DBS-C01 Database Security Practice Test 7 — 15 Questions

Question 1

A company is using Amazon DynamoDB to store user session data. The security team requires that all access to the table be authenticated and authorized using AWS IAM. Which mechanism should the developer use to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use IAM policies to grant permissions to the DynamoDB table.. DynamoDB is integrated with AWS IAM for authentication and authorization. IAM policies can be attached to users, groups, or roles to grant specific permissions to DynamoDB tables. Option A is wrong because VPC endpoints provide network isolation but do not authenticate or authorize access. Option B is wrong because Amazon Cognito identity pools are used for federated user authentication, not for direct IAM-based access to DynamoDB. Option D is wrong because DynamoDB does not support resource-based policies; access control is managed through IAM policies.

Answer

Create a VPC endpoint for DynamoDB and allow only traffic from the VPC.

Answer

Use Amazon Cognito identity pools to grant access to the DynamoDB table.

Answer

Use a DynamoDB resource-based policy to restrict access.

Question 2

A company is using Amazon RDS for SQL Server with Multi-AZ deployment. The security team requires that all database activity be monitored for suspicious queries. The database specialist enabled RDS Database Activity Streams and configured AWS Lambda to process the stream. However, the Lambda function fails to process some events when the database fails over to the standby instance. What is the most likely cause?

Accepted Answer

The Lambda function does not re-establish the stream session after a failover event.. When a failover occurs, the RDS Database Activity Stream session is tied to the original primary instance. The Lambda function must re-establish the stream session to the new primary instance to continue processing events. If it does not, events during failover are lost. Option A is incorrect because the security group controls network access to the RDS endpoint, which remains the same after failover; connectivity is not the issue. Option C is incorrect because parameter group settings apply to both primary and standby instances; the activity stream setting is not parameter group-dependent. Option D is incorrect because the KMS key used for encryption is available in the same region; region unavailability is not a factor in Multi-AZ deployments within a single region.

Answer

The security group does not allow the Lambda function to connect to the new primary instance.

Answer

The parameter group for the standby instance does not have the activity stream enabled.

Answer

The KMS key used to encrypt the activity stream is not available in the standby instance's Region.

Question 3

A company is using Amazon Aurora MySQL-Compatible Edition. The security team wants to restrict access to the database so that only specific applications running on Amazon EC2 instances can connect. The EC2 instances are in the same VPC as the Aurora cluster. Which combination of steps should be taken to enforce this restriction?

Accepted Answer

Configure the Aurora cluster's security group to allow inbound traffic from the EC2 instances' security group.. Configuring the Aurora cluster's security group to allow inbound traffic from the EC2 instances' security group is the correct approach because security groups can reference other security groups as a source, enabling dynamic, instance-level access control without managing individual IP addresses. Option A is incorrect because IAM database authentication manages user authentication at the database level, not network access. Option B is incorrect because the DB subnet group defines the subnets where the Aurora cluster can be placed, not traffic filtering rules. Option C is incorrect because network ACLs are stateless and operate at the subnet boundary, making them less granular and harder to manage for instance-specific access compared to security group references.

Answer

Enable IAM database authentication and create database users for each application.

Answer

Modify the DB subnet group to include only subnets where the EC2 instances reside.

Answer

Use a network ACL to allow traffic only from the EC2 instances' IP addresses.

Question 4

A company is migrating an on-premises MongoDB database to Amazon DocumentDB (with MongoDB compatibility). The security team requires that data be encrypted at rest and in transit. Additionally, the team wants to use IAM roles to authenticate applications. Which THREE steps should the database specialist take to meet these requirements?

Accepted Answer

Use IAM roles to authenticate applications to the DocumentDB cluster.. Options A, C, and E are correct. IAM roles (A) can be used for authentication to DocumentDB, enabling fine-grained access control. Encryption at rest (C) can be enabled when creating the cluster, as DocumentDB supports encrypted storage using AWS KMS. Encryption in transit (E) is achieved by using TLS for all connections. Option B is incorrect because DocumentDB uses a trusted certificate authority for TLS, not a custom CA. Option D is incorrect because VPC endpoints provide private connectivity but do not enforce encryption; encryption is handled at the cluster level and via TLS.

Answer

Use a custom certificate authority for SSL/TLS.

Answer

Create a VPC endpoint for DocumentDB to enforce encryption.

Question 5

A company is using Amazon RDS for MySQL to host a web application. The security team has identified that the application is vulnerable to SQL injection attacks. The team wants to implement a defense-in-depth strategy to protect the database. Which THREE measures should be taken to mitigate SQL injection risks?

Accepted Answer

Grant the minimum required permissions to the database user used by the application.. Options A, C, and E are correct. Parameterized queries (C) prevent SQL injection by separating SQL logic from data. Least privilege (A) reduces the impact if injection occurs. AWS WAF (E) provides a web application firewall to filter malicious input before it reaches the database. Option B is incorrect because stored procedures alone do not prevent SQL injection unless they use parameterized queries. Option D is incorrect because encryption at rest protects data at rest but does not prevent SQL injection.

Answer

Move all SQL logic into stored procedures.

Answer

Enable encryption at rest for the RDS instance.

Question 6

A company has an Amazon RDS for MySQL DB instance that stores sensitive customer data. The security team requires that all data at rest be encrypted using a customer-managed AWS KMS key. The DB instance was originally launched without encryption. Which combination of steps will meet the requirement with the least downtime?

Accepted Answer

Take a snapshot of the DB instance, copy the snapshot with encryption enabled using the desired KMS key, and restore the encrypted snapshot to a new DB instance.. To enable encryption on an existing unencrypted RDS MySQL DB instance, you must take a snapshot of the instance, copy the snapshot with encryption enabled using the desired KMS key, and then restore the encrypted snapshot to a new DB instance. This process results in some downtime but is the standard method. Option A is incorrect because you cannot create an encrypted read replica from an unencrypted source instance; encryption on a read replica requires the source to be encrypted. Option B is incorrect because you cannot enable encryption on an existing unencrypted DB instance by modifying it; encryption can only be enabled at creation time or by restoring an encrypted snapshot. Option D is incorrect because you cannot restore an encrypted snapshot to the same DB instance ID; you must restore to a new instance, then update the application endpoint.

Answer

Create a read replica of the DB instance with encryption enabled, and then promote the read replica to become the primary instance.

Answer

Modify the DB instance and enable encryption using the AWS Management Console.

Answer

Take a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the encrypted snapshot to the same DB instance ID.

Question 7

A company uses Amazon DynamoDB to store user session data. The security team requires that all data be encrypted at rest using a customer-managed AWS KMS key. The DynamoDB table is already configured with AWS managed KMS encryption. How can the company meet the encryption requirement without recreating the table?

Accepted Answer

Use the UpdateTable API to specify the new KMS key in the SSESpecification parameter.. DynamoDB supports updating the server-side encryption settings on an existing table using the UpdateTable API with the SSESpecification parameter. This allows you to change from an AWS managed KMS key to a customer managed KMS key without recreating the table or causing downtime. Option A is incorrect because DynamoDB Streams are used for change data capture and cannot modify encryption settings. Option B is incorrect because exporting to S3 and importing into a new table is unnecessary and introduces additional complexity and potential downtime when an in-place update is available. Option D is incorrect because deleting and recreating the table would result in data loss and downtime, and is not required as the UpdateTable API can change encryption directly.

Answer

Enable DynamoDB Streams and use a Lambda function to copy data to a new table with the desired encryption.

Answer

Export the table to Amazon S3 using the on-demand backup feature, then import it into a new table encrypted with the desired KMS key.

Answer

Delete the table and recreate it with the new KMS key.

Question 8

A database administrator needs to audit all SQL statements executed on an Amazon RDS for PostgreSQL DB instance. Which service should be used to capture and log the SQL statements?

Accepted Answer

Amazon RDS for PostgreSQL database activity streams. Amazon RDS for PostgreSQL supports database activity streams, which can be integrated with services like Amazon CloudWatch and AWS CloudTrail to provide a near real-time stream of database activities. The other options do not capture SQL statements: CloudTrail records API calls to RDS, Config records resource configuration changes, and Inspector is for vulnerability assessment.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon Inspector

Question 9

A company has a requirement to automatically rotate the password for an Amazon RDS for MySQL DB instance every 90 days. The password is stored in AWS Secrets Manager. Which combination of steps will meet this requirement?

Accepted Answer

Store the password in Secrets Manager and configure automatic rotation with a Lambda function that updates the RDS password every 90 days.. AWS Secrets Manager provides built-in support for automatic rotation of RDS database passwords using a custom or pre-built AWS Lambda rotation function. You can configure the rotation interval to 90 days to meet the requirement. Option A is incorrect because IAM database authentication does not rotate passwords; it uses IAM roles and credentials, not password rotation. Option B is incorrect because AWS Systems Manager Parameter Store does not have native rotation capabilities for RDS passwords; it requires a custom solution. Option D is incorrect while it describes a manual approach via Lambda and CloudWatch Events, it does not leverage Secrets Manager's automatic rotation feature, which is the recommended and simplest method.

Answer

Enable IAM database authentication for the RDS instance and rotate the IAM keys every 90 days.

Answer

Store the password in AWS Systems Manager Parameter Store and configure a scheduled AWS Lambda function to update the parameter and the RDS password.

Answer

Use an AWS Lambda function to manually update the RDS password and store the new password in Secrets Manager, triggered by a CloudWatch Events rule every 90 days.

Question 10

A company is using Amazon DynamoDB with a global table that replicates data across two AWS Regions. The security team requires that all data be encrypted at rest with a customer-managed AWS KMS key. How should the company configure the KMS keys to meet this requirement?

Accepted Answer

Create a separate KMS key in each region and assign each replica table its regional KMS key.. For DynamoDB global tables, each replica table can use a different KMS key. You must create a KMS key in each region and configure the table to use the regional key. Option A is incorrect because a single KMS key cannot be used across regions; KMS keys are region-specific. Option B is incorrect because using the same key across regions is not possible. Option D is incorrect because DynamoDB global tables support encryption with customer managed keys.

Answer

Create a single KMS key in the primary region and use it for both replicas.

Answer

Use AWS managed encryption as DynamoDB does not support customer managed KMS keys for global tables.

Answer

Create a multi-Region KMS key and use it for both replicas.

Question 11

A company has an Amazon Redshift cluster that contains sensitive data. The security team requires that data be encrypted at rest using a customer-managed AWS KMS key. The cluster was initially launched without encryption. How can the company enable encryption with minimal downtime?

Accepted Answer

Take a snapshot of the cluster and restore it to a new cluster with encryption enabled.. To enable encryption on an existing unencrypted Redshift cluster with minimal downtime, the recommended approach is to take a snapshot of the cluster and restore it to a new cluster with encryption enabled. This allows the original cluster to remain operational while the encrypted cluster is being created, minimizing downtime. Once the new cluster is ready, traffic can be redirected. Option A (unload to S3, create new encrypted cluster, reload) also achieves encryption but requires significant downtime for data transfer. Option B is incorrect because there is no direct CLI command to enable encryption on an existing cluster; a new cluster must be created. Option D is incorrect because the AWS Management Console does not allow enabling encryption on an existing cluster.

Answer

Unload the data to Amazon S3, create a new encrypted cluster, and reload the data from S3.

Answer

Use the AWS CLI to update the cluster encryption setting.

Answer

Modify the cluster and enable encryption using the AWS Management Console.

Question 12

A company wants to ensure that only specific IAM users can perform certain operations on an Amazon RDS DB instance, such as creating snapshots or modifying the instance. Which AWS feature should be used to define these permissions?

Accepted Answer

IAM policies. IAM policies are used to grant or deny permissions to AWS resources, including Amazon RDS DB instances. By attaching an IAM policy to a user, group, or role, you can control which actions (e.g., CreateDBSnapshot, ModifyDBInstance) are allowed. Options A, C, and D are incorrect: VPC security groups control network traffic, DB parameter groups manage database engine settings, and DB subnet groups define which subnets the DB instance can use—none of these define permissions for specific operations.

Answer

VPC security groups

Answer

DB parameter groups

Answer

DB subnet groups

Question 13

A company is using Amazon Aurora MySQL-Compatible Edition. The security team requires that all connections to the database use SSL/TLS. The application currently connects using a standard JDBC connection string without SSL. What changes are needed to enforce SSL connections?

Accepted Answer

Modify the DB cluster parameter group to set require_secure_transport to ON and update the application connection string to use SSL parameters.. To enforce SSL for all connections to an Amazon Aurora MySQL database, you must modify the DB cluster parameter group to set require_secure_transport to ON, which rejects non-SSL connections. Additionally, the application's JDBC connection string must be updated to include SSL parameters (e.g., useSSL=true) so that the application initiates an SSL connection. Option A is incomplete because modifying the parameter group alone does not enforce SSL on existing connections if the application does not use SSL. Option C is incorrect because security groups do not have an SSL flag; they control network access based on IP and port. Option D is incorrect because IAM roles do not enforce SSL encryption; they handle authentication and authorization.

Answer

Modify the DB cluster parameter group to set require_secure_transport to ON.

Answer

Modify the security group to only allow traffic on port 3306 with the SSL flag.

Answer

Create an IAM role that requires SSL for database access and assign it to the application.

Question 14

A company stores sensitive data in an Amazon S3 bucket that is accessed by an Amazon Redshift cluster. The security team requires that the data in transit between Redshift and S3 be encrypted. Which configuration ensures this?

Accepted Answer

Ensure that the Redshift cluster has SSL enabled, which encrypts data in transit by default for COPY/UNLOAD operations to S3.. Redshift automatically uses SSL encryption for data in transit when moving data to and from S3 using COPY/UNLOAD commands. Option A is incorrect because server-side encryption (SSE-S3) encrypts data at rest, not in transit. Option C is incorrect because client-side encryption encrypts data before sending, but Redshift handles this automatically with SSL. Option D is incorrect because VPC endpoints do not encrypt data in transit; they provide private connectivity.

Answer

Enable server-side encryption (SSE-S3) on the S3 bucket.

Answer

Configure a VPC endpoint for S3.

Answer

Use client-side encryption on the data before uploading to S3.

Question 15

Which TWO of the following are valid methods to control network access to an Amazon RDS DB instance? (Select TWO.)

Accepted Answer

VPC security groups. A and B are correct. VPC security groups (A) act as a virtual firewall to control inbound and outbound traffic to the RDS instance at the network level. DB subnet groups (B) determine which subnets the RDS instance can be deployed in, effectively controlling network access by restricting the IP ranges that can reach the instance. AWS WAF (C) is a web application firewall for HTTP/HTTPS traffic, not for network-level RDS access. IAM policies (D) control API-level permissions, not network traffic. DB parameter groups (E) manage database engine configuration settings and do not affect network access.

Answer

AWS WAF

Answer

IAM policies

Answer

DB parameter groups