DBS-C01 Database Security Practice Test 9 — 15 Questions

Question 1

A development team is building a serverless application that uses Amazon DynamoDB. The team needs to ensure that only the application's Lambda function can read and write data to a specific DynamoDB table. The Lambda function uses an IAM role. How should the team configure access?

Accepted Answer

Create an IAM role for the Lambda function with DynamoDB access, and configure a resource-based policy on the DynamoDB table that allows only that role.. Option B is correct because using a resource-based policy on the DynamoDB table that grants access only to the Lambda function's role is the proper way to restrict access. Option A is wrong because an IAM role attached to the Lambda function alone does not restrict other principals from accessing the table; a resource-based policy is needed. Option C is wrong because DynamoDB does not support VPC endpoints for resource-based policies in this manner. Option D is wrong because encryption does not control access.

Answer

Place the DynamoDB table and Lambda function in the same VPC and use a VPC endpoint to control access.

Answer

Encrypt the DynamoDB table with an AWS KMS key and grant the Lambda function decryption permissions.

Answer

Create an IAM role for the Lambda function with a policy that allows DynamoDB access, and attach the role to the function.

Question 2

A company uses an Amazon RDS for PostgreSQL database with Multi-AZ deployment. The security team wants to audit all SQL queries executed against the database for compliance purposes. Which solution should be implemented to capture and store the queries?

Accepted Answer

Enable PostgreSQL query logging and publish logs to Amazon CloudWatch Logs.. Option C is correct because RDS for PostgreSQL supports log export to CloudWatch Logs, and enabling query logging captures SQL queries. Option A is wrong because RDS events do not contain SQL query details. Option B is wrong because RDS Performance Insights focuses on performance, not query auditing. Option D is wrong because CloudTrail captures API calls, not SQL queries.

Answer

Use AWS CloudTrail to capture SQL queries.

Answer

Enable Performance Insights and store the data in CloudWatch Logs.

Answer

Enable RDS event notifications for database queries.

Question 3

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all connections to the database use SSL/TLS encryption. Which step is necessary to enforce SSL connections?

Accepted Answer

Set the 'rds.force_ssl' parameter to 1 in the DB parameter group.. Option A is correct because RDS for Oracle supports SSL/TLS, and you can set a parameter in the DB parameter group to require SSL. Option B is wrong because security groups control network access, not encryption. Option C is wrong because the option group defines features like timezone, not SSL enforcement. Option D is wrong because the subnet group defines networking, not encryption.

Answer

Configure the security group to only allow traffic on port 443.

Answer

Modify the DB subnet group to use a private subnet.

Answer

Add the SSL option to the option group.

Question 4

A security engineer is investigating an Amazon RDS for MySQL database that was compromised. The engineer finds that the compromise was due to a SQL injection vulnerability in a web application. The web application uses a database user with full administrative privileges. What is the BEST practice to prevent such incidents in the future?

Accepted Answer

Create dedicated database users with minimal privileges required for each application function.. Option D is correct because using separate database users with least privilege for each application limits the impact of a compromise. Option A is wrong because database audit logs help detect but not prevent. Option B is wrong because it reduces attack surface but does not address the root cause of excessive privileges. Option C is wrong because parameter groups do not enforce least privilege.

Answer

Configure the DB parameter group to use the 'sql_mode' option to reject dangerous queries.

Answer

Enable RDS audit logs to capture all SQL queries.

Answer

Place the RDS instance in a private subnet with a security group that restricts inbound traffic.

Question 5

A company uses Amazon DynamoDB for its critical application. The security team requires that all access to DynamoDB tables be logged and monitored for suspicious activity. The company also needs to be alerted when a user deletes a table. Which combination of AWS services should be used?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Events.. Option B is correct because CloudTrail logs all DynamoDB API calls, and CloudWatch Events can trigger alerts. Option A is wrong because DynamoDB Streams captures item-level changes, not API calls. Option C is wrong because VPC Flow Logs capture network traffic, not API calls. Option D is wrong because Config records resource changes but not API calls directly for alerting.

Answer

AWS CloudTrail and Amazon DynamoDB Streams.

Answer

AWS Config and Amazon Simple Notification Service (SNS).

Answer

Amazon VPC Flow Logs and Amazon CloudWatch Logs.

Question 6

A company stores sensitive customer data in an Amazon S3 bucket. The data is accessed by an Amazon Redshift cluster using the COPY command. The security team wants to ensure that data is encrypted in transit between S3 and Redshift. Which configuration should be used?

Accepted Answer

Use the 'ENCRYPTED' option with the COPY command and ensure the S3 bucket policy requires HTTPS.. Option C is correct because the COPY command supports encryption in transit via HTTPS when using the 'ENCRYPTED' option or using an S3 endpoint that enforces HTTPS. Option A is wrong because S3 supports HTTPS, and specifying 'ENCRYPTED' is needed. Option B is wrong because S3 server-side encryption protects data at rest, not in transit. Option D is wrong because the COPY command does not use SSH; it uses HTTPS.

Answer

Use a VPC endpoint for S3 with a bucket policy that denies HTTP.

Answer

Use the 'SSH' option in the COPY command to encrypt the transfer.

Answer

Enable S3 server-side encryption on the bucket.

Question 7

A company is using an Amazon RDS for MySQL database and needs to audit all database login events. The audit logs must be stored in Amazon S3 for long-term retention. Which steps should be taken to accomplish this?

Accepted Answer

Enable the 'audit_log' plugin, publish logs to CloudWatch Logs, and create an export task to S3.. Option C is correct because RDS for MySQL supports audit logs via the 'audit_log' plugin, which can be published to CloudWatch Logs, and then exported to S3. Option A is wrong because RDS does not natively publish logs directly to S3. Option B is wrong because CloudTrail does not capture database login events. Option D is wrong because the general log is not the same as audit log and may not capture all login events as required.

Answer

Enable the 'general_log' parameter and set 'log_output' to 'FILE', then copy the log file to S3 manually.

Answer

Enable CloudTrail data events for RDS to capture login events and store in S3.

Answer

Enable the 'audit_log' plugin and configure RDS to publish logs to an S3 bucket.

Question 8

A company's security policy requires that all database passwords be rotated every 90 days. The company uses AWS Secrets Manager to store database credentials for Amazon RDS. Which feature can be used to automate password rotation?

Accepted Answer

Configure automatic rotation in Secrets Manager with a rotation interval of 90 days.. Option A is correct because Secrets Manager has built-in rotation support for RDS databases. Option B is wrong because Lambda can be used but is not a feature of Secrets Manager itself; the managed rotation is the simplest. Option C is wrong because IAM Access Analyzer is for analyzing resource policies, not password rotation. Option D is wrong because Systems Manager Parameter Store does not have built-in rotation for RDS.

Answer

Use an AWS Lambda function triggered by Amazon CloudWatch Events every 90 days to rotate the password.

Answer

Use IAM Access Analyzer to detect unused passwords and rotate them.

Answer

Store the password in AWS Systems Manager Parameter Store and use automatic rotation.

Question 9

A security administrator is setting up a new Amazon RDS for SQL Server database. The company requires that all data be encrypted at rest and in transit. Additionally, the database must be accessible only from a specific CIDR range. Which TWO actions should the administrator take? (Choose TWO.)

Accepted Answer

Enable encryption at rest using AWS KMS.. Options A and D are correct. Option A: Enabling encryption at rest is a requirement. Option D: Configuring the security group to allow inbound traffic from the specific CIDR range meets the network access restriction. Option B is wrong because encryption in transit is typically handled by the database engine (SSL/TLS), not by an RDS option. Option C is wrong because the DB parameter group does not control network access. Option E is wrong because encryption at rest uses KMS, not CloudHSM by default.

Answer

Enable encryption in transit by modifying the RDS option group to include SSL.

Answer

Modify the DB parameter group to restrict network access.

Answer

Use AWS CloudHSM to manage encryption keys for the database.

Question 10

A company uses Amazon DynamoDB to store session data for a web application. The security team discovers that an IAM user has been performing unauthorized scans on the table. They need to implement controls to detect and prevent such unauthorized access in the future. Which THREE actions should the security team take? (Choose THREE.)

Accepted Answer

Enable AWS CloudTrail logging and create a metric filter for Scan API calls.. Options A, B, and E are correct. Option A: Using CloudTrail logs to detect unauthorized scans helps with detective controls. Option B: Implementing a resource-based policy with a condition key 'dynamodb:Scan' to deny access is a preventive control. Option E: Using fine-grained access control with IAM conditions like 'dynamodb:Attributes' can restrict scans to specific attributes. Option C is wrong because VPC Flow Logs capture network traffic, not DynamoDB operations. Option D is wrong because disabling scan operations is not practical; many use cases require scans.

Answer

Disable the Scan operation on the DynamoDB table.

Answer

Enable VPC Flow Logs to monitor traffic to DynamoDB.

Question 11

A company is deploying a new Amazon RDS for MySQL database in a VPC. The database must be accessible only from an application server running in the same VPC. The security team also wants to ensure that the database is not accessible from the internet. Which TWO configurations are required? (Choose TWO.)

Accepted Answer

Configure the security group to allow inbound traffic only from the application server's security group.. Options B and D are correct. Option B: Making the DB instance not publicly accessible ensures it cannot be reached from the internet. Option D: Configuring the security group to allow inbound traffic only from the application server's security group limits access. Option A is wrong because a public subnet does not prevent internet access; it enables it. Option C is wrong because a network ACL is stateless and less specific than security groups. Option E is wrong because the parameter group does not control network access.

Answer

Place the DB instance in a public subnet.

Answer

Modify the DB parameter group to restrict network access.

Answer

Configure a network ACL to deny inbound traffic from 0.0.0.0/0.

Question 12

A company is using an Amazon RDS for PostgreSQL database to store sensitive customer data. The security team requires that all data be encrypted at rest and in transit, and that access to the database is restricted to only specific applications. Currently, the database is encrypted at rest using AWS KMS, and connections are made over SSL. However, the security team wants to ensure that even if the database credentials are compromised, an attacker cannot access the database from unauthorized IP addresses. What should be done to meet this requirement?

Accepted Answer

Modify the security group associated with the RDS instance to allow inbound traffic only from the application's IP addresses.. Option D is correct because a security group can restrict inbound traffic to the RDS instance based on source IP addresses. Option A does not restrict network access. Option B is about permissions, not network. Option C creates a separate cluster but does not restrict access to the existing one.

Answer

Attach a resource-based policy to the RDS instance to allow only specific IAM roles.

Answer

Create a new RDS instance in a VPC with a network ACL that allows inbound traffic only from specific IP ranges, and migrate the data.

Answer

Enable IAM database authentication for the RDS instance.

Question 13

A company is using Amazon DynamoDB to store financial transactions. The security team requires that all access to the table be logged for auditing, and that any unauthorized access attempts trigger an immediate alert. The company has enabled AWS CloudTrail to log all DynamoDB API calls. However, the security team is concerned that CloudTrail logs may not capture all access patterns, such as queries that return no results. Which additional step should the company take to ensure comprehensive auditing and alerting?

Accepted Answer

Create a CloudWatch Logs metric filter on the CloudTrail log group to detect unauthorized access attempts and set up a CloudWatch alarm.. Option B is correct because CloudWatch Logs can be used to monitor CloudTrail logs and trigger alerts on specific patterns like unauthorized access. Option A only monitors performance, not access. Option C does not monitor access. Option D may miss some operations.

Answer

Configure Amazon Inspector to assess the DynamoDB table for vulnerabilities.

Answer

Enable DynamoDB Accelerator (DAX) and configure it to log all read requests.

Answer

Enable VPC Flow Logs on the subnet where DynamoDB endpoints are deployed.

Question 14

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database contains personally identifiable information (PII). The security team requires that the data be encrypted at rest using a customer-managed key stored in AWS KMS. Additionally, the team wants to ensure that the key can be rotated automatically every year. What should the company do to meet these requirements?

Accepted Answer

Create a customer-managed key in AWS KMS, enable automatic rotation, and enable encryption on the RDS instance using that key.. Option A is correct because RDS supports encryption at rest using a KMS key, and customer-managed keys can be rotated automatically. Option B is not possible. Option C does not cover encryption at rest. Option D does not provide automatic rotation.

Answer

Enable encryption on the RDS instance using the default RDS encryption and use AWS Secrets Manager to store the key.

Answer

Create a customer-managed key in AWS KMS without automatic rotation, and manually rotate the key using the RDS console.

Answer

Use an AWS managed key for RDS and create an AWS Lambda function to rotate the key manually each year.

Question 15

A company uses Amazon Redshift for data warehousing. The security team has implemented column-level security using Redshift's column-level access controls. However, during a security audit, it is discovered that a user with SELECT privilege on a table can still see the content of a column that should be restricted. The column is defined with a GRANT statement that only allows SELECT on certain columns to specific users. What is the most likely cause of this issue?

Accepted Answer

The user was previously granted SELECT on the entire table, and the column-level GRANT did not revoke that broader permission.. Option C is correct because column-level GRANTs in Redshift do not revoke existing permissions; they only add. If the user already had SELECT on the table, they still have access to all columns. Option A is not relevant. Option B is about views, not the issue. Option D is unrelated.

Answer

The column is part of a distribution key that bypasses security controls.

Answer

The user is accessing the table via a stored procedure that bypasses column-level security.

Answer

The column-level security is not supported in Redshift; it must be implemented using views.