DBS-C01 Database Security Practice Test 28 — 15 Questions

Question 1

A company uses Amazon RDS for SQL Server and wants to audit all login attempts and database operations for compliance. The security team needs to capture detailed logs, including successful and failed logins, and store them for 90 days. Which solution should they implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable SQL Server Audit on the DB instance and configure it to write to file, then set up a job to upload logs to Amazon S3 with a 90-day lifecycle policy.. To audit logins and database operations on Amazon RDS for SQL Server, enable SQL Server Audit, which can capture successful and failed logins and other actions. Configure it to write to files, then export those logs to Amazon S3 and apply a lifecycle policy to retain them for 90 days. This meets the compliance requirement.

Answer

Enable Amazon RDS Enhanced Monitoring and set the retention period to 90 days.

Answer

Use AWS CloudTrail to log all database operations and set the trail to retain logs for 90 days.

Answer

Enable Amazon CloudWatch Logs for the DB instance and create a metric filter for login events.

Question 2

A company uses Amazon DynamoDB to store user session data. The security team wants to ensure that all data is encrypted at rest using a customer managed key (CMK) in AWS KMS, and that they can audit key usage. They also want to minimize operational overhead. Which approach should they take?

Accepted Answer

Enable DynamoDB encryption at rest with a customer managed CMK in AWS KMS.. DynamoDB encryption at rest with a customer managed CMK allows the security team to use their own KMS key, audit key usage through CloudTrail, and manage key rotation. It is a server-side encryption feature that requires no application changes and minimal operational effort. The other options either do not use a CMK, add complexity, or are not supported.

Answer

Use AWS CloudHSM to store the encryption keys and integrate with DynamoDB.

Answer

Use client-side encryption with a custom application that encrypts data before writing to DynamoDB.

Answer

Enable DynamoDB encryption at rest with the default AWS owned CMK.

Question 3

A company uses Amazon Redshift and needs to implement row-level security so that users from the sales department can only see rows where the region column matches their assigned region. The security team wants to enforce this at the database level without modifying application queries. Which feature should they use?

Accepted Answer

Use Redshift row-level security (RLS) policies to define access based on the current user's role or group.. Amazon Redshift row-level security (RLS) allows you to define policies that filter rows based on the current user's role or group. This enforcement is transparent to applications and does not require query modifications. By creating an RLS policy that matches the region column to the user's assigned region, the sales department users will only see rows for their region.

Answer

Use Redshift Spectrum to create an external table with a filter on the region column based on the user.

Answer

Create a view that filters rows based on the current user and grant access to the view instead of the base table.

Answer

Implement column-level security by granting only the region column to sales users.

Question 4

A company uses Amazon RDS for SQL Server and wants to audit all login attempts and database operations for compliance. The security team needs to capture detailed logs, including successful and failed logins, and store them for 90 days. Which solution should they implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable AWS CloudTrail logging for the KMS key and restrict key usage to the RDS service principal via the KMS key policy.. For RDS SQL Server TDE, the TDE certificate is protected by a customer-managed KMS key. To audit access to that key, CloudTrail must be enabled (which logs KMS API calls by default for customer-managed keys). Additionally, the KMS key policy should restrict usage to the RDS service principal to enforce least privilege. This ensures both visibility and control over the key protecting the TDE certificate.

Answer

Use AWS Certificate Manager (ACM) to issue a certificate for TDE and configure RDS to use it.

Answer

Store the TDE certificate and private key in AWS Secrets Manager and rotate them every 90 days.

Answer

Enable RDS Enhanced Monitoring to capture TDE certificate access events.

Question 5

A company uses Amazon Aurora PostgreSQL and wants to implement row-level security (RLS) to restrict access to rows based on the current database user. The security team requires that the RLS policies are enforced for all users, including the table owner, and that the policies are applied automatically when new tables are created in a specific schema. Which combination of actions should a database specialist take to meet these requirements?

Accepted Answer

For each table, enable RLS with ALTER TABLE ... ENABLE ROW LEVEL SECURITY, then use ALTER TABLE ... FORCE ROW LEVEL SECURITY, and create policies using CREATE POLICY. To automate for new tables, create an event trigger that executes these commands on table creation.. To enforce RLS for all users including the table owner in Aurora PostgreSQL, you must enable RLS on each table and then use FORCE ROW LEVEL SECURITY. This ensures that the table owner is also subject to the policies. Policies are created with CREATE POLICY to define row access. To apply this automatically to new tables in a schema, an event trigger can be set up to execute the necessary ALTER TABLE and CREATE POLICY commands upon table creation. This combination satisfies the requirement for automatic enforcement.

Answer

Create a role with BYPASSRLS privilege, grant it to all users, and create RLS policies that reference the current_user.

Answer

Create a view for each table that filters rows based on current_user, grant SELECT on the views to users, and revoke direct table access.

Answer

Enable RLS on each table using ALTER TABLE ... ENABLE ROW LEVEL SECURITY, create policies with CREATE POLICY, and set the row_security parameter to on for all users.

Question 6

A company has an Amazon Redshift cluster that contains sensitive data. The security team wants to ensure that all connections to the cluster are encrypted in transit and that only authorized users can connect. They have already configured the cluster in a private VPC subnet. Which additional step should the database specialist take to enforce encryption in transit?

Accepted Answer

Enable SSL enforcement by setting the require_ssl parameter to true in the cluster's parameter group.. For Amazon Redshift, encryption in transit is enforced by setting the require_ssl parameter to true in the parameter group associated with the cluster. This ensures that all client connections use SSL/TLS. Other options either address different security aspects or are not valid for Redshift, so setting require_ssl is the correct action.

Answer

Attach an IAM policy to the cluster that denies unencrypted connections.

Answer

Enable encryption at rest using AWS KMS, which also encrypts data in transit.

Answer

Configure the cluster to use AWS Certificate Manager (ACM) certificates for SSL/TLS.

Question 7

A company uses Amazon DynamoDB to store user session data. The security team wants to enforce that all data written to the table is encrypted with a customer-managed AWS KMS key, and that only specific IAM roles can read the data. Which combination of actions should they take?

Accepted Answer

Create a customer-managed KMS key, enable DynamoDB encryption at rest with that key, and attach an IAM policy granting dynamodb:GetItem only to the specific roles.. To enforce customer-managed encryption for DynamoDB, you must create a customer-managed KMS key and configure the table to use it for encryption at rest. To restrict read access, an IAM policy granting dynamodb:GetItem to specific roles is required. The default AWS owned key cannot be customer-managed, and other services like Secrets Manager or DynamoDB Streams do not provide the required encryption control.

Answer

Enable DynamoDB encryption at rest with the default AWS owned key and attach an IAM policy to the roles allowing dynamodb:GetItem.

Answer

Use AWS Secrets Manager to store the DynamoDB table name and restrict access to the secret.

Answer

Enable DynamoDB Streams and use an AWS Lambda function to encrypt each item with a customer-managed KMS key before writing to the table.

Question 8

A financial services company runs Amazon RDS for SQL Server with Transparent Data Encryption (TDE) enabled using a customer-managed KMS key. An auditor asks how the database encryption keys are protected and rotated. The security team must explain which component actually performs the encryption and how key rotation is handled. Which statement is correct?

Accepted Answer

SQL Server TDE encrypts the database with a data encryption key protected by a certificate, and RDS manages the certificate using the KMS customer-managed key for envelope encryption.. RDS for SQL Server TDE uses a layered key model: SQL Server creates a database encryption key, protects it with a certificate, and RDS encrypts that certificate with a customer-managed KMS key. The KMS key never touches data blocks directly, and rotation affects the wrapping key rather than forcing immediate re-encryption. This envelope approach is what the auditor needs to understand.

Answer

TDE uses the KMS customer-managed key only for backup encryption, while primary data files remain unencrypted unless RDS encryption is also enabled.

Answer

RDS encrypts the database files directly with the KMS customer-managed key, and rotating that key re-encrypts all data immediately.

Answer

The KMS customer-managed key directly encrypts the SQL Server transaction log, while data files are encrypted with an IAM-generated key.

Question 9

A security team is using Amazon RDS for Oracle with Transparent Data Encryption (TDE) enabled. They need to rotate the encryption keys regularly without causing downtime. The RDS instance is using the Oracle Enterprise Edition with the Advanced Security Option. What is the correct method to rotate the TDE master encryption key?

Accepted Answer

Connect to the Oracle database and execute the ADMINISTER KEY MANAGEMENT SET KEY command to rotate the master encryption key.. Oracle TDE master key rotation is performed within the database using the ADMINISTER KEY MANAGEMENT SET KEY command. This operation rotates the master key and re-encrypts the data encryption keys without downtime. It is not managed through RDS console, option groups, or AWS KMS.

Answer

Take a snapshot of the DB instance, restore it with a new KMS key, and switch over.

Answer

Create a new option group with a new TDE master key and apply it to the DB instance.

Answer

Use the RDS console to modify the DB instance and select a new master encryption key from AWS KMS.

Question 10

A healthcare company stores patient records in an Amazon DynamoDB table. The security team must ensure that only authenticated users from a specific Amazon Cognito identity pool can read and write items, and that each user can access only their own records. They decide to use IAM policies with fine-grained access control. Which combination of features must they use to meet these requirements?

Accepted Answer

Use IAM roles for Cognito identities and a DynamoDB policy with a Condition element that uses dynamodb:LeadingKeys to match the user's identity.. DynamoDB fine-grained access control relies on IAM condition keys, specifically dynamodb:LeadingKeys, to restrict operations to items whose partition key matches the caller. When combined with Cognito identity pools and IAM roles, this lets each authenticated user access only their own records. Streams, per-user tables, and DAX do not provide the required item-level authorization.

Answer

Create a separate DynamoDB table for each user and grant each Cognito identity access only to its own table using an IAM policy.

Answer

Use DynamoDB Accelerator (DAX) with an IAM policy that limits access based on the Cognito user's email address stored in the item.

Answer

Enable DynamoDB Streams and use an AWS Lambda function to filter items based on the Cognito user ID before returning results.

Question 11

A company runs an Amazon RDS for Oracle DB instance in a private subnet. The security team wants to allow only the application servers in a specific VPC security group to connect to the database on port 1521, and to block all other traffic. What is the correct way to configure this?

Accepted Answer

Modify the RDS DB instance's security group to allow inbound traffic on port 1521 from the application servers' security group.. Network access to an RDS DB instance is controlled by VPC security groups. To allow only specific application servers, you add an inbound rule to the RDS instance's security group that references the application servers' security group as the source on the database port. Network ACLs, parameter groups, and IAM policies do not provide this level of precise, dynamic network control.

Answer

Create a network ACL on the DB subnet that allows inbound traffic on port 1521 from the application servers' IP addresses.

Answer

Attach an IAM policy to the RDS instance that allows connections only from the application servers' IAM roles.

Answer

Configure the RDS instance's parameter group to restrict connections to specific IP addresses on port 1521.

Question 12

A company runs an Amazon RDS for Oracle DB instance. The security team wants to ensure that all data in the database is encrypted at rest using a key that the company controls and can audit. Which option should the company choose?

Accepted Answer

Enable encryption at rest using an AWS KMS customer managed key when creating the DB instance.. To encrypt an RDS for Oracle DB instance at rest with a key the company controls and can audit, use an AWS KMS customer managed key. This provides full control over the key lifecycle and auditability via CloudTrail. Oracle TDE with Oracle Wallet does not provide the same level of AWS-integrated control, and SSL/TLS is for data in transit.

Answer

Enable SSL/TLS for all connections to the DB instance.

Answer

Use Oracle Transparent Data Encryption (TDE) with a key stored in Oracle Wallet.

Answer

Enable encryption at rest using an AWS owned key.

Question 13

A company runs an Amazon RDS for SQL Server DB instance. The security team wants to ensure that all connections to the database are encrypted using SSL/TLS. They have already created a custom option group and added the SSL option. Which additional step is required to enforce SSL/TLS for all connections?

Accepted Answer

Modify the DB instance to set the Force SSL option to true in the SSL option settings.. For RDS for SQL Server, SSL/TLS encryption is enabled by adding the SSL option to the option group. To enforce that all connections use SSL, you must configure the option to set Force SSL to true. This setting makes the server reject unencrypted connections. Other parameters like rds.force_ssl are for different engines, and SQLNET parameters are for Oracle. Simply restarting the instance does not enforce SSL; the option must be configured correctly.

Answer

Create a new parameter group and set the SQLNET.SSL_VERSION parameter to 1.2.

Answer

Set the rds.force_ssl parameter to 1 in the parameter group associated with the DB instance.

Answer

Restart the DB instance to apply the SSL option.

Question 14

A company uses Amazon Redshift and has implemented column-level access control using Redshift's column-level privileges. The security team now wants to ensure that when a user queries a table, they can only see rows that match their department. The company already uses an IAM role for Redshift Spectrum and has a mapping of users to departments in a separate table. Which Redshift feature should be used to enforce row-level security dynamically based on the user's department?

Accepted Answer

Create a row-level security policy using the CREATE RLS POLICY statement and attach it to the table.. Amazon Redshift row-level security (RLS) allows you to define policies that filter rows based on the current user or their group. By using CREATE RLS POLICY and ATTACH RLS POLICY, you can dynamically enforce row-level access based on a mapping table. Column-level privileges, views, and Redshift Spectrum do not provide the same centralized, dynamic row-level filtering.

Answer

Use column-level privileges to restrict access to the department column.

Answer

Create a view that filters rows based on the current user and grant SELECT on the view to users.

Answer

Enable Redshift Spectrum and create an external table with row filtering.

Question 15

A company uses Amazon Redshift for a data warehouse. The security team requires that all data in the cluster be encrypted at rest using a hardware security module (HSM) to meet compliance requirements. The cluster is currently unencrypted. What should the company do to meet this requirement?

Accepted Answer

Create a new Redshift cluster with HSM encryption enabled, and migrate the data from the existing cluster.. Amazon Redshift HSM encryption must be enabled when the cluster is created; it cannot be added to an existing cluster. To meet the compliance requirement, the company must create a new Redshift cluster with HSM encryption enabled and then migrate the data from the existing unencrypted cluster. This ensures that all data at rest is encrypted using an HSM.

Answer

Enable encryption on the existing cluster using AWS KMS with a customer-managed key, and then enable HSM encryption.

Answer

Modify the existing cluster to use HSM encryption by enabling it in the cluster's parameter group.

Answer

Use AWS KMS with a customer-managed key and enable automatic key rotation to meet the HSM requirement.