DBS-C01 Database Security Practice Test 5 — 15 Questions

Question 1

A company stores sensitive customer data in an Amazon S3 bucket. The data is accessed by an Amazon Redshift cluster using the COPY command. The security team wants to ensure that data is encrypted in transit between S3 and Redshift. Which configuration should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the 'ENCRYPTED' option with the COPY command and ensure the S3 bucket policy requires HTTPS.. The COPY command supports encryption in transit via HTTPS when using the 'ENCRYPTED' option or using an S3 endpoint that enforces HTTPS. Option A is wrong because S3 supports HTTPS, and specifying 'ENCRYPTED' is needed. Option B is wrong because the COPY command does not use SSH; it uses HTTPS. Option D is wrong because S3 server-side encryption protects data at rest, not in transit.

Answer

Use a VPC endpoint for S3 with a bucket policy that denies HTTP.

Answer

Use the 'SSH' option in the COPY command to encrypt the transfer.

Answer

Enable S3 server-side encryption on the bucket.

Question 2

A company is using an Amazon RDS for MySQL database and needs to audit all database login events. The audit logs must be stored in Amazon S3 for long-term retention. Which steps should be taken to accomplish this?

Accepted Answer

Enable the 'audit_log' plugin, publish logs to CloudWatch Logs, and create an export task to S3.. To audit all database login events on RDS for MySQL and store them in S3, you must enable the 'audit_log' plugin, which captures connection and query events. RDS publishes these logs to CloudWatch Logs, and from there you can create an export task to S3 for long-term retention. This is the standard AWS-native approach because RDS does not natively publish audit logs directly to S3.

Answer

Enable the 'general_log' parameter and set 'log_output' to 'FILE', then copy the log file to S3 manually.

Answer

Enable CloudTrail data events for RDS to capture login events and store in S3.

Answer

Enable the 'audit_log' plugin and configure RDS to publish logs to an S3 bucket.

Question 3

A security administrator is setting up a new Amazon RDS for SQL Server database. The company requires that all data be encrypted at rest and in transit. Additionally, the database must be accessible only from a specific CIDR range. Which TWO actions should the administrator take? (Choose TWO.)

Accepted Answer

Enable encryption at rest using AWS KMS.. Option A is correct because Amazon RDS for SQL Server supports encryption at rest by enabling it with an AWS KMS customer master key (CMK) when creating or modifying the DB instance, which satisfies the requirement that all data be encrypted at rest. Option B is correct because network access to an RDS instance is controlled by its VPC security group; configuring inbound rules that permit traffic only from the specified CIDR range on the SQL Server port (1433) restricts access to that range. Option C is not correct because encryption in transit for RDS SQL Server is enforced by forcing SSL/TLS connections (e.g., via the rds.force_ssl parameter) and using SSL certificates, not by modifying the option group. Option D is not correct because DB parameter groups tune database engine settings, not network access, which is handled by security groups and subnet/VPC configuration. Option E is not correct because CloudHSM is not required for RDS encryption at rest; RDS integrates with AWS KMS for key management, and CloudHSM is a separate service for dedicated HSM key storage.

Answer

Enable encryption in transit by modifying the RDS option group to include SSL.

Answer

Modify the DB parameter group to restrict network access.

Answer

Use AWS CloudHSM to manage encryption keys for the database.

Question 4

A company uses Amazon DynamoDB to store session data for a web application. The security team discovers that an IAM user has been performing unauthorized scans on the table. They need to implement controls to detect and prevent such unauthorized access in the future. Which THREE actions should the security team take? (Choose THREE.)

Accepted Answer

Enable AWS CloudTrail logging and create a metric filter for Scan API calls.. Option A is correct because CloudTrail records DynamoDB data-plane API calls such as Scan, and a CloudWatch metric filter on the trail's logs can raise an alarm when unauthorized Scan activity occurs, providing the required detection capability. Option B is correct because DynamoDB fine-grained access control lets IAM policies use condition keys like dynamodb:LeadingKeys and dynamodb:Attributes to limit which items or attributes a user can read, so even if a Scan is attempted it cannot return data outside the user's authorized scope. Option D is correct because an explicit IAM Deny with the dynamodb:Scan action (optionally scoped by a condition key such as aws:PrincipalArn or dynamodb:LeadingKeys) immediately blocks the unauthorized Scan calls, satisfying the prevention requirement. Option C is not appropriate because DynamoDB does not provide a table-level switch to disable only the Scan operation, and removing Scan for all principals would break legitimate administrative and application use cases. Option E is not relevant because VPC Flow Logs capture IP traffic metadata for network interfaces and do not log DynamoDB API-level operations, so they cannot detect or prevent unauthorized Scan calls.

Answer

Disable the Scan operation on the DynamoDB table.

Answer

Enable VPC Flow Logs to monitor traffic to DynamoDB.

Question 5

A company is using Amazon DynamoDB to store financial transactions. The security team requires that all access to the table be logged for auditing, and that any unauthorized access attempts trigger an immediate alert. The company has enabled AWS CloudTrail to log all DynamoDB API calls. However, the security team is concerned that CloudTrail logs may not capture all access patterns, such as queries that return no results. Which additional step should the company take to ensure comprehensive auditing and alerting?

Accepted Answer

Create a CloudWatch Logs metric filter on the CloudTrail log group to detect unauthorized access attempts and set up a CloudWatch alarm.. CloudTrail logs all DynamoDB API calls, including queries that return no results, because it captures the API request itself (e.g., Query, Scan, GetItem) regardless of the response. To detect unauthorized access attempts and trigger an immediate alert, the company should create a CloudWatch Logs metric filter on the CloudTrail log group that matches patterns indicating unauthorized access (e.g., AccessDenied errors) and set up a CloudWatch alarm to notify the security team. This approach leverages the existing CloudTrail logs and provides real-time alerting.

Answer

Configure Amazon Inspector to assess the DynamoDB table for vulnerabilities.

Answer

Enable DynamoDB Accelerator (DAX) and configure it to log all read requests.

Answer

Enable VPC Flow Logs on the subnet where DynamoDB endpoints are deployed.

Question 6

A company has an Amazon S3 bucket that stores database backup files. The backups are encrypted using server-side encryption with AWS KMS (SSE-KMS). The security team wants to ensure that only a specific IAM role can decrypt the backups when restoring the database. Which policy should be attached to the KMS key to achieve this?

Accepted Answer

A KMS key policy that grants kms:Decrypt to the IAM role.. A KMS key policy can grant the kms:Decrypt permission to a specific IAM role, ensuring only that role can decrypt the backups. Option A is incorrect because an S3 bucket policy cannot grant kms:Decrypt; KMS permissions are controlled via KMS key policies or IAM policies. Option B is incorrect because s3:GetObject alone does not enable decryption of SSE-KMS encrypted objects; decryption also requires kms:Decrypt. Option C is incorrect because an IAM policy attached to the role that grants kms:Decrypt is not sufficient unless the KMS key policy also allows the role to use the key; the key policy must explicitly grant permission to the role or the root account.

Answer

An S3 bucket policy that grants kms:Decrypt to the IAM role.

Answer

An S3 bucket policy that grants s3:GetObject to the IAM role.

Answer

An IAM policy attached to the role that grants kms:Decrypt.

Question 7

A company is using Amazon RDS for MySQL to power a web application. The database contains sensitive data, and the security team requires that all connections to the database use SSL/TLS. The team has enabled 'require_secure_transport' parameter in the DB parameter group. However, a developer reports that they are able to connect to the database using a MySQL client without specifying SSL options. What could be the reason?

Accepted Answer

The 'require_secure_transport' parameter is not set to '1' in the DB parameter group.. Enabling the 'require_secure_transport' parameter in the DB parameter group requires explicitly setting it to '1'. By default, this parameter is '0' (disabled). Even if the parameter group is associated with the RDS instance, if the parameter value is not set to '1', the database will still accept non-SSL connections. After setting it to '1', the instance must be rebooted for the change to take effect. Option A is incorrect because 'require_secure_transport', when properly configured, rejects non-SSL connections. Option B is incorrect because the MySQL client does not automatically upgrade to SSL; it only uses SSL if explicitly requested or if the client defaults to SSL (which depends on client configuration). Option D is incorrect because connections from within the same VPC are still subject to the database's SSL enforcement settings.

Answer

The RDS instance is configured to accept both SSL and non-SSL connections by default.

Answer

The MySQL client automatically upgrades to SSL when the server requires it.

Answer

The developer is connecting from an EC2 instance in the same VPC, which bypasses SSL enforcement.

Question 8

A company is using Amazon RDS for SQL Server with Multi-AZ deployment. The security team wants to ensure that database audit logs are stored in a secure S3 bucket for long-term retention. The audit logs are currently stored on the RDS instance. Which approach should be used to export the audit logs to S3?

Accepted Answer

Modify the RDS instance to use the 'SQLSERVER_AUDIT' option and specify an S3 bucket as the audit destination.. For Amazon RDS for SQL Server, the native auditing feature is enabled via the SQLSERVER_AUDIT option in the option group. This option allows you to specify an S3 bucket as the audit log destination, enabling long-term retention in a secure S3 bucket. This is the correct, supported method for exporting SQL Server audit logs to S3.

Answer

Use the Amazon RDS for Oracle 'Audit' feature and specify an S3 bucket as the audit trail destination.

Answer

Enable the 'General Log' option in the RDS parameter group and configure the log destination as S3.

Answer

Configure the RDS instance to publish logs to CloudWatch Logs, and then export CloudWatch Logs to S3 using a subscription filter.

Question 9

A company is using Amazon DynamoDB with a global table. The security team requires that all data be encrypted at rest using a customer-managed KMS key. The table was originally created with AWS managed key encryption. The company wants to switch to a customer-managed key without downtime. What should they do?

Accepted Answer

Create a new table with the customer-managed key, export the data from the old table using AWS Data Pipeline, and import into the new table.. You cannot modify the encryption key of an existing DynamoDB table. To switch to a customer-managed KMS key without downtime, you must create a new table with the desired key, export data from the old table using AWS Data Pipeline, and import into the new table. Option A is incorrect because the UpdateTable API does not support changing the KMS key after table creation. Option B is incorrect because DynamoDB Streams and Lambda are not suitable for full table migration, especially for global tables. Option C is incorrect because replicas inherit the table's encryption key and cannot have a different key.

Answer

Use the UpdateTable API to change the KMS key to the customer-managed key.

Answer

Enable DynamoDB Streams on the old table and use a Lambda function to copy data to a new table with the customer-managed key.

Answer

Create a new replica in the global table with the customer-managed key and then delete the old replica.

Question 10

A company is using Amazon RDS for PostgreSQL and wants to implement encryption in transit for all client connections. The security team has identified that some connections are not using SSL. Which TWO actions should the company take to enforce SSL for all connections?

Accepted Answer

Set the 'rds.force_ssl' parameter to '1' in the DB parameter group.. Option A is correct because setting the 'rds.force_ssl' parameter to '1' in the DB parameter group makes the RDS for PostgreSQL instance reject any non-SSL connection, thereby enforcing encryption in transit at the server level. Option E is correct because editing pg_hba.conf to use 'hostssl' entries requires SSL for matching connections, which is the underlying PostgreSQL mechanism that enforces SSL at the host-based authentication layer. Option B is not correct because installing the RDS CA certificate only enables clients to verify the server certificate; it does not force clients to use SSL. Option C is not correct because RDS manages the SSL certificate for the instance automatically, and creating a new certificate does not enforce SSL. Option D is not correct because configuring 'sslmode=require' in the application connection string only affects that specific application's connections and does not enforce SSL for all clients.

Answer

Install the RDS CA certificate on all client machines.

Answer

Create a new SSL certificate and associate it with the RDS instance.

Answer

Configure the application connection string to use 'sslmode=require'.

Question 11

A company is using Amazon Redshift for analytics. The security team wants to audit all SQL queries executed against the database, including the actual query text, for compliance. They also want to ensure that the audit logs are stored in a secure, immutable location. Which THREE services or features should they use together to meet these requirements?

Accepted Answer

Redshift Audit Logging. Redshift Audit Logging (A) is correct because it captures connection and user activity logs, including the actual SQL query text executed against the database, which is exactly what the security team needs for compliance auditing. Amazon CloudWatch Logs (C) is correct because Redshift can export its audit logs to CloudWatch Logs, providing centralized, durable storage and monitoring of the query activity. S3 Object Lock (E) is correct because it enforces WORM (write-once-read-many) immutability on the S3 bucket where audit logs are delivered, ensuring logs cannot be altered or deleted, satisfying the secure, immutable storage requirement. VPC Flow Logs (B) is not correct because it only captures IP traffic metadata (source/destination, ports, protocol) for network interfaces and does not record SQL query text. Redshift Spectrum (D) is not correct because it is a query feature for reading data directly from S3, not an auditing or log-immutability mechanism.

Answer

VPC Flow Logs

Answer

Redshift Spectrum

Question 12

A company is using Amazon RDS for MySQL and wants to implement database activity monitoring to detect suspicious queries. Which TWO AWS services can be used together to achieve this?

Accepted Answer

AWS Lambda. AWS Lambda (A) is correct because it can be subscribed to the RDS MySQL audit log stream (via CloudWatch Logs subscription filters) and run code to parse queries, apply detection logic, and raise alerts on suspicious activity. Amazon CloudWatch Logs (E) is correct because RDS for MySQL can publish audit logs (enabled via the MariaDB/MySQL audit plugin or parameter group settings) to CloudWatch Logs, where they are stored and made available for monitoring and triggering Lambda. Together, CloudWatch Logs captures the database activity and Lambda analyzes it, forming a serverless monitoring pipeline. AWS CloudTrail (B) only records AWS API control-plane calls, not SQL queries, so it cannot detect suspicious database statements. AWS Systems Manager Patch Manager (C) handles OS/instance patching and has nothing to do with query monitoring. Amazon Inspector (D) performs vulnerability and network exposure assessments, not database activity monitoring.

Answer

AWS CloudTrail

Answer

AWS Systems Manager Patch Manager

Answer

Amazon Inspector

Question 13

A company has an Amazon DynamoDB table that stores user sessions. The security team wants to ensure that only authorized applications can read and write to the table, and that all access is logged. Which THREE steps should the company take to meet these requirements?

Accepted Answer

Enable AWS CloudTrail to log DynamoDB API calls.. Option A is correct because AWS CloudTrail records DynamoDB control-plane and data-plane API calls (such as PutItem, GetItem, and Query) as management and data events, providing the audit trail the security team requires for all access. Option B is correct because an IAM role with a least-privilege policy scoped to only the necessary DynamoDB actions (for example, dynamodb:GetItem and dynamodb:PutItem on the specific table ARN) ensures that only authorized applications can read and write to the table. Option C is correct because an interface VPC endpoint (AWS PrivateLink) for DynamoDB keeps traffic within the AWS network, and attaching a VPC endpoint policy restricts which principals and actions can reach DynamoDB through that endpoint, adding an additional authorization boundary. Option D is not required because KMS encryption at rest protects data confidentiality but does not control which applications are authorized or provide access logging. Option E is not required because DynamoDB Streams with Lambda is used for change-data-capture and event processing, not for access authorization or audit logging.

Answer

Encrypt the table using a customer-managed KMS key.

Answer

Enable DynamoDB Streams and process events with Lambda.

Question 14

A company runs an e-commerce platform on AWS. The application uses an Amazon RDS for MySQL Multi-AZ database instance. The security team recently conducted an audit and found that the database is accessible from the internet because the public accessibility setting is enabled. The security team has disabled public accessibility and updated the security group to allow inbound traffic only from the application's security group. However, after these changes, the application can no longer connect to the database. The application is running on EC2 instances in the same VPC. The RDS instance is also in the same VPC. The security group for the RDS instance allows inbound MySQL traffic (port 3306) from the application's security group. The application's security group allows all outbound traffic. The application's EC2 instances have a public IP address and are in a public subnet. The RDS instance is in a private subnet. The VPC has an internet gateway attached. What is the most likely cause of the connection failure?

Accepted Answer

The security group for the RDS instance still allows traffic from the public IP addresses of the EC2 instances, but the EC2 instances now have different public IPs.. The most likely cause is that the security group for the RDS instance still contains a rule allowing inbound traffic from the public IP addresses of the EC2 instances. After disabling public accessibility, the EC2 instances in the public subnet may receive new public IPs if they are stopped and started, or the original rule may have referenced specific public IPs that are no longer valid. The application's connection attempts using the old public IPs fail. Although the security group was updated to allow traffic from the application's security group, the old rule might not have been removed, or the application was not using the security group reference. Since the EC2 instances are in the same VPC, the private IP communication should work with the security group reference, but if the old rule is still present and the public IPs changed, the connection might fail. Options A and D are incorrect because same-VPC communication does not require VPC peering or a NAT gateway. Option C is incorrect because the public DNS name resolves to the private IP within the VPC even after public accessibility is disabled, so it should work.

Answer

The RDS instance is in a private subnet and cannot receive inbound traffic from the public subnet EC2 instances without a VPC peering or VPN.

Answer

The application is using the RDS public DNS name, which no longer resolves after disabling public accessibility.

Answer

The EC2 instances need a NAT gateway to communicate with the RDS instance in the private subnet.

Question 15

A company is using Amazon DocumentDB (with MongoDB compatibility) for a content management system. The security team requires that all data be encrypted at rest and in transit. The DocumentDB cluster is already encrypted at rest using AWS KMS. To enforce encryption in transit, the security team wants to ensure that all client connections use TLS. The team has enabled the 'tls' parameter in the cluster parameter group. However, a developer reports that they can still connect to the cluster without specifying TLS options using the mongo shell. The developer is connecting from an EC2 instance in the same VPC. The security group for the DocumentDB cluster allows inbound traffic on port 27017 from the EC2 instance's security group. What is the most likely reason the developer can connect without TLS?

Accepted Answer

The 'tls' parameter was not applied to the cluster because the parameter group was not associated with the cluster or the cluster was not rebooted.. Enabling the 'tls' parameter in a cluster parameter group only takes effect if that parameter group is actually associated with the DocumentDB cluster and the cluster has been rebooted to apply the change. If the parameter group is not attached or the cluster was not rebooted, the tls parameter remains at its default (enabled but not enforced), allowing non-TLS connections. This is the most likely reason the developer can still connect without TLS options.

Answer

DocumentDB does not support TLS; it only supports SSL.

Answer

The EC2 instance is in the same VPC, so TLS is not enforced for intra-VPC traffic.

Answer

The developer is using an older version of the mongo shell that does not support TLS.