DBS-C01 Database Security Practice Test 9 — 15 Questions

Question 1

Refer to the exhibit. A database administrator has this IAM policy attached to their user. They are trying to authorize ingress to a DB security group named 'my-security-group' in the us-east-1 region. The operation fails. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The user is missing the 'rds:DescribeDBSecurityGroups' permission, which is required to perform the authorize operation.. The policy grants the `rds:AuthorizeDBSecurityGroupIngress` action on a specific DB security group. However, to authorize ingress, the user must also be able to describe the security group to verify its existence and details. The policy does not include `rds:DescribeDBSecurityGroups`, which is a prerequisite for the authorization operation. Therefore, the operation fails due to missing describe permission.

Answer

The user is not allowed to create DB security groups, which is a prerequisite.

Answer

The policy does not grant 'rds:AuthorizeDBSecurityGroupIngress' on the specific security group.

Answer

The security group ARN in the policy is incorrect; it should include the security group ID instead of the name.

Question 2

A company is using Amazon RDS for MySQL and wants to restrict access to the database based on the source IP address. Which AWS feature should be used to achieve this?

Accepted Answer

VPC Security Groups. Security groups act as a virtual firewall for RDS instances. You can specify inbound rules that allow traffic only from certain IP addresses or other security groups. Network ACLs are for subnets, not individual instances. IAM policies control API access, not network traffic. DB parameter groups configure database engine parameters.

Answer

DB Parameter Groups

Answer

IAM Database Authentication

Answer

Network ACLs

Question 3

A company is deploying an Amazon DynamoDB table with server-side encryption using a customer-managed AWS KMS key. The security team requires that the key be automatically rotated every year and that access to the key be logged. Which THREE steps should be taken?

Accepted Answer

Enable automatic key rotation for the KMS key.. To meet the requirements: (1) Enable automatic key rotation (Option A) to satisfy the automatic rotation requirement. (2) Enable AWS CloudTrail to log KMS API calls (Option C) to log access to the key. (3) Create a KMS key policy that restricts usage to specific IAM roles (Option D) to control access. Option B is incorrect because AWS CloudHSM is a hardware security module, not used for KMS key rotation or logging. Option E is incorrect because client-side encryption is not relevant; server-side encryption with KMS is already used.

Answer

Use AWS CloudHSM to store the key and manage rotation.

Answer

Configure the DynamoDB table to use client-side encryption.

Question 4

A company has an Amazon Redshift cluster that contains sensitive data. The security team wants to ensure that all data is encrypted at rest and that the encryption keys are managed by AWS. Which configuration should be used?

Accepted Answer

Enable encryption at rest using the default AWS-managed KMS key for Redshift.. Amazon Redshift supports encryption at rest using AWS KMS. When you enable encryption, you can choose to use the default AWS-managed key (aws/redshift) or a customer-managed key. The default key is managed by AWS, meeting the requirement that keys are managed by AWS. Option A is incorrect because CloudHSM is used for customer-managed keys, not AWS-managed keys. Option B is incorrect because SSE-S3 is for S3 objects, not Redshift clusters. Option D is incorrect because client-side encryption is not supported for Redshift at rest.

Answer

Use AWS CloudHSM to generate and store encryption keys.

Answer

Use server-side encryption with S3-managed keys (SSE-S3) for the Redshift cluster.

Answer

Use client-side encryption with the AWS Encryption SDK.

Question 5

A company has an Amazon RDS for MySQL database that contains sensitive data. The security team requires that all data be encrypted at rest using a customer-managed key stored in AWS KMS. Which action should be taken to meet this requirement?

Accepted Answer

Create a new RDS instance with encryption enabled using the KMS key, migrate data, and delete the old instance.. Amazon RDS encryption at rest with a customer-managed KMS key can only be enabled when the DB instance is created. You cannot enable encryption on an existing unencrypted instance (option A is incorrect). Once you create a new encrypted instance using the desired KMS key, you can migrate the data from the old instance and then delete it. Option D is incorrect because restoring a snapshot of an unencrypted database without modifying encryption settings will result in an unencrypted instance; you would need to create an encrypted copy of the snapshot first, which is not described. Option C is incorrect because DB parameter groups do not control encryption at rest.

Answer

Enable encryption on the existing RDS instance by modifying the instance.

Answer

Configure the DB parameter group to require encryption at rest.

Answer

Create a snapshot of the unencrypted database and restore it as an encrypted database.

Question 6

A development team is building a serverless application that uses Amazon DynamoDB. The team needs to ensure that only the application's Lambda function can read and write data to a specific DynamoDB table. The Lambda function uses an IAM role. How should the team configure access?

Accepted Answer

Create an IAM role for the Lambda function with DynamoDB access, and configure a resource-based policy on the DynamoDB table that allows only that role.. DynamoDB supports resource-based policies (also known as table policies) that allow you to specify which IAM roles or users can access the table. By attaching such a policy that grants access only to the Lambda function's execution role, you ensure that only that function can read/write to the table. Option A is incorrect because using a VPC endpoint does not inherently control access to the table; it only controls network traffic. Option B is incorrect because KMS encryption protects data at rest but does not authorize access. Option D is incomplete because while an IAM role with a DynamoDB access policy is necessary, without a resource-based policy on the table that restricts access to that role, other principals with DynamoDB permissions could still access the table.

Answer

Place the DynamoDB table and Lambda function in the same VPC and use a VPC endpoint to control access.

Answer

Encrypt the DynamoDB table with an AWS KMS key and grant the Lambda function decryption permissions.

Answer

Create an IAM role for the Lambda function with a policy that allows DynamoDB access, and attach the role to the function.

Question 7

A company uses an Amazon RDS for PostgreSQL database with Multi-AZ deployment. The security team wants to audit all SQL queries executed against the database for compliance purposes. Which solution should be implemented to capture and store the queries?

Accepted Answer

Enable PostgreSQL query logging and publish logs to Amazon CloudWatch Logs.. Enabling PostgreSQL query logging and publishing those logs to CloudWatch Logs captures all SQL queries for auditing. Option A is wrong because CloudTrail captures API calls, not SQL queries. Option B is wrong because Performance Insights captures performance metrics, not the text of SQL queries. Option C is wrong because RDS event notifications are for database events (e.g., failover, scaling), not for capturing SQL query text.

Answer

Use AWS CloudTrail to capture SQL queries.

Answer

Enable Performance Insights and store the data in CloudWatch Logs.

Answer

Enable RDS event notifications for database queries.

Question 8

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all connections to the database use SSL/TLS encryption. Which step is necessary to enforce SSL connections?

Accepted Answer

Set the 'rds.force_ssl' parameter to 1 in the DB parameter group.. To enforce SSL/TLS connections to an Amazon RDS for Oracle instance, you must set the 'rds.force_ssl' parameter to 1 in the DB parameter group. This requires all connections to use SSL. Option A is incorrect because security groups control network-level access, not encryption. Option B is incorrect because the DB subnet group defines the subnets for the instance, not encryption. Option C is incorrect because the option group is used to enable additional features like Oracle Enterprise Manager or timezone, not SSL enforcement. Therefore, Option D is the correct step.

Answer

Configure the security group to only allow traffic on port 443.

Answer

Modify the DB subnet group to use a private subnet.

Answer

Add the SSL option to the option group.

Question 9

A security engineer is investigating an Amazon RDS for MySQL database that was compromised. The engineer finds that the compromise was due to a SQL injection vulnerability in a web application. The web application uses a database user with full administrative privileges. What is the BEST practice to prevent such incidents in the future?

Accepted Answer

Create dedicated database users with minimal privileges required for each application function.. The best practice is to use dedicated database users with minimal privileges for each application function (Option A). This principle of least privilege limits the damage a SQL injection attack can cause because the compromised user cannot perform unauthorized actions beyond its specific scope. Option B is incorrect because the 'sql_mode' parameter can reject certain dangerous queries but does not address the root cause of excessive privileges and may not prevent all injection attacks. Option C is incorrect because audit logs only help detect incidents after they occur, not prevent them. Option D is incorrect because while placing the RDS instance in a private subnet and restricting inbound traffic reduces the network attack surface, it does not prevent SQL injection attacks that originate from the application itself; the vulnerability lies in how the application interacts with the database.

Answer

Configure the DB parameter group to use the 'sql_mode' option to reject dangerous queries.

Answer

Enable RDS audit logs to capture all SQL queries.

Answer

Place the RDS instance in a private subnet with a security group that restricts inbound traffic.

Question 10

A company uses Amazon DynamoDB for its critical application. The security team requires that all access to DynamoDB tables be logged and monitored for suspicious activity. The company also needs to be alerted when a user deletes a table. Which combination of AWS services should be used?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Events.. AWS CloudTrail logs all DynamoDB API calls, including DeleteTable, and can send events to Amazon CloudWatch Events, which can trigger alerts via SNS or Lambda. Option A is incorrect because DynamoDB Streams captures item-level changes, not API calls. Option B is incorrect because AWS Config records resource configuration changes but not API calls directly for alerting; CloudTrail is needed. Option D is incorrect because VPC Flow Logs capture network traffic, not API calls.

Answer

AWS CloudTrail and Amazon DynamoDB Streams.

Answer

AWS Config and Amazon Simple Notification Service (SNS).

Answer

Amazon VPC Flow Logs and Amazon CloudWatch Logs.

Question 11

A company stores sensitive customer data in an Amazon S3 bucket. The data is accessed by an Amazon Redshift cluster using the COPY command. The security team wants to ensure that data is encrypted in transit between S3 and Redshift. Which configuration should be used?

Accepted Answer

Use the 'ENCRYPTED' option with the COPY command and ensure the S3 bucket policy requires HTTPS.. The COPY command supports encryption in transit via HTTPS when using the 'ENCRYPTED' option or using an S3 endpoint that enforces HTTPS. Option A is wrong because S3 supports HTTPS, and specifying 'ENCRYPTED' is needed. Option B is wrong because the COPY command does not use SSH; it uses HTTPS. Option D is wrong because S3 server-side encryption protects data at rest, not in transit.

Answer

Use a VPC endpoint for S3 with a bucket policy that denies HTTP.

Answer

Use the 'SSH' option in the COPY command to encrypt the transfer.

Answer

Enable S3 server-side encryption on the bucket.

Question 12

A company is using an Amazon RDS for MySQL database and needs to audit all database login events. The audit logs must be stored in Amazon S3 for long-term retention. Which steps should be taken to accomplish this?

Accepted Answer

Enable the 'audit_log' plugin, publish logs to CloudWatch Logs, and create an export task to S3.. Amazon RDS for MySQL supports the audit_log plugin, which captures login events. These logs can be published to CloudWatch Logs, and then an export task can be created to move them to Amazon S3 for long-term retention. Option A is incorrect because RDS does not allow direct log file copying to S3 via manual methods. Option B is incorrect because CloudTrail data events for RDS capture API calls, not database-level login events. Option C is incorrect because RDS does not natively publish audit logs directly to an S3 bucket; they must go through CloudWatch Logs first.

Answer

Enable the 'general_log' parameter and set 'log_output' to 'FILE', then copy the log file to S3 manually.

Answer

Enable CloudTrail data events for RDS to capture login events and store in S3.

Answer

Enable the 'audit_log' plugin and configure RDS to publish logs to an S3 bucket.

Question 13

A company's security policy requires that all database passwords be rotated every 90 days. The company uses AWS Secrets Manager to store database credentials for Amazon RDS. Which feature can be used to automate password rotation?

Accepted Answer

Configure automatic rotation in Secrets Manager with a rotation interval of 90 days.. Secrets Manager has built-in rotation support for RDS databases. Option B is wrong because Lambda can be used but is not a feature of Secrets Manager itself; the managed rotation is the simplest. Option C is wrong because IAM Access Analyzer is for analyzing resource policies, not password rotation. Option D is wrong because Systems Manager Parameter Store does not have built-in rotation for RDS.

Answer

Use an AWS Lambda function triggered by Amazon CloudWatch Events every 90 days to rotate the password.

Answer

Use IAM Access Analyzer to detect unused passwords and rotate them.

Answer

Store the password in AWS Systems Manager Parameter Store and use automatic rotation.

Question 14

A security administrator is setting up a new Amazon RDS for SQL Server database. The company requires that all data be encrypted at rest and in transit. Additionally, the database must be accessible only from a specific CIDR range. Which TWO actions should the administrator take? (Choose TWO.)

Accepted Answer

Enable encryption at rest using AWS KMS.. Enabling encryption at rest using AWS KMS is a straightforward way to meet the encryption-at-rest requirement for RDS. Option B: Configuring a security group to allow inbound traffic from the specific CIDR range restricts network access to the database. Option C is incorrect because encryption in transit is handled by the database engine (e.g., SSL/TLS) and is not an RDS option group feature; you enable it on the client side or by modifying the DB parameter group. Option D is incorrect because DB parameter groups do not control network access; they manage database engine parameters. Option E is incorrect because AWS KMS is the default service for RDS encryption at rest; CloudHSM is an alternative for key management but not required.

Answer

Enable encryption in transit by modifying the RDS option group to include SSL.

Answer

Modify the DB parameter group to restrict network access.

Answer

Use AWS CloudHSM to manage encryption keys for the database.

Question 15

A company uses Amazon DynamoDB to store session data for a web application. The security team discovers that an IAM user has been performing unauthorized scans on the table. They need to implement controls to detect and prevent such unauthorized access in the future. Which THREE actions should the security team take? (Choose THREE.)

Accepted Answer

Enable AWS CloudTrail logging and create a metric filter for Scan API calls.. Options A, B, and D are correct. Option A: Enabling CloudTrail logging and creating a metric filter for Scan API calls allows the security team to detect unauthorized scan attempts in real time and trigger alerts. Option B: Using fine-grained access control with IAM conditions (e.g., 'dynamodb:LeadingKeys' or 'dynamodb:Attributes') restricts access to specific items or attributes, preventing unauthorized scans from retrieving sensitive data. Option D: Creating an IAM policy that denies the 'Scan' action for unauthorized users using a condition key (e.g., 'aws:SourceIp' or custom tag) provides a preventive control to block unauthorized scans at the API level. Option C is incorrect because disabling the Scan operation on the DynamoDB table would break legitimate use cases that require scanning (e.g., admin queries, reporting) and is not a recommended control. Option E is incorrect because VPC Flow Logs capture network traffic to DynamoDB, not the DynamoDB API operations themselves, so they cannot detect scans.

Answer

Disable the Scan operation on the DynamoDB table.

Answer

Enable VPC Flow Logs to monitor traffic to DynamoDB.