DBS-C01 Database Security Practice Test 7 — 15 Questions

Question 1

Which TWO AWS services can be used to monitor database security events in real time? (Choose 2.)

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty (Option B) is a threat detection service that continuously monitors for malicious activity and unauthorized behavior, including database security events such as suspicious API calls or potential credential compromise. It uses machine learning, anomaly detection, and integrated threat intelligence to analyze AWS CloudTrail logs, VPC Flow Logs, and DNS logs in real time, making it suitable for monitoring database security events.

Answer

AWS WAF

Answer

Amazon RDS Performance Insights

Answer

AWS CloudTrail

Question 2

A database administrator has the IAM policy shown in the exhibit. Which action will be allowed by this policy?

Accepted Answer

Create a snapshot of the prod-db instance.. The policy explicitly allows CreateDBSnapshot on the resource. Option A is denied. Option C is not in the policy. Option D is not in the policy.

Answer

Modify the prod-db instance.

Answer

Delete the prod-db instance.

Answer

Describe all DB instances in the account.

Question 3

A security team is auditing an Amazon RDS for SQL Server DB instance. They notice that SSL connections are not enforced. Which configuration change will enforce SSL for all connections?

Accepted Answer

Set the 'rds.force_ssl' parameter to 1 in the DB parameter group.. For Amazon RDS for SQL Server, you can enforce SSL connections by setting the 'rds.force_ssl' parameter to 1 in the DB parameter group. This forces all connections to use SSL. Option A is incorrect because security groups control network access but do not enforce encryption. Option B is incorrect because the option group manages features such as Transparent Data Encryption (TDE) and native backup/restore, not SSL enforcement. Option D is incorrect because changing the subnet to public would expose the instance to the internet and does not enforce SSL.

Answer

Modify the security group to only allow inbound traffic on port 443.

Answer

Add the SQL Server SSL option to the option group.

Answer

Change the DB subnet group to a public subnet.

Question 4

A developer needs to grant an IAM user permission to perform automated backups of an Amazon RDS DB instance. Which IAM action should be allowed?

Accepted Answer

rds:ModifyDBInstance. The question asks for the IAM action to perform automated backups of an Amazon RDS DB instance. Automated backups are managed by setting the backup retention period, which is configured using the ModifyDBInstance API call. Therefore, the correct IAM action is rds:ModifyDBInstance (option D). Option A (rds:BackupDBInstance) is not a valid IAM action. Option B (rds:CreateDBSnapshot) is for manual snapshots, not automated backups. Option C (rds:RestoreDBInstanceFromDBSnapshot) is for restoration.

Answer

rds:BackupDBInstance

Answer

rds:CreateDBSnapshot

Answer

rds:RestoreDBInstanceFromDBSnapshot

Question 5

A company has an Amazon RDS for Oracle DB instance that is publicly accessible. They want to restrict access to only a specific CIDR block. Which two actions must be taken together?

Accepted Answer

Modify the VPC security group to allow inbound traffic on the database port from the specific CIDR, and ensure the DB instance is publicly accessible with the correct security group.. Option A is correct because restricting access to a publicly accessible RDS for Oracle instance requires editing the VPC security group's inbound rules to permit the database port (e.g., 1521 for Oracle) only from the specified CIDR block, while keeping the instance publicly accessible and attached to that security group. Security groups are stateful and act as the instance-level firewall, so they are the authoritative control for allowing the CIDR. Option B is wrong because a DB subnet group only defines which subnets the instance can use, not client CIDR filtering. Option C is insufficient because network ACLs are stateless subnet-level controls and do not by themselves satisfy the requirement. Option D is wrong because rds.force_ssl only enforces TLS encryption and does not restrict source CIDR ranges.

Answer

Modify the DB subnet group to include only subnets from the allowed CIDR.

Answer

Add a rule to the network ACL to allow inbound traffic from the CIDR.

Answer

Set the rds.force_ssl parameter to force encrypted connections from the allowed CIDR.

Question 6

Which TWO of the following are valid ways to encrypt data at rest in Amazon DynamoDB? (Select TWO.)

Accepted Answer

Use AWS owned CMK for server-side encryption.. Option A is correct because DynamoDB always encrypts data at rest by default using server-side encryption with an AWS owned CMK, which is a valid encryption-at-rest method requiring no configuration. Option E is correct because DynamoDB supports server-side encryption with a customer managed CMK stored in AWS KMS, giving you control over the key, its rotation, and its access policies. Option B is incorrect because Transparent Data Encryption (TDE) is a SQL Server/Oracle database feature and is not used by DynamoDB. Option C is incorrect because EBS encryption applies to EC2 volumes, not to DynamoDB, which is a fully managed service that abstracts the underlying storage. Option D is incorrect because client-side encryption protects data before it reaches DynamoDB, but it is not a DynamoDB encryption-at-rest mechanism; the question asks for ways to encrypt data at rest in DynamoDB itself.

Answer

Enable Transparent Data Encryption (TDE).

Answer

Enable EBS encryption on the underlying storage.

Answer

Implement client-side encryption before sending data to DynamoDB.

Question 7

A KMS key has the grant shown. An IAM role named AdminRole is the grantee. What additional permission does this grant provide to AdminRole beyond what the role's IAM policy allows?

Accepted Answer

The role can use the key to encrypt and decrypt, regardless of its IAM policy.. AWS KMS grants provide a way to delegate permissions to a principal (like an IAM role) without modifying the key policy or IAM policies. When a grant is created, it explicitly allows the grantee to perform the specified operations (e.g., Encrypt, Decrypt) on the KMS key. These permissions are effective regardless of the grantee's IAM policy, because KMS evaluates grants as part of its authorization process. Thus, AdminRole gains the ability to encrypt and decrypt with the key even if its IAM policy does not allow those actions.

Answer

The role can use the key to encrypt and decrypt, but only if its IAM policy also allows it.

Answer

The role can delete the KMS key.

Answer

The role can create new grants for this key.

Question 8

A company is using an Amazon RDS for MySQL DB instance to store sensitive customer data. A security audit reveals that all database traffic between the application and the database is transmitted in plaintext. Which configuration change would encrypt data in transit for new connections?

Accepted Answer

Modify the DB instance to require SSL/TLS connections and update the application connection string to use SSL.. To encrypt data in transit for new connections to an RDS for MySQL instance, you must modify the DB instance to require SSL/TLS connections (by setting the parameter group parameter require_secure_transport to ON) and update the application connection string to use SSL. This enforces encryption for all new connections.

Answer

Configure the DB instance to be in a VPC with a VPC peering connection to the application's VPC.

Answer

Enable encryption at rest for the RDS DB instance using AWS KMS.

Answer

Enable IAM database authentication for the DB instance.

Question 9

A company uses Amazon DynamoDB with a global secondary index (GSI) and client-side encryption using the AWS Encryption SDK. The security team requires that the partition key and sort key be searchable by the application but not stored in plaintext in the table. Which approach should be taken?

Accepted Answer

Encrypt the entire item client-side and use a secondary index on the encrypted keys.. The AWS Encryption SDK supports deterministic encryption of the partition and sort key attributes, which produces the same ciphertext for the same plaintext every time. This allows the application to query the GSI using the encrypted key values while the plaintext keys are never stored in DynamoDB. The entire item is encrypted client-side, and the GSI is built on the encrypted key attributes, so the keys remain searchable without being exposed in plaintext.

Answer

Use server-side encryption with a KMS key and enable DynamoDB Streams to decrypt on read.

Answer

Use client-side encryption to encrypt only the non-key attributes, leaving the partition and sort keys in plaintext.

Answer

Use DynamoDB encryption at rest with a customer-managed KMS key.

Question 10

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all connections to the database use Oracle Native Network Encryption (NNE). How should this be configured?

Accepted Answer

Create a custom DB parameter group with the encryption parameters set to REQUIRED.. Oracle Native Network Encryption (NNE) is configured through database parameters such as SQLNET.ENCRYPTION_SERVER and SQLNET.ENCRYPTION_TYPES_SERVER. On RDS for Oracle, these are set in a custom DB parameter group, not by editing sqlnet.ora directly, because RDS restricts OS-level access. Setting the encryption parameters to REQUIRED enforces encryption for all connections.

Answer

Enable IAM database authentication.

Answer

Modify the sqlnet.ora file on the RDS instance to require encryption.

Answer

Enable encryption at rest using Oracle TDE.

Question 11

Which THREE practices should be implemented to secure an Amazon DynamoDB table that stores personally identifiable information (PII)? (Select THREE.)

Accepted Answer

Enable encryption at rest using an AWS KMS customer-managed key.. Option B is correct because enabling encryption at rest with an AWS KMS customer-managed key (CMK) protects the PII stored on disk and gives you control over the key policy, rotation, and audit trail, which is essential for sensitive data. Option C is correct because IAM policies provide fine-grained, least-privilege authorization over DynamoDB tables, items, and attributes, ensuring only approved principals can read or write PII. Option D is correct because AWS CloudTrail records all DynamoDB control-plane and data-plane API calls (e.g., PutItem, GetItem, Scan), enabling auditing, detection of unauthorized access, and compliance reporting for PII. Option A is not required because a VPC endpoint only changes network path (keeping traffic off the public internet) and does not by itself secure PII; DynamoDB access is already authenticated and authorized via IAM. Option E is not selected because DynamoDB encrypts data in transit using TLS by default for all endpoints, so it is not an additional practice you must implement to secure the table.

Answer

Use a VPC endpoint to access the table.

Answer

Enable encryption in transit using SSL/TLS.

Question 12

Which TWO methods can be used to securely connect to an Amazon RDS for PostgreSQL DB instance from an EC2 instance in the same VPC? (Select TWO.)

Accepted Answer

Use IAM database authentication.. Option A is correct because IAM database authentication lets the EC2 instance use an IAM role or user credentials to obtain a short-lived authentication token for the RDS for PostgreSQL DB instance, avoiding hard-coded database passwords and providing secure, auditable access. Option D is correct because connecting with SSL/TLS encrypts the traffic between the EC2 instance and the RDS for PostgreSQL endpoint, protecting credentials and data in transit; RDS for PostgreSQL supports SSL/TLS and you can enforce it with rds.force_ssl. Option B is not appropriate because allowing all traffic from the EC2 instance is overly permissive; security groups should restrict access to the specific database port, such as 5432 for PostgreSQL. Option C is unnecessary because a bastion host is used to reach private resources from outside a VPC, whereas the EC2 instance is already in the same VPC as the RDS instance. Option E is irrelevant because VPC peering connects separate VPCs, but the EC2 instance and RDS instance are already in the same VPC.

Answer

Configure a security group that allows all traffic from the EC2 instance.

Answer

Use a bastion host to proxy the connection.

Answer

Set up a VPC peering connection between the EC2 VPC and the RDS VPC.

Question 13

Refer to the exhibit. An IAM policy is attached to a user. What is the effect when the user attempts to delete the RDS DB instance named 'prod-db'?

Accepted Answer

The user cannot delete the instance because of the explicit Deny statement.. An explicit Deny in an IAM policy always overrides any Allow, so if the policy contains a Deny for the rds:DeleteDBInstance action on the 'prod-db' resource, the user's delete request is rejected regardless of other Allow statements. This is the fundamental evaluation logic of AWS IAM: explicit deny wins.

Answer

The user can delete any other instance except 'prod-db'.

Answer

The user can delete the instance because the Deny statement only applies to snapshots.

Answer

The user can delete the instance because of the Allow on DescribeDBInstances.

Question 14

A company has an Amazon DynamoDB table with a global secondary index (GSI). The security team wants to ensure that only certain attributes are returned in query results based on the IAM policy of the calling user. What is the most secure and scalable approach?

Accepted Answer

Use IAM condition keys with 'dynamodb:Attributes' to restrict access to specific attributes.. Using IAM condition keys with 'dynamodb:Attributes' allows fine-grained access control at the attribute level. This is the recommended way to restrict access to specific attributes. Option A is incorrect because using a Lambda middleware adds latency and complexity, and it is not the most secure or scalable approach compared to native IAM attribute-level conditions. Option B is incorrect because creating multiple GSIs for attribute access would be costly and not scalable, and GSIs are not designed for attribute-level access control; they are for querying. Option D is incorrect because VPC endpoints do not control attribute access; they provide network-level security. A bucket policy is for S3, not DynamoDB.

Answer

Use an AWS Lambda function as a middleware to filter attributes before returning results.

Answer

Create multiple global secondary indexes that include only the allowed attributes for each user group.

Answer

Create a VPC endpoint for DynamoDB and attach a bucket policy that limits attribute access.

Question 15

A developer needs to connect to an Amazon RDS for PostgreSQL DB instance from an EC2 instance in the same VPC. What is the most secure way to authenticate the connection without storing database credentials in the application code?

Accepted Answer

Enable IAM database authentication and generate an authentication token.. IAM database authentication for RDS PostgreSQL allows the application to connect using an IAM user or role without storing any database credentials. The authentication token is generated by the AWS SDK and is valid for 15 minutes. This eliminates the need to store credentials in the application code. Option A is incorrect because a hardcoded password is not secure. Option B (Secrets Manager) and Option D (Systems Manager Parameter Store SecureString) both require the application to retrieve a secret at runtime, which still introduces credential management overhead and potential exposure. IAM authentication is the most secure option as it removes static credentials entirely.

Answer

Use a hardcoded password in the application configuration file.

Answer

Store the database password in AWS Secrets Manager and retrieve it at runtime.

Answer

Store the password in AWS Systems Manager Parameter Store as a SecureString.