DBS-C01 Database Security Practice Test 6 — 15 Questions

Question 1

A company uses Amazon DynamoDB to store sensitive user data. The security team wants to ensure that all data is encrypted at rest using a customer-managed AWS KMS key. The DynamoDB table was created with the default AWS managed key. What is the required action to change the encryption key?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a new DynamoDB table with the desired KMS key, export data from the old table, and import into the new table.. DynamoDB does not allow changing the encryption key on an existing table. To use a customer-managed KMS key, you must create a new table with the desired key, export data from the old table, and import it into the new table. Option A is incorrect because the UpdateTable API does not support changing the encryption key. Option C is incorrect because enabling automatic key rotation on the existing KMS key does not change the key used by DynamoDB; it rotates the key material but the table still uses the same key ID. Option D is incorrect because deleting the default AWS managed key would break encryption for any tables using it, and it does not allow you to change the key for the existing table.

Answer

Use the UpdateTable API to specify the new KMS key.

Answer

Enable automatic key rotation on the existing KMS key.

Answer

Delete the default AWS managed key and create a new customer managed key.

Question 2

A developer is configuring an Amazon RDS for PostgreSQL DB instance. The application connects using IAM database authentication. Which setting must be enabled on the DB instance for IAM authentication to work?

Accepted Answer

Set the 'rds.force_ssl' parameter to 1.. IAM database authentication for Amazon RDS PostgreSQL requires an encrypted connection to protect the authentication token. Setting the 'rds.force_ssl' parameter to 1 enforces TLS/SSL connections between the client and the database, which is a prerequisite for IAM authentication. Option A is incorrect because the port (default 5432) does not need to change for IAM. Option C is incorrect because the DB instance can be private within a VPC; IAM authentication works over private or public connections as long as TLS is enforced. Option D is incorrect because the master username is not changed; IAM authentication uses database users that are mapped to IAM identities.

Answer

Set the database port to 5432.

Answer

Ensure the DB instance is publicly accessible.

Answer

Change the master username to 'iam_user'.

Question 3

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all data be encrypted at rest using a key stored in AWS CloudHSM. What must be done to meet this requirement?

Accepted Answer

Use Oracle Transparent Data Encryption (TDE) with CloudHSM as the key store.. Amazon RDS for Oracle supports Oracle Transparent Data Encryption (TDE) for encrypting data at rest, and RDS integrates with AWS CloudHSM as the key store for TDE master keys. This is the documented way to satisfy a requirement that encryption keys reside in CloudHSM, because RDS's native storage encryption uses KMS keys (which cannot be CloudHSM-backed in the way described). TDE with CloudHSM gives the customer control over the master encryption key inside a dedicated HSM.

Answer

Enable RDS encryption at rest using a KMS key backed by CloudHSM.

Answer

Create an encrypted file system on the RDS instance using CloudHSM.

Answer

Configure SSL/TLS for the database connection.

Question 4

A security engineer is designing access controls for an Amazon DynamoDB table containing customer data. Which TWO actions enforce least privilege access?

Accepted Answer

Use IAM conditions to restrict access to specific attributes.. Option A is correct because IAM condition keys such as dynamodb:Attributes and dynamodb:Select let you restrict a principal to reading or writing only specific attributes of an item, which is the essence of least privilege for DynamoDB data. Option C is correct because DynamoDB fine-grained access control is implemented precisely through IAM policy conditions (for example dynamodb:LeadingKeys to limit a user to their own partition key values and dynamodb:Attributes to limit item attributes), scoping permissions to only the data each user needs. Options B and E are wrong because granting dynamodb:* or allowing all actions in a VPC endpoint policy is wildcard, full-access permission that violates least privilege. Option D is not the intended answer here: DynamoDB is primarily an IAM identity-based authorization model, and a resource-based policy alone does not by itself provide the attribute- and key-level least-privilege scoping described in the correct options.

Answer

Grant dynamodb:* action to all users.

Answer

Use a resource-based policy on the DynamoDB table.

Answer

Attach a VPC endpoint policy that allows all actions.

Question 5

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The security team wants to audit all database logins and queries. Which TWO actions should be taken to enable auditing?

Accepted Answer

Publish MySQL logs to Amazon CloudWatch Logs.. Option C is correct because RDS for MySQL can publish the MySQL error, slow query, and general logs to Amazon CloudWatch Logs, which is the mechanism that makes query/login audit data centrally viewable and retainable for the security team. Option D is correct because setting the general_log parameter to 1 makes MySQL log every client connection and every SQL statement executed, which is exactly the login and query auditing the team requires. Option A is wrong because CloudTrail data events are not supported for RDS database engines; CloudTrail only records RDS control-plane API calls (management events), not individual logins or queries. Option B is wrong because RDS event notifications deliver operational events about the DB instance (e.g., failover, backup, maintenance), not SQL-level audit records. Option E is wrong because Enhanced Monitoring reports OS-level metrics such as CPU, memory, and disk I/O, and does not capture logins or queries.

Answer

Enable AWS CloudTrail data events for RDS.

Answer

Create an RDS event notification subscription.

Answer

Enable Enhanced Monitoring.

Question 6

A database administrator is troubleshooting why Amazon RDS Enhanced Monitoring is not displaying metrics for a DB instance. The IAM role attached to the instance has the policy shown in the exhibit. What is the likely cause?

Accepted Answer

The policy denies the 'rds:DescribeDBInstances' action.. Amazon RDS Enhanced Monitoring requires an IAM role with permissions to publish metrics to CloudWatch Logs and to describe the DB instance. The policy shown likely lacks the 'rds:DescribeDBInstances' action, which is needed for the monitoring agent to identify the DB instance and its resources. Without this permission, Enhanced Monitoring cannot collect and display metrics.

Answer

The policy is missing the 'rds:CreateDBInstance' action.

Answer

The policy does not include 'monitoring:ListMetrics'.

Answer

The resource is set to '*' instead of the specific DB instance ARN.

Question 7

A security auditor notices that the DynamoDB table 'UserData' is encrypted with a KMS key (exhibit). The company policy requires that all DynamoDB tables use an AWS managed key for encryption. What must be done to comply with the policy?

Accepted Answer

Create a new DynamoDB table with SSE enabled using the AWS managed key, then export data from the existing table and import into the new table.. DynamoDB encryption at rest is configured at table creation time, and the KMS key choice (AWS owned, AWS managed, or customer managed) cannot be changed after the table exists. To switch from a customer managed key to an AWS managed key, you must create a new table with the desired SSE setting and migrate the data. Option A correctly describes this create-and-migrate approach, which is the only supported way to change the encryption key type for an existing table.

Answer

Delete the customer managed KMS key and recreate it as an AWS managed key.

Answer

Modify the table's SSE configuration to use the AWS managed key.

Answer

Use the UpdateTable API to change the KMS key to the AWS managed key.

Question 8

A retail company uses Amazon DynamoDB to store product catalog data. The security team wants to ensure that only authorized applications can read and write to the table. The applications are running on Amazon EC2 instances. The current setup uses an IAM role attached to the EC2 instance with a policy that grants dynamodb:* on the specific table. However, during a security audit, it was discovered that any process on the EC2 instance can access the table because the instance has access to the temporary credentials from the instance metadata service. The security team requires that only specific processes (the application) can access the credentials, and that the credentials cannot be extracted from the instance. What should be done to meet these requirements?

Accepted Answer

Create a VPC endpoint for DynamoDB with a policy that restricts access to the specific IAM role, and configure the EC2 instance to use IMDSv2 with a hop limit.. Using a VPC endpoint for DynamoDB with a policy that restricts access to the specific IAM role ensures that only requests from that role are allowed, and using IMDSv2 with a hop limit prevents credential theft by ensuring that only the intended application process on the EC2 instance can access the credentials. Option B is incorrect because security groups control network traffic but do not enforce IAM role usage. Option C is incorrect because storing AWS access keys on the instance is less secure and exposes credentials to any process. Option D is incorrect because DynamoDB does not support resource-based policies; IAM roles are authorized via identity-based policies attached to the role.

Answer

Modify the security group to only allow traffic from the EC2 instance's private IP.

Answer

Store AWS access keys on the EC2 instance and use them in the application.

Answer

Attach a resource-based policy to the DynamoDB table allowing only the EC2 instance's IAM role.

Question 9

A security engineer reviews the IAM policy attached to a user. The user is unable to modify any RDS DB instance, even when MFA is enabled. What is the most likely cause?

Accepted Answer

The user does not have MFA enabled, or the instance name does not match the allowed prefixes.. The most likely cause is that the user either does not have MFA enabled or the RDS instance name does not match the allowed prefixes specified in the policy. IAM policies that require MFA typically include a condition like aws:MultiFactorAuthPresent, and if MFA is not enabled, the condition fails. Additionally, if the policy restricts actions to specific resource ARNs with prefixes, the instance name must match those prefixes for the action to be allowed.

Answer

The policy is missing the ec2:ModifyInstance permission.

Answer

The policy does not include a Deny statement for RDS actions.

Answer

The user is trying to use the RDS console, but the policy only allows API calls.

Question 10

A security engineer runs the AWS CLI command shown in the exhibit. The engineer wants to ensure that all RDS DB instances in the account are encrypted at rest. What should the engineer do to remediate the unencrypted read replica?

Accepted Answer

Delete the unencrypted read replica and create a new read replica from the encrypted source, enabling encryption on the new replica.. RDS encryption at rest can only be enabled at the time a DB instance or read replica is created — it cannot be turned on afterward for an existing unencrypted instance. The correct remediation is therefore to delete the unencrypted read replica and recreate it from the encrypted source while enabling encryption on the new replica (option B). This produces an encrypted read replica that satisfies the security requirement.

Answer

Modify the read replica by setting the StorageEncrypted parameter to true.

Answer

Enable encryption on the source DB instance and the read replica will automatically become encrypted.

Answer

Create a snapshot of the read replica, encrypt the snapshot, and restore it as a new instance.

Question 11

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all network traffic between the application servers and the database be encrypted using TLS. The application servers are in a different VPC connected via VPC Peering. What is the simplest way to enforce encryption in transit?

Accepted Answer

Enable the rds.force_ssl parameter in the DB parameter group and configure the application to use SSL connections.. The simplest way to enforce encryption in transit for RDS for Oracle is to enable the rds.force_ssl parameter in the DB parameter group. This parameter forces all connections to use SSL/TLS. The application must then be configured to use SSL connections. This approach ensures encryption without complex network changes.

Answer

Modify the security group for the RDS instance to only allow traffic on port 443.

Answer

Use a default DB parameter group, as it already enforces SSL.

Answer

Set up a VPN connection between the two VPCs and route all traffic through it.

Question 12

A company is running an RDS for MySQL database and needs to ensure that all connections to the database use SSL encryption. Which configuration step is required?

Accepted Answer

Set 'require_secure_transport' to ON in the DB parameter group.. Setting 'require_secure_transport' to ON in the DB parameter group forces all connections to the RDS for MySQL database to use SSL/TLS encryption. This parameter is supported in MySQL 5.7 and later, and when enabled, the server rejects non-encrypted connections, ensuring compliance with security policies.

Answer

Enable 'Enable SSL' in the RDS console.

Answer

Set 'rds.force_ssl' to 1 in the DB parameter group.

Answer

Set 'ssl' to 'require' in the DB parameter group.

Question 13

A company is using DynamoDB with a VPC endpoint. They want to restrict access to only requests originating from their VPC. Which policy condition should be used?

Accepted Answer

'aws:SourceVpce': 'vpce-12345678'. The 'aws:SourceVpce' condition key allows you to restrict access to requests originating from a specific VPC endpoint (interface endpoint) in your VPC. This ensures that only traffic coming through that VPC endpoint can access the DynamoDB table, providing a network-level security boundary. The condition must reference the exact VPC endpoint ID (e.g., 'vpce-12345678') to enforce this restriction.

Answer

'aws:VpcSourceIp': '10.0.0.0/16'

Answer

's3:x-amz-server-side-encryption': 'AES256'

Answer

'aws:SourceVpc': 'vpc-12345678'

Question 14

A company is using Amazon RDS for Oracle and wants to integrate with AWS CloudTrail to log database API calls. Which action is necessary?

Accepted Answer

Enable CloudTrail for the RDS instance.. AWS CloudTrail is the service that logs API calls made to AWS services, including Amazon RDS. To capture database API calls (e.g., CreateDBInstance, ModifyDBInstance) for an RDS for Oracle instance, you must enable CloudTrail for the RDS instance by creating a trail that covers the RDS service. This logs management events at the AWS control plane level, not the database engine level.

Answer

Create a VPC endpoint for CloudTrail.

Answer

Configure Oracle Fine-Grained Auditing (FGA).

Answer

Install the pgAudit extension.

Question 15

Which THREE are valid methods to encrypt data at rest in Amazon DynamoDB? (Choose 3.)

Accepted Answer

Use a customer managed CMK.. DynamoDB encryption at rest is implemented through AWS KMS, supporting three types of customer master keys (CMKs): AWS-owned CMKs (default), AWS managed CMKs, and customer managed CMKs. Option A is correct because customer managed CMKs are fully supported, allowing you to create, manage, and control key policies and rotation. Option C (AWS-owned) and D (AWS managed) are also correct. Option E (client-side encryption with DynamoDB Encryption Client) is not an encryption-at-rest method provided by DynamoDB; it encrypts data before transmission, but data at rest is still encrypted by DynamoDB's server-side encryption. Option B is irrelevant as S3 server-side encryption does not apply to DynamoDB.

Answer

Use S3 server-side encryption.

Answer

Use client-side encryption with the DynamoDB Encryption Client.