DBS-C01 Database Security Practice Test 9 — 15 Questions

Question 1

A company wants to restrict access to an Amazon DynamoDB table so that only requests from a specific VPC endpoint are allowed. Which policy should be attached to the table?

Accepted Answer

A VPC endpoint policy that allows only the specific VPC endpoint to access the DynamoDB table.. A VPC endpoint policy attached to the VPC endpoint can restrict which DynamoDB tables are accessible through that endpoint. Option A is incorrect because security groups apply to EC2 instances and other network interfaces, not to DynamoDB tables. Option B is incorrect because while IAM policies can include conditions to restrict access based on source VPC, they are attached to IAM users or roles, not directly to the DynamoDB table. Option D is incorrect because bucket policies are used for Amazon S3, not DynamoDB.

Answer

A security group rule that allows traffic only from the VPC endpoint.

Answer

An IAM policy that denies access unless the request comes from the specific VPC.

Answer

An S3 bucket policy that references the DynamoDB table.

Question 2

A company is using Amazon RDS for PostgreSQL with a read replica. The security team wants to ensure that data in transit between the primary DB instance and the read replica is encrypted. What should be done?

Accepted Answer

Enable encryption at rest on the primary DB instance using AWS KMS.. Enabling encryption at rest on the primary DB instance using AWS KMS automatically encrypts the replication traffic between the primary and the read replica. Options A, B, and C are incorrect: A VPN is not required as RDS handles encryption in transit for replication when the primary is encrypted; using a different KMS key for the replica does not affect replication encryption; SSL/TLS is for client connections, not for replication traffic.

Answer

Set up a VPN connection between the primary and the replica.

Answer

Configure the read replica to use a different KMS key.

Answer

Enable SSL/TLS on the read replica and configure the primary to use it.

Question 3

A company needs to comply with PCI DSS requirements for an Amazon RDS for Oracle DB instance. The requirements include encryption of sensitive data at rest and in transit, and automated key rotation. Which combination of services and configurations should be used? (Select THREE.)

Accepted Answer

Enable encryption at rest on the RDS instance using AWS KMS.. The correct combination is B, C, and D: enabling encryption at rest on the RDS instance using AWS KMS satisfies the PCI DSS requirement for data-at-rest encryption, using AWS Secrets Manager to automatically rotate database credentials provides automated rotation of the Oracle DB credentials, and enabling SSL/TLS for connections to the database encrypts data in transit. AWS KMS integrates natively with RDS for Oracle to encrypt storage volumes and snapshots, Secrets Manager supports scheduled rotation via Lambda rotation functions for RDS credentials, and RDS for Oracle supports SSL/TLS endpoints for encrypted client connections. Option A does not fit because CloudHSM is not required for RDS encryption at rest, which uses KMS, and it does not by itself provide automated key rotation for the DB instance. Option E does not fit because VPC Flow Logs capture IP traffic metadata for auditing, not encryption of data at rest or in transit.

Answer

Use AWS CloudHSM to generate and store encryption keys.

Answer

Enable VPC Flow Logs to audit database connections.

Question 4

A company is designing a security strategy for an Amazon Aurora MySQL database. They need to ensure that database activity is monitored for suspicious behavior and that alerts are sent when anomalies are detected. Which AWS services should be combined to achieve this? (Select TWO.)

Accepted Answer

Amazon GuardDuty. Options A and B are correct. Amazon GuardDuty (A) is a threat detection service that monitors for suspicious activity and anomalous behavior. Amazon RDS Database Activity Streams (B) provide a near-real-time stream of database activity, which can be integrated with GuardDuty for monitoring. Option C (AWS WAF) is a web application firewall, not for database activity monitoring. Option D (Amazon EventBridge) is an event bus service that can trigger alerts but does not itself detect anomalies. Option E (Amazon Inspector) is for vulnerability assessment on EC2 instances.

Answer

AWS WAF

Answer

Amazon EventBridge

Answer

Amazon Inspector

Question 5

A security team is auditing IAM policies for Amazon RDS. They want to ensure that all RDS snapshots shared with other AWS accounts are encrypted. Which IAM policy condition key should be used to enforce this?

Accepted Answer

rds:Encrypted. Rds:Encrypted. This condition key verifies that a snapshot is encrypted when sharing with other AWS accounts. Option B (rds:SnapshotEncrypted) is not a valid condition key. Option C (rds:StorageEncrypted) is used to check if the DB instance's storage is encrypted, not the snapshot. Option D (s3:x-amz-server-side-encryption) is an S3 condition key and not applicable to RDS snapshots.

Answer

rds:SnapshotEncrypted

Answer

rds:StorageEncrypted

Answer

s3:x-amz-server-side-encryption

Question 6

A developer needs to allow an application running on EC2 to access an Amazon RDS database without storing database credentials in the application code. Which solution is the MOST secure?

Accepted Answer

Use IAM database authentication for the RDS instance and assign an IAM role to the EC2 instance.. IAM database authentication allows the EC2 instance to use an IAM role to authenticate to the RDS database, eliminating the need to store any credentials in the application code. This is the most secure method. Options B and C still rely on storing and retrieving a password, which introduces risk. Option D stores credentials in a config file, which is insecure.

Answer

Store the database password in AWS Systems Manager Parameter Store as a SecureString.

Answer

Store the database password in the application configuration file.

Answer

Store the database password in AWS Secrets Manager and enable automatic rotation.

Question 7

A company wants to enforce that all new Amazon RDS DB instances are created with encryption at rest enabled. Which approach should be taken?

Accepted Answer

Use an IAM policy that denies the rds:CreateDBInstance action unless rds:StorageEncrypted is set to true.. Using an IAM policy that denies the rds:CreateDBInstance action unless rds:StorageEncrypted is set to true enforces encryption at rest at the API level. This preventive control ensures that any attempt to create an unencrypted RDS instance is denied, regardless of the user or method used.

Answer

Use AWS CloudTrail to detect unencrypted instance creation and automatically delete them.

Answer

Use AWS Config rules to mark unencrypted instances as noncompliant.

Answer

Enable encryption by default in the RDS console.

Question 8

A company has an Amazon RDS for Oracle DB instance that needs to be encrypted at rest. The instance currently uses Oracle Transparent Data Encryption (TDE) with a key stored in the database. The company wants to use AWS KMS for key management. What is the correct migration path?

Accepted Answer

Take a snapshot of the DB instance, copy the snapshot with KMS encryption, and restore from the encrypted snapshot.. RDS encryption at rest cannot be enabled in place on an existing unencrypted instance — the only supported migration path is to snapshot the instance, copy the snapshot with KMS encryption enabled, and restore a new instance from that encrypted snapshot. This is the documented AWS procedure for encrypting an existing unencrypted RDS instance. The original instance remains unencrypted until you cut over to the restored one.

Answer

Enable KMS encryption directly on the existing DB instance using the AWS CLI.

Answer

Create a read replica with KMS encryption.

Answer

Modify the DB instance and select the KMS key.

Question 9

Which TWO AWS services can be used to centrally manage database credentials and automate rotation for Amazon RDS? (Choose two.)

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager (A) is correct because it natively supports Amazon RDS by storing database credentials as secrets and providing built-in, scheduled rotation via Lambda rotation functions for engines like MySQL, PostgreSQL, Aurora, Oracle, and SQL Server. AWS Systems Manager Parameter Store (D) is correct because it can store RDS credentials as SecureString parameters and, when integrated with Secrets Manager rotation or custom Lambda rotation logic, supports automated credential rotation and centralized management. AWS KMS (B) only provides encryption key management and does not store or rotate database credentials itself. IAM database authentication (C) issues short-lived authentication tokens for RDS and eliminates stored passwords, but it does not centrally manage or rotate credentials. AWS CloudHSM (E) is a hardware security module for key operations and does not manage or rotate RDS database credentials.

Answer

AWS Key Management Service (KMS)

Answer

IAM database authentication

Answer

AWS CloudHSM

Question 10

An IAM policy is shown in the exhibit. What is the effect of this policy when a user tries to create an unencrypted RDS DB instance?

Accepted Answer

The user is denied from creating the unencrypted instance because of the Deny statement.. The IAM policy contains an explicit Deny for the rds:CreateDBInstance action when the request lacks the storage-encrypted condition (or when encryption is false). Explicit Deny in IAM always overrides any Allow, so the user cannot create an unencrypted RDS instance. The Deny statement is valid and takes precedence.

Answer

The user is allowed to create the unencrypted instance because the Deny statement is not valid.

Answer

The user is denied from creating any DB instance because of an implicit deny.

Answer

The user is allowed to create the unencrypted instance because of the Allow statement.

Question 11

A snapshot of an Amazon RDS DB instance is shown in the exhibit. What does the output indicate?

Accepted Answer

The snapshot is encrypted and the encryption process is complete.. The snapshot is encrypted (Encrypted: true) and the status is 'encrypted', indicating that the encryption process is complete. Option A is incorrect because the snapshot exists and is not in progress. Option C is incorrect because the snapshot is indeed encrypted. Option D is incorrect because the status shows 'encrypted', not 'encrypting'.

Answer

The snapshot creation is still in progress.

Answer

The snapshot is not encrypted.

Answer

The snapshot is in the process of being encrypted.

Question 12

A developer wants to grant an IAM user read-only access to an Amazon DynamoDB table named 'Orders' in the 'us-east-1' region. Which IAM policy should be attached to the user?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["dynamodb:GetItem","dynamodb:Query","dynamodb:Scan"],"Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/Orders"}]}. It grants only the read-only actions GetItem, Query, and Scan on the specified DynamoDB table. Option B is incorrect because it grants full DynamoDB access (dynamodb:*) to the table, allowing write and delete operations. Option C is incorrect because it includes PutItem and UpdateItem, which are write operations. Option D is incorrect because it uses a Deny effect for write operations, but an explicit deny is not necessary and could conflict with other policies; additionally, it does not explicitly allow read actions, so the user would have no access.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["dynamodb:*"],"Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/Orders"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["dynamodb:GetItem","dynamodb:PutItem","dynamodb:UpdateItem"],"Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/Orders"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":["dynamodb:PutItem","dynamodb:UpdateItem","dynamodb:DeleteItem"],"Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/Orders"}]}

Question 13

A company is migrating its Oracle database to Amazon RDS for Oracle. The security team requires that all data be encrypted at rest using a customer-managed AWS KMS key. Which TWO steps are necessary to achieve this?

Accepted Answer

Migrate the data using Oracle Data Pump to the new encrypted instance.. Option C is correct because Amazon RDS for Oracle only supports encryption at rest when it is enabled at DB instance creation time, so you must create a new DB instance and specify the customer-managed KMS key in the storage-encrypted parameter. Option A is correct because after creating the new encrypted instance, the existing data must be migrated into it, and Oracle Data Pump (expdp/impdp) is the standard supported mechanism for moving Oracle schema data between RDS for Oracle instances. Option B is incorrect because you cannot modify an existing unencrypted RDS DB instance to turn on encryption; the modify-db-instance operation does not support adding storage encryption to an already-created instance. Option D is incorrect for the same reason: encryption at rest cannot be enabled retroactively on an existing RDS instance by modification. Option E is incorrect because the requirement explicitly calls for a customer-managed AWS KMS key, whereas aws/rds is an AWS-managed default key and does not satisfy that mandate.

Answer

Modify the DB instance to enable encryption using a KMS key.

Answer

Enable encryption at rest on the existing RDS instance by modifying the DB instance.

Answer

Use the default RDS encryption key (aws/rds) to encrypt the instance.

Question 14

A company uses Amazon DynamoDB with a global secondary index (GSI). The security team requires that only specific IAM users can query the GSI. Which THREE conditions must be met to restrict access to the GSI?

Accepted Answer

The user must have permission to query the base table as well.. To restrict access to a DynamoDB GSI, the IAM policy must allow the dynamodb:Query action on the index (D), because querying a GSI is performed with the Query API and requires that action to be authorized. The policy must also specify the index ARN in the Resource element (E), since the GSI is a distinct resource with its own ARN (table-name/index/index-name) and permissions are evaluated against that resource. Additionally, the user must have permission to query the base table as well (C), because DynamoDB requires base-table access to service a GSI query, so an index-only allow is insufficient. Option A is incorrect because dynamodb:IndexName is not a valid IAM condition key for this purpose, and option B is incorrect because dynamodb:Attributes is used to restrict attribute-level access, not to grant or restrict the ability to query a GSI.

Answer

The policy must include a condition 'dynamodb:IndexName' with the index name.

Answer

The policy must include a condition key 'dynamodb:Attributes' to restrict which attributes are returned.

Question 15

A database administrator runs the command shown in the exhibit. The security team requires that the database be encrypted at rest. What should the administrator do to enable encryption?

Accepted Answer

Create a snapshot of the DB instance, copy the snapshot with encryption, and restore from the encrypted snapshot.. Encryption cannot be enabled on an existing unencrypted instance; you must create a snapshot, copy it with encryption, and restore. Option A is wrong because encryption is at the storage level, not table level. Option C is wrong because modifying the instance does not add encryption. Option D is wrong because the command shows StorageEncrypted is false, so it is not encrypted.

Answer

Enable encryption at the table level using MySQL's built-in encryption.

Answer

Modify the DB instance and set StorageEncrypted to true.

Answer

The instance is already encrypted because the output shows 'StorageEncrypted' as false.