DBS-C01 Database Security — Timed 100 Questions

Question 1

A company uses Amazon DynamoDB with a table that stores sensitive customer data. The security team requires that all data at rest be encrypted using a customer-managed AWS KMS key (CMK). Additionally, the company needs to ensure that only specific IAM roles can access the table. Which solution meets these requirements with the least operational overhead?

100 minute time limit — choose an answer to begin.

Accepted Answer

Configure the DynamoDB table to use AWS KMS encryption with a CMK. Create an IAM role with a policy that grants access to the table and includes a condition that the encryption context matches the CMK.. It combines DynamoDB encryption at rest with a customer-managed KMS CMK and uses an IAM role policy with an encryption context condition. This ensures that only specific IAM roles can access the table, and the encryption context condition ties the KMS key usage to the table, providing fine-grained access control with minimal operational overhead. The encryption context is automatically set by DynamoDB to the table ARN, so the condition key `kms:EncryptionContext:aws:dynamodb:tableName` can be used to restrict decryption to that specific table.

Answer

Enable encryption at rest using AWS KMS with a CMK and use column-level encryption with AWS KMS to restrict access.

Answer

Attach a resource-based policy to the DynamoDB table that grants access only to the specific IAM roles.

Answer

Use a DynamoDB Accelerator (DAX) cluster with encryption at rest using a CMK, and attach a resource-based policy to the table.

Answer

Configure the DynamoDB table to use AWS KMS encryption with a CMK, and attach a key policy to the CMK that allows only the specific IAM roles.

Question 2

A database specialist is troubleshooting a connectivity issue with an Amazon RDS for PostgreSQL instance. The instance is in a VPC with a public subnet. The security group allows inbound traffic on port 5432 from the application server's IP address. The application server is in the same VPC but in a private subnet. Despite the security group configuration, the application cannot connect. Which action should the specialist take to resolve the issue?

Accepted Answer

Update the security group inbound rule to allow traffic from the application server's private IP address.. The application server is in a private subnet, so it communicates with the RDS instance using its private IP address. The security group inbound rule must allow traffic from the application server's private IP (or the security group of the application server) on port 5432. The current rule only allows the application server's public IP, which is not used for traffic within the VPC, causing the connection failure.

Answer

Launch the RDS instance in the default VPC.

Answer

Change the DB subnet group to include the application server's subnet.

Answer

Add a network ACL rule allowing inbound traffic on port 5432 from the application server's public IP.

Answer

Modify the RDS instance to be publicly accessible.

Question 3

A company stores financial data in an Amazon Aurora MySQL DB cluster. The security team requires that database audit logs be stored in Amazon CloudWatch Logs and encrypted at rest using a customer-managed KMS key. The database specialist enables audit log publishing to CloudWatch Logs and specifies a KMS key for log encryption. However, the audit logs are not appearing in CloudWatch Logs. What is the most likely cause?

Accepted Answer

The IAM role used for publishing logs does not have the necessary permissions to use the KMS key for CloudWatch Logs.. When publishing database audit logs to CloudWatch Logs with a customer-managed KMS key, the IAM role used by RDS must have explicit permissions for the `kms:Encrypt` and `kms:Decrypt` actions on the KMS key. Without these permissions, RDS cannot encrypt the log stream, and the logs will not appear. Option C correctly identifies this missing permission as the most likely cause.

Answer

The CloudWatch Logs log group does not exist and RDS cannot create it automatically.

Answer

The DB cluster is not configured to export error logs, only audit logs.

Answer

CloudWatch Logs does not support encryption with customer-managed KMS keys for audit logs.

Answer

The audit log parameter is static and requires a DB cluster reboot after modification.

Question 4

A company uses Amazon RDS for SQL Server with Multi-AZ deployment. The security team wants to ensure that all database connections use SSL/TLS encryption. Which TWO actions should the database specialist take to enforce SSL connections? (Choose two.)

Accepted Answer

Create a server-level trigger that requires SSL for all logins.. SQL Server allows you to create a server-level DDL trigger that checks the login event and enforces SSL by examining the `@@OPTIONS` or `encrypt_option` in `sys.dm_exec_connections`. This is a supported method to force SSL for all connections to an RDS for SQL Server instance. Option E is correct because setting the `rds.force_ssl` parameter to 1 in the DB parameter group is the native RDS mechanism to enforce SSL/TLS for all connections to the DB instance.

Answer

Use the RDS Console to enable 'Force SSL' on the DB instance.

Answer

Modify the DB parameter group to set 'require_secure_transport' to ON.

Answer

Add an inbound rule to the security group that only allows traffic on port 1433 from IP addresses that use SSL.

Question 5

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all data be encrypted at rest using a customer-managed KMS key. Additionally, the database should be accessible only from a specific VPC. Which THREE steps should the database specialist take to meet these requirements? (Choose three.)

Accepted Answer

Configure the security group for the RDS instance to allow inbound traffic only from the application security group.. Option A is correct because restricting the RDS instance's security group to allow inbound traffic only from the application security group enforces least-privilege network access, ensuring only the intended application can reach the database. Option B is correct because launching the RDS instance in a private subnet of the specific VPC prevents any public internet exposure and confines the database to that VPC's network boundary. Option E is correct because selecting a customer-managed KMS key during instance creation enables encryption at rest with the required customer-controlled key, which cannot be changed after creation without re-encrypting. Option C is not needed because VPC endpoints are for privately accessing AWS services like S3 or KMS, not for making an RDS instance accessible only within a VPC. Option D is incorrect because KMS keys are managed in AWS KMS, not stored in Amazon S3, and RDS encryption at rest must use a KMS key, not an S3 object.

Answer

Create a VPC endpoint for RDS and associate it with the DB instance.

Answer

Store the encryption key in Amazon S3 and configure RDS to use it.

Question 6

A company uses Amazon RDS for MySQL with encryption at rest enabled. The security team mandates that all access to the database must be authenticated using IAM database authentication. The database administrator has created a user 'app_user' and granted appropriate privileges. However, when the application tries to connect using an IAM authentication token, it receives an 'Access denied' error. Which action should be taken to resolve this issue?

Accepted Answer

Ensure the IAM role used by the application has a name that matches the database user 'app_user' and has the necessary policy attached.. IAM database authentication for RDS MySQL requires that the database user name matches the IAM role or user name used to generate the authentication token. The IAM role must have a policy that allows the `rds-db:connect` action with a resource ARN specifying the database user. Without this exact match, the authentication token is rejected, resulting in an 'Access denied' error.

Answer

Create a password for 'app_user' and use that password in the connection string.

Answer

Modify the security group to allow inbound traffic on port 3306 from the application's IP address.

Answer

Download the latest Amazon RDS CA certificate and add it to the application trust store.

Question 7

A financial services company uses Amazon DynamoDB to store sensitive customer data. The security team requires that all data at rest be encrypted using a customer-managed AWS KMS key (CMK) with automatic rotation enabled. The DynamoDB table was created with the default AWS-managed key. Which steps are necessary to transition to a customer-managed CMK while minimizing downtime and data loss?

Accepted Answer

Export the table data to Amazon S3, create a new DynamoDB table with the new CMK, import the data, and update the application to use the new table.. DynamoDB does not support in-place modification of the encryption key for an existing table. To transition from an AWS-managed key to a customer-managed CMK, you must export the table data to Amazon S3, create a new DynamoDB table configured with the new CMK, import the data, and update the application to point to the new table. This approach minimizes downtime by allowing the original table to serve reads/writes during the export and import process, and avoids data loss by using DynamoDB's native export and import features.

Answer

Modify the DynamoDB table to update the encryption key to the new CMK using the AWS Console.

Answer

Disable encryption at rest, then re-enable it with the new CMK.

Answer

Update the KMS key policy to grant DynamoDB access to the new CMK, then rotate the key.

Question 8

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The compliance team requires that all database connections use SSL/TLS and that users authenticate using IAM database authentication. The database migration is completed, but the application team reports that connections using IAM authentication are failing. The company has already enabled IAM database authentication on the RDS instance. What is the most likely cause of the failure?

Accepted Answer

The database user has not been granted the necessary privileges for IAM authentication.. IAM database authentication requires that the database user be created with the `IDENTIFIED WITH AWS_AUTHENTICATION` clause in Oracle. Without this privilege, the RDS instance will reject IAM-authenticated connections even if IAM authentication is enabled at the instance level. The application team must ensure the database user has been granted the `AWS_ORACLE_EXTENSIONS` role and that the user is mapped to an IAM policy allowing `rds-db:connect`.

Answer

The application is using an outdated root CA certificate for SSL.

Answer

The Security Group does not allow inbound traffic from the application.

Answer

The RDS instance is using a different KMS key for encryption.

Question 9

A company is designing a disaster recovery strategy for an Amazon Aurora MySQL database. The database stores sensitive data that must be encrypted at rest. The primary region is us-east-1, and the secondary region is us-west-2. Which THREE steps are required to set up cross-region replication with encryption at rest?

Accepted Answer

Use a multi-Region KMS key to encrypt the Aurora cluster in the primary region.. Option A is correct because Aurora cross-Region encryption requires a multi-Region KMS key so the same key material can encrypt data in both us-east-1 and us-west-2, allowing the encrypted cluster and its replica to be decrypted consistently. Option D is correct because the secondary Region needs its own KMS key (or a multi-Region key replica) in us-west-2, and the Aurora service must be granted permission via the key policy to use it for encrypting the replica. Option E is correct because enabling cross-Region replication on the primary Aurora cluster is the action that initiates replication of the encrypted data to the secondary Region. Option B is not required because parameter groups do not need to be identical across Regions for cross-Region replication to function. Option C is not a separate required step because creating the cross-Region read replica is the outcome of enabling cross-Region replication, not an independent configuration action.

Answer

Ensure the DB cluster parameter group is the same in both regions.

Answer

Create a cross-Region read replica in the secondary region.

Question 10

A security engineer is troubleshooting an issue where an application using IAM role 'app-role' with a trust policy to assume the 'app-user' user is unable to decrypt an RDS database that uses a customer-managed KMS key. The above key policy is attached to the KMS key. What is the likely cause of the failure?

Accepted Answer

The principal in the policy is 'app-user', but the application uses an IAM role that does not have the necessary permissions.. The KMS key policy specifies the principal as 'app-user', which is an IAM user. However, the application uses an IAM role 'app-role' to make the decryption requests. Since the principal in the key policy does not include the role or its associated permissions, the KMS key policy denies access to the role, causing the decryption failure. The trust policy on the role allows the user to assume it, but that does not grant the role any KMS permissions unless explicitly added.

Answer

The 'kms:ViaService' condition requires the request to come from RDS, but the application is making KMS API calls directly.

Answer

The policy has a missing 'Effect': 'Deny' statement that is blocking access.

Answer

The condition 'kms:ViaService' restricts the key to be used only with RDS, but the application is using a different service.

Question 11

A company has a production Amazon RDS for SQL Server database that stores financial data. The database administrator wants to audit all access to sensitive columns (e.g., credit card numbers) using the SQL Server Audit feature. The database is part of a Multi-AZ deployment. The administrator has enabled audit logging to the 'DEFAULT' file audit target, but the audit files are being written to the local instance storage and are not being retained after failover. The compliance team requires that audit logs be stored in Amazon S3 for at least 7 years. The administrator has set up an event subscription to send database events to an S3 bucket using AWS DMS, but the audit logs are not being captured. What should the administrator do to meet the compliance requirements?

Accepted Answer

Create a new SQL Server Audit target using the Amazon S3 option and configure the audit to write to an S3 bucket.. Amazon RDS for SQL Server supports writing SQL Server Audit logs directly to an Amazon S3 bucket as an audit target. This is the only native method that persists audit logs beyond the instance lifecycle, ensuring they survive Multi-AZ failover and meet the 7-year retention requirement. The DEFAULT file target writes to ephemeral instance storage, which is lost on failover, and RDS event subscriptions or DMS cannot capture SQL Server Audit output.

Answer

Use RDS event subscriptions to send database audit logs to an S3 bucket.

Answer

Configure AWS DMS to continuously replicate the audit database to an S3 bucket.

Answer

Enable RDS Enhanced Monitoring and configure it to send logs to CloudWatch Logs.

Question 12

A financial services company runs a critical application on Amazon RDS for PostgreSQL with Multi-AZ and automated backups enabled. The database stores sensitive customer data, and the security team recently audited the environment and found that the database master user password is stored in plain text in a configuration file on the application server. Additionally, the security team noted that the database security group allows inbound traffic from 0.0.0.0/0 on port 5432. The company needs to remediate these issues immediately without downtime and must ensure that access to the database is restricted to only the application servers, and that password management follows AWS best practices. The application connects to the database using the master user credentials. What should the database specialist do to meet these requirements?

Accepted Answer

Modify the security group to allow inbound traffic on port 5432 only from the private IP address of the application server. Store the database password in AWS Secrets Manager and configure automatic rotation. Update the application to retrieve the password from Secrets Manager.. It restricts inbound traffic to the application server's private IP address, which is the secure approach for traffic within AWS, and it uses AWS Secrets Manager to store the master password with automatic rotation, following AWS best practices for secrets management. This eliminates the plain-text password exposure and ensures no downtime by updating the application to retrieve credentials dynamically from Secrets Manager.

Answer

Modify the security group to allow inbound traffic on port 5432 only from the public IP address of the application server. Rotate the password using the AWS CLI and store the new password in an encrypted file on the application server. Update the application to read the password from the encrypted file.

Answer

Modify the security group to allow inbound traffic on port 5432 only from the private IP address of the application server. Rotate the master password by modifying the DB instance and store the new password in AWS Systems Manager Parameter Store as a SecureString. Update the application to retrieve the password from Parameter Store.

Answer

Modify the security group to allow inbound traffic on port 5432 only from the private IP address of the application server. Rotate the password using the AWS CLI and store the new password in an encrypted file on the application server. Update the application to read the password from the encrypted file.

Question 13

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all connections to the database be encrypted in transit. Which TWO steps should be taken to enforce this requirement?

Accepted Answer

Set the rds.force_ssl parameter to 1 in the DB parameter group.. The correct steps are A and B. Setting the rds.force_ssl parameter to 1 in the DB parameter group forces all connections to use SSL/TLS on the server side. Additionally, configuring the database to require a client-side SSL/TLS certificate provides mutual authentication and ensures that only clients with valid certificates can connect, thereby enforcing encryption in transit from both ends.

Answer

Enable Oracle native network encryption (NNE) in the sqlnet.ora file.

Answer

Use AWS Secrets Manager to store database credentials and enable Kerberos authentication.

Answer

Use AWS Direct Connect or a VPN to connect to the VPC.

Question 14

Refer to the exhibit. A security engineer has applied this key policy to a customer managed KMS key used to encrypt a Secrets Manager secret containing database credentials. An application running on an Amazon EC2 instance in the same account and region is unable to decrypt the secret. What is the MOST likely cause?

Accepted Answer

The condition kms:ViaService restricts the decryption to requests made via Secrets Manager, but the application is calling KMS directly.. The condition `kms:ViaService` in the key policy restricts the `Decrypt` permission to requests that originate specifically from the AWS Secrets Manager service. When the application on the EC2 instance calls KMS directly (e.g., via the `Decrypt` API) to decrypt the secret, the request does not come through Secrets Manager, so the condition is not satisfied and the request is denied. This is the most likely cause of the decryption failure.

Answer

The KMS key ARN in the resource field is incorrect.

Answer

The policy is missing an encryption context that matches the secret's encryption context.

Answer

The policy only allows Decrypt, but the application needs Encrypt permission.

Question 15

A company runs an e-commerce application on AWS using an Aurora MySQL database cluster. The security team mandates that all database audit logs must be stored in Amazon S3 for at least one year for compliance. The database is currently configured to publish audit logs to Amazon CloudWatch Logs. The security team wants to use AWS Database Migration Service (DMS) to migrate the database to a new Aurora MySQL cluster, and during the migration, the audit logs must continue to be captured uninterrupted. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Enable the Aurora MySQL advanced audit feature with file-based output, and configure the DMS task to use these log files as a source for ongoing replication.. Enabling the Aurora MySQL advanced audit feature allows audit logs to be output to files on the DB instance. These files can then be exported to Amazon S3 (e.g., via a scheduled script or Lambda function) for compliance. During the DMS migration, change data capture is handled by binary logs, not audit logs, so the audit logging remains uninterrupted. This approach minimizes operational overhead by using the built-in audit feature and a simple export mechanism, without requiring additional services like CloudTrail or Performance Insights.

Answer

Enable Performance Insights on the source cluster and export the data to S3.

Answer

Create an Aurora MySQL read replica and enable audit logs on the replica, then migrate from the replica.

Answer

Use AWS CloudTrail to capture SQL queries and deliver them to S3.

Question 16

Arrange the steps to troubleshoot a connection timeout issue from an EC2 instance to an Amazon RDS for SQL Server DB instance in the correct order.

Accepted Answer

First, verify security group inbound rules. Second, check network ACLs. Third, verify EC2 network configuration. Finally, test connectivity using telnet.. Troubleshooting connectivity involves checking security groups, network ACLs, network configuration, and testing with telnet.

Answer

First, check network ACLs. Second, verify security group inbound rules. Third, test connectivity using telnet. Finally, verify EC2 network configuration.

Answer

First, test connectivity using telnet. Second, verify security group inbound rules. Third, check network ACLs. Finally, verify EC2 network configuration.

Answer

First, verify EC2 network configuration. Second, verify security group inbound rules. Third, check network ACLs. Finally, test connectivity using telnet.

Question 17

Match each DynamoDB concept to its definition.

Accepted Answer

Partition key: A simple primary key that determines the partition where the item is stored.. This matching exercise tests understanding of core DynamoDB concepts. The partition key distributes items across partitions, while the sort key enables ordering. Global secondary indexes (GSIs) allow queries on different partition keys, while local secondary indexes (LSIs) share the same partition key but different sort keys.

Answer

Sort key: A simple primary key that determines the partition where the item is stored.

Answer

Global secondary index: An index that uses the same partition key as the base table but a different sort key.

Question 18

A company is using an RDS for MySQL DB instance encrypted at rest with AWS KMS. The security team requires that all access to the database be logged, including queries that fail due to authentication errors. Which configuration meets this requirement?

Accepted Answer

Enable the RDS audit log by setting the 'audit_log_enabled' parameter to 1 in the DB parameter group and export logs to CloudWatch Logs.. For RDS for MySQL, the audit log is enabled by setting the 'audit_log_enabled' parameter to 1 in the DB parameter group, and then exporting the audit logs to CloudWatch Logs. This captures all connections and queries, including failed authentication attempts, because the audit log plugin logs connection events regardless of success. This is the only option that provides query-level logging including authentication failures.

Answer

Enable RDS Enhanced Monitoring and publish metrics to CloudWatch.

Answer

Enable AWS CloudTrail for the RDS instance and store logs in S3.

Answer

Use S3 server access logs to capture database connection attempts.

Question 19

A company uses Amazon Redshift for data warehousing. The security team requires that all data loaded into the cluster be encrypted at rest using a customer-managed KMS key. The cluster is currently unencrypted. What is the most efficient way to achieve this requirement with minimal data loss?

Accepted Answer

Unload the data from the existing cluster to S3, create a new encrypted cluster using the KMS key, and reload the data from S3.. An existing unencrypted Redshift cluster cannot be encrypted in place. The only way to achieve encryption using a customer-managed KMS key is to unload the data to S3, create a new encrypted cluster with the desired KMS key, and reload the data. Options B, C, and D are incorrect because Redshift does not support enabling encryption on an existing cluster, modifying an existing cluster to enable encryption, or adding encryption to an unencrypted snapshot.

Answer

Change the cluster parameter group to enable encryption.

Answer

Modify the cluster and enable encryption in the Redshift console.

Answer

Take a snapshot of the cluster, copy the snapshot with encryption, and restore from the encrypted snapshot.

Question 20

A company has an RDS for SQL Server DB instance that stores sensitive data. The database administrator needs to ensure that all connections to the database use SSL/TLS encryption. What should the administrator do?

Accepted Answer

Set the 'rds.force_ssl' parameter to 1 in the DB parameter group.. Setting 'rds.force_ssl' to 1 in the DB parameter group forces all connections to the RDS for SQL Server DB instance to use SSL/TLS encryption. Option A is incorrect because security group rules control network access, not encryption. Option C is incorrect because AWS CloudTrail logs API calls, not database connections. Option D is incorrect because deleting and recreating the instance would not, by itself, enforce SSL; encryption at rest is separate from SSL enforcement.

Answer

Configure the security group to only allow traffic from specific IP addresses.

Answer

Enable AWS CloudTrail to monitor connections.

Answer

Delete the DB instance and create a new one with encryption enabled.