DBS-C01 Database Security Practice Test 8 — 15 Questions

Question 1

A financial services company stores sensitive data in an Amazon DynamoDB table. The security team requires that all data at rest be encrypted with a customer-managed key that is rotated automatically every 12 months. The company also needs to audit key usage. Which solution meets these requirements?

Accepted Answer

Enable encryption at rest using an AWS KMS customer-managed CMK. Configure automatic key rotation with a 12-month period. Use AWS CloudTrail to audit key usage.. DynamoDB supports encryption at rest with AWS KMS customer-managed CMKs. Automatic key rotation every 12 months is a feature of KMS for CMKs. CloudTrail logs KMS API calls for auditing. Option B uses the default AWS-managed key, which cannot be rotated manually but rotates automatically every 3 years, not 12 months; also, auditing is possible but the key is not customer-managed. Option C uses SSE-S3, which is for S3, not DynamoDB. Option D uses CloudHSM, which provides HSMs but does not automatically rotate keys every 12 months.

Answer

Use server-side encryption with S3-managed keys (SSE-S3) for the DynamoDB table.

Answer

Use AWS CloudHSM to generate and store the encryption key. Configure the application to encrypt data before writing to DynamoDB.

Answer

Enable encryption at rest using the default DynamoDB encryption option (AWS owned key). Use AWS CloudTrail to audit key usage.

Question 2

A company uses Amazon Redshift for its data warehouse. The security team wants to encrypt the data at rest and ensure that only authorized users can access the encryption keys. Which AWS service should be used to manage the encryption keys?

Accepted Answer

AWS Key Management Service (KMS). Amazon Redshift uses AWS KMS for encryption at rest. You can use either the default AWS-managed key or a customer-managed CMK. KMS integrates with Redshift to encrypt data in the cluster and allows fine-grained control over key access via IAM policies. CloudHSM is not directly integrated with Redshift. Secrets Manager and Systems Manager Parameter Store are for secrets, not encryption keys for Redshift.

Answer

AWS CloudHSM

Answer

AWS Secrets Manager

Answer

AWS Systems Manager Parameter Store

Question 3

A company has an Amazon RDS for Oracle DB instance that stores Personally Identifiable Information (PII). The security team requires that the data be transparently encrypted at rest using a key stored in AWS CloudHSM. What should the database administrator do to meet this requirement?

Accepted Answer

Enable TDE and use AWS KMS as the key manager by integrating with the Oracle TDE keystore.. Oracle Transparent Data Encryption (TDE) can use an external hardware security module (HSM) via the Oracle Key Vault or direct integration. However, AWS CloudHSM is not directly supported by RDS for Oracle TDE. RDS Oracle supports TDE using the Oracle wallet or AWS KMS (for integrated TDE). To use CloudHSM, you would need to run Oracle on EC2, not RDS. Option A is not supported; Option B is for KMS; Option D is incorrect because RDS does not allow custom init scripts. The correct approach is to use AWS KMS, which is the only supported method for TDE key management in RDS Oracle.

Answer

Use Oracle Data Pump to export the data, encrypt it using CloudHSM, and import it back into RDS.

Answer

Enable TDE and configure the Oracle wallet to point to the CloudHSM key.

Answer

Create a custom DB engine using a custom AMI that includes CloudHSM integration.

Question 4

A company uses Amazon DynamoDB with fine-grained access control based on user identity. The IAM policy for a user includes a condition that restricts access to items where the 'department' attribute equals 'engineering'. However, the user is receiving an 'AccessDeniedException' when trying to query items. What is the most likely cause?

Accepted Answer

The 'department' attribute is not the partition key of the table.. Fine-grained access control in DynamoDB uses IAM policy conditions with the 'dynamodb:LeadingKeys' or 'dynamodb:Attributes' condition keys. The 'department' attribute must be the partition key of the table for 'LeadingKeys' to work. If 'department' is not the partition key, the condition cannot be evaluated for the query. Option A is possible but less likely if the user is using the correct role. Option C is wrong because DynamoDB does not require SSL for all operations. Option D is wrong because Condition check is exactly how it works.

Answer

The user is not using the correct IAM role.

Answer

The DynamoDB table is not configured to require SSL.

Answer

The IAM policy is missing a 'Condition' block.

Question 5

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database contains sensitive data that must be encrypted at rest. Which action should the company take to enable encryption on the RDS instance?

Accepted Answer

Create a new RDS DB instance with encryption enabled and migrate the data.. Amazon RDS for Oracle supports encryption at rest using AWS KMS. Encryption can only be enabled when the DB instance is created; you cannot encrypt an existing unencrypted RDS instance. You must either create a new encrypted instance and migrate the data, or use Oracle features like TDE. Option A is correct because you create a new encrypted instance. Option B is wrong because you cannot modify an existing instance to add encryption. Option C is wrong because you cannot encrypt a snapshot and restore from it if the original instance was unencrypted. Option D is wrong because Oracle TDE is an option but requires additional configuration; the simplest solution is to create a new encrypted instance.

Answer

Modify the existing RDS DB instance and enable encryption.

Answer

Enable Oracle Transparent Data Encryption (TDE) on the existing RDS instance.

Answer

Take a snapshot of the existing database, encrypt the snapshot, and restore from it.

Question 6

A company uses Amazon RDS for PostgreSQL to store customer data. The security team wants to audit all SQL queries executed against the database, including SELECT statements. Which TWO actions should be taken to achieve this?

Accepted Answer

Install the pgaudit extension in the DB instance.. To audit SQL queries in RDS PostgreSQL, you can enable the pgaudit extension (Option A) and set the appropriate parameters (Option B). Database Activity Streams (Option C) send events to CloudWatch and Kinesis, but they capture a subset of activities and require additional configuration; they are not the primary method for SQL auditing. Option D is about logging connections, not queries. Option E is for MySQL, not PostgreSQL.

Answer

Enable the 'log_connections' and 'log_disconnections' parameters.

Answer

Set the 'audit_log_enabled' parameter to 1 in the DB parameter group.

Answer

Enable Database Activity Streams on the DB instance.

Question 7

A company is designing a disaster recovery strategy for an Amazon RDS for SQL Server DB instance that contains sensitive financial data. The database must be encrypted at rest using a customer-managed AWS KMS key. The recovery point objective (RPO) is 5 minutes, and the recovery time objective (RTO) is 1 hour. Which THREE steps should be taken to meet these requirements?

Accepted Answer

Enable Multi-AZ deployment for automatic failover.. To meet the RPO of 5 minutes, enable Multi-AZ with automatic failover (Option A) and automated backups with a 5-minute backup window (Option B). For RTO of 1 hour, manual DB snapshot restore is faster than point-in-time restore; automated backups allow point-in-time recovery but may take longer. Option C is wrong because manual snapshots are not automated; you need automated backups. Option D is correct because you need to ensure the KMS key is available in the secondary Region for cross-Region DR. Option E is correct because a read replica can be promoted faster than restoring from a snapshot.

Answer

Take a manual DB snapshot every hour.

Answer

Store the KMS key in the secondary Region by creating a cross-Region KMS key replica.

Question 8

A company is setting up an Amazon Aurora MySQL-compatible database. The security policy requires that all traffic between the application and database be encrypted in transit. Which TWO steps should be taken?

Accepted Answer

Set the 'require_secure_transport' parameter to 'ON' in the DB cluster parameter group.. To encrypt in transit, you need to enforce SSL on the server side (Option A) and have the application use the SSL endpoint (Option B). Option C is not necessary because Aurora uses a cluster endpoint. Option D is about network-level encryption, which is not required if SSL is used. Option E is about data at rest, not in transit.

Answer

Use a Network Load Balancer with a TLS listener in front of the Aurora cluster.

Answer

Place the Aurora cluster in a private subnet with a VPN connection.

Answer

Enable encryption at rest using AWS KMS.

Question 9

Refer to the exhibit. A company has attached this IAM policy to an IAM role used by an application running on Amazon EC2. The application needs to decrypt data in an S3 bucket that is encrypted with the specified KMS key. However, the application is receiving access denied errors. What is the most likely cause?

Accepted Answer

The application is decrypting the data by calling KMS directly instead of using S3's server-side decryption.. The policy condition 'kms:ViaService' restricts KMS operations to only when they are made through S3. However, the condition also includes 'kms:CallerAccount' which is redundant but not harmful. The error likely occurs because the EC2 instance does not have the correct IAM role, or the policy is missing 'kms:Decrypt' for the specific ciphertext. But the most common mistake is that the application is not using the S3 service to decrypt; if the application reads the encrypted object and then calls KMS directly to decrypt, the 'kms:ViaService' condition will fail because the call is not via S3. Option B addresses this. Option A is wrong because the condition is present. Option C is wrong because the role is not explicitly denied. Option D is wrong because the policy allows KMS actions.

Answer

The policy does not include 'kms:Decrypt' for the specific key.

Answer

The policy is missing a 'Principal' element.

Answer

The IAM role does not have a trust policy that allows EC2 to assume it.

Question 10

Refer to the exhibit. A database administrator is reviewing the output of 'SHOW FULL PROCESSLIST' on an Amazon RDS for MySQL DB instance. The company's security policy requires that all database users access only the minimum necessary data. Which user's activity should be investigated further?

Accepted Answer

The admin user, because the query is selecting all columns from the credit_cards table.. The admin user is executing a full scan of the credit_cards table, which is a security concern because it could be accessing unnecessary data. The app_user is querying a specific column with a condition, which is more appropriate. The admin user should have a more restrictive query. Option B is correct. Option A is wrong because the admin user's query is broad. Option C is wrong because the app_user's query is specific. Option D is wrong because both queries are selecting data, but the admin's is more concerning.

Answer

Both users, because they are both accessing the credit_cards table.

Answer

The app_user, because the query is selecting card_number which is sensitive.

Answer

Neither user, because the queries are normal for their roles.

Question 11

Refer to the exhibit. A database administrator has this IAM policy attached to their user. They are trying to authorize ingress to a DB security group named 'my-security-group' in the us-east-1 region. The operation fails. What is the most likely reason?

Accepted Answer

The user is missing the 'rds:DescribeDBSecurityGroups' permission, which is required to perform the authorize operation.. The policy allows 'AuthorizeDBSecurityGroupIngress' on the specific security group ARN. However, the ARN format is incorrect. The correct ARN for a DB security group is 'arn:aws:rds:us-east-1:123456789012:secgrp:my-security-group'? Actually, the resource type is 'secgrp'? No, the correct resource type is 'security-group'? In AWS RDS, the resource type for DB security groups is 'secgrp'? Wait, let's check: For RDS DB security groups, the resource type in IAM is 'secgrp'? Actually, the ARN format is 'arn:aws:rds:region:account:secgrp:security-group-name'. So the ARN in the policy is correct? The issue might be that the security group does not exist or is in a different region. However, the most common mistake is that the user also needs permission to 'rds:DescribeDBSecurityGroups' to view the security group. Option A is a valid explanation. Option B is wrong because the policy does allow the action on that resource. Option C is wrong because the policy allows the action. Option D is wrong because the user can create security groups.

Answer

The user is not allowed to create DB security groups, which is a prerequisite.

Answer

The policy does not grant 'rds:AuthorizeDBSecurityGroupIngress' on the specific security group.

Answer

The security group ARN in the policy is incorrect; it should include the security group ID instead of the name.

Question 12

A company is using Amazon RDS for MySQL and wants to restrict access to the database based on the source IP address. Which AWS feature should be used to achieve this?

Accepted Answer

VPC Security Groups. Security groups act as a virtual firewall for RDS instances. You can specify inbound rules that allow traffic only from certain IP addresses or other security groups. Network ACLs are for subnets, not individual instances. IAM policies control API access, not network traffic. DB parameter groups configure database engine parameters.

Answer

DB Parameter Groups

Answer

IAM Database Authentication

Answer

Network ACLs

Question 13

A company is deploying an Amazon DynamoDB table with server-side encryption using a customer-managed AWS KMS key. The security team requires that the key be automatically rotated every year and that access to the key be logged. Which THREE steps should be taken?

Accepted Answer

Enable automatic key rotation for the KMS key.. To meet the requirements, enable automatic key rotation (Option A), enable CloudTrail logging (Option B), and create a KMS key policy that restricts usage (Option C). Option D is wrong because CloudHSM is not used here. Option E is wrong because DynamoDB encryption is managed by KMS, not by the application.

Answer

Use AWS CloudHSM to store the key and manage rotation.

Answer

Configure the DynamoDB table to use client-side encryption.

Question 14

A company has an Amazon Redshift cluster that contains sensitive data. The security team wants to ensure that all data is encrypted at rest and that the encryption keys are managed by AWS. Which configuration should be used?

Accepted Answer

Enable encryption at rest using the default AWS-managed KMS key for Redshift.. Amazon Redshift supports encryption at rest using AWS KMS. When you enable encryption, you can choose to use the default AWS-managed key (aws/redshift) or a customer-managed key. The default key is managed by AWS, meeting the requirement that keys are managed by AWS. Option A is client-side, not server-side. Option C is wrong because HSM does not automatically rotate. Option D is wrong because Redshift does not use S3-managed keys for its own storage.

Answer

Use AWS CloudHSM to generate and store encryption keys.

Answer

Use server-side encryption with S3-managed keys (SSE-S3) for the Redshift cluster.

Answer

Use client-side encryption with the AWS Encryption SDK.

Question 15

A company has an Amazon RDS for MySQL database that contains sensitive data. The security team requires that all data be encrypted at rest using a customer-managed key stored in AWS KMS. Which action should be taken to meet this requirement?

Accepted Answer

Create a new RDS instance with encryption enabled using the KMS key, migrate data, and delete the old instance.. Option D is correct because RDS encryption at rest with a customer-managed KMS key is enabled at launch time and cannot be enabled after creation. Option A is wrong because enabling encryption on an existing unencrypted instance is not supported. Option B is wrong because you cannot modify an existing instance to add encryption. Option C is wrong because encryption is set at launch, not by modifying the DB parameter group.

Answer

Enable encryption on the existing RDS instance by modifying the instance.

Answer

Configure the DB parameter group to require encryption at rest.

Answer

Create a snapshot of the unencrypted database and restore it as an encrypted database.