DBS-C01 Database Security Practice Test 3 — 15 Questions

Question 1

Match each DynamoDB concept to its definition.

Accepted Answer

Partition key: A simple primary key that determines the partition where the item is stored.. This matching exercise tests understanding of core DynamoDB concepts. The partition key distributes items across partitions, while the sort key enables ordering. Global secondary indexes (GSIs) allow queries on different partition keys, while local secondary indexes (LSIs) share the same partition key but different sort keys.

Answer

Sort key: A simple primary key that determines the partition where the item is stored.

Answer

Global secondary index: An index that uses the same partition key as the base table but a different sort key.

Question 2

Match each AWS database migration tool/service to its function.

Accepted Answer

AWS DMS: Migrates databases to AWS with minimal downtime. AWS DMS is for minimal-downtime database migration, AWS SCT for schema conversion, and AWS Snowball for physical data transfer. Common confusions involve swapping these functions.

Answer

AWS DMS: Converts database schema to target engine

Answer

AWS Snowball: Migrates databases to AWS with minimal downtime

Question 3

A company is using an RDS for MySQL DB instance encrypted at rest with AWS KMS. The security team requires that all access to the database be logged, including queries that fail due to authentication errors. Which configuration meets this requirement?

Accepted Answer

Enable the RDS audit log by setting the 'audit_log_enabled' parameter to 1 in the DB parameter group and export logs to CloudWatch Logs.. RDS for MySQL supports audit logs that can capture authentication failures and queries. By setting the 'audit_log_enabled' parameter to 1 in the DB parameter group and exporting logs to CloudWatch Logs, you meet the requirement to log all access including failed authentication attempts. Option B is incorrect because Enhanced Monitoring provides OS-level metrics, not query logs. Option C is incorrect because AWS CloudTrail logs control plane API calls for RDS, not data plane activities like database queries. Option D is incorrect because S3 server access logs capture requests made to S3 buckets, not database connections.

Answer

Enable RDS Enhanced Monitoring and publish metrics to CloudWatch.

Answer

Enable AWS CloudTrail for the RDS instance and store logs in S3.

Answer

Use S3 server access logs to capture database connection attempts.

Question 4

A developer needs to allow an application running on an EC2 instance to read and write data to a DynamoDB table named 'Orders'. The EC2 instance is configured with an IAM role. Which IAM policy should be attached to the role?

Accepted Answer

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "dynamodb:GetItem", "dynamodb:PutItem" ], "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders" } ] }. The policy grants exactly the required DynamoDB actions (GetItem and PutItem) on the specific 'Orders' table, following the principle of least privilege. Option A is incorrect because it grants full DynamoDB access to all tables, which is overly permissive. Option B is incorrect because it grants EC2 actions, not DynamoDB actions. Option D is incorrect because it grants S3 actions instead of DynamoDB actions.

Answer

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "dynamodb:*", "Resource": "*" } ] }

Answer

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "ec2:*", "Resource": "*" } ] }

Answer

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "s3:*", "Resource": "arn:aws:s3:::example-bucket/*" } ] }

Question 5

A company's security team wants to encrypt data at rest for an existing RDS for PostgreSQL DB instance. The instance is currently unencrypted. Which steps should the team take to enable encryption with minimal downtime?

Accepted Answer

Take a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore a new DB instance from the encrypted snapshot.. Amazon RDS does not support enabling encryption directly on an existing unencrypted DB instance. The only supported method is to take a snapshot of the instance, copy the snapshot with encryption enabled, and restore a new DB instance from the encrypted snapshot. Option A is incorrect because the RDS console does not allow enabling encryption on an existing instance. Option B is incorrect because a read replica of an unencrypted instance is also unencrypted; promoting it does not add encryption. Option C is incorrect because option groups control database engine configuration, not encryption at rest. Encryption at rest is a storage-level feature that can only be enabled during instance creation or via snapshot operations.

Answer

Modify the DB instance and enable encryption in the RDS console.

Answer

Create a read replica of the DB instance and promote it to a standalone instance.

Answer

Create a new option group with encryption enabled and associate it with the DB instance.

Question 6

A company uses Amazon Redshift for data warehousing. The security team requires that all data loaded into the cluster be encrypted at rest using a customer-managed KMS key. The cluster is currently unencrypted. What is the most efficient way to achieve this requirement with minimal data loss?

Accepted Answer

Unload the data from the existing cluster to S3, create a new encrypted cluster using the KMS key, and reload the data from S3.. An existing unencrypted Redshift cluster cannot be encrypted in place. The only way to achieve encryption using a customer-managed KMS key is to unload the data to S3, create a new encrypted cluster with the desired KMS key, and reload the data. Options B, C, and D are incorrect because Redshift does not support enabling encryption on an existing cluster, modifying an existing cluster to enable encryption, or adding encryption to an unencrypted snapshot.

Answer

Change the cluster parameter group to enable encryption.

Answer

Modify the cluster and enable encryption in the Redshift console.

Answer

Take a snapshot of the cluster, copy the snapshot with encryption, and restore from the encrypted snapshot.

Question 7

A company has an RDS for SQL Server DB instance that stores sensitive data. The database administrator needs to ensure that all connections to the database use SSL/TLS encryption. What should the administrator do?

Accepted Answer

Set the 'rds.force_ssl' parameter to 1 in the DB parameter group.. Setting 'rds.force_ssl' to 1 in the DB parameter group forces all connections to the RDS for SQL Server DB instance to use SSL/TLS encryption. Option A is incorrect because security group rules control network access, not encryption. Option C is incorrect because AWS CloudTrail logs API calls, not database connections. Option D is incorrect because deleting and recreating the instance would not, by itself, enforce SSL; encryption at rest is separate from SSL enforcement.

Answer

Configure the security group to only allow traffic from specific IP addresses.

Answer

Enable AWS CloudTrail to monitor connections.

Answer

Delete the DB instance and create a new one with encryption enabled.

Question 8

A company uses Amazon DynamoDB with AWS KMS customer managed keys for encryption at rest. The security team wants to audit who is using the KMS key to encrypt and decrypt data. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail logs all KMS API calls, including Encrypt and Decrypt, enabling auditing of who used the KMS key. Amazon S3 access logs (option A) are for S3 bucket access, not KMS. AWS Config (option B) tracks resource configuration changes, not API calls. Amazon CloudWatch Logs (option D) can store logs but does not capture KMS API calls by itself.

Answer

Amazon S3 access logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 9

A company has a multi-AZ RDS for PostgreSQL DB instance. The security team wants to ensure that database audit logs are stored in CloudWatch Logs for real-time monitoring. The team enabled the 'pgaudit.log' parameter and set 'log_destination' to 'csvlog'. However, logs are not appearing in CloudWatch. What is the most likely cause?

Accepted Answer

The 'rds.logs_to_cloudwatch' parameter is not set to 1.. RDS publishes logs to CloudWatch only if the 'rds.logs_to_cloudwatch' parameter is set to 1. Option A is wrong because multi-AZ does not prevent log delivery. Option B is wrong because CloudTrail is not involved in log delivery to CloudWatch; it's about API activity logging. Option C is wrong because the DB parameter group is associated; the issue is that the specific parameter 'rds.logs_to_cloudwatch' is not set.

Answer

The DB instance is multi-AZ, which prevents log delivery to CloudWatch.

Answer

AWS CloudTrail is not enabled for the RDS instance.

Answer

The DB parameter group is not associated with the DB instance.

Question 10

A developer is writing an AWS Lambda function that needs to access a Secrets Manager secret to retrieve database credentials. The Lambda function has an IAM role. Which action must be allowed in the IAM policy?

Accepted Answer

secretsmanager:GetSecretValue. The Lambda function must call secretsmanager:GetSecretValue to retrieve the secret. Option A (kms:Decrypt) may be necessary if the secret is encrypted with a KMS key, but it is not the primary action. Option B (secretsmanager:PutSecretValue) is for updating secrets, not reading. Option C (secretsmanager:ListSecrets) only lists secret names, not the actual values.

Answer

kms:Decrypt

Answer

secretsmanager:PutSecretValue

Answer

secretsmanager:ListSecrets

Question 11

A company is using Amazon Aurora MySQL-Compatible Edition. The database administrator wants to restrict a specific user to only execute SELECT statements on a specific database. Which SQL command should the administrator use?

Accepted Answer

GRANT SELECT ON db_name.* TO 'user'@'%';. The GRANT SELECT ON db_name.* TO 'user'@'%' command grants SELECT privilege on all tables within the specified database to the user. Option A is incorrect because ALTER USER with GRANT OPTION is used to change user attributes or grant the ability to grant privileges, not to directly grant SELECT. Option B is incorrect because CREATE USER only creates a new user without assigning any privileges. Option C is incorrect because REVOKE ALL PRIVILEGES removes all privileges from the user, which is opposite of the desired action.

Answer

ALTER USER 'user'@'%' WITH GRANT OPTION;

Answer

CREATE USER 'user'@'%' IDENTIFIED BY 'password';

Answer

REVOKE ALL PRIVILEGES ON db_name.* FROM 'user'@'%';

Question 12

Which TWO actions should be taken to protect sensitive data in an Amazon RDS for Oracle DB instance? (Choose two.)

Accepted Answer

Use Oracle Transparent Data Encryption (TDE) for sensitive columns.. The correct answers are C and E. Option C, using Oracle Transparent Data Encryption (TDE), encrypts sensitive data at the column level within the database. Option E, enabling encryption at rest using AWS KMS, protects data stored on disk. Option A is incorrect because storing credentials in application configuration files is insecure. Option B is incorrect because disabling automated backups does not enhance security. Option D is incorrect because assigning a public IP increases exposure to attacks.

Answer

Store database credentials in the application configuration file.

Answer

Disable automated backups to reduce storage costs.

Answer

Assign a public IP address to the DB instance for easier access.

Question 13

Which THREE methods can be used to authenticate users to an Amazon RDS for MySQL DB instance? (Choose three.)

Accepted Answer

MySQL native password authentication.. Options B, D, and E are correct. MySQL native password authentication (B) is the standard method. Kerberos authentication (D) is supported for RDS for MySQL. IAM database authentication (E) allows IAM users and roles to authenticate to the DB instance using an authentication token. Option A is incorrect because AWS Managed Microsoft AD authentication is not supported for RDS for MySQL; it is supported for RDS for SQL Server and Oracle. Option C is incorrect because Lambda is not an authentication method; it is a compute service that cannot directly authenticate users to a database.

Answer

AWS Managed Microsoft AD authentication.

Answer

AWS Lambda function authentication.

Question 14

Which TWO AWS services can be used to centrally manage database credentials securely? (Choose two.)

Accepted Answer

AWS Secrets Manager. Options A and E are correct. AWS Secrets Manager is specifically designed to centrally manage secrets, including database credentials, with features like automatic rotation. AWS Systems Manager Parameter Store can also securely store secrets (e.g., using SecureString parameters). Option B (AWS CloudFormation) is incorrect because it is an infrastructure-as-code service, not a secrets manager. Option C (Amazon S3) is incorrect because it is an object storage service, not designed for secret storage. Option D (AWS IAM) is incorrect because it manages access permissions and identities, not secrets.

Answer

AWS CloudFormation

Answer

Amazon S3

Answer

AWS Identity and Access Management (IAM)

Question 15

A database administrator runs the AWS CLI command shown in the exhibit. The administrator wants to enable encryption at rest for the RDS instance. What should the administrator do?

Accepted Answer

Take a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore a new instance.. To enable encryption on an unencrypted RDS instance, you must take a snapshot, copy the snapshot with encryption enabled, and restore a new encrypted instance. You cannot enable encryption on an existing instance (Option A is incorrect). Creating a new KMS key does not enable encryption on the existing instance (Option B is incorrect). Encryption is not controlled by a DB parameter group (Option C is incorrect). Only D is correct.

Answer

Modify the DB instance and set StorageEncrypted to true.

Answer

Create a new KMS key and associate it with the DB instance.

Answer

Create a new DB parameter group with encryption enabled.