DBS-C01 Database Security Practice Test 5 — 15 Questions

Question 1

A company is using Amazon RDS for PostgreSQL. The security team wants to ensure that all connections to the database are encrypted in transit. Currently, applications connect using the PostgreSQL native encryption (SSL/TLS). What is the MOST secure way to enforce encrypted connections?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable the 'rds.force_ssl' parameter in the DB parameter group and restart the instance.. In Amazon RDS for PostgreSQL, the parameter to enforce SSL is 'rds.force_ssl' (often abbreviated as 'force_ssl'). Setting this parameter to 1 in the DB parameter group and rebooting the instance forces all connections to use SSL/TLS. Option A is incorrect because security groups control network access but do not enforce encryption. Option C is incorrect because changing the port only obscures the port number, not enforce encryption. Option D is incorrect because 'require_ssl' is not a valid parameter in RDS PostgreSQL; the correct parameter is 'rds.force_ssl'.

Answer

Configure the security group to only allow traffic on port 5432 from trusted IP addresses.

Answer

Use a custom database port that is not commonly used, such as 5433, to avoid unencrypted traffic.

Answer

Modify the DB parameter group to set 'ssl' to 'on' and 'require_ssl' to 'on', then reboot the instance.

Question 2

A company is using Amazon DynamoDB to store customer session data. The security team requires that all data is encrypted at rest using a customer-managed KMS key, and that access to the key is restricted to specific IAM roles. The company also wants to ensure that DynamoDB Accelerator (DAX) cluster is encrypted. Which steps should be taken to meet these requirements?

Accepted Answer

Create the DynamoDB table with encryption using a customer-managed KMS key. Create the DAX cluster and enable encryption at rest using the same KMS key.. DynamoDB tables can be encrypted at rest with a customer-managed KMS key at creation, and DAX clusters also support encryption at rest using the same or a different KMS key, meeting the requirement. Option B is wrong because DynamoDB encryption cannot be enabled after table creation; it must be specified at creation. Option C is wrong because it uses default encryption (AWS managed key) for the table, not a customer-managed key. Option D is wrong because it refers to encryption in transit (TLS) for DAX, but the requirement is for encryption at rest; DAX encryption at rest is not addressed.

Answer

Create the DynamoDB table without encryption, then use the AWS CLI to enable encryption after creation.

Answer

Create the DynamoDB table with default encryption, and create the DAX cluster with a separate customer-managed KMS key.

Answer

Create the DynamoDB table with encryption using a customer-managed key, and enable encryption in transit on the DAX cluster using TLS.

Question 3

A company has an Amazon RDS for SQL Server Multi-AZ DB instance with a standby replica in a different AWS Region. The database is encrypted with a KMS key. The company needs to implement automated backups that are also encrypted and stored in a cross-region S3 bucket. The backups must be retained for 3 years. Which solution meets these requirements with the LEAST administrative effort?

Accepted Answer

Configure RDS to send automated backups directly to the cross-region S3 bucket using the AWS Backup service.. AWS Backup can be used to manage automated backups of RDS instances and store them in a cross-region S3 bucket. AWS Backup natively supports RDS and allows you to create backup plans that automatically take snapshots and copy them to a different region, storing them in S3. The backups are encrypted using the KMS key, and you can set retention policies for 3 years. This solution requires minimal administrative effort as AWS Backup automates the entire process. Option B is incorrect because RDS cross-Region backup copy stores backups in the destination region's RDS-managed storage, not in an S3 bucket as required. Option C is incorrect because AWS DMS is designed for migrations, not for ongoing backup management. Option D is incorrect because manual snapshots require manual intervention and do not provide automated backups.

Answer

Enable automated backups on the RDS instance, configure cross-Region backup copy to a destination Region, and store the backups in an S3 bucket with S3 Object Lock enabled for retention.

Answer

Use AWS Database Migration Service (DMS) to continuously replicate the database to an S3 bucket in the target region.

Answer

Create manual snapshots of the RDS instance, copy them to the cross-region S3 bucket using AWS CLI, and set a lifecycle policy for retention.

Question 4

A company is using Amazon Redshift for data warehousing. The security team requires that all data is encrypted at rest using a hardware security module (HSM). Additionally, the team wants to ensure that only specific IAM roles can access the database. Which configuration will meet these requirements?

Accepted Answer

Create the Redshift cluster with encryption enabled using an HSM, and attach an IAM role to the cluster to control access.. Redshift supports HSM for encryption at rest, and IAM roles can be attached to the cluster for access control. Option A is wrong because HSM and KMS are mutually exclusive. Option C is wrong because KMS does not meet the HSM requirement. Option D is wrong because encryption cannot be enabled after cluster creation.

Answer

Create the Redshift cluster with encryption enabled using a KMS key, and configure the cluster to use an HSM for key storage.

Answer

Create the Redshift cluster without encryption, then use the AWS CLI to enable encryption using a KMS key.

Answer

Create the Redshift cluster with encryption using a KMS key, and then import the HSM certificate into the cluster.

Question 5

A company is using Amazon Aurora MySQL-Compatible Edition. The security team wants to audit all database login attempts and store the logs in Amazon S3 for 90 days. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Enable the Aurora audit log and publish logs to Amazon CloudWatch Logs. Create a CloudWatch Logs subscription filter to stream the logs to an Amazon S3 bucket.. Amazon Aurora can publish audit logs to Amazon CloudWatch Logs. A CloudWatch Logs subscription filter can then stream those logs to an Amazon S3 bucket for long-term storage. This approach requires minimal operational overhead because it uses native AWS services without custom scripts or additional infrastructure. Option B is incorrect because Aurora does not support writing audit logs directly to S3. Option C is incorrect because installing a custom audit plugin and using a Lambda function introduces unnecessary complexity and operational overhead. Option D is incorrect because using Amazon Kinesis Data Firehose adds an extra streaming service that is not needed; a CloudWatch Logs subscription filter is simpler and more direct.

Answer

Enable the Aurora audit log and configure the DB cluster to publish logs directly to an S3 bucket.

Answer

Install a custom audit plugin on the Aurora cluster that writes logs to a file, then use an AWS Lambda function to upload the file to S3.

Answer

Enable the Aurora audit log and use Amazon Kinesis Data Firehose to stream the logs to S3.

Question 6

A company is using Amazon RDS for PostgreSQL and needs to implement column-level encryption for sensitive data. The application must be able to encrypt and decrypt data transparently. Which approach should be taken?

Accepted Answer

Install the pgcrypto extension on the RDS instance and use its functions to encrypt data at the column level.. Pgcrypto is a PostgreSQL extension that provides column-level encryption functions, allowing the application to encrypt and decrypt data transparently at the column level. Option A is incorrect because RDS encryption at rest encrypts the entire database storage, not individual columns. Option B is incorrect because using AWS Lambda would require application modifications and introduce additional latency. Option C is incorrect because AWS KMS is a key management service, not a direct column-level encryption solution for databases, and using its APIs would require building encryption logic in the application.

Answer

Enable RDS encryption at rest using a KMS key, which will automatically encrypt all columns.

Answer

Use AWS Lambda to encrypt data before writing to the database and decrypt after reading.

Answer

Use the AWS KMS Encrypt and Decrypt APIs directly in the application code.

Question 7

A company is using Amazon RDS for MySQL and needs to comply with PCI DSS requirements. Which TWO actions should the company take to secure the database? (Choose TWO.)

Accepted Answer

Enable encryption at rest using AWS KMS.. Options A and C are correct. Enabling encryption at rest using AWS KMS protects data on disk, which is a PCI DSS requirement. Enabling audit logging helps track database activities for compliance. Options B and D are incorrect: writing audit logs directly to an S3 bucket is not supported; RDS audit logs are sent to CloudWatch Logs. Enabling public accessibility would violate security requirements. Option E is incorrect because changing the default port is not a PCI DSS requirement and may complicate management without adding meaningful security.

Answer

Configure the database to write audit logs directly to an S3 bucket.

Answer

Enable public accessibility on the RDS instance to allow access from anywhere.

Answer

Change the default database port to a non-standard port.

Question 8

A company is designing a security architecture for Amazon DynamoDB. They need to ensure that only authorized applications can access the data, and that data in transit is encrypted. Which THREE steps should be taken? (Choose THREE.)

Accepted Answer

Attach an IAM policy that grants access only to specific IAM roles or users.. The correct answers are B, C, and E. IAM policies ensure only authorized principals can access DynamoDB. AWS PrivateLink VPC endpoints keep traffic within the AWS network, enhancing security. HTTPS (TLS) encrypts data in transit, which is required for confidentiality. Option A is incorrect because KMS keys are for encryption at rest, not in transit. Option D is incorrect because security groups are associated with network interfaces, not DynamoDB tables; they can be used with VPC endpoints but not directly on the table.

Answer

Use a customer-managed KMS key to encrypt data in transit.

Answer

Configure a security group to restrict inbound traffic to the DynamoDB table.

Question 9

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all database connections use SSL and that the database is encrypted at rest. Which THREE steps are required to meet these requirements? (Choose THREE.)

Accepted Answer

Modify the DB parameter group to set 'require_ssl' to 'true'.. To meet the requirements, three steps are needed. First, enable encryption at rest by selecting the encryption option when creating the RDS instance (option E). Second, to enforce SSL connections, modify the DB parameter group to set require_ssl to true (option C). Third, download the RDS SSL certificate from AWS and configure the application to trust it (option D). Options A and B are incorrect because you cannot upload a custom SSL certificate to RDS, and the certificate must be trusted by the application, not necessarily installed on every client machine individually.

Answer

Upload a custom SSL certificate to the RDS instance.

Answer

Install the SSL certificate on every client machine.

Question 10

An IAM policy is attached to a role used by an RDS instance. The RDS instance is in VPC with a VPC endpoint to KMS. What is the effect of this policy?

Accepted Answer

Allows only the specified KMS actions on the key when the request originates from the RDS service via the specific VPC endpoint.. An IAM policy attached to a role used by an RDS instance, combined with a VPC endpoint to KMS, restricts the allowed KMS actions to only those specified and requires that the request originate from the RDS service via that specific VPC endpoint. Option A is incorrect because it suggests all KMS actions are allowed, which is not the case; only specified actions are allowed. Option B is incorrect because it mistakenly implies the policy allows actions from any source, ignoring the VPC endpoint restriction. Option C is incorrect because it states the policy applies to all KMS keys, whereas it is typically scoped to a specific key.

Answer

Allows all KMS actions on the key only when the request comes from RDS.

Answer

Allows all KMS actions on the specified key from any source.

Answer

Allows the specified KMS actions on all KMS keys in the account.

Question 11

The security team reports that the database 'mydb' is not encrypted. However, the CLI output shows 'StorageEncrypted' is true. What is the MOST likely reason for the security team's concern?

Accepted Answer

The KMS key specified may have been disabled or deleted, causing the database to be inaccessible or not encrypted.. The security team's concern likely stems from the possibility that the KMS key specified for encryption might have been disabled or deleted. Even though 'StorageEncrypted' is true, if the KMS key is not available, the database may become inaccessible or the encryption may not be effective. Option A is incorrect because using a default AWS managed key still provides encryption; the security team's concern is about encryption itself, not key type. Option C is incorrect because the CLI output clearly shows 'StorageEncrypted' is true, so the field is not false. Option D is incorrect because there is no indication that a CloudHSM key is involved, and using a KMS key is the standard approach for RDS encryption.

Answer

The database is using a default AWS managed key instead of a customer-managed key.

Answer

The 'StorageEncrypted' field is false, but the CLI output shows true.

Answer

The database is not using a KMS key and is instead using a CloudHSM key.

Question 12

An IAM policy is attached to an IAM user. The user wants to connect to an RDS MySQL database using IAM database authentication. What does this policy allow?

Accepted Answer

Allows the user to connect to the RDS instance with the database user name 'db_user1'.. IAM database authentication allows an IAM user to authenticate to an RDS MySQL database using an IAM user or role. The IAM policy must include the rds-db:connect action with a resource ARN specifying the RDS instance and the database user name. When the resource ARN includes 'db_user1', the policy only permits connection as that specific database user, not as any user. Option A is incorrect because the policy does not grant permissions to any database or any user; it is scoped to 'db_user1'. Option B is incorrect because the rds-db:connect action does not grant management of the RDS instance. Option D is incorrect because the resource ARN restricts to 'db_user1', so connecting with any other database user name would be denied.

Answer

Allows the user to connect to any database on the RDS instance as any user.

Answer

Allows the user to manage the RDS instance.

Answer

Allows the user to connect to the RDS instance with any database user name.

Question 13

A company is migrating its on-premises Oracle database to Amazon RDS for Oracle. As part of the migration, they need to ensure that all sensitive data is encrypted at rest using AWS Key Management Service (AWS KMS). Which configuration step is required to achieve this?

Accepted Answer

Create a new encrypted DB instance by enabling encryption and specifying a KMS key.. To encrypt an Amazon RDS for Oracle DB instance at rest using AWS KMS, you must enable encryption when creating the DB instance and specify a KMS key. Encryption cannot be added to an existing unencrypted DB instance directly; you must take a snapshot, create an encrypted copy, and restore it. Option A is incorrect because modifying an existing instance does not allow enabling encryption. Option B is incorrect because SSL/TLS encrypts data in transit, not at rest. Option C is incorrect because while CloudHSM can be used, AWS KMS is the simpler and more common approach, and the question specifically mentions AWS KMS.

Answer

Modify the existing DB instance to enable encryption.

Answer

Configure SSL/TLS on the DB instance to encrypt data at rest.

Answer

Use AWS CloudHSM to generate and store the encryption keys.

Question 14

A company uses Amazon DynamoDB with AWS KMS-managed encryption at rest. The security team requires that all access to a particular DynamoDB table be logged for audit purposes. Which solution meets this requirement?

Accepted Answer

Enable CloudTrail data events for the DynamoDB table.. AWS CloudTrail logs all DynamoDB API calls, including data plane operations, when data events are enabled. Option A is wrong because VPC Flow Logs capture network traffic, not API calls. Option B is wrong because AWS Config records resource configuration changes, not API calls. Option D is wrong because Amazon GuardDuty is a threat detection service, not a logging service.

Answer

Enable VPC Flow Logs for the VPC where the DynamoDB endpoint is accessed.

Answer

Enable AWS Config rules for DynamoDB.

Answer

Enable Amazon GuardDuty with DynamoDB protection.

Question 15

A company is using Amazon RDS for MySQL and needs to restrict access to the database to only specific Amazon EC2 instances in the same VPC. Which security mechanism should be used?

Accepted Answer

Configure a VPC security group that allows inbound traffic from the EC2 security groups.. In a VPC, RDS instances use VPC security groups to control inbound traffic. Configuring a VPC security group that allows inbound traffic from the EC2 security groups is the correct mechanism. Option B is incorrect because IAM policies control API access, not network connectivity. Option C is incorrect because subnet groups define subnets for deployment, not security rules. Option D is incorrect because network ACLs are stateless, apply to entire subnets, and cannot reference security groups or specific instances.

Answer

Create an IAM policy that allows the EC2 instances to connect to the RDS instance.

Answer

Create a DB subnet group that includes only the subnets where the EC2 instances reside.

Answer

Modify the network ACL for the DB subnet to allow traffic from the EC2 instances' IP addresses.