DBS-C01 Database Security Practice Test 5 — 15 Questions

Question 1

A company is designing a security architecture for Amazon DynamoDB. They need to ensure that only authorized applications can access the data, and that data in transit is encrypted. Which THREE steps should be taken? (Choose THREE.)

Accepted Answer

Attach an IAM policy that grants access only to specific IAM roles or users.. Options A, B, and D are correct. Using VPC endpoints keeps traffic within AWS network, IAM policies control access, and DynamoDB encrypts data in transit automatically. Option C is wrong because security groups are not used for DynamoDB (they are for VPC endpoints). Option E is wrong because KMS is for encryption at rest, not in transit.

Answer

Use a customer-managed KMS key to encrypt data in transit.

Answer

Configure a security group to restrict inbound traffic to the DynamoDB table.

Question 2

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all database connections use SSL and that the database is encrypted at rest. Which THREE steps are required to meet these requirements? (Choose THREE.)

Accepted Answer

Modify the DB parameter group to set 'require_ssl' to 'true'.. Options A, B, and D are correct. Enabling encryption at rest is done during instance creation. SSL enforcement requires modifying the parameter group and downloading the certificate. Option C is wrong because RDS manages the certificate; you don't upload your own. Option E is wrong because you don't need to install the certificate on every client; it's needed on the application side.

Answer

Upload a custom SSL certificate to the RDS instance.

Answer

Install the SSL certificate on every client machine.

Question 3

An IAM policy is attached to a role used by an RDS instance. The RDS instance is in VPC with a VPC endpoint to KMS. What is the effect of this policy?

Accepted Answer

Allows only the specified KMS actions on the key when the request originates from the RDS service via the specific VPC endpoint.. Option B is correct. The policy allows the specified KMS actions only when the request comes through the specified VPC endpoint and via the RDS service. Option A is wrong because it only allows through VPC endpoint. Option C is wrong because it does not allow all KMS actions. Option D is wrong because it does not allow all resources.

Answer

Allows all KMS actions on the key only when the request comes from RDS.

Answer

Allows all KMS actions on the specified key from any source.

Answer

Allows the specified KMS actions on all KMS keys in the account.

Question 4

The security team reports that the database 'mydb' is not encrypted. However, the CLI output shows 'StorageEncrypted' is true. What is the MOST likely reason for the security team's concern?

Accepted Answer

The KMS key specified may have been disabled or deleted, causing the database to be inaccessible or not encrypted.. Option C is correct. The KMS key ID is in the output, but the security team might be concerned about the key being disabled or deleted. Option A is wrong because 'StorageEncrypted' is true. Option B is wrong because there is no HSM requirement. Option D is wrong because the key is specified.

Answer

The database is using a default AWS managed key instead of a customer-managed key.

Answer

The 'StorageEncrypted' field is false, but the CLI output shows true.

Answer

The database is not using a KMS key and is instead using a CloudHSM key.

Question 5

An IAM policy is attached to an IAM user. The user wants to connect to an RDS MySQL database using IAM database authentication. What does this policy allow?

Accepted Answer

Allows the user to connect to the RDS instance with the database user name 'db_user1'.. Option A is correct. The policy allows the user to connect to the specified database as user 'db_user1'. Option B is wrong because it only allows connecting to one database user. Option C is wrong because it allows only one database user. Option D is wrong because the resource is specific to a database instance and user.

Answer

Allows the user to connect to any database on the RDS instance as any user.

Answer

Allows the user to manage the RDS instance.

Answer

Allows the user to connect to the RDS instance with any database user name.

Question 6

A company is migrating its on-premises Oracle database to Amazon RDS for Oracle. As part of the migration, they need to ensure that all sensitive data is encrypted at rest using AWS Key Management Service (AWS KMS). Which configuration step is required to achieve this?

Accepted Answer

Create a new encrypted DB instance by enabling encryption and specifying a KMS key.. Option C is correct because Amazon RDS for Oracle supports encryption at rest using AWS KMS by enabling encryption when creating the DB instance. Option A is wrong because enabling encryption on an existing unencrypted DB instance requires a snapshot restore, not a direct modification. Option B is wrong because AWS CloudHSM is not required; AWS KMS is sufficient. Option D is wrong because SSL/TLS encrypts data in transit, not at rest.

Answer

Modify the existing DB instance to enable encryption.

Answer

Configure SSL/TLS on the DB instance to encrypt data at rest.

Answer

Use AWS CloudHSM to generate and store the encryption keys.

Question 7

A company uses Amazon DynamoDB with AWS KMS-managed encryption at rest. The security team requires that all access to a particular DynamoDB table be logged for audit purposes. Which solution meets this requirement?

Accepted Answer

Enable CloudTrail data events for the DynamoDB table.. Option B is correct because AWS CloudTrail logs all DynamoDB API calls, including data plane operations, when data events are enabled. Option A is wrong because VPC Flow Logs capture network traffic, not API calls. Option C is wrong because Amazon GuardDuty is a threat detection service, not a logging service. Option D is wrong because AWS Config records resource configuration changes, not API calls.

Answer

Enable VPC Flow Logs for the VPC where the DynamoDB endpoint is accessed.

Answer

Enable AWS Config rules for DynamoDB.

Answer

Enable Amazon GuardDuty with DynamoDB protection.

Question 8

A company is using Amazon RDS for MySQL and needs to restrict access to the database to only specific Amazon EC2 instances in the same VPC. Which security mechanism should be used?

Accepted Answer

Configure a DB security group that allows inbound traffic from the EC2 security groups.. Option A is correct because RDS security groups control inbound traffic at the instance level and can reference EC2 security groups. Option B is wrong because network ACLs are stateless and apply to subnets, not individual instances. Option C is wrong because IAM policies control API access, not network traffic. Option D is wrong because the DB subnet group defines subnet availability, not access control.

Answer

Create an IAM policy that allows the EC2 instances to connect to the RDS instance.

Answer

Create a DB subnet group that includes only the subnets where the EC2 instances reside.

Answer

Modify the network ACL for the DB subnet to allow traffic from the EC2 instances' IP addresses.

Question 9

A company has an Amazon Redshift cluster that stores sensitive financial data. The security team requires that all data be encrypted at rest and that the encryption keys be rotated annually. Which solution meets these requirements?

Accepted Answer

Use AWS KMS with automatic key rotation to encrypt the Redshift cluster.. Option D is correct because Redshift supports encryption at rest with AWS KMS, and KMS keys can be rotated automatically or manually yearly. Option A is wrong because Redshift does not allow you to change the encryption key type after the cluster is created. Option B is wrong because enabling encryption on an existing unencrypted cluster is not possible without a snapshot restore. Option C is wrong because CloudHSM is not required and does not provide automatic key rotation.

Answer

Create the cluster with AWS CloudHSM-backed encryption and rotate the key annually.

Answer

Enable encryption on the existing cluster by modifying the cluster settings.

Answer

Create a new encrypted cluster with a KMS key and configure automatic key rotation.

Question 10

A company uses Amazon Aurora MySQL-Compatible Edition and needs to audit all SQL statements executed by database users. Which feature should be enabled?

Accepted Answer

Enable the database engine audit logs (advanced auditing).. Option A is correct because Aurora MySQL supports advanced auditing through database engine audit logs. Option B is wrong because CloudTrail logs API calls, not SQL queries. Option C is wrong because RDS Enhanced Monitoring provides OS metrics, not SQL audit. Option D is wrong because database activity streams capture activity in near real-time but are designed for monitoring and not primarily for SQL audit logging; however, they can be used, but the most direct answer is advanced auditing.

Answer

Enable AWS CloudTrail data events for the DB instance.

Answer

Enable database activity streams.

Answer

Enable RDS Enhanced Monitoring.

Question 11

A company is using Amazon DynamoDB and wants to ensure that only authorized users can access a specific table. Which AWS service should be used to manage access control?

Accepted Answer

AWS Identity and Access Management (IAM).. Option B is correct because IAM is used to manage access to DynamoDB tables through policies. Option A is wrong because security groups control network traffic, not database access. Option C is wrong because CloudHSM is for encryption keys, not access control. Option D is wrong because KMS is for encryption, not access control.

Answer

AWS CloudHSM.

Answer

AWS Key Management Service (KMS).

Answer

Amazon VPC security groups.

Question 12

A company is using Amazon RDS for PostgreSQL with automated backups. The security team requires that backups be encrypted at rest. The DB instance is currently unencrypted. What is the most efficient way to enable encryption for future backups?

Accepted Answer

Create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance.. Option C is correct because you cannot enable encryption on an existing unencrypted RDS instance directly; you must take a snapshot, copy it with encryption, and restore to a new encrypted instance. Option A is wrong because modifying the instance does not allow enabling encryption. Option B is wrong because enabling encryption on the backup destination (S3) does not encrypt the backup data itself if the source is unencrypted. Option D is wrong because you cannot enable encryption on an existing instance.

Answer

Enable encryption by setting the 'backup_encryption' parameter in the DB parameter group.

Answer

Modify the DB instance to enable encryption.

Answer

Enable encryption on the S3 bucket where backups are stored.

Question 13

A company uses Amazon ElastiCache for Redis and needs to encrypt data in transit between the application and the cache cluster. Which feature should be enabled?

Accepted Answer

Enable encryption in transit on the replication group.. Option D is correct because ElastiCache for Redis supports encryption in transit using TLS. Option A is wrong because encryption at rest is separate. Option B is wrong because KMS is used for encryption at rest, not transit. Option C is wrong because security groups control network access, not encryption.

Answer

Enable encryption at rest.

Answer

Use AWS KMS customer master keys.

Answer

Configure the VPC security group to allow only HTTPS traffic.

Question 14

A company is using Amazon DynamoDB and wants to ensure that all data is automatically encrypted at rest. What is the default encryption status for a new DynamoDB table?

Accepted Answer

Encryption is enabled by default using an AWS-owned key.. Option B is correct because all new DynamoDB tables are encrypted at rest by default using an AWS-owned key. Option A is wrong because encryption is enabled by default. Option C is wrong because the default key is AWS-owned, not a customer-managed key. Option D is wrong because encryption is not optional; it is always enabled.

Answer

Encryption is optional and can be enabled during table creation.

Answer

Encryption is disabled by default and must be enabled manually.

Answer

Encryption is enabled by default using a customer-managed key.

Question 15

A company is designing a security strategy for Amazon RDS for SQL Server. Which TWO actions should be taken to encrypt data at rest? (Choose TWO.)

Accepted Answer

Enable Transparent Data Encryption (TDE) on the SQL Server database.. Option A is correct because enabling RDS encryption at rest uses KMS. Option C is correct because Transparent Data Encryption (TDE) is supported by SQL Server and can be used. Option B is wrong because SSL encrypts in transit. Option D is wrong because EBS encryption is not applicable to RDS instances (RDS manages storage). Option E is wrong because CloudHSM is not required for RDS encryption.

Answer

Enable Amazon EBS encryption on the underlying volumes.

Answer

Use AWS CloudHSM to store encryption keys.

Answer

Enable SSL/TLS for connections.