAM database authentication on the cluster and require all users to authenticate with IAM credentials.

Answer

Modify the security group associated with the cluster to allow only port 5432 and block port 5433.

Answer

Create a new parameter group with ssl_min_protocol_version set to TLSv1.2 and apply it to the cluster.

Question 14

A company uses Amazon DynamoDB to store user session data. The security team wants to ensure that all data stored in the table is encrypted at rest using a customer-managed AWS KMS key so they can control key rotation and audit key usage. The table currently uses the AWS owned key. What should a database specialist do to meet this requirement?

Accepted Answer

Create a new table with the customer-managed KMS key specified, migrate the data, and update applications to use the new table.. DynamoDB tables are encrypted at rest by default, but the encryption key choice is made at creation and cannot be changed afterward. To use a customer-managed KMS key, you must create a new table with that key and migrate data into it. Resource policies and KMS grants manage access, not the table's encryption key binding.

Answer

Enable AWS KMS customer-managed key encryption by adding a resource-based policy to the existing table that references the KMS key.

Answer

Modify the table's encryption settings in the DynamoDB console to select the customer-managed KMS key.

Answer

Use AWS KMS grants to associate the customer-managed key with the existing table's underlying storage.

Question 15

A company is using Amazon Aurora MySQL and wants to implement fine-grained access control for its database users. The security team requires that specific users can only access certain columns in a table and that all failed login attempts are logged. Which two actions should the team take to meet these requirements? (Choose two.)

Accepted Answer

Enable the audit_log plugin and configure it to log connection events, including failed logins.. For column-level access control in Aurora MySQL, use the native MySQL GRANT statement to assign privileges on specific columns. To log failed login attempts, enable the audit_log plugin and configure it to capture connection events. IAM policies, Lake Formation, and Global Database do not provide these database-level controls. Thus, the correct actions are to use column-level grants and enable audit logging.

Answer

Enable Aurora Global Database and use its write forwarding to enforce column-level security across regions.

Answer

Create an IAM policy that restricts access to specific columns in the Aurora table.

Answer

Use AWS Lake Formation to define column-level permissions on the Aurora table.