DBS-C01 Database Security Practice Test 3 — 15 Questions

Question 1

A company is using Amazon Aurora MySQL-Compatible Edition. The security team wants to audit all database login attempts and store the logs in Amazon S3 for 90 days. Which solution meets these requirements with the LEAST operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable the Aurora audit log and publish logs to Amazon CloudWatch Logs. Create a CloudWatch Logs subscription filter to stream the logs to an Amazon S3 bucket.. Aurora MySQL audit logs are published to CloudWatch Logs, and a CloudWatch Logs subscription filter can stream those logs to Amazon S3 with configurable retention. This uses only managed AWS services, requires no custom code or plugins, and satisfies the 90-day retention requirement via S3 lifecycle policies. It is the lowest-operational-overhead solution among the options.

Answer

Enable the Aurora audit log and configure the DB cluster to publish logs directly to an S3 bucket.

Answer

Install a custom audit plugin on the Aurora cluster that writes logs to a file, then use an AWS Lambda function to upload the file to S3.

Answer

Enable the Aurora audit log and use Amazon Kinesis Data Firehose to stream the logs to S3.

Question 2

A company has an Amazon DynamoDB table with global secondary indexes (GSIs) that store personally identifiable information (PII). The security team requires that all PII is encrypted at rest using a customer-managed KMS key. The table already exists and is encrypted with the default AWS managed key. What is the MOST efficient way to change the encryption to a customer-managed key?

Accepted Answer

Create a new DynamoDB table with the customer-managed key, use AWS Glue to copy the data from the old table to the new table, and then delete the old table.. The correct option is C: create a new DynamoDB table encrypted with the customer-managed KMS key, copy the data over with AWS Glue, and delete the old table. DynamoDB does not support changing the encryption key of an existing table in place, so the data must be migrated to a new table that is created with the desired customer-managed key. AWS Glue is an efficient serverless way to copy the data, and this approach also covers the GSIs since they are recreated with the new table. Option A is not the most efficient because restoring a backup creates a new table but does not let you specify a different KMS key during restore, and it may not preserve all settings as directly as a purpose-built copy. Option B is invalid because the console cannot modify an existing table's encryption key, and option D is invalid because the DynamoDB update-table command has no --sse-specification parameter to change the KMS key.

Answer

Create a backup of the table, restore the backup to a new table, and specify the customer-managed key during restoration.

Answer

Use the AWS Management Console to modify the table and select the customer-managed key.

Answer

Use the AWS CLI 'update-table' command with the --sse-specification parameter to change the key.

Question 3

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all database connections use SSL and that the database is encrypted at rest. Which THREE steps are required to meet these requirements? (Choose THREE.)

Accepted Answer

Modify the DB parameter group to set 'require_ssl' to 'true'.. Option C is correct because Amazon RDS for Oracle enforces SSL/TLS for all connections by setting the DB parameter group parameter 'require_ssl' (in the sqlnet/SSL-related parameter group) to 'true', which rejects non-SSL sessions. Option D is correct because clients must trust the AWS-provided RDS CA certificate; you download the RDS SSL certificate bundle (e.g., rds-ca-rsa2048-g1 or the global bundle) and configure the application's truststore/wallet to validate the server certificate during the TLS handshake. Option E is correct because encryption at rest for RDS for Oracle must be enabled at instance creation time by selecting storage encryption (KMS key), since it cannot be enabled after the instance is created without restoring from an encrypted snapshot. Option A is not required because RDS for Oracle uses AWS-managed SSL certificates, not customer-uploaded certificates, for the DB instance endpoint. Option B is not required because the RDS CA certificate must be trusted by the client application, not installed as a server certificate on every client machine.

Answer

Upload a custom SSL certificate to the RDS instance.

Answer

Install the SSL certificate on every client machine.

Question 4

An IAM policy is attached to a role used by an RDS instance. The RDS instance is in VPC with a VPC endpoint to KMS. What is the effect of this policy?

Accepted Answer

Allows only the specified KMS actions on the key when the request originates from the RDS service via the specific VPC endpoint.. An IAM policy attached to a role used by an RDS instance, combined with a VPC endpoint to KMS, restricts the allowed KMS actions to only those specified and requires that the request originate from the RDS service via that specific VPC endpoint. Option A is incorrect because it suggests all KMS actions are allowed, which is not the case; only specified actions are allowed. Option B is incorrect because it mistakenly implies the policy allows actions from any source, ignoring the VPC endpoint restriction. Option C is incorrect because it states the policy applies to all KMS keys, whereas it is typically scoped to a specific key.

Answer

Allows all KMS actions on the key only when the request comes from RDS.

Answer

Allows all KMS actions on the specified key from any source.

Answer

Allows the specified KMS actions on all KMS keys in the account.

Question 5

The security team reports that the database 'mydb' is not encrypted. However, the CLI output shows 'StorageEncrypted' is true. What is the MOST likely reason for the security team's concern?

Accepted Answer

The KMS key specified may have been disabled or deleted, causing the database to be inaccessible or not encrypted.. If the CLI reports StorageEncrypted=true but the security team says the database is not encrypted, the most likely explanation is that the referenced KMS key was disabled or scheduled for deletion. A disabled or deleted KMS key means the database cannot be decrypted — effectively making the data inaccessible and, from a security/compliance perspective, appearing unencrypted or broken. This is a common operational failure mode when a KMS key is mistakenly disabled or deleted.

Answer

The database is using a default AWS managed key instead of a customer-managed key.

Answer

The 'StorageEncrypted' field is false, but the CLI output shows true.

Answer

The database is not using a KMS key and is instead using a CloudHSM key.

Question 6

A company has an Amazon Redshift cluster that stores sensitive financial data. The security team requires that all data be encrypted at rest and that the encryption keys be rotated annually. Which solution meets these requirements?

Accepted Answer

Create a new encrypted cluster with a KMS key and configure automatic key rotation.. Amazon Redshift supports encryption at rest using AWS KMS customer managed keys (CMKs), and KMS supports automatic annual key rotation. Because you cannot enable KMS encryption on an existing unencrypted Redshift cluster in place, you must create a new encrypted cluster with the KMS key and enable rotation on that key. This satisfies both the encryption-at-rest and annual-rotation requirements.

Answer

Use AWS KMS with automatic key rotation to encrypt the Redshift cluster.

Answer

Create the cluster with AWS CloudHSM-backed encryption and rotate the key annually.

Answer

Enable encryption on the existing cluster by modifying the cluster settings.

Question 7

A company is using Amazon Redshift and needs to comply with regulatory requirements that mandate encryption of all data at rest and control of the encryption keys. Which THREE steps should be taken? (Choose THREE.)

Accepted Answer

Enable automatic key rotation for the KMS key.. Option B is correct because using a customer-managed KMS key gives the company control over the key policy, grants, and lifecycle, satisfying the requirement to control the encryption keys. Option E is correct because Redshift encryption must be enabled at cluster creation time when using a KMS key; you specify the KMS key in the CreateCluster API call or console wizard, ensuring all data at rest is encrypted from the start. Option A is correct because enabling automatic key rotation on the KMS key is a best practice that rotates the backing key material annually while retaining the same key ID, helping meet regulatory key-management requirements. Option C is not correct because Redshift at-rest encryption uses AWS KMS keys (including customer-managed keys), not CloudHSM directly, and CloudHSM is not a supported key source for Redshift cluster encryption. Option D is not correct because you cannot enable encryption on an existing Redshift cluster by simply modifying it; encryption must be enabled at creation, or you must migrate data to a new encrypted cluster (e.g., via snapshot and restore).

Answer

Use AWS CloudHSM to generate and manage encryption keys.

Answer

Enable encryption on the cluster after creation by modifying the cluster.

Question 8

A company uses Amazon DynamoDB and wants to audit access to a table. Which TWO services can be used together to log and monitor data plane operations? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Logs. AWS CloudTrail [CORRECT] is right because DynamoDB integrates with CloudTrail to record API activity, including data plane operations such as GetItem, PutItem, UpdateItem, and DeleteItem, when data events are enabled for the table. Amazon CloudWatch Logs [CORRECT] is right because CloudTrail can deliver those DynamoDB data event logs to a CloudWatch Logs log group, where they can be monitored, searched, and alerted on with metric filters and alarms. Together, CloudTrail captures the audit trail and CloudWatch Logs stores and monitors it. S3 access logs are wrong because they record requests to S3 buckets, not DynamoDB table operations. VPC Flow Logs are wrong because they capture IP traffic metadata for network interfaces, not DynamoDB API calls. AWS Config is wrong because it evaluates resource configuration compliance and changes, not data plane access logging.

Answer

S3 access logs

Answer

VPC Flow Logs

Answer

AWS Config

Question 9

A company has an Amazon RDS for Oracle DB instance that stores sensitive data. The security team wants to audit all SQL queries that read or modify specific columns containing personally identifiable information (PII). The audit logs must be stored for 5 years. Which solution should the database specialist implement?

Accepted Answer

Use Oracle fine-grained auditing to create an audit policy on the specific columns and store logs in a custom table.. Amazon RDS for Oracle supports fine-grained auditing (FGA) to create audit policies on specific columns, and audit logs can be stored in a custom table with the desired retention period. Option B is incorrect because database activity streams capture all database activities and do not filter by specific columns, and they integrate with CloudWatch Logs where retention must be set separately. Option C is incorrect because RDS Enhanced Monitoring is for OS-level metrics, not SQL auditing. Option D is incorrect because Oracle Audit Vault and Database Firewall are not supported on Amazon RDS for Oracle.

Answer

Enable database activity streams and send logs to Amazon CloudWatch Logs with a retention of 5 years.

Answer

Enable RDS Enhanced Monitoring and enable SQL auditing in the parameter group.

Answer

Enable Oracle Audit Vault and Database Firewall.

Question 10

A company is using Amazon Redshift for data warehousing. The security team requires that all data be encrypted at rest using a customer-managed AWS KMS key. Additionally, the team wants to ensure that the key must be used only for this specific Redshift cluster. Which configuration should be applied?

Accepted Answer

Create a new KMS key with a key policy that grants access only to the Redshift cluster's IAM role.. To ensure a customer-managed KMS key is scoped to a single Redshift cluster, you create a CMK and attach a key policy that grants usage only to the Redshift cluster's IAM role (or the specific service principal with a condition restricting to that cluster). This satisfies both requirements: customer-managed key and restricted usage.

Answer

Create a new KMS key and associate it with the Redshift cluster's subnet group.

Answer

Use the default AWS managed KMS key for Redshift.

Answer

Use an HSM-backed key from CloudHSM.

Question 11

A company is using Amazon DynamoDB to store user session data. The security team requires that all access to the table be authenticated and authorized using AWS IAM. Which mechanism should the developer use to achieve this?

Accepted Answer

Use IAM policies to grant permissions to the DynamoDB table.. DynamoDB is integrated with AWS IAM for authentication and authorization. IAM policies can be attached to users, groups, or roles to grant specific permissions to DynamoDB tables. Option A is wrong because VPC endpoints provide network isolation but do not authenticate or authorize access. Option B is wrong because Amazon Cognito identity pools are used for federated user authentication, not for direct IAM-based access to DynamoDB. Option D is wrong because DynamoDB does not support resource-based policies; access control is managed through IAM policies.

Answer

Create a VPC endpoint for DynamoDB and allow only traffic from the VPC.

Answer

Use Amazon Cognito identity pools to grant access to the DynamoDB table.

Answer

Use a DynamoDB resource-based policy to restrict access.

Question 12

A company is using Amazon DynamoDB with encryption at rest using a customer-managed KMS key. The security team wants to audit every use of this KMS key. Which TWO steps should be taken to meet this requirement?

Accepted Answer

Turn on KMS key auditing in the key's advanced configuration.. Option B is correct because enabling KMS key auditing in the key's advanced configuration activates the automatic, periodic logging of every cryptographic operation performed with that customer-managed key, which is exactly what the security team needs to audit all key usage. Option D is correct because AWS CloudTrail records all KMS API calls (such as Encrypt, Decrypt, GenerateDataKey, and ReEncrypt) made against the key, providing the authoritative audit trail of every use of the KMS key. Option A is not correct because CloudWatch Logs is a log storage/analysis destination, not the mechanism that captures KMS key usage events. Option C is not correct because AWS Config records configuration changes to resources, not the actual cryptographic operations or API calls that constitute key usage. Option E is not correct because VPC Flow Logs capture IP traffic metadata to and from network interfaces, not KMS API activity.

Answer

Send KMS audit logs to Amazon CloudWatch Logs.

Answer

Enable AWS Config to record KMS key configuration changes.

Answer

Enable VPC Flow Logs for the DynamoDB VPC endpoint.

Question 13

A company is migrating an on-premises MongoDB database to Amazon DocumentDB (with MongoDB compatibility). The security team requires that data be encrypted at rest and in transit. Additionally, the team wants to use IAM roles to authenticate applications. Which THREE steps should the database specialist take to meet these requirements?

Accepted Answer

Use IAM roles to authenticate applications to the DocumentDB cluster.. Option A is correct because Amazon DocumentDB natively integrates with AWS Identity and Access Management, allowing applications to authenticate using IAM roles and temporary credentials instead of static database passwords, which satisfies the requirement to use IAM roles for authentication. Option C is correct because DocumentDB supports encryption at rest, which must be enabled when the cluster is created (it cannot be enabled afterward), and it uses AWS KMS keys to encrypt the underlying storage, snapshots, and indexes, meeting the data-at-rest encryption requirement. Option E is correct because DocumentDB supports TLS to encrypt data in transit, and enforcing TLS on all client connections ensures traffic between applications and the cluster is encrypted, satisfying the in-transit encryption requirement. Option B is not needed because DocumentDB already provides managed TLS certificates issued by Amazon's certificate authority, so a custom CA is not required to meet the encryption-in-transit requirement. Option D is not correct because a VPC endpoint is used for private network connectivity to the cluster, not for enforcing encryption at rest or in transit, so it does not address either encryption requirement.

Answer

Use a custom certificate authority for SSL/TLS.

Answer

Create a VPC endpoint for DocumentDB to enforce encryption.

Question 14

A company uses Amazon DynamoDB to store user session data. The security team requires that all data be encrypted at rest using a customer-managed AWS KMS key. The DynamoDB table is already configured with AWS managed KMS encryption. How can the company meet the encryption requirement without recreating the table?

Accepted Answer

Use the UpdateTable API to specify the new KMS key in the SSESpecification parameter.. DynamoDB supports updating the encryption key for an existing table via the UpdateTable API by specifying the new KMS key in the SSESpecification parameter. This allows switching from an AWS managed key to a customer managed key without recreating the table. The operation is seamless and does not require data migration.

Answer

Enable DynamoDB Streams and use a Lambda function to copy data to a new table with the desired encryption.

Answer

Export the table to Amazon S3 using the on-demand backup feature, then import it into a new table encrypted with the desired KMS key.

Answer

Delete the table and recreate it with the new KMS key.

Question 15

A company has a requirement to automatically rotate the password for an Amazon RDS for MySQL DB instance every 90 days. The password is stored in AWS Secrets Manager. Which combination of steps will meet this requirement?

Accepted Answer

Store the password in Secrets Manager and configure automatic rotation with a Lambda function that updates the RDS password every 90 days.. Secrets Manager natively supports automatic rotation of RDS credentials via a Lambda rotation function on a schedule (e.g., every 90 days). Storing the password in Secrets Manager and enabling rotation with the RDS rotation Lambda template meets the requirement with the least custom code.

Answer

Enable IAM database authentication for the RDS instance and rotate the IAM keys every 90 days.

Answer

Store the password in AWS Systems Manager Parameter Store and configure a scheduled AWS Lambda function to update the parameter and the RDS password.

Answer

Use an AWS Lambda function to manually update the RDS password and store the new password in Secrets Manager, triggered by a CloudWatch Events rule every 90 days.