DBS-C01 Database Security Practice Test 4 — 15 Questions

Question 1

A security engineer creates the IAM policy shown in the exhibit and attaches it to an IAM user. What is the effect of this policy?

Accepted Answer

The user can modify 'prod-db' but cannot delete it.. The IAM policy allows DescribeDBInstances and ModifyDBInstance on all resources, but explicitly denies DeleteDBInstance on the database 'prod-db'. Since an explicit deny overrides any allow, the user cannot delete 'prod-db'. However, the policy does not allow DeleteDBInstance on any database, so the user cannot delete any database. For 'prod-db', the user can still modify and describe it because the deny is only for the delete action. Thus, the user can modify 'prod-db' but cannot delete it.

Answer

The user can delete any database except 'prod-db'.

Answer

The user can describe all databases except 'prod-db'.

Answer

The user can modify any database except 'prod-db'.

Question 2

A developer runs the AWS CLI command shown in the exhibit. What is the output indicating?

Accepted Answer

The secret contains a username and password in JSON format.. The `aws secretsmanager get-secret-value` command returns the secret's value in the `SecretString` field, which typically contains a JSON object with the username and password. Option A is incorrect because the command succeeded, indicating the secret is accessible. Option B is incorrect because secrets are encrypted at rest by default. Option C is incorrect because the output includes the version ID but does not indicate rotation.

Answer

The secret value is not accessible.

Answer

The secret is not encrypted.

Answer

The secret has been rotated.

Question 3

A company is using Amazon RDS for MySQL with encryption at rest enabled. The security team requires that all access to the database be authenticated using IAM database authentication. Which combination of steps must the company take to meet this requirement?

Accepted Answer

Create an IAM policy that allows the rds-db:connect action and map the IAM role to a database user created with the AWSAuthenticationPlugin.. IAM database authentication for Amazon RDS MySQL requires creating an IAM policy that allows the rds-db:connect action, then mapping that IAM role/entity to a database user created with the AWSAuthenticationPlugin. This enables authentication via IAM credentials instead of a password. Option A is incorrect because rds:Connect is not a valid action; the correct action is rds-db:connect, and the IAM role is not attached to the RDS instance but mapped to a database user. Option B is incorrect because IAM database authentication does not use passwords; the database user must be created with AWSAuthenticationPlugin, not with a password. Option C is incorrect because SSL is not required for IAM database authentication, though it is recommended for encryption in transit; also, the correct action is rds-db:connect, not rds:Connect.

Answer

Create an IAM role with a policy that allows rds:Connect and attach it to the RDS instance.

Answer

Create a database user with a password and attach an IAM role that allows rds-db:connect to the database user.

Answer

Enable SSL on the RDS instance and create an IAM policy that allows rds:Connect.

Question 4

A financial services company runs a critical application on Amazon RDS for PostgreSQL. They must ensure that database activity logs are sent to Amazon CloudWatch Logs for real-time monitoring. The logs must include all SQL queries, including SELECT statements. Which configuration will meet these requirements?

Accepted Answer

Set log_statement = 'all' and log_min_duration_statement = 0 in the DB parameter group. Enable CloudWatch Logs export.. Setting `log_statement = 'all'` captures every SQL statement, including SELECT, and `log_min_duration_statement = 0` ensures all statements are logged regardless of duration. Enabling CloudWatch Logs export then sends these logs to CloudWatch Logs for real-time monitoring. Option B is incorrect because while pgAudit can log all statements, it is not necessary; the built-in PostgreSQL logging with `log_statement = 'all'` meets the requirement without additional extensions. Option C is incorrect because `log_statement = 'ddl'` only logs data definition language statements, not SELECT queries. Option D is incorrect because `log_min_duration_statement = -1` disables logging of all statements.

Answer

Install the pgAudit extension and configure it to log all statements. Enable CloudWatch Logs export in the RDS console.

Answer

Set the parameter log_statement = 'ddl' in the DB parameter group. Enable CloudWatch Logs export.

Answer

Set log_min_duration_statement = -1 in the DB parameter group. Enable CloudWatch Logs export.

Question 5

A company wants to encrypt data at rest for an existing Amazon RDS for Oracle DB instance. The database is currently unencrypted. What is the simplest way to enable encryption with minimal downtime?

Accepted Answer

Create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance.. You cannot directly enable encryption on an existing unencrypted Amazon RDS instance. The correct process is to create a snapshot of the DB instance, copy the snapshot with encryption enabled, and then restore the encrypted snapshot to a new DB instance. You then redirect traffic to the new instance. Option A is incorrect because creating a read replica does not encrypt the master instance, and the replica can only be encrypted if the master is already encrypted. Option B is incorrect because you cannot modify an existing DB instance to enable encryption through the RDS console. Option D is incorrect because enabling encryption directly on the existing DB instance is not supported.

Answer

Create an encrypted read replica and promote it to a standalone instance.

Answer

Modify the DB instance and enable encryption using the RDS console.

Answer

Enable encryption directly on the existing DB instance by modifying the DB instance settings.

Question 6

A company is using Amazon Aurora MySQL-Compatible Edition. The security team wants to ensure that database credentials are not stored in application configuration files. They decide to use AWS Secrets Manager to manage credentials. The application is hosted on Amazon EC2 instances that have an IAM role attached. What is the most secure way to grant the application access to the secret?

Accepted Answer

Grant the IAM role attached to the EC2 instance permissions to read the secret, and use the Secrets Manager API to retrieve it at runtime.. The most secure approach is to grant the EC2 IAM role permission to read the secret using an IAM policy attached to the role, and then have the application call the Secrets Manager API to retrieve the secret at runtime. This avoids storing secrets in code or configuration files. Option B is wrong because storing the secret in application code is insecure. Option C is wrong because resource-based policies are not attached to EC2 instances; IAM roles are the correct mechanism. Option D is wrong because storing secrets in an S3 bucket introduces additional complexity and potential exposure; using Secrets Manager with IAM roles is more secure.

Answer

Store the secret in the application code and rotate it periodically.

Answer

Attach a resource-based policy to the EC2 instance allowing access to the secret.

Answer

Store the secret in an encrypted S3 bucket and have the application download it at startup.

Question 7

A company is using Amazon DynamoDB to store sensitive customer data. They need to ensure that all data is encrypted at rest using a customer-managed AWS KMS key. The company also wants to rotate the KMS key every year. What is the simplest way to achieve key rotation?

Accepted Answer

Enable automatic key rotation in AWS KMS for the customer-managed key.. The simplest way to achieve annual key rotation for a customer-managed AWS KMS key used with DynamoDB is to enable automatic key rotation on the existing key. AWS KMS supports automatic rotation of customer-managed keys once per year when enabled, which can be done through the KMS console or API without any manual intervention or table modification. Option A is incorrect because creating a new key and updating the DynamoDB table requires manual effort and is more complex than enabling automatic rotation. Option B is incorrect because deleting and recreating the key is disruptive and not simpler. Option D is incorrect because importing new key material does not provide automatic rotation and is not the simplest method.

Answer

Create a new KMS key every year and update the DynamoDB table to use the new key.

Answer

Manually rotate the key by deleting and recreating the KMS key each year.

Answer

Import new key material into the existing KMS key every year.

Question 8

A company uses Amazon RDS for SQL Server with Multi-AZ deployment. The security team has mandated that all connections to the database must use SSL/TLS. The database is accessed by multiple applications running on EC2 instances. Which configuration ensures that all connections use SSL/TLS?

Accepted Answer

Set the parameter rds.force_ssl to 1 in the DB parameter group.. Setting the rds.force_ssl parameter to 1 in the DB parameter group enforces SSL/TLS for all connections to the RDS for SQL Server instance. No additional steps are needed; this parameter alone ensures that any connection attempt without SSL is rejected. Option B is incorrect because it includes an unnecessary step of revoking permissions from users that do not use SSL; the rds.force_ssl setting already forces SSL for all users and revoking permissions is redundant. Option A is incorrect because the 'Require SSL' option does not exist in the RDS console; SSL enforcement is controlled via parameter group settings. Option D is incorrect because configuring applications to use a trusted certificate only addresses the client side; the server must also require SSL, which is achieved through the parameter group setting.

Answer

Modify the DB instance by enabling the 'Require SSL' option in the RDS console.

Answer

Set the parameter rds.force_ssl to 1 in the DB parameter group and revoke permissions from users that do not use SSL.

Answer

Configure the applications to use a certificate from a trusted certificate authority and connect using SSL.

Question 9

A company is using Amazon Redshift for data warehousing. They need to ensure that data is encrypted at rest using a customer-managed AWS KMS key. The cluster is currently unencrypted. What is the simplest way to enable encryption?

Accepted Answer

Create a new Redshift cluster with encryption enabled and migrate the data.. You cannot enable encryption on an existing Amazon Redshift cluster. The simplest approach is to create a new cluster with encryption enabled using a customer-managed AWS KMS key, then migrate the data from the old cluster to the new one using tools such as UNLOAD/COPY or AWS DMS. Option C (snapshot and restore) is also valid, but it is not the simplest because it requires creating a snapshot and then restoring it to a new encrypted cluster, which involves extra steps. Therefore, option A is correct.

Answer

Enable encryption directly on the existing cluster using AWS CLI.

Answer

Create a snapshot of the existing cluster and restore it to a new encrypted cluster.

Answer

Modify the existing cluster and enable encryption using the Redshift console.

Question 10

A company is using Amazon RDS for MySQL. They want to audit all database logins and failed login attempts. Which option should they enable?

Accepted Answer

Set the parameter audit_log = 'ON' in the DB parameter group.. Setting the parameter audit_log = 'ON' enables audit logging for MySQL, which logs connections and disconnections, including failed login attempts. Option A is wrong because log_queries_not_using_indexes logs queries that do not use indexes, not login attempts. Option C is wrong because general_log logs all queries, not just logins. Option D is wrong because slow_query_log logs only slow queries.

Answer

Set the parameter log_queries_not_using_indexes = 'ON' in the DB parameter group.

Answer

Set the parameter general_log = 'ON' in the DB parameter group.

Answer

Set the parameter slow_query_log = 'ON' in the DB parameter group.

Question 11

A company uses Amazon DynamoDB with a global secondary index (GSI) on a table that contains sensitive data. The security team requires that the GSI be encrypted with a different AWS KMS key than the base table. Can this be achieved, and if so, how?

Accepted Answer

No, DynamoDB encrypts the entire table and all its indexes with the same KMS key.. DynamoDB encrypts all data at rest using a single KMS key per table. The base table and all of its GSIs are encrypted with the same key. It is not possible to use a different KMS key for a GSI. Option A is wrong because the GSI cannot have a separate key. Option B is wrong because KMS key policies do not allow per-index encryption. Option D is wrong because the table and its GSIs always use the same key.

Answer

Yes, by using a custom KMS key policy that differentiates between table and index.

Answer

Yes, by specifying a different KMS key ID when creating the GSI.

Answer

No, but you can use a different KMS key for the table and then the GSI will automatically use a different key.

Question 12

A company is deploying a new application on Amazon RDS for PostgreSQL. The security policy requires that all data be encrypted at rest and in transit. Which TWO actions should the company take to meet these requirements?

Accepted Answer

Enable encryption at rest by specifying a KMS key when creating the DB instance.. To encrypt data at rest, you must enable encryption when creating the DB instance by specifying a KMS key (Option C). RDS automatically encrypts automated backups for encrypted instances, so Option B is unnecessary. To encrypt data in transit, you must enforce SSL/TLS connections by setting the parameter rds.force_ssl to 1 in the DB parameter group (Option E). Option A is incorrect because client-side encryption is not required when using RDS encryption and SSL; the requirement is to use RDS features. Option D is incorrect because creating an encrypted read replica does not encrypt the original master instance; you need to enable encryption on the master from the start.

Answer

Use a client-side encryption library to encrypt data before sending to the database.

Answer

Enable encryption for automated backups separately.

Answer

Create an encrypted read replica and promote it to master.

Question 13

A company uses Amazon Aurora MySQL-Compatible Edition. The security team wants to implement database activity streams to monitor database activity. Which THREE statements are true about Aurora database activity streams?

Accepted Answer

Activity streams can be started and stopped without restarting the database.. Options A, B, and E are correct. Activity streams can be started and stopped without a database restart (A). They are encrypted using a KMS key (B). They publish database activity to Amazon CloudWatch Logs and Amazon Kinesis Firehose (E). Option C is incorrect because activity streams do not automatically mask sensitive data; they capture the actual queries. Option D is incorrect because activity streams capture all SQL statements, including DDL, DML, and SELECT.

Answer

Activity streams automatically mask sensitive data in the logs.

Answer

Activity streams only capture DDL statements, not DML or SELECT.

Question 14

A company is using Amazon DynamoDB and wants to restrict access to a specific table so that only users in a particular IAM group can perform read and write operations. Which THREE steps should be taken to achieve this?

Accepted Answer

Create an IAM policy that allows dynamodb:GetItem, dynamodb:PutItem, etc. on the specific table ARN.. The correct answers are A, B, and D. To restrict access to a specific DynamoDB table, you create an IAM policy that allows the required DynamoDB actions on that table's ARN (A). You then attach that policy to an IAM group (B), and add the users who need access to that group (D). Options C and E are incorrect because DynamoDB does not support resource-based policies, and IAM roles are not directly assigned to tables for access control.

Answer

Attach a resource-based policy to the DynamoDB table allowing access from the group.

Answer

Create an IAM role and assign it to the table.

Question 15

A company is migrating its on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all data at rest be encrypted using a customer-managed key stored in AWS KMS, and that the key be rotated automatically every year. The company also needs to ensure that only specific IAM roles can access the key. Which combination of steps should the database administrator take to meet these requirements?

Accepted Answer

Create the RDS instance with encryption enabled using a customer-managed KMS key, and configure the key policy to restrict access to the required IAM roles.. It enables encryption on the RDS instance with a customer-managed KMS key, which allows automatic yearly key rotation (configurable in KMS) and access control via KMS key policies to restrict usage to specific IAM roles. Option A is wrong because RDS does not support enabling encryption after creation; it must be enabled at launch. Option B is wrong because the default AWS managed service key does not allow customer-managed rotation or custom key policies. Option C is wrong because CloudHSM is not required; KMS customer-managed keys satisfy the requirements without CloudHSM.

Answer

Create the RDS instance without encryption, then use the AWS Console to enable encryption after creation using a customer-managed key.

Answer

Create the RDS instance with encryption using the default AWS managed service key, and set up automatic key rotation in KMS.

Answer

Use AWS CloudHSM to generate and store the encryption key, and configure RDS to use the CloudHSM key for encryption.