DBS-C01 Database Security Practice Test 8 — 15 Questions

Question 1

A security engineer is designing a solution to encrypt data at rest for an Amazon Redshift cluster. The company requires that the encryption key be rotated automatically every year. Which solution meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable encryption for the Redshift cluster using an AWS KMS key with automatic rotation.. Amazon Redshift supports encryption at rest using AWS Key Management Service (KMS) customer managed keys (CMKs). When you enable encryption for a Redshift cluster with a KMS key, you can enable automatic key rotation for that KMS key. AWS KMS automatically rotates the key material every year (approximately every 365 days) without any manual intervention, satisfying the requirement. This is the native, fully managed solution that integrates directly with Redshift and meets the annual rotation requirement.

Answer

Use a Lambda function to rotate the encryption key manually every year.

Answer

Use a CloudHSM key to encrypt the Redshift cluster and configure automatic rotation in CloudHSM.

Answer

Store the Redshift cluster data in an S3 bucket with server-side encryption enabled.

Question 2

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security policy requires that all connections to the database use SSL/TLS. What should the database administrator do to meet this requirement?

Accepted Answer

Download the RDS certificate bundle and set the 'rds.force_ssl' parameter to 1 in the DB parameter group.. To enforce SSL/TLS on RDS for Oracle, you set the rds.force_ssl parameter to 1 in the DB parameter group, which makes the instance reject any non-SSL connection. You must also download the RDS certificate bundle and configure clients to use it for certificate validation. This combination satisfies a policy requiring all connections to be encrypted.

Answer

Enable IAM database authentication for the DB instance.

Answer

Modify the DB instance security group to only allow traffic on port 443.

Answer

Set the DB instance to be publicly accessible and use a VPN connection.

Question 3

A security engineer needs to restrict access to an Amazon DynamoDB table so that only users from a specific AWS account can read and write data. Which of the following can be used to achieve this? (Choose TWO.)

Accepted Answer

Use a VPC endpoint policy for DynamoDB.. To restrict access to a DynamoDB table from a specific AWS account, you can use a VPC endpoint policy for DynamoDB (Option A) to control access through VPC endpoints, and an IAM policy with a condition key such as 'aws:SourceAccount' (Option C) to restrict API calls to those originating from the specified account. Option B is incorrect because DynamoDB does not support resource-based policies. Option D is incorrect because security groups are used for network-level access to EC2 instances, not DynamoDB. Option E is incorrect because S3 bucket policies apply only to S3 resources, not DynamoDB.

Answer

Use a resource-based policy on the DynamoDB table.

Answer

Use a security group to restrict access to the DynamoDB table.

Answer

Use an S3 bucket policy to allow access to the DynamoDB table.

Question 4

An IAM policy is attached to a user. What does this policy allow the user to do?

Accepted Answer

Get an item from the Orders table but only return the order_id, customer_id, and status attributes.. The policy grants GetItem with a ProjectionExpression limiting returned attributes to order_id, customer_id, and status, which matches option D exactly. DynamoDB IAM policies can constrain both the action and the specific attributes returned via the dynamodb:Attributes condition key or by policy design.

Answer

Update an item in the Orders table.

Answer

Scan the entire Orders table and return all attributes.

Answer

Delete an item from the Orders table.

Question 5

A database administrator runs the described command. What does the output indicate about the RDS instance?

Accepted Answer

The DB instance is not encrypted at rest.. The command output shows that the RDS instance does not have the StorageEncrypted parameter set to true, indicating the DB instance is not encrypted at rest. In AWS RDS, encryption at rest must be enabled at creation time or by restoring from an unencrypted snapshot to an encrypted one; it cannot be enabled on an existing unencrypted instance.

Answer

The DB instance is in a failed state.

Answer

The DB instance is running PostgreSQL.

Answer

The DB instance is encrypted at rest using a KMS key.

Question 6

An IAM policy is attached to a user. Which of the following actions will be allowed?

Accepted Answer

Create a new DB instance named 'prod-db'.. The IAM policy attached to the user allows the 'rds:CreateDBInstance' action for any resource, so the user can create a new DB instance named 'prod-db'. The policy does not allow delete actions, so the user cannot delete any DB instance.

Answer

Delete a DB instance named 'prod-db'.

Answer

Delete a DB instance named 'test-db'.

Answer

Delete a DB instance named 'dev-db'.

Question 7

A financial services company uses Amazon RDS for MySQL to store sensitive customer data. The compliance team requires that all database administrators (DBAs) must authenticate using IAM database authentication, and no static database passwords should be used. A junior DBA has been granted the rds_iam role in the database. However, the junior DBA is unable to connect using the AWS CLI command: aws rds generate-db-auth-token --hostname mydb.xyz.us-east-1.rds.amazonaws.com --port 3306 --username jdba. The error message says 'Access denied'. What is the most likely cause?

Accepted Answer

The RDS instance does not have IAM database authentication enabled.. IAM database authentication must be explicitly enabled on the RDS instance; it is not on by default. Even if the DBA has the rds_iam role and generates a token, the instance will reject the connection with 'Access denied' if IAM authentication is disabled. The most likely cause is that the instance was not configured with IAM authentication enabled.

Answer

The RDS instance does not have a resource-based policy that grants the junior DBA access.

Answer

The junior DBA is not using an SSL connection to the database.

Answer

The security group does not allow inbound traffic on port 3306 from the junior DBA's IP address.

Question 8

A company is using Amazon RDS for PostgreSQL to store application data. The security team wants to ensure that database audit logs are stored securely and cannot be modified after creation. Which AWS service should be used to meet this requirement?

Accepted Answer

Amazon CloudWatch Logs. Amazon RDS for PostgreSQL can publish database audit logs to Amazon CloudWatch Logs. CloudWatch Logs provides immutability through IAM policies that prevent log modification and deletion, combined with log group encryption using AWS KMS. Option D is correct. Option A (AWS KMS) is wrong because KMS manages encryption keys, not log storage. Option B (AWS CloudTrail) is wrong because CloudTrail records API activity, not database audit logs. Option C (Amazon S3) can store logs, but enabling immutability requires additional configuration like S3 Object Lock, making CloudWatch Logs the more straightforward and recommended service for this requirement.

Answer

AWS Key Management Service (KMS)

Answer

AWS CloudTrail

Answer

Amazon S3

Question 9

A company is designing a security strategy for an Amazon RDS for MySQL instance that stores Personally Identifiable Information (PII). Which TWO measures should be implemented to protect the data at rest?

Accepted Answer

Enable automatic backups with encryption.. Options A and D are correct. Option A: Enabling automatic backups with encryption ensures that backup data is encrypted at rest. Option D: Enabling encryption at rest using AWS KMS encrypts the underlying storage of the DB instance. Option B is wrong because Amazon GuardDuty is a threat detection service, not for data at rest protection. Option C is wrong because deletion protection prevents accidental deletion but does not protect data at rest. Option E is wrong because encryption in transit (SSL/TLS) protects data in motion, not at rest.

Answer

Enable Amazon GuardDuty to monitor for suspicious activity.

Answer

Enable deletion protection on the DB instance.

Answer

Enable encryption in transit using SSL/TLS.

Question 10

A company uses Amazon DynamoDB with DAX and wants to implement fine-grained access control using IAM. Which THREE conditions can be used in an IAM policy to restrict access to specific items based on the primary key?

Accepted Answer

dynamodb:Attributes. Option D (dynamodb:LeadingKeys) is correct because it is the specific DynamoDB condition key that restricts access based on the partition key value of the primary key, allowing policies such as limiting users to items where the partition key equals their own user ID. Option E (dynamodb:Select) is correct because it is a valid DynamoDB condition key that controls which attributes are returned (for example, ALL_ATTRIBUTES, SPECIFIC_ATTRIBUTES, COUNT), and it can be combined with key-based conditions to further constrain item access in fine-grained IAM policies. Option A (dynamodb:Attributes) is correct because it is the DynamoDB condition key used to restrict which item attributes a principal can read or write, which is a core part of fine-grained access control alongside LeadingKeys. Option B (dynamodb:ReturnValues) is not a valid IAM condition key for DynamoDB access control; ReturnValues is an API request parameter (NONE, ALL_OLD, UPDATED_OLD, ALL_NEW, UPDATED_NEW), not a policy condition. Option C (dynamodb:TableName) is not a DynamoDB IAM condition key; table-level restrictions are expressed through the Resource element (for example, arn:aws:dynamodb:region:account:table/name), not a condition key.

Answer

dynamodb:ReturnValues

Answer

dynamodb:TableName

Question 11

A company is using Amazon RDS for Oracle and needs to comply with regulatory requirements that mandate encryption of all data at rest and in transit. Which TWO actions should be taken to meet these requirements?

Accepted Answer

Enable encryption at rest by specifying a KMS key when creating the DB instance.. Option A is correct because Amazon RDS for Oracle supports encryption at rest by specifying an AWS KMS key when the DB instance is created, which encrypts the underlying storage, automated backups, read replicas, and snapshots. Option E is correct because encryption in transit for RDS for Oracle is achieved by enabling SSL/TLS, which can be enforced by setting the rds.force_ssl parameter to 1 and having clients connect using the RDS-provided SSL certificate. Option B is not the required action because Oracle TDE is an in-database encryption feature that is not the native RDS mechanism for encrypting storage at rest, and RDS already handles at-rest encryption via KMS. Option C is incorrect because CloudWatch Logs encryption protects log data, not the database data at rest or in transit. Option D is incorrect because Oracle Native Network Encryption encrypts client-server traffic at the Oracle layer, but the RDS-recommended and supported method for in-transit encryption in this scenario is SSL/TLS with the RDS certificate.

Answer

Use Oracle Transparent Data Encryption (TDE) to encrypt the data at rest.

Answer

Enable encryption for CloudWatch Logs.

Answer

Configure Oracle Native Network Encryption in the sqlnet.ora file.

Question 12

A company has an Amazon DynamoDB table that stores sensitive user data. The security team requires that all data is encrypted at rest using a customer-managed AWS KMS key. Which step should be taken to meet this requirement?

Accepted Answer

Specify a customer-managed KMS key in the DynamoDB table creation.. You can specify a customer-managed AWS KMS key when creating a DynamoDB table to enable encryption at rest with that key. Option E is incorrect because while you can restrict access to a specific IAM role, the question specifically asks about encryption at rest. Option A is wrong because DynamoDB uses KMS keys, not S3-managed keys. Option B is wrong because bucket policies are for S3, not DynamoDB. Option D is wrong because encryption at rest cannot be enabled after table creation; it must be specified at creation time.

Answer

Enable server-side encryption with S3-managed keys (SSE-S3) on the DynamoDB table.

Answer

Attach a bucket policy to restrict access to the DynamoDB table.

Answer

Modify the existing DynamoDB table to enable encryption at rest.

Answer

Create an IAM policy that allows dynamodb:GetItem and dynamodb:PutItem only when the request is made by the specific IAM role.

Question 13

A company needs to enforce that all new Amazon RDS DB instances are automatically encrypted at rest. What is the most efficient way to achieve this?

Accepted Answer

Use an AWS Organizations service control policy (SCP) to deny creation of unencrypted RDS instances.. An AWS Organizations service control policy (SCP) can deny the rds:CreateDBInstance action unless the request includes the storage-encrypted parameter set to true, enforcing encryption at rest across every account in the organization from a single control point. SCPs are the most efficient way to apply a guardrail to all accounts because they are inherited and cannot be overridden by account-level IAM. This satisfies the requirement with minimal ongoing management.

Answer

Create an IAM policy that denies rds:CreateDBInstance unless encryption is enabled, and attach it to all users.

Answer

Enable the 'encryption at rest' default in each AWS account's RDS console.

Answer

Use AWS CloudFormation StackSets to deploy a template that creates encrypted instances in every account.

Question 14

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database contains personally identifiable information (PII). The security team requires that all PII columns be transparently encrypted and that the encryption keys be stored in AWS CloudHSM. Which solution meets these requirements?

Accepted Answer

Use Oracle Transparent Data Encryption (TDE) with AWS CloudHSM as the key store.. Oracle Transparent Data Encryption (TDE) with AWS CloudHSM as the key store meets the requirements because TDE provides column-level encryption for PII, and CloudHSM can be used as a custom key store for Oracle TDE on RDS. This allows the encryption keys to be stored in a dedicated HSM, satisfying the security team's requirement.

Answer

Enable Amazon RDS encryption at rest using a KMS key and rely on that encryption.

Answer

Modify the Oracle database to use AWS KMS for column-level encryption.

Answer

Use Oracle Data Pump to export data with encryption and store the encryption key in AWS Secrets Manager.

Question 15

A company has an Amazon RDS for SQL Server DB instance that stores financial data. The security team requires that the data be encrypted at rest using a customer-managed key stored in AWS KMS. Additionally, they want to ensure that the key cannot be deleted without authorization. What should be done?

Accepted Answer

Create a customer-managed KMS key, enable key rotation, and set a deletion protection policy.. It satisfies both requirements: using a customer-managed KMS key for encryption at rest, and adding a key policy that prevents deletion without authorization. Enabling key rotation is a best practice for customer-managed keys, and a deletion protection policy (via key policy or IAM) ensures the key cannot be scheduled for deletion by unauthorized principals. RDS for SQL Server supports encryption with customer-managed KMS keys, so this is the valid solution.

Answer

Enable encryption on the RDS instance and use the default KMS key.

Answer

Use AWS CloudHSM to generate and store the encryption key, and associate it with the RDS instance.

Answer

Enable AWS CloudTrail to log key deletion attempts.