DBS-C01 Database Security Practice Test 4 — 15 Questions

Question 1

A company is using Amazon Aurora MySQL-Compatible Edition. The security team requires that all connections to the database use SSL/TLS. The application currently connects using a standard JDBC connection string without SSL. What changes are needed to enforce SSL connections?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify the DB cluster parameter group to set require_secure_transport to ON and update the application connection string to use SSL parameters.. To enforce SSL for all connections to an Amazon Aurora MySQL database, you must modify the DB cluster parameter group to set require_secure_transport to ON, which rejects non-SSL connections. Additionally, the application's JDBC connection string must be updated to include SSL parameters (e.g., useSSL=true) so that the application initiates an SSL connection. Option A is incomplete because modifying the parameter group alone does not enforce SSL on existing connections if the application does not use SSL. Option C is incorrect because security groups do not have an SSL flag; they control network access based on IP and port. Option D is incorrect because IAM roles do not enforce SSL encryption; they handle authentication and authorization.

Answer

Modify the DB cluster parameter group to set require_secure_transport to ON.

Answer

Modify the security group to only allow traffic on port 3306 with the SSL flag.

Answer

Create an IAM role that requires SSL for database access and assign it to the application.

Question 2

Which TWO of the following are valid methods to control network access to an Amazon RDS DB instance? (Select TWO.)

Accepted Answer

VPC security groups. A and B are correct. VPC security groups (A) act as a virtual firewall to control inbound and outbound traffic to the RDS instance at the network level. DB subnet groups (B) determine which subnets the RDS instance can be deployed in, effectively controlling network access by restricting the IP ranges that can reach the instance. AWS WAF (C) is a web application firewall for HTTP/HTTPS traffic, not for network-level RDS access. IAM policies (D) control API-level permissions, not network traffic. DB parameter groups (E) manage database engine configuration settings and do not affect network access.

Answer

AWS WAF

Answer

IAM policies

Answer

DB parameter groups

Question 3

A security auditor reviews the output of a DynamoDB table description command as shown in the exhibit. Which statement accurately describes the encryption configuration of the Users table?

Accepted Answer

The table is encrypted using a customer managed KMS key.. The output shows SSEDescription with Status ENABLED, SSEType KMS, and a KMSMasterKeyArn, which indicates that the table is encrypted using a customer-managed KMS key. Option A is incorrect because AWS managed KMS keys do not have an ARN like the one shown; they would have an alias like 'aws/dynamodb'. Option B is incorrect because DynamoDB does not use S3 managed keys; the SSEType is KMS. Option C is incorrect because the status is ENABLED, indicating encryption at rest is enabled.

Answer

The table is encrypted using an AWS managed KMS key.

Answer

The table uses server-side encryption with an S3 managed key.

Answer

The table is not encrypted at rest.

Question 4

A company has an Amazon RDS for Oracle DB instance that stores Personally Identifiable Information (PII). The security team requires that the data be transparently encrypted at rest using a key stored in AWS CloudHSM. What should the database administrator do to meet this requirement?

Accepted Answer

Create a custom DB engine using a custom AMI that includes CloudHSM integration.. The requirement is to use a key stored in AWS CloudHSM for transparent encryption of an Amazon RDS for Oracle DB instance. RDS for Oracle does not natively support integrating with CloudHSM for TDE. The only viable approach to meet this requirement is to use RDS Custom for Oracle, which allows the creation of a custom DB engine using a custom AMI. With RDS Custom, you can customize the database and host environment to integrate CloudHSM with Oracle TDE. Option A is incorrect because Oracle Data Pump does not provide transparent encryption. Option B is incorrect because RDS does not allow configuring the Oracle wallet to point to an external HSM. Option C is incorrect because AWS KMS does not directly use a key stored in CloudHSM unless you set up a custom key store, but even then, RDS Oracle TDE integration with KMS does not support CloudHSM-backed keys.

Answer

Use Oracle Data Pump to export the data, encrypt it using CloudHSM, and import it back into RDS.

Answer

Enable TDE and configure the Oracle wallet to point to the CloudHSM key.

Answer

Enable TDE and use AWS KMS as the key manager by integrating with the Oracle TDE keystore.

Question 5

A company uses Amazon DynamoDB with fine-grained access control based on user identity. The IAM policy for a user includes a condition that restricts access to items where the 'department' attribute equals 'engineering'. However, the user is receiving an 'AccessDeniedException' when trying to query items. What is the most likely cause?

Accepted Answer

The 'department' attribute is not the partition key of the table.. DynamoDB fine-grained access control using IAM condition keys like dynamodb:LeadingKeys requires that the attribute used in the condition be the partition key of the table or index. If the 'department' attribute is not the partition key, the condition cannot be evaluated as intended, resulting in AccessDeniedException. The policy must reference the leading key (partition key) for the restriction to work.

Answer

The user is not using the correct IAM role.

Answer

The DynamoDB table is not configured to require SSL.

Answer

The IAM policy is missing a 'Condition' block.

Question 6

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database contains sensitive data that must be encrypted at rest. Which action should the company take to enable encryption on the RDS instance?

Accepted Answer

Create a new RDS DB instance with encryption enabled and migrate the data.. Amazon RDS does not allow encryption to be enabled on an existing unencrypted DB instance — encryption must be specified at creation time. The only supported path to encrypt an existing unencrypted database is to create a new encrypted instance and migrate the data into it (via native tools like Data Pump, or by snapshot-copy-restore with encryption). Option B correctly reflects this constraint.

Answer

Modify the existing RDS DB instance and enable encryption.

Answer

Enable Oracle Transparent Data Encryption (TDE) on the existing RDS instance.

Answer

Take a snapshot of the existing database, encrypt the snapshot, and restore from it.

Question 7

A company uses Amazon RDS for PostgreSQL to store customer data. The security team wants to audit all SQL queries executed against the database, including SELECT statements. Which TWO actions should be taken to achieve this?

Accepted Answer

Install the pgaudit extension in the DB instance.. Option A is correct because pgaudit is the PostgreSQL extension that provides detailed session and object-level audit logging, and it must be installed (via shared_preload_libraries and CREATE EXTENSION) on the RDS for PostgreSQL instance before any query auditing can occur. Option C is correct because the pgaudit.log parameter controls which statement classes are logged, and setting it to include 'read' and 'write' ensures that SELECT statements (read) as well as INSERT/UPDATE/DELETE (write) are captured in the audit log. Option B is incorrect because log_connections and log_disconnections only record session connect/disconnect events, not the actual SQL statements executed. Option D is incorrect because audit_log_enabled is not a valid RDS for PostgreSQL parameter (it resembles MySQL/MariaDB audit settings). Option E is incorrect because Database Activity Streams is an Aurora-only feature and does not apply to RDS for PostgreSQL.

Answer

Enable the 'log_connections' and 'log_disconnections' parameters.

Answer

Set the 'audit_log_enabled' parameter to 1 in the DB parameter group.

Answer

Enable Database Activity Streams on the DB instance.

Question 8

A company is designing a disaster recovery strategy for an Amazon RDS for SQL Server DB instance that contains sensitive financial data. The database must be encrypted at rest using a customer-managed AWS KMS key. The recovery point objective (RPO) is 5 minutes, and the recovery time objective (RTO) is 1 hour. Which THREE steps should be taken to meet these requirements?

Accepted Answer

Store the KMS key in the secondary Region by creating a cross-Region KMS key replica.. Option C is correct because a customer-managed KMS key is Region-specific, so to restore an encrypted RDS for SQL Server snapshot in a secondary Region for disaster recovery, a cross-Region KMS key replica must exist there; otherwise the encrypted snapshot cannot be decrypted and restored. Option D is correct because RDS automated backups capture transaction logs continuously, enabling point-in-time recovery (PITR) to any second within the retention period, which satisfies the 5-minute RPO without needing hourly snapshots. Option E is correct because a cross-Region read replica maintains an asynchronous copy of the DB instance in another Region and can be promoted to a standalone primary in a few minutes, meeting the 1-hour RTO for a regional disaster. Option A is not correct because hourly manual snapshots yield an RPO of up to 60 minutes, far exceeding the 5-minute requirement. Option B is not correct because Multi-AZ provides automatic failover only within a single Region (synchronous standby), not cross-Region disaster recovery, so it does not address a Region-wide outage.

Answer

Take a manual DB snapshot every hour.

Answer

Enable Multi-AZ deployment for automatic failover.

Question 9

A company is setting up an Amazon Aurora MySQL-compatible database. The security policy requires that all traffic between the application and database be encrypted in transit. Which TWO steps should be taken?

Accepted Answer

Set the 'require_secure_transport' parameter to 'ON' in the DB cluster parameter group.. Option C is correct because setting the 'require_secure_transport' parameter to 'ON' in the Aurora MySQL DB cluster parameter group forces all client connections to use TLS/SSL, rejecting any unencrypted connections and thereby enforcing encryption in transit at the database level. Option D is correct because the application must actually initiate an encrypted connection by using the SSL-enabled endpoint and specifying SSL/TLS in the connection string (Aurora MySQL uses port 3306 with SSL), which is the client-side counterpart needed to satisfy the in-transit encryption requirement. Option A is incorrect because a Network Load Balancer with a TLS listener terminates TLS at the load balancer, not between the application and the database, and Aurora is normally accessed directly via its cluster endpoint rather than through an NLB. Option B is incorrect because private subnets and VPN connections provide network isolation and encrypted tunneling for network paths, but they do not by themselves guarantee that the application-to-database traffic uses TLS encryption. Option E is incorrect because AWS KMS encryption at rest protects stored data on disk, not data in transit between the application and the database.

Answer

Use a Network Load Balancer with a TLS listener in front of the Aurora cluster.

Answer

Place the Aurora cluster in a private subnet with a VPN connection.

Answer

Enable encryption at rest using AWS KMS.

Question 10

Refer to the exhibit. A company has attached this IAM policy to an IAM role used by an application running on Amazon EC2. The application needs to decrypt data in an S3 bucket that is encrypted with the specified KMS key. However, the application is receiving access denied errors. What is the most likely cause?

Accepted Answer

The application is decrypting the data by calling KMS directly instead of using S3's server-side decryption.. When S3 objects are encrypted with SSE-KMS, the S3 service itself calls KMS to decrypt the data key on behalf of the caller — the application never calls kms:Decrypt directly. The IAM policy shown grants S3-related permissions but the application is attempting to call KMS directly (e.g., using the AWS SDK's Decrypt API on the ciphertext), which fails because the policy does not grant kms:Decrypt. The correct pattern is to let S3 perform server-side decryption by calling GetObject, which requires s3:GetObject and, for SSE-KMS, kms:Decrypt on the key via the S3 service.

Answer

The policy does not include 'kms:Decrypt' for the specific key.

Answer

The policy is missing a 'Principal' element.

Answer

The IAM role does not have a trust policy that allows EC2 to assume it.

Question 11

Refer to the exhibit. A database administrator is reviewing the output of 'SHOW FULL PROCESSLIST' on an Amazon RDS for MySQL DB instance. The company's security policy requires that all database users access only the minimum necessary data. Which user's activity should be investigated further?

Accepted Answer

The admin user, because the query is selecting all columns from the credit_cards table.. The admin user is running a query that selects all columns from the credit_cards table, which likely includes sensitive data beyond what is necessary for the admin's role. The principle of least privilege requires that users access only the minimum data needed. The app_user is selecting only the card_number column, which may be necessary for its function, but the admin's broad SELECT * is a violation. Therefore, the admin's activity should be investigated further.

Answer

Both users, because they are both accessing the credit_cards table.

Answer

The app_user, because the query is selecting card_number which is sensitive.

Answer

Neither user, because the queries are normal for their roles.

Question 12

Refer to the exhibit. A database administrator has this IAM policy attached to their user. They are trying to authorize ingress to a DB security group named 'my-security-group' in the us-east-1 region. The operation fails. What is the most likely reason?

Accepted Answer

The user is missing the 'rds:DescribeDBSecurityGroups' permission, which is required to perform the authorize operation.. The IAM policy shown in the exhibit grants permissions for several RDS actions, but it does not include the 'rds:DescribeDBSecurityGroups' action. When authorizing ingress to a DB security group, RDS requires the caller to have both 'rds:AuthorizeDBSecurityGroupIngress' and 'rds:DescribeDBSecurityGroups' permissions. The describe permission is necessary because the service validates the security group's current state and rules before applying the change. Without it, the operation fails with an authorization error, even if the authorize action itself is allowed.

Answer

The user is not allowed to create DB security groups, which is a prerequisite.

Answer

The policy does not grant 'rds:AuthorizeDBSecurityGroupIngress' on the specific security group.

Answer

The security group ARN in the policy is incorrect; it should include the security group ID instead of the name.

Question 13

A company has an Amazon RDS for MySQL database that contains sensitive data. The security team requires that all data be encrypted at rest using a customer-managed key stored in AWS KMS. Which action should be taken to meet this requirement?

Accepted Answer

Create a new RDS instance with encryption enabled using the KMS key, migrate data, and delete the old instance.. RDS encryption at rest can only be enabled at instance creation time; it cannot be turned on for an existing unencrypted instance. The supported path is to create a new encrypted instance using the customer-managed KMS key, migrate the data, and decommission the old instance. This satisfies the requirement that the data be encrypted with a CMK under the security team's control.

Answer

Enable encryption on the existing RDS instance by modifying the instance.

Answer

Configure the DB parameter group to require encryption at rest.

Answer

Create a snapshot of the unencrypted database and restore it as an encrypted database.

Question 14

A development team is building a serverless application that uses Amazon DynamoDB. The team needs to ensure that only the application's Lambda function can read and write data to a specific DynamoDB table. The Lambda function uses an IAM role. How should the team configure access?

Accepted Answer

Create an IAM role for the Lambda function with DynamoDB access, and configure a resource-based policy on the DynamoDB table that allows only that role.. DynamoDB supports resource-based policies, so the team can attach a policy directly to the table that grants access only to the specific Lambda execution role. Combined with an IAM role that has DynamoDB permissions, this enforces that only that role can read/write the table. This is the least-privilege, resource-scoped approach the question is asking for.

Answer

Place the DynamoDB table and Lambda function in the same VPC and use a VPC endpoint to control access.

Answer

Encrypt the DynamoDB table with an AWS KMS key and grant the Lambda function decryption permissions.

Answer

Create an IAM role for the Lambda function with a policy that allows DynamoDB access, and attach the role to the function.

Question 15

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all connections to the database use SSL/TLS encryption. Which step is necessary to enforce SSL connections?

Accepted Answer

Set the 'rds.force_ssl' parameter to 1 in the DB parameter group.. To enforce SSL/TLS connections to an Amazon RDS for Oracle instance, you must set the 'rds.force_ssl' parameter to 1 in the DB parameter group. This requires all connections to use SSL. Option A is incorrect because security groups control network-level access, not encryption. Option B is incorrect because the DB subnet group defines the subnets for the instance, not encryption. Option C is incorrect because the option group is used to enable additional features like Oracle Enterprise Manager or timezone, not SSL enforcement. Therefore, Option D is the correct step.

Answer

Configure the security group to only allow traffic on port 443.

Answer

Modify the DB subnet group to use a private subnet.

Answer

Add the SSL option to the option group.