DBS-C01 Database Security Practice Test 7 — 15 Questions

Question 1

A company uses Amazon DynamoDB to store user session data. The security team requires that all data be encrypted at rest using a customer-managed AWS KMS key. The DynamoDB table is already configured with AWS managed KMS encryption. How can the company meet the encryption requirement without recreating the table?

Accepted Answer

Use the UpdateTable API to specify the new KMS key in the SSESpecification parameter.. Option C is correct because DynamoDB supports updating the encryption key for an existing table using the UpdateTable API with the SSESpecification parameter. You can switch from AWS managed key to a customer managed key. Option A is incorrect because you cannot change the encryption configuration during table creation after the table exists. Option B is incorrect because exporting to S3 and re-importing is unnecessary and causes more downtime. Option D is incorrect because DynamoDB streams are used for change data capture, not for encryption changes.

Answer

Enable DynamoDB Streams and use a Lambda function to copy data to a new table with the desired encryption.

Answer

Export the table to Amazon S3 using the on-demand backup feature, then import it into a new table encrypted with the desired KMS key.

Answer

Delete the table and recreate it with the new KMS key.

Question 2

A database administrator needs to audit all SQL statements executed on an Amazon RDS for PostgreSQL DB instance. Which service should be used to capture and log the SQL statements?

Accepted Answer

Amazon RDS for PostgreSQL database activity streams. Option D is correct. Amazon RDS for PostgreSQL supports database activity streams, which can be integrated with services like Amazon CloudWatch and AWS CloudTrail to provide a near real-time stream of database activities. The other options do not capture SQL statements: CloudTrail records API calls to RDS, Config records resource configuration changes, and Inspector is for vulnerability assessment.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon Inspector

Question 3

A company has a requirement to automatically rotate the password for an Amazon RDS for MySQL DB instance every 90 days. The password is stored in AWS Secrets Manager. Which combination of steps will meet this requirement?

Accepted Answer

Store the password in Secrets Manager and configure automatic rotation with a Lambda function that updates the RDS password every 90 days.. Option A is correct. Secrets Manager can automatically rotate secrets for RDS databases using a Lambda rotation function. You can configure the rotation interval to 90 days. Option B is incorrect because Systems Manager Parameter Store does not have built-in rotation for RDS passwords. Option C is incorrect because manual rotation does not meet the automatic requirement. Option D is incorrect because IAM database authentication does not rotate passwords; it uses IAM credentials.

Answer

Enable IAM database authentication for the RDS instance and rotate the IAM keys every 90 days.

Answer

Store the password in AWS Systems Manager Parameter Store and configure a scheduled AWS Lambda function to update the parameter and the RDS password.

Answer

Use an AWS Lambda function to manually update the RDS password and store the new password in Secrets Manager, triggered by a CloudWatch Events rule every 90 days.

Question 4

A company is using Amazon DynamoDB with a global table that replicates data across two AWS Regions. The security team requires that all data be encrypted at rest with a customer-managed AWS KMS key. How should the company configure the KMS keys to meet this requirement?

Accepted Answer

Create a separate KMS key in each region and assign each replica table its regional KMS key.. Option C is correct. For DynamoDB global tables, each replica table can use a different KMS key. You must create a KMS key in each region and configure the table to use the regional key. Option A is incorrect because a single KMS key cannot be used across regions; KMS keys are region-specific. Option B is incorrect because using the same key across regions is not possible. Option D is incorrect because DynamoDB global tables support encryption with customer managed keys.

Answer

Create a single KMS key in the primary region and use it for both replicas.

Answer

Use AWS managed encryption as DynamoDB does not support customer managed KMS keys for global tables.

Answer

Create a multi-Region KMS key and use it for both replicas.

Question 5

A company has an Amazon Redshift cluster that contains sensitive data. The security team requires that data be encrypted at rest using a customer-managed AWS KMS key. The cluster was initially launched without encryption. How can the company enable encryption with minimal downtime?

Accepted Answer

Unload the data to Amazon S3, create a new encrypted cluster, and reload the data from S3.. Option B is correct. To enable encryption on an existing unencrypted Redshift cluster, you must unload the data to Amazon S3, create a new encrypted cluster, and reload the data. Option A is incorrect because Redshift does not support enabling encryption on an existing cluster directly. Option C is incorrect because snapshots preserve encryption status; restoring an unencrypted snapshot to an encrypted cluster is not possible. Option D is incorrect because modifying the cluster does not support enabling encryption.

Answer

Use the AWS CLI to update the cluster encryption setting.

Answer

Take a snapshot of the cluster and restore it to a new cluster with encryption enabled.

Answer

Modify the cluster and enable encryption using the AWS Management Console.

Question 6

A company wants to ensure that only specific IAM users can perform certain operations on an Amazon RDS DB instance, such as creating snapshots or modifying the instance. Which AWS feature should be used to define these permissions?

Accepted Answer

IAM policies. Option D is correct. IAM policies are used to grant permissions to IAM users, groups, or roles for specific AWS resources, including RDS. Options A, B, and C are not used for access control: Security groups control network traffic, DB subnet groups define network subnets, and parameter groups configure database engine settings.

Answer

VPC security groups

Answer

DB parameter groups

Answer

DB subnet groups

Question 7

A company is using Amazon Aurora MySQL-Compatible Edition. The security team requires that all connections to the database use SSL/TLS. The application currently connects using a standard JDBC connection string without SSL. What changes are needed to enforce SSL connections?

Accepted Answer

Modify the DB cluster parameter group to set require_secure_transport to ON and update the application connection string to use SSL parameters.. Option D is correct. To enforce SSL for all connections, you must configure the DB cluster parameter group to set require_secure_transport to ON and update the application connection string to use SSL parameters. Option A is incomplete because modifying the parameter group alone does not enforce SSL for existing connections. Option B is incorrect because modifying the security group does not enforce SSL. Option C is incorrect because using an IAM role does not enforce SSL.

Answer

Modify the DB cluster parameter group to set require_secure_transport to ON.

Answer

Modify the security group to only allow traffic on port 3306 with the SSL flag.

Answer

Create an IAM role that requires SSL for database access and assign it to the application.

Question 8

A company stores sensitive data in an Amazon S3 bucket that is accessed by an Amazon Redshift cluster. The security team requires that the data in transit between Redshift and S3 be encrypted. Which configuration ensures this?

Accepted Answer

Ensure that the Redshift cluster has SSL enabled, which encrypts data in transit by default for COPY/UNLOAD operations to S3.. Option B is correct. Redshift automatically uses SSL encryption for data in transit when moving data to and from S3 using COPY/UNLOAD commands. Option A is incorrect because server-side encryption (SSE-S3) encrypts data at rest, not in transit. Option C is incorrect because client-side encryption encrypts data before sending, but Redshift handles this automatically with SSL. Option D is incorrect because VPC endpoints do not encrypt data in transit; they provide private connectivity.

Answer

Enable server-side encryption (SSE-S3) on the S3 bucket.

Answer

Configure a VPC endpoint for S3.

Answer

Use client-side encryption on the data before uploading to S3.

Question 9

Which TWO of the following are valid methods to control network access to an Amazon RDS DB instance? (Select TWO.)

Accepted Answer

VPC security groups. Options B and D are correct. Security groups control inbound and outbound traffic to RDS instances. DB subnet groups define which subnets the DB instance can be placed in, but they indirectly control network access. Option A (IAM policies) control API-level permissions, not network access. Option C (DB parameter groups) control database engine settings. Option E (AWS WAF) is for web application firewalls, not network-level access to RDS.

Answer

AWS WAF

Answer

IAM policies

Answer

DB parameter groups

Question 10

Which THREE of the following are best practices for securing an Amazon DynamoDB table? (Select THREE.)

Accepted Answer

Enable point-in-time recovery (PITR) to protect against accidental writes or deletes.. Options A, C, and D are correct. IAM policies should be used to grant least privilege. DynamoDB supports encryption at rest with KMS. Point-in-time recovery (PITR) is a security best practice for data protection. Option B (public access) is not a security best practice; DynamoDB tables are private by default. Option E (limiting item size) is a performance consideration, not a security best practice.

Answer

Enable public access to the table to allow easy data sharing.

Answer

Limit the maximum item size to 100 KB to reduce storage costs.

Question 11

Which TWO of the following are methods to encrypt data at rest for an Amazon RDS for Oracle DB instance? (Select TWO.)

Accepted Answer

Enable encryption at rest using AWS KMS when creating the DB instance.. Options B and D are correct. RDS Oracle supports both Transparent Data Encryption (TDE) using Oracle native encryption and encryption using AWS KMS. Option A (SSL) is for data in transit. Option C (client-side encryption) is not supported natively by RDS. Option E (S3 SSE) applies to S3, not RDS.

Answer

Enable SSL/TLS for the DB instance.

Answer

Configure Amazon S3 server-side encryption on the DB instance's storage.

Answer

Use client-side encryption in the application before sending data to RDS.

Question 12

An IAM policy is attached to a role used by an application to access an Amazon RDS for MySQL DB instance. The DB instance is encrypted with a customer-managed KMS key. The application is unable to create a snapshot of the encrypted DB instance. Which missing permission is the most likely cause?

Accepted Answer

kms:CreateGrant. Option D is correct. To create a snapshot of an encrypted RDS instance, the IAM role needs permission to the KMS key for the kms:CreateGrant action. The policy allows kms:Decrypt and kms:GenerateDataKey but not kms:CreateGrant, which is required for RDS to use the KMS key on behalf of the user when creating a snapshot. Options A, B, and C are not required for snapshot creation.

Answer

kms:ReEncrypt

Answer

kms:DescribeKey

Answer

kms:Encrypt

Question 13

A database administrator is troubleshooting connectivity to an Amazon RDS for MySQL DB instance. The application is running on an EC2 instance in the same VPC and security group. The application can connect using the endpoint shown in the exhibit. However, the security team requires that all connections be encrypted using SSL. The DBA has enabled SSL on the DB instance and modified the parameter group to set require_secure_transport to ON. The application is now failing to connect. What is the most likely cause?

Accepted Answer

The application's JDBC connection string does not include SSL parameters such as useSSL=true.. Option C is correct. When require_secure_transport is set to ON, the database server rejects non-SSL connections. The application must be configured to use SSL by adding the useSSL=true and requireSSL=true parameters to the JDBC connection string. Option A is incorrect because the security group does not need to allow port 3307; SSL uses the same port. Option B is incorrect because the endpoint is a DNS name, not an IP address. Option D is incorrect because the user account does not need the SSL privilege if the server enforces SSL.

Answer

The DB instance endpoint is not resolving to the correct IP address.

Answer

The database user account does not have the SSL privilege granted.

Answer

The security group does not allow inbound traffic on port 3307, which is used for SSL connections.

Question 14

A security auditor reviews the output of a DynamoDB table description command as shown in the exhibit. Which statement accurately describes the encryption configuration of the Users table?

Accepted Answer

The table is encrypted using a customer managed KMS key.. Option B is correct. The output shows SSEDescription with Status ENABLED, SSEType KMS, and a KMSMasterKeyArn, indicating that the table is encrypted using a customer-managed KMS key. Option A is incorrect because the key ARN is a customer managed key, not an AWS managed key. Option C is incorrect because the status is ENABLED. Option D is incorrect because the table is encrypted.

Answer

The table is encrypted using an AWS managed KMS key.

Answer

The table uses server-side encryption with an S3 managed key.

Answer

The table is not encrypted at rest.

Question 15

A company is running an Amazon RDS for MySQL DB instance in a VPC. The security team requires that all connections to the database use SSL/TLS. Which combination of steps should be taken to enforce this? (Choose two.)

Accepted Answer

Require database users to connect using the --ssl-ca parameter with the RDS certificate.. To enforce SSL on RDS MySQL, you set the rds.force_ssl parameter to 1 in the DB parameter group and require users to connect using the --ssl-ca option. The option group is for features like Oracle TDE, not SSL enforcement. Security group rules control network access, not encryption enforcement. Option E is unnecessary if you set the parameter.

Answer

Create a new DB subnet group that isolates the DB instance in a private subnet without internet access.

Answer

Update the security group for the DB instance to deny inbound traffic on port 3306 from sources that do not have SSL.

Answer

Modify the DB option group associated with the DB instance, enabling the SSL option.