DBS-C01 Database Security Practice Test 3 — 15 Questions

Question 1

A developer is writing an AWS Lambda function that needs to access a Secrets Manager secret to retrieve database credentials. The Lambda function has an IAM role. Which action must be allowed in the IAM policy?

Accepted Answer

secretsmanager:GetSecretValue. Option B is correct because 'secretsmanager:GetSecretValue' retrieves the secret. Option A is wrong because 'kms:Decrypt' may be needed if the secret is encrypted with a KMS key, but the primary action is GetSecretValue. Option C is wrong because 'secretsmanager:ListSecrets' only lists secrets, not retrieve values. Option D is wrong because 'secretsmanager:PutSecretValue' is for updating secrets.

Answer

kms:Decrypt

Answer

secretsmanager:PutSecretValue

Answer

secretsmanager:ListSecrets

Question 2

A company is using Amazon Aurora MySQL-Compatible Edition. The database administrator wants to restrict a specific user to only execute SELECT statements on a specific database. Which SQL command should the administrator use?

Accepted Answer

GRANT SELECT ON db_name.* TO 'user'@'%';. Option C is correct because GRANT SELECT ON db_name.* TO user grants SELECT on all tables in the database. Option A is wrong because REVOKE removes privileges. Option B is wrong because CREATE USER creates a user but does not grant privileges. Option D is wrong because ALTER USER modifies user attributes.

Answer

ALTER USER 'user'@'%' WITH GRANT OPTION;

Answer

CREATE USER 'user'@'%' IDENTIFIED BY 'password';

Answer

REVOKE ALL PRIVILEGES ON db_name.* FROM 'user'@'%';

Question 3

Which TWO actions should be taken to protect sensitive data in an Amazon RDS for Oracle DB instance? (Choose two.)

Accepted Answer

Use Oracle Transparent Data Encryption (TDE) for sensitive columns.. Options B and D are correct. Enabling encryption at rest protects data on disk, and enabling Transparent Data Encryption (TDE) provides additional encryption for specific columns. Option A is wrong because disabling automatic backups does not enhance security. Option C is wrong because setting a public IP address increases exposure. Option E is wrong because storing credentials in the application code is insecure.

Answer

Store database credentials in the application configuration file.

Answer

Disable automated backups to reduce storage costs.

Answer

Assign a public IP address to the DB instance for easier access.

Question 4

Which THREE methods can be used to authenticate users to an Amazon RDS for MySQL DB instance? (Choose three.)

Accepted Answer

MySQL native password authentication.. Options A, B, and D are correct. MySQL native password authentication is standard. IAM database authentication allows IAM users and roles to authenticate. Kerberos authentication is supported for RDS for MySQL. Option C is wrong because RDS does not support Active Directory directly for MySQL (it is supported for SQL Server and Oracle). Option E is wrong because Lambda cannot be used for authentication.

Answer

AWS Managed Microsoft AD authentication.

Answer

AWS Lambda function authentication.

Question 5

Which TWO AWS services can be used to centrally manage database credentials securely? (Choose two.)

Accepted Answer

AWS Secrets Manager. Options B and D are correct. AWS Secrets Manager is designed to manage secrets, including database credentials. AWS Systems Manager Parameter Store can also store secrets securely. Option A is wrong because S3 is not designed for secret management. Option C is wrong because CloudFormation can create resources but not manage secrets centrally. Option E is wrong because IAM manages permissions, not secrets.

Answer

AWS CloudFormation

Answer

Amazon S3

Answer

AWS Identity and Access Management (IAM)

Question 6

A database administrator runs the AWS CLI command shown in the exhibit. The administrator wants to enable encryption at rest for the RDS instance. What should the administrator do?

Accepted Answer

Take a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore a new instance.. Option C is correct because the output shows the instance is unencrypted. To enable encryption, you must create a snapshot, copy it with encryption, and restore a new encrypted instance. Option A is wrong because encryption cannot be enabled on an existing instance. Option B is wrong because modifying the instance does not allow encryption. Option D is wrong because the KMS key is null, but that's because encryption is not enabled.

Answer

Modify the DB instance and set StorageEncrypted to true.

Answer

Create a new KMS key and associate it with the DB instance.

Answer

Create a new DB parameter group with encryption enabled.

Question 7

A security engineer creates the IAM policy shown in the exhibit and attaches it to an IAM user. What is the effect of this policy?

Accepted Answer

The user can modify 'prod-db' but cannot delete it.. Option D is correct because the policy allows DescribeDBInstances and ModifyDBInstance on all resources, but explicitly denies DeleteDBInstance on the specific database 'prod-db'. Since an explicit deny overrides any allow, the user cannot delete that database. However, the user can modify all databases including 'prod-db'. Option A is wrong because the deny is only for DeleteDBInstance. Option B is wrong because the user can modify all databases. Option C is wrong because the user can describe all databases.

Answer

The user can delete any database except 'prod-db'.

Answer

The user can describe all databases except 'prod-db'.

Answer

The user can modify any database except 'prod-db'.

Question 8

A developer runs the AWS CLI command shown in the exhibit. What is the output indicating?

Accepted Answer

The secret contains a username and password in JSON format.. Option B is correct because the JSON in SecretString contains the username and password. Option A is wrong because the secret is encrypted at rest by default. Option C is wrong because the secret version is shown, not rotation. Option D is wrong because the output includes the secret value.

Answer

The secret value is not accessible.

Answer

The secret is not encrypted.

Answer

The secret has been rotated.

Question 9

A company is using Amazon RDS for MySQL with encryption at rest enabled. The security team requires that all access to the database be authenticated using IAM database authentication. Which combination of steps must the company take to meet this requirement?

Accepted Answer

Create an IAM policy that allows the rds-db:connect action and map the IAM role to a database user created with the AWSAuthenticationPlugin.. Option C is correct because IAM database authentication for RDS MySQL requires creating an IAM role with a policy that allows the rds-db:connect action, then mapping that role to a database user using the CREATE USER statement with the AWSAuthenticationPlugin. Option A is wrong because SSL is not required for IAM auth, though recommended. Option B is wrong because the policy must include rds-db:connect, not rds:connect. Option D is wrong because the database user must be created with AWSAuthenticationPlugin, not with a password.

Answer

Create an IAM role with a policy that allows rds:Connect and attach it to the RDS instance.

Answer

Create a database user with a password and attach an IAM role that allows rds-db:connect to the database user.

Answer

Enable SSL on the RDS instance and create an IAM policy that allows rds:Connect.

Question 10

A financial services company runs a critical application on Amazon RDS for PostgreSQL. They must ensure that database activity logs are sent to Amazon CloudWatch Logs for real-time monitoring. The logs must include all SQL queries, including SELECT statements. Which configuration will meet these requirements?

Accepted Answer

Set log_statement = 'all' and log_min_duration_statement = 0 in the DB parameter group. Enable CloudWatch Logs export.. Option D is correct because to log all SQL queries including SELECT statements, you need to set the RDS parameter group parameters log_statement = 'all' and log_min_duration_statement = 0, and then enable exporting logs to CloudWatch Logs in the RDS console. Option A is wrong because pgAudit is needed if you want audit logs, but the requirement is for general query logs. Option B is wrong because setting log_statement = 'ddl' only logs DDL statements, not SELECT. Option C is wrong because log_min_duration_statement = -1 disables logging of all statements.

Answer

Install the pgAudit extension and configure it to log all statements. Enable CloudWatch Logs export in the RDS console.

Answer

Set the parameter log_statement = 'ddl' in the DB parameter group. Enable CloudWatch Logs export.

Answer

Set log_min_duration_statement = -1 in the DB parameter group. Enable CloudWatch Logs export.

Question 11

A company wants to encrypt data at rest for an existing Amazon RDS for Oracle DB instance. The database is currently unencrypted. What is the simplest way to enable encryption with minimal downtime?

Accepted Answer

Create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance.. Option B is correct because you cannot directly enable encryption on an existing unencrypted RDS instance. You must create a snapshot, copy it with encryption enabled, and then restore the snapshot to a new encrypted instance. You then redirect traffic to the new instance. Option A is wrong because modifying the DB instance does not support enabling encryption. Option C is wrong because enabling encryption on an existing instance is not supported. Option D is wrong because creating a read replica does not encrypt the master instance, and the replica can only be encrypted if the master is already encrypted.

Answer

Create an encrypted read replica and promote it to a standalone instance.

Answer

Modify the DB instance and enable encryption using the RDS console.

Answer

Enable encryption directly on the existing DB instance by modifying the DB instance settings.

Question 12

A company is using Amazon Aurora MySQL-Compatible Edition. The security team wants to ensure that database credentials are not stored in application configuration files. They decide to use AWS Secrets Manager to manage credentials. The application is hosted on Amazon EC2 instances that have an IAM role attached. What is the most secure way to grant the application access to the secret?

Accepted Answer

Grant the IAM role attached to the EC2 instance permissions to read the secret, and use the Secrets Manager API to retrieve it at runtime.. Option D is correct because the most secure approach is to grant the EC2 IAM role permission to read the secret using an IAM policy attached to the role, and then have the application call the Secrets Manager API to retrieve the secret at runtime. This avoids storing secrets in code or configuration files. Option A is wrong because hardcoding credentials defeats the purpose. Option B is wrong because storing the secret in a configuration file is not secure. Option C is wrong because you should not attach a resource-based policy to the EC2 instance; IAM roles are the correct mechanism.

Answer

Store the secret in the application code and rotate it periodically.

Answer

Attach a resource-based policy to the EC2 instance allowing access to the secret.

Answer

Store the secret in an encrypted S3 bucket and have the application download it at startup.

Question 13

A company is using Amazon DynamoDB to store sensitive customer data. They need to ensure that all data is encrypted at rest using a customer-managed AWS KMS key. The company also wants to rotate the KMS key every year. What is the simplest way to achieve key rotation?

Accepted Answer

Enable automatic key rotation in AWS KMS for the customer-managed key.. Option A is correct because AWS KMS supports automatic annual rotation for customer-managed keys when enabled. You can enable automatic rotation using the KMS console or API. Option B is wrong because creating a new key and updating the DynamoDB table requires manual effort and is more complex. Option C is wrong because AWS KMS does not support importing key material for symmetric keys; you can import key material for asymmetric keys but rotation is not automatic. Option D is wrong because manual rotation is not required and is more error-prone.

Answer

Create a new KMS key every year and update the DynamoDB table to use the new key.

Answer

Manually rotate the key by deleting and recreating the KMS key each year.

Answer

Import new key material into the existing KMS key every year.

Question 14

A company uses Amazon RDS for SQL Server with Multi-AZ deployment. The security team has mandated that all connections to the database must use SSL/TLS. The database is accessed by multiple applications running on EC2 instances. Which configuration ensures that all connections use SSL/TLS?

Accepted Answer

Set the parameter rds.force_ssl to 1 in the DB parameter group and revoke permissions from users that do not use SSL.. Option D is correct because to enforce SSL/TLS for all connections, you need to set the rds.force_ssl parameter to 1 in the RDS parameter group, which forces all connections to use SSL. Additionally, you should revoke non-SSL permissions from the database users. Option A is wrong because modifying the DB instance to require SSL is not a direct setting; the parameter group controls this. Option B is wrong because using a certificate authority is not required; RDS provides a certificate. Option C is wrong because setting the parameter is the correct method, but you also need to revoke non-SSL permissions to fully enforce.

Answer

Modify the DB instance by enabling the 'Require SSL' option in the RDS console.

Answer

Set the parameter rds.force_ssl to 1 in the DB parameter group.

Answer

Configure the applications to use a certificate from a trusted certificate authority and connect using SSL.

Question 15

A company is using Amazon Redshift for data warehousing. They need to ensure that data is encrypted at rest using a customer-managed AWS KMS key. The cluster is currently unencrypted. What is the simplest way to enable encryption?

Accepted Answer

Create a new Redshift cluster with encryption enabled and migrate the data.. Option C is correct because you cannot enable encryption on an existing Redshift cluster. You must create a new cluster with encryption enabled, then copy data from the old cluster to the new one. Option A is wrong because modifying the cluster does not support encryption. Option B is wrong because you cannot directly encrypt an existing cluster. Option D is wrong because restoring from a snapshot to an encrypted target is possible, but you must first create an unencrypted snapshot and then restore to an encrypted cluster; however, the simplest method is to create a new encrypted cluster and copy data, as restoring a snapshot to a different cluster still requires creating a new cluster.

Answer

Enable encryption directly on the existing cluster using AWS CLI.

Answer

Create a snapshot of the existing cluster and restore it to a new encrypted cluster.

Answer

Modify the existing cluster and enable encryption using the Redshift console.