DBS-C01 Database Security Practice Test 6 — 15 Questions

Question 1

A company is using Amazon Redshift and needs to comply with regulatory requirements that mandate encryption of all data at rest and control of the encryption keys. Which THREE steps should be taken? (Choose THREE.)

Accepted Answer

Enable automatic key rotation for the KMS key.. Option A is correct because encrypting the cluster at creation with a KMS key is required. Option C is correct because enabling KMS automatic key rotation meets key control requirements. Option D is correct because configuring the cluster to use a customer-managed key provides key control. Option B is wrong because CloudHSM is not required. Option E is wrong because encryption at rest cannot be enabled after cluster creation without restoring from a snapshot.

Answer

Use AWS CloudHSM to generate and manage encryption keys.

Answer

Enable encryption on the cluster after creation by modifying the cluster.

Question 2

A company uses Amazon DynamoDB and wants to audit access to a table. Which TWO services can be used together to log and monitor data plane operations? (Choose TWO.)

Accepted Answer

Amazon CloudWatch Logs. Option B is correct because CloudTrail logs data events for DynamoDB. Option C is correct because Amazon CloudWatch Logs can be used to store and monitor the logs. Option A is wrong because VPC Flow Logs capture network traffic. Option D is wrong because AWS Config records configuration changes. Option E is wrong because S3 access logs log access to S3, not DynamoDB.

Answer

S3 access logs

Answer

VPC Flow Logs

Answer

AWS Config

Question 3

A company is running an Amazon RDS for MySQL DB instance in a VPC. The security team requires that all connections to the database use SSL/TLS. The DBA has enabled 'require_secure_transport' parameter in the DB parameter group. However, after applying the change and rebooting, some applications that were previously connecting successfully are now failing. What is the most likely cause?

Accepted Answer

The application is not configured to connect using SSL/TLS.. Option C is correct because enabling require_secure_transport forces the server to accept only SSL connections. If the application does not use SSL, the connection will be rejected. Option A is wrong because the DB subnet group does not affect SSL enforcement. Option B is wrong because the security group controls network access, not SSL. Option D is wrong because the option group is irrelevant for this setting.

Answer

The security group inbound rule for the database port is missing.

Answer

The option group does not have the SSL option enabled.

Answer

The DB subnet group does not include the application's subnet.

Question 4

A financial services company is using Amazon DynamoDB to store customer transaction data. The compliance team requires that all data be encrypted at rest using a customer-managed AWS KMS key, and that access to the key be auditable via AWS CloudTrail. Additionally, the security team wants to ensure that DynamoDB can only be accessed from within the VPC using a VPC endpoint. Which combination of steps should the company take to meet these requirements?

Accepted Answer

Enable server-side encryption with a customer-managed KMS key and create an interface VPC endpoint for DynamoDB.. Option D is correct because DynamoDB uses KMS for encryption; an interface VPC endpoint (AWS PrivateLink) is used for private access. Option A is wrong because gateway endpoints are for S3 and DynamoDB, but DynamoDB supports both, however interface endpoint is recommended for private access with security groups. Option B is wrong because using a NAT gateway is not secure and does not enforce VPC-only access. Option C is wrong because CloudHSM is not needed for encryption; KMS is sufficient.

Answer

Use a CloudHSM key for encryption and create a VPC peering connection to DynamoDB.

Answer

Enable server-side encryption with a customer-managed KMS key and route all traffic through a NAT gateway.

Answer

Use AWS managed KMS key and a gateway VPC endpoint for DynamoDB.

Question 5

A developer needs to securely store database credentials for an application that runs on Amazon EC2 and connects to an Amazon RDS for PostgreSQL database. The credentials must be automatically rotated every 90 days. Which AWS service should the developer use to meet these requirements?

Accepted Answer

AWS Secrets Manager. Option B is correct because AWS Secrets Manager supports automatic rotation of database credentials. Option A is wrong because SSM Parameter Store can store secrets but does not natively rotate RDS credentials. Option C is wrong because CloudHSM is for hardware security modules, not credential storage. Option D is wrong because IAM Roles can be used for EC2 to access RDS but do not store credentials; also RDS PostgreSQL does not support IAM authentication by default.

Answer

AWS Systems Manager Parameter Store

Answer

AWS CloudHSM

Answer

AWS Identity and Access Management (IAM) roles

Question 6

A company has an Amazon RDS for Oracle DB instance that stores sensitive data. The security team wants to audit all SQL queries that read or modify specific columns containing personally identifiable information (PII). The audit logs must be stored for 5 years. Which solution should the database specialist implement?

Accepted Answer

Use Oracle fine-grained auditing to create an audit policy on the specific columns and store logs in a custom table.. Option C is correct because Amazon RDS for Oracle supports fine-grained auditing using the AUDIT policy for specific columns. Option A is wrong because RDS does not support Oracle Audit Vault. Option B is wrong because database activity streams capture all activities but do not filter by column; also they are stored in CloudWatch Logs, not for 5 years by default. Option D is wrong because RDS Enhanced Monitoring is for OS metrics, not SQL auditing.

Answer

Enable database activity streams and send logs to Amazon CloudWatch Logs with a retention of 5 years.

Answer

Enable RDS Enhanced Monitoring and enable SQL auditing in the parameter group.

Answer

Enable Oracle Audit Vault and Database Firewall.

Question 7

A company is using Amazon Redshift for data warehousing. The security team requires that all data be encrypted at rest using a customer-managed AWS KMS key. Additionally, the team wants to ensure that the key must be used only for this specific Redshift cluster. Which configuration should be applied?

Accepted Answer

Create a new KMS key with a key policy that grants access only to the Redshift cluster's IAM role.. Option D is correct because Redshift uses KMS keys for encryption; a cluster-specific key can be created and used. Option A is wrong because default KMS key is AWS managed, not customer-managed. Option B is wrong because cluster subnet group does not affect encryption. Option C is wrong because HSM is not used for Redshift encryption.

Answer

Create a new KMS key and associate it with the Redshift cluster's subnet group.

Answer

Use the default AWS managed KMS key for Redshift.

Answer

Use an HSM-backed key from CloudHSM.

Question 8

A company is migrating its on-premises Oracle database to Amazon RDS for Oracle. The database contains sensitive data that must be encrypted at rest and in transit. The security team also requires that the encryption keys be rotated every year. The DBA has enabled encryption at rest using a customer-managed KMS key and SSL/TLS for in-transit encryption. What additional step is needed to meet the key rotation requirement?

Accepted Answer

Enable automatic KMS key rotation for the customer-managed key.. Option B is correct because KMS automatic key rotation rotates the key material annually. Option A is wrong because manual rotation requires creating a new key and updating the RDS instance. Option C is wrong because CloudHSM is not used with RDS. Option D is wrong because the option group does not control key rotation.

Answer

Manually create a new KMS key every year and update the RDS instance to use the new key.

Answer

Configure the RDS option group to rotate the encryption key.

Answer

Use an AWS CloudHSM key and configure automatic rotation.

Question 9

A company is using Amazon DynamoDB to store user session data. The security team requires that all access to the table be authenticated and authorized using AWS IAM. Which mechanism should the developer use to achieve this?

Accepted Answer

Use IAM policies to grant permissions to the DynamoDB table.. Option A is correct because DynamoDB is integrated with IAM for authentication and authorization. Option B is wrong because Cognito is for user authentication, not for direct DynamoDB access. Option C is wrong because VPC endpoints provide network isolation but not authentication. Option D is wrong because resource-based policies are not supported for DynamoDB tables.

Answer

Create a VPC endpoint for DynamoDB and allow only traffic from the VPC.

Answer

Use Amazon Cognito identity pools to grant access to the DynamoDB table.

Answer

Use a DynamoDB resource-based policy to restrict access.

Question 10

A company is using Amazon RDS for SQL Server with Multi-AZ deployment. The security team requires that all database activity be monitored for suspicious queries. The database specialist enabled RDS Database Activity Streams and configured AWS Lambda to process the stream. However, the Lambda function fails to process some events when the database fails over to the standby instance. What is the most likely cause?

Accepted Answer

The Lambda function does not re-establish the stream session after a failover event.. Option D is correct because after failover, the stream session may be interrupted and the application must reconnect. Option A is wrong because the KMS key is used for encryption, not for connectivity. Option B is wrong because the security group applies to the RDS endpoint, which remains the same after failover. Option C is wrong because the parameter group is applied to both instances.

Answer

The security group does not allow the Lambda function to connect to the new primary instance.

Answer

The parameter group for the standby instance does not have the activity stream enabled.

Answer

The KMS key used to encrypt the activity stream is not available in the standby instance's Region.

Question 11

A company is using Amazon Aurora MySQL-Compatible Edition. The security team wants to restrict access to the database so that only specific applications running on Amazon EC2 instances can connect. The EC2 instances are in the same VPC as the Aurora cluster. Which combination of steps should be taken to enforce this restriction?

Accepted Answer

Configure the Aurora cluster's security group to allow inbound traffic from the EC2 instances' security group.. Option A is correct because security groups can be used to allow traffic only from specific security groups (e.g., EC2 security group). Option B is wrong because IAM database authentication controls user authentication, not network access. Option C is wrong because NACLs are stateless and less granular. Option D is wrong because subnet group does not restrict access.

Answer

Enable IAM database authentication and create database users for each application.

Answer

Modify the DB subnet group to include only subnets where the EC2 instances reside.

Answer

Use a network ACL to allow traffic only from the EC2 instances' IP addresses.

Question 12

A company is using Amazon DynamoDB with encryption at rest using a customer-managed KMS key. The security team wants to audit every use of this KMS key. Which TWO steps should be taken to meet this requirement?

Accepted Answer

Turn on KMS key auditing in the key's advanced configuration.. Option A and D are correct. CloudTrail logs all KMS API calls; enabling CloudTrail and KMS key auditing (via CloudTrail) provides the audit. Option B is wrong because CloudWatch Logs is for log storage, not for enabling KMS audit. Option C is wrong because Config records resource changes, not API calls. Option E is wrong because VPC Flow Logs capture network traffic, not KMS usage.

Answer

Send KMS audit logs to Amazon CloudWatch Logs.

Answer

Enable AWS Config to record KMS key configuration changes.

Answer

Enable VPC Flow Logs for the DynamoDB VPC endpoint.

Question 13

A company is migrating an on-premises MongoDB database to Amazon DocumentDB (with MongoDB compatibility). The security team requires that data be encrypted at rest and in transit. Additionally, the team wants to use IAM roles to authenticate applications. Which THREE steps should the database specialist take to meet these requirements?

Accepted Answer

Use IAM roles to authenticate applications to the DocumentDB cluster.. Options A, B, and E are correct. Encryption at rest is enabled by default; in-transit encryption is enabled via TLS; IAM authentication is supported through IAM roles. Option C is wrong because DocumentDB uses TLS, not SSL/TLS with custom certificates. Option D is wrong because DocumentDB does not support VPC endpoints for encryption; encryption at rest is cluster-level.

Answer

Use a custom certificate authority for SSL/TLS.

Answer

Create a VPC endpoint for DocumentDB to enforce encryption.

Question 14

A company is using Amazon RDS for MySQL to host a web application. The security team has identified that the application is vulnerable to SQL injection attacks. The team wants to implement a defense-in-depth strategy to protect the database. Which THREE measures should be taken to mitigate SQL injection risks?

Accepted Answer

Grant the minimum required permissions to the database user used by the application.. Options A, B, and D are correct. Prepared statements prevent SQL injection; least privilege reduces impact; WAF filters malicious input. Option C is wrong because stored procedures do not inherently prevent injection if not used with parameters. Option E is wrong because encryption does not prevent injection.

Answer

Move all SQL logic into stored procedures.

Answer

Enable encryption at rest for the RDS instance.

Question 15

A company has an Amazon RDS for MySQL DB instance that stores sensitive customer data. The security team requires that all data at rest be encrypted using a customer-managed AWS KMS key. The DB instance was originally launched without encryption. Which combination of steps will meet the requirement with the least downtime?

Accepted Answer

Take a snapshot of the DB instance, copy the snapshot with encryption enabled using the desired KMS key, and restore the encrypted snapshot to a new DB instance.. Option D is correct because you must create a snapshot of the unencrypted DB instance, copy the snapshot with encryption enabled using the desired KMS key, and then restore the encrypted snapshot to a new DB instance. This process results in some downtime but is the standard method for enabling encryption on an existing unencrypted RDS instance. Option A is incorrect because modifying the DB instance directly does not support enabling encryption. Option B is incorrect because enabling encryption on a snapshot copy is the correct approach, but you cannot restore an encrypted snapshot to the same instance; you must create a new instance. Option C is incorrect because RDS does not support enabling encryption via a read replica.

Answer

Create a read replica of the DB instance with encryption enabled, and then promote the read replica to become the primary instance.

Answer

Modify the DB instance and enable encryption using the AWS Management Console.

Answer

Take a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the encrypted snapshot to the same DB instance ID.