DBS-C01 Database Security Practice Test 8 — 15 Questions

Question 1

Which THREE of the following are best practices for securing an Amazon DynamoDB table? (Select THREE.)

Accepted Answer

Enable point-in-time recovery (PITR) to protect against accidental writes or deletes.. Options A, B, and D are correct. Point-in-time recovery (PITR) protects against accidental writes or deletes by allowing you to restore the table to any point within the last 35 days. Encryption at rest using AWS KMS secures data at rest. IAM policies based on least privilege restrict access to only necessary actions and resources. Option C (public access) is not a best practice; DynamoDB tables are private by default and should not be exposed publicly. Option E (limiting item size) is a performance consideration, not a security best practice.

Answer

Enable public access to the table to allow easy data sharing.

Answer

Limit the maximum item size to 100 KB to reduce storage costs.

Question 2

Which TWO of the following are methods to encrypt data at rest for an Amazon RDS for Oracle DB instance? (Select TWO.)

Accepted Answer

Enable encryption at rest using AWS KMS when creating the DB instance.. Options A and B are correct. Amazon RDS for Oracle supports encryption at rest via two methods: enabling encryption using AWS KMS when creating the DB instance (Option A) or using Oracle Transparent Data Encryption (TDE) with a customer-managed Oracle wallet (Option B). Option C (SSL/TLS) encrypts data in transit, not at rest. Option D (S3 SSE) is irrelevant as S3 is not used for RDS storage. Option E (client-side encryption) is an application-level approach and not a native RDS encryption method.

Answer

Enable SSL/TLS for the DB instance.

Answer

Configure Amazon S3 server-side encryption on the DB instance's storage.

Answer

Use client-side encryption in the application before sending data to RDS.

Question 3

An IAM policy is attached to a role used by an application to access an Amazon RDS for MySQL DB instance. The DB instance is encrypted with a customer-managed KMS key. The application is unable to create a snapshot of the encrypted DB instance. Which missing permission is the most likely cause?

Accepted Answer

kms:CreateGrant. To create a snapshot of an encrypted RDS DB instance, the IAM role must have the kms:CreateGrant permission on the customer-managed KMS key. This permission allows RDS to create a grant that enables it to use the key for encrypting the snapshot. Without kms:CreateGrant, the snapshot creation fails. Options A (kms:ReEncrypt), B (kms:DescribeKey), and D (kms:Encrypt) are not required for this operation.

Answer

kms:ReEncrypt

Answer

kms:DescribeKey

Answer

kms:Encrypt

Question 4

A database administrator is troubleshooting connectivity to an Amazon RDS for MySQL DB instance. The application is running on an EC2 instance in the same VPC and security group. The application can connect using the endpoint shown in the exhibit. However, the security team requires that all connections be encrypted using SSL. The DBA has enabled SSL on the DB instance and modified the parameter group to set require_secure_transport to ON. The application is now failing to connect. What is the most likely cause?

Accepted Answer

The application's JDBC connection string does not include SSL parameters such as useSSL=true.. When require_secure_transport is set to ON, the database server rejects non-SSL connections. The application must be configured to use SSL by adding the useSSL=true and requireSSL=true parameters to the JDBC connection string. Option A is incorrect because the application could connect before SSL was enforced, indicating that DNS resolution was working. Option B is incorrect because the server enforces SSL at the transport level, and no separate SSL privilege is needed for the user account. Option D is incorrect because SSL connections use the same port as non-SSL (3306 for MySQL), and the security group was already configured to allow traffic on that port.

Answer

The DB instance endpoint is not resolving to the correct IP address.

Answer

The database user account does not have the SSL privilege granted.

Answer

The security group does not allow inbound traffic on port 3307, which is used for SSL connections.

Question 5

A security auditor reviews the output of a DynamoDB table description command as shown in the exhibit. Which statement accurately describes the encryption configuration of the Users table?

Accepted Answer

The table is encrypted using a customer managed KMS key.. The output shows SSEDescription with Status ENABLED, SSEType KMS, and a KMSMasterKeyArn, which indicates that the table is encrypted using a customer-managed KMS key. Option A is incorrect because AWS managed KMS keys do not have an ARN like the one shown; they would have an alias like 'aws/dynamodb'. Option B is incorrect because DynamoDB does not use S3 managed keys; the SSEType is KMS. Option C is incorrect because the status is ENABLED, indicating encryption at rest is enabled.

Answer

The table is encrypted using an AWS managed KMS key.

Answer

The table uses server-side encryption with an S3 managed key.

Answer

The table is not encrypted at rest.

Question 6

A company is running an Amazon RDS for MySQL DB instance in a VPC. The security team requires that all connections to the database use SSL/TLS. Which combination of steps should be taken to enforce this? (Choose two.)

Accepted Answer

Require database users to connect using the --ssl-ca parameter with the RDS certificate.. To enforce SSL on RDS MySQL, you set the rds.force_ssl parameter to 1 in the DB parameter group and require users to connect using the --ssl-ca option. The option group is for features like Oracle TDE, not SSL enforcement. Security group rules control network access, not encryption enforcement. Option E is unnecessary if you set the parameter.

Answer

Create a new DB subnet group that isolates the DB instance in a private subnet without internet access.

Answer

Update the security group for the DB instance to deny inbound traffic on port 3306 from sources that do not have SSL.

Answer

Modify the DB option group associated with the DB instance, enabling the SSL option.

Question 7

A financial services company stores sensitive data in an Amazon DynamoDB table. The security team requires that all data at rest be encrypted with a customer-managed key that is rotated automatically every 12 months. The company also needs to audit key usage. Which solution meets these requirements?

Accepted Answer

Enable encryption at rest using an AWS KMS customer-managed CMK. Configure automatic key rotation with a 12-month period. Use AWS CloudTrail to audit key usage.. DynamoDB supports encryption at rest with AWS KMS customer-managed CMKs. Automatic key rotation every 12 months is a feature of KMS for CMKs. CloudTrail logs KMS API calls for auditing. Option A is incorrect because SSE-S3 is for S3, not DynamoDB. Option B is incorrect because CloudHSM does not provide automatic key rotation every 12 months and requires application-side encryption. Option C is incorrect because the default DynamoDB encryption uses an AWS owned key, which is not customer-managed and rotates automatically every 3 years, not 12 months. Option D is correct: it uses a customer-managed CMK with yearly rotation and CloudTrail for auditing.

Answer

Use server-side encryption with S3-managed keys (SSE-S3) for the DynamoDB table.

Answer

Use AWS CloudHSM to generate and store the encryption key. Configure the application to encrypt data before writing to DynamoDB.

Answer

Enable encryption at rest using the default DynamoDB encryption option (AWS owned key). Use AWS CloudTrail to audit key usage.

Question 8

A company uses Amazon Redshift for its data warehouse. The security team wants to encrypt the data at rest and ensure that only authorized users can access the encryption keys. Which AWS service should be used to manage the encryption keys?

Accepted Answer

AWS Key Management Service (KMS). Amazon Redshift uses AWS KMS for encryption at rest. You can use either the default AWS-managed key or a customer-managed CMK. KMS integrates with Redshift to encrypt data in the cluster and allows fine-grained control over key access via IAM policies. CloudHSM is not directly integrated with Redshift. Secrets Manager and Systems Manager Parameter Store are for secrets, not encryption keys for Redshift.

Answer

AWS CloudHSM

Answer

AWS Secrets Manager

Answer

AWS Systems Manager Parameter Store

Question 9

A company uses Amazon DynamoDB with fine-grained access control based on user identity. The IAM policy for a user includes a condition that restricts access to items where the 'department' attribute equals 'engineering'. However, the user is receiving an 'AccessDeniedException' when trying to query items. What is the most likely cause?

Accepted Answer

The 'department' attribute is not the partition key of the table.. Fine-grained access control in DynamoDB uses IAM policy conditions with the 'dynamodb:LeadingKeys' or 'dynamodb:Attributes' condition keys. The 'department' attribute must be the partition key of the table for 'LeadingKeys' to work. If 'department' is not the partition key, the condition cannot be evaluated for the query. Option A is possible but less likely if the user is using the correct role. Option C is wrong because DynamoDB does not require SSL for all operations. Option D is wrong because Condition check is exactly how it works.

Answer

The user is not using the correct IAM role.

Answer

The DynamoDB table is not configured to require SSL.

Answer

The IAM policy is missing a 'Condition' block.

Question 10

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database contains sensitive data that must be encrypted at rest. Which action should the company take to enable encryption on the RDS instance?

Accepted Answer

Create a new RDS DB instance with encryption enabled and migrate the data.. Amazon RDS for Oracle supports encryption at rest using AWS KMS. Encryption can only be enabled when the DB instance is created; you cannot encrypt an existing unencrypted RDS instance. Therefore, to enable encryption for an existing on-premises Oracle database being migrated, you must create a new RDS DB instance with encryption enabled at launch and then migrate the data into that new instance. This makes option B the correct choice. Option A is incorrect because you cannot modify an existing unencrypted RDS instance to add encryption. Option C is incorrect because while Oracle Transparent Data Encryption (TDE) can be used to encrypt data within the database, it is not the native Amazon RDS encryption method and requires additional configuration; moreover, the scenario assumes a new RDS instance is being created, not an existing one. Option D is incorrect because the source database is on-premises, not an RDS instance, so there is no RDS snapshot to take; even if there were an existing unencrypted RDS instance, encrypting a snapshot requires copying it with encryption enabled, not directly encrypting the snapshot. Thus D is not a valid action for this migration.

Answer

Modify the existing RDS DB instance and enable encryption.

Answer

Enable Oracle Transparent Data Encryption (TDE) on the existing RDS instance.

Answer

Take a snapshot of the existing database, encrypt the snapshot, and restore from it.

Question 11

A company uses Amazon RDS for PostgreSQL to store customer data. The security team wants to audit all SQL queries executed against the database, including SELECT statements. Which TWO actions should be taken to achieve this?

Accepted Answer

Install the pgaudit extension in the DB instance.. To audit SQL queries on Amazon RDS for PostgreSQL, the pgaudit extension must be installed (Option A). Then, the 'pgaudit.log' parameter must be set to include 'read' and 'write' statements to capture SELECT and DML operations (Option C). Option B enables connection logging but not query auditing. Option D ('audit_log_enabled') is for MySQL, not PostgreSQL. Option E (Database Activity Streams) provides a different auditing mechanism that may not capture all SQL queries and requires additional setup.

Answer

Enable the 'log_connections' and 'log_disconnections' parameters.

Answer

Set the 'audit_log_enabled' parameter to 1 in the DB parameter group.

Answer

Enable Database Activity Streams on the DB instance.

Question 12

A company is designing a disaster recovery strategy for an Amazon RDS for SQL Server DB instance that contains sensitive financial data. The database must be encrypted at rest using a customer-managed AWS KMS key. The recovery point objective (RPO) is 5 minutes, and the recovery time objective (RTO) is 1 hour. Which THREE steps should be taken to meet these requirements?

Accepted Answer

Store the KMS key in the secondary Region by creating a cross-Region KMS key replica.. To achieve an RPO of 5 minutes and RTO of 1 hour across regions, you need automated backups with a 5-minute interval (D) so that transaction logs are backed up frequently. A cross-Region read replica (E) can be promoted quickly in the secondary region to meet the RTO. Since the database uses a customer-managed KMS key, you must create a cross-Region KMS key replica (C) in the secondary region so that the replica can be encrypted. Multi-AZ (B) only provides high availability within a single region and does not support cross-region disaster recovery, so it does not help meet these RPO/RTO requirements.

Answer

Take a manual DB snapshot every hour.

Answer

Enable Multi-AZ deployment for automatic failover.

Question 13

A company is setting up an Amazon Aurora MySQL-compatible database. The security policy requires that all traffic between the application and database be encrypted in transit. Which TWO steps should be taken?

Accepted Answer

Set the 'require_secure_transport' parameter to 'ON' in the DB cluster parameter group.. To encrypt data in transit, you need to enforce SSL on the server side and ensure the client uses SSL. Setting the 'require_secure_transport' parameter to 'ON' in the DB cluster parameter group (Option C) forces the server to require SSL connections. Configuring the application connection string to use the SSL-enabled endpoint (Option D) ensures the client connects using SSL. Option A is unnecessary because Aurora supports SSL natively without a load balancer. Option B does not encrypt traffic; a VPN only secures the network path but does not enforce encryption at the database layer. Option E encrypts data at rest, not in transit.

Answer

Use a Network Load Balancer with a TLS listener in front of the Aurora cluster.

Answer

Place the Aurora cluster in a private subnet with a VPN connection.

Answer

Enable encryption at rest using AWS KMS.

Question 14

Refer to the exhibit. A company has attached this IAM policy to an IAM role used by an application running on Amazon EC2. The application needs to decrypt data in an S3 bucket that is encrypted with the specified KMS key. However, the application is receiving access denied errors. What is the most likely cause?

Accepted Answer

The application is decrypting the data by calling KMS directly instead of using S3's server-side decryption.. The policy condition 'kms:ViaService' restricts KMS operations to only when they are made through S3. However, the condition also includes 'kms:CallerAccount' which is redundant but not harmful. The error likely occurs because the EC2 instance does not have the correct IAM role, or the policy is missing 'kms:Decrypt' for the specific ciphertext. But the most common mistake is that the application is not using the S3 service to decrypt; if the application reads the encrypted object and then calls KMS directly to decrypt, the 'kms:ViaService' condition will fail because the call is not via S3. Option B addresses this. Option A is wrong because the condition is present. Option C is wrong because the role is not explicitly denied. Option D is wrong because the policy allows KMS actions.

Answer

The policy does not include 'kms:Decrypt' for the specific key.

Answer

The policy is missing a 'Principal' element.

Answer

The IAM role does not have a trust policy that allows EC2 to assume it.

Question 15

Refer to the exhibit. A database administrator is reviewing the output of 'SHOW FULL PROCESSLIST' on an Amazon RDS for MySQL DB instance. The company's security policy requires that all database users access only the minimum necessary data. Which user's activity should be investigated further?

Accepted Answer

The admin user, because the query is selecting all columns from the credit_cards table.. The admin user is executing a full scan of the credit_cards table, which is a security concern because it could be accessing unnecessary data. The app_user is querying a specific column with a condition, which is more appropriate. The admin user should have a more restrictive query. Option B is correct. Option A is wrong because the admin user's query is broad. Option C is wrong because the app_user's query is specific. Option D is wrong because both queries are selecting data, but the admin's is more concerning.

Answer

Both users, because they are both accessing the credit_cards table.

Answer

The app_user, because the query is selecting card_number which is sensitive.

Answer

Neither user, because the queries are normal for their roles.