DBS-C01 Database Security Practice Test 6 — 15 Questions

Question 1

A company has an Amazon Redshift cluster that stores sensitive financial data. The security team requires that all data be encrypted at rest and that the encryption keys be rotated annually. Which solution meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a new encrypted cluster with a KMS key and configure automatic key rotation.. The security requirements are to have encryption at rest and automatic annual key rotation. Amazon Redshift clusters can only be encrypted at creation time; you cannot enable encryption on an existing unencrypted cluster. Therefore, the only way to meet the requirements is to create a new encrypted cluster using a KMS key with automatic rotation enabled. The existing cluster must be replaced by restoring from an encrypted snapshot or by creating a new cluster and migrating data. Option D precisely describes this solution: 'Create a new encrypted cluster with a KMS key and configure automatic key rotation.' Automatic rotation can be enabled on the KMS key, and Redshift will use the new key material automatically for re-encryption.

Option A is ambiguous: 'Use AWS KMS with automatic key rotation to encrypt the Redshift cluster' – this could be interpreted as enabling encryption on an existing cluster, which is not possible. Option D clearly states the correct procedure. Hence D is the best answer.

Option B is wrong because CloudHSM-backed encryption does not support automatic key rotation; rotation must be done manually.

Option C is wrong because encryption cannot be enabled on an existing cluster; a new encrypted cluster must be created.

Answer

Use AWS KMS with automatic key rotation to encrypt the Redshift cluster.

Answer

Create the cluster with AWS CloudHSM-backed encryption and rotate the key annually.

Answer

Enable encryption on the existing cluster by modifying the cluster settings.

Question 2

A company uses Amazon Aurora MySQL-Compatible Edition and needs to audit all SQL statements executed by database users. Which feature should be enabled?

Accepted Answer

Enable the database engine audit logs (advanced auditing).. Aurora MySQL supports advanced auditing through database engine audit logs. Option B is wrong because CloudTrail logs API calls, not SQL queries. Option C is wrong because RDS Enhanced Monitoring provides OS metrics, not SQL audit. Option D is wrong because database activity streams capture activity in near real-time but are designed for monitoring and not primarily for SQL audit logging; however, they can be used, but the most direct answer is advanced auditing.

Answer

Enable AWS CloudTrail data events for the DB instance.

Answer

Enable database activity streams.

Answer

Enable RDS Enhanced Monitoring.

Question 3

A company is using Amazon DynamoDB and wants to ensure that only authorized users can access a specific table. Which AWS service should be used to manage access control?

Accepted Answer

AWS Identity and Access Management (IAM).. AWS Identity and Access Management (IAM) is the service used to manage access control for DynamoDB tables by creating policies that grant or deny permissions. Option A (CloudHSM) provides hardware security modules for encryption keys, not access control. Option B (KMS) manages encryption keys but does not handle access control. Option C (VPC security groups) control network traffic at the instance level, not database-level access control.

Answer

AWS CloudHSM.

Answer

AWS Key Management Service (KMS).

Answer

Amazon VPC security groups.

Question 4

A company is using Amazon RDS for PostgreSQL with automated backups. The security team requires that backups be encrypted at rest. The DB instance is currently unencrypted. What is the most efficient way to enable encryption for future backups?

Accepted Answer

Create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance.. The correct method to enable encryption for future backups on an existing unencrypted Amazon RDS for PostgreSQL instance is to create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance. Option A is incorrect because there is no 'backup_encryption' parameter in the DB parameter group. Option B is incorrect because modifying the DB instance does not allow enabling encryption on an unencrypted instance; encryption can only be enabled at creation time. Option C is incorrect because enabling encryption on the S3 bucket does not encrypt the RDS backups themselves; the backups must be encrypted at the source.

Answer

Enable encryption by setting the 'backup_encryption' parameter in the DB parameter group.

Answer

Modify the DB instance to enable encryption.

Answer

Enable encryption on the S3 bucket where backups are stored.

Question 5

A company uses Amazon ElastiCache for Redis and needs to encrypt data in transit between the application and the cache cluster. Which feature should be enabled?

Accepted Answer

Enable encryption in transit on the replication group.. Amazon ElastiCache for Redis supports encryption in transit using TLS (Transport Layer Security) when enabled on the replication group. This ensures data is encrypted between the application and the cache cluster. Option B is incorrect because encryption at rest protects data stored on disk, not data in transit. Option C is incorrect because AWS KMS customer master keys are used for encryption at rest, not for transit encryption. Option D is incorrect because VPC security groups control network access at the IP/port level, not encryption; allowing HTTPS traffic does not enable encryption for ElastiCache communication.

Answer

Enable encryption at rest.

Answer

Use AWS KMS customer master keys.

Answer

Configure the VPC security group to allow only HTTPS traffic.

Question 6

A company is using Amazon DynamoDB and wants to ensure that all data is automatically encrypted at rest. What is the default encryption status for a new DynamoDB table?

Accepted Answer

Encryption is enabled by default using an AWS-owned key.. All new DynamoDB tables are encrypted at rest by default using an AWS-owned key. Option A is wrong because encryption is not optional; it is always enabled by default. Option B is wrong because encryption is enabled by default, not disabled. Option D is wrong because the default key is AWS-owned, not a customer-managed key.

Answer

Encryption is optional and can be enabled during table creation.

Answer

Encryption is disabled by default and must be enabled manually.

Answer

Encryption is enabled by default using a customer-managed key.

Question 7

A company is designing a security strategy for Amazon RDS for SQL Server. Which TWO actions should be taken to encrypt data at rest? (Choose TWO.)

Accepted Answer

Enable Transparent Data Encryption (TDE) on the SQL Server database.. For Amazon RDS for SQL Server, encryption at rest can be achieved using two methods: enabling RDS encryption at rest with AWS KMS (option E) or enabling Transparent Data Encryption (TDE) natively within SQL Server (option B). Option A is incorrect because EBS encryption is automatically handled by RDS when you enable encryption at rest via KMS, but you cannot enable EBS encryption directly on the underlying volumes. Option C is incorrect because AWS CloudHSM can be used for key management but is not required for RDS encryption at rest. Option D is incorrect because SSL/TLS encrypts data in transit, not at rest.

Answer

Enable Amazon EBS encryption on the underlying volumes.

Answer

Use AWS CloudHSM to store encryption keys.

Answer

Enable SSL/TLS for connections.

Question 8

A company is using Amazon Redshift and needs to comply with regulatory requirements that mandate encryption of all data at rest and control of the encryption keys. Which THREE steps should be taken? (Choose THREE.)

Accepted Answer

Enable automatic key rotation for the KMS key.. Enabling automatic key rotation for the KMS key ensures that encryption keys are rotated regularly, meeting key control requirements. Option B is correct because using a customer-managed KMS key allows the company to control the encryption keys themselves. Option E is correct because Amazon Redshift requires encryption to be enabled at cluster creation time, and using a KMS key accomplishes this. Option C is incorrect because AWS CloudHSM is not necessary for this requirement; KMS provides sufficient key management. Option D is incorrect because encryption cannot be enabled on an existing Redshift cluster; it must be enabled at creation.

Answer

Use AWS CloudHSM to generate and manage encryption keys.

Answer

Enable encryption on the cluster after creation by modifying the cluster.

Question 9

A company uses Amazon DynamoDB and wants to audit access to a table. Which TWO services can be used together to log and monitor data plane operations? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Logs. AWS CloudTrail (option C) can be configured to log data plane operations for DynamoDB, such as GetItem, PutItem, or Query. Amazon CloudWatch Logs (option A) can then be used to store, monitor, and alarm on these logs. Together they provide auditing of data plane access. Options B, D, and E are incorrect: S3 access logs only apply to S3, VPC Flow Logs capture network traffic, and AWS Config records configuration changes, not data operations.

Answer

S3 access logs

Answer

VPC Flow Logs

Answer

AWS Config

Question 10

A company is running an Amazon RDS for MySQL DB instance in a VPC. The security team requires that all connections to the database use SSL/TLS. The DBA has enabled 'require_secure_transport' parameter in the DB parameter group. However, after applying the change and rebooting, some applications that were previously connecting successfully are now failing. What is the most likely cause?

Accepted Answer

The application is not configured to connect using SSL/TLS.. Enabling 'require_secure_transport' in the MySQL parameter group forces the server to accept only SSL/TLS connections. Applications that are not configured with SSL will be rejected, causing them to fail after this change. Option A is incorrect because the security group inbound rule missing would have prevented connections entirely, not just after this change. Option B is incorrect because the SSL option in the option group is separate from the 'require_secure_transport' parameter; the parameter group controls this setting. Option D is incorrect because the DB subnet group determines network placement, not SSL enforcement.

Answer

The security group inbound rule for the database port is missing.

Answer

The option group does not have the SSL option enabled.

Answer

The DB subnet group does not include the application's subnet.

Question 11

A financial services company is using Amazon DynamoDB to store customer transaction data. The compliance team requires that all data be encrypted at rest using a customer-managed AWS KMS key, and that access to the key be auditable via AWS CloudTrail. Additionally, the security team wants to ensure that DynamoDB can only be accessed from within the VPC using a VPC endpoint. Which combination of steps should the company take to meet these requirements?

Accepted Answer

Enable server-side encryption with a customer-managed KMS key and create an interface VPC endpoint for DynamoDB.. Option C. To meet the encryption requirement, the company must use a customer-managed KMS key, not an AWS managed key. For VPC-only access, DynamoDB supports interface VPC endpoints (via AWS PrivateLink), which provide private connectivity. Option C correctly uses a customer-managed KMS key and an interface VPC endpoint. Option D is incorrect because it uses an AWS managed KMS key. Option A is incorrect because CloudHSM is unnecessary and VPC peering is not the correct method. Option B is incorrect because a NAT gateway still routes traffic over the internet.

Answer

Use a CloudHSM key for encryption and create a VPC peering connection to DynamoDB.

Answer

Enable server-side encryption with a customer-managed KMS key and route all traffic through a NAT gateway.

Answer

Use AWS managed KMS key and a gateway VPC endpoint for DynamoDB.

Question 12

A developer needs to securely store database credentials for an application that runs on Amazon EC2 and connects to an Amazon RDS for PostgreSQL database. The credentials must be automatically rotated every 90 days. Which AWS service should the developer use to meet these requirements?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager. Secrets Manager is designed to securely store and manage secrets such as database credentials. It natively supports automatic rotation of credentials for Amazon RDS databases, including PostgreSQL, with a customizable rotation interval (e.g., every 90 days). Option A (AWS Systems Manager Parameter Store) can store secrets but does not provide built-in automatic rotation for RDS credentials. Option B (AWS CloudHSM) provides hardware security modules for encryption key storage, not for managing database credentials. Option C (IAM roles) allow EC2 instances to assume roles for API access but do not store or rotate database credentials; while IAM database authentication can be used with RDS PostgreSQL, it does not meet the requirement to store and rotate credentials automatically.

Answer

AWS Systems Manager Parameter Store

Answer

AWS CloudHSM

Answer

AWS Identity and Access Management (IAM) roles

Question 13

A company has an Amazon RDS for Oracle DB instance that stores sensitive data. The security team wants to audit all SQL queries that read or modify specific columns containing personally identifiable information (PII). The audit logs must be stored for 5 years. Which solution should the database specialist implement?

Accepted Answer

Use Oracle fine-grained auditing to create an audit policy on the specific columns and store logs in a custom table.. Amazon RDS for Oracle supports fine-grained auditing (FGA) to create audit policies on specific columns, and audit logs can be stored in a custom table with the desired retention period. Option B is incorrect because database activity streams capture all database activities and do not filter by specific columns, and they integrate with CloudWatch Logs where retention must be set separately. Option C is incorrect because RDS Enhanced Monitoring is for OS-level metrics, not SQL auditing. Option D is incorrect because Oracle Audit Vault and Database Firewall are not supported on Amazon RDS for Oracle.

Answer

Enable database activity streams and send logs to Amazon CloudWatch Logs with a retention of 5 years.

Answer

Enable RDS Enhanced Monitoring and enable SQL auditing in the parameter group.

Answer

Enable Oracle Audit Vault and Database Firewall.

Question 14

A company is using Amazon Redshift for data warehousing. The security team requires that all data be encrypted at rest using a customer-managed AWS KMS key. Additionally, the team wants to ensure that the key must be used only for this specific Redshift cluster. Which configuration should be applied?

Accepted Answer

Create a new KMS key with a key policy that grants access only to the Redshift cluster's IAM role.. To enforce encryption at rest with a customer-managed AWS KMS key and restrict key usage to a specific Redshift cluster, you create a new KMS key and configure its key policy to grant encrypt/decrypt permissions only to the IAM role associated with the Redshift cluster. This ensures the key is only used by that cluster. Option A is incorrect because associating a key with a subnet group does not limit usage to the cluster; key policies control access. Option C is incorrect because the default AWS managed key is not customer-managed. Option D is incorrect because CloudHSM keys are not directly used with Redshift; KMS is the required service for integration.

Answer

Create a new KMS key and associate it with the Redshift cluster's subnet group.

Answer

Use the default AWS managed KMS key for Redshift.

Answer

Use an HSM-backed key from CloudHSM.

Question 15

A company is migrating its on-premises Oracle database to Amazon RDS for Oracle. The database contains sensitive data that must be encrypted at rest and in transit. The security team also requires that the encryption keys be rotated every year. The DBA has enabled encryption at rest using a customer-managed KMS key and SSL/TLS for in-transit encryption. What additional step is needed to meet the key rotation requirement?

Accepted Answer

Enable automatic KMS key rotation for the customer-managed key.. Enable automatic KMS key rotation for the customer-managed key. AWS KMS supports automatic annual rotation of customer-managed keys, which meets the key rotation requirement without manual intervention. Option A is incorrect because manually creating a new key and updating the RDS instance each year is an unnecessary manual process when automatic rotation is available. Option B is incorrect because RDS option groups do not control encryption key rotation; they are used for managing additional database features. Option C is incorrect because CloudHSM is not integrated with RDS for key management; KMS is the service used for RDS encryption at rest.

Answer

Manually create a new KMS key every year and update the RDS instance to use the new key.

Answer

Configure the RDS option group to rotate the encryption key.

Answer

Use an AWS CloudHSM key and configure automatic rotation.