20+ practice questions focused on Database Security — one of the most tested topics on the AWS Certified Database Specialty DBS-C01 exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Database Security PracticeA company is designing a disaster recovery strategy for an Amazon Aurora MySQL database. The database stores sensitive data that must be encrypted at rest. The primary region is us-east-1, and the secondary region is us-west-2. Which THREE steps are required to set up cross-region replication with encryption at rest?
Explanation: A multi-Region KMS key allows the same key material to be replicated to the secondary region, enabling the cross-region read replica (created automatically) to decrypt the encrypted data without re-encrypting. Option C is not a separate required step: when you enable cross-region replication on the Aurora cluster (Option E), Aurora automatically creates a cross-region read replica in the secondary region. Option D is required to authorize the Aurora service in us-west-2 to use the locally created KMS key. Option B is unnecessary because parameter groups do not affect encryption.
A financial services company runs a critical application on Amazon RDS for PostgreSQL with Multi-AZ and automated backups enabled. The database stores sensitive customer data, and the security team recently audited the environment and found that the database master user password is stored in plain text in a configuration file on the application server. Additionally, the security team noted that the database security group allows inbound traffic from 0.0.0.0/0 on port 5432. The company needs to remediate these issues immediately without downtime and must ensure that access to the database is restricted to only the application servers, and that password management follows AWS best practices. The application connects to the database using the master user credentials. What should the database specialist do to meet these requirements?
Explanation: It restricts inbound traffic to the application server's private IP address, which is the secure approach for traffic within AWS, and it uses AWS Secrets Manager to store the master password with automatic rotation, following AWS best practices for secrets management. This eliminates the plain-text password exposure and ensures no downtime by updating the application to retrieve credentials dynamically from Secrets Manager.
A company has an Amazon RDS for MySQL Multi-AZ DB instance that stores sensitive financial data. The security team has enabled encryption at rest using a KMS key. They also need to ensure that database audit logs are encrypted and stored in an S3 bucket. The logs must be accessible only by the security team via a VPC endpoint. The log data must be retained for 7 years. Which solution meets these requirements with the LEAST operational overhead?
Explanation: It is the most efficient: enabling MySQL audit logs, publishing them to CloudWatch Logs, and using a CloudWatch Logs subscription filter to stream encrypted logs to S3 with access restricted via VPC endpoint. This uses managed services with minimal configuration. Option A is wrong because RDS cannot publish audit logs directly to S3; it requires an intermediate step. Option B is wrong because installing a custom audit plugin and using Lambda to export logs adds significant operational overhead and complexity. Option D is wrong because RDS does not natively support sending audit logs to Kinesis Data Firehose; setting that up would require additional components and overhead.
A company has an Amazon DynamoDB table with global secondary indexes (GSIs) that store personally identifiable information (PII). The security team requires that all PII is encrypted at rest using a customer-managed KMS key. The table already exists and is encrypted with the default AWS managed key. What is the MOST efficient way to change the encryption to a customer-managed key?
Explanation: DynamoDB does not allow changing encryption on an existing table. You must create a new table with the desired customer-managed KMS key, copy the data (e.g., using AWS Glue), and then delete the old table. Option A is incorrect: although you can restore a backup to a new table with a different key, this method requires an additional backup step, making it less efficient than directly copying data via AWS Glue. Option B is incorrect because the AWS Management Console does not support modifying encryption on an existing table. Option D is incorrect because the 'update-table' CLI command cannot change encryption after table creation.
A company is using Amazon DynamoDB with encryption at rest using a customer-managed KMS key. The security team wants to audit every use of this KMS key. Which TWO steps should be taken to meet this requirement?
Explanation: Options B and D are correct. To audit every use of a customer-managed KMS key, you need to enable AWS CloudTrail to log all KMS API calls (option D). Additionally, for the key itself, you can turn on KMS key auditing in the key's advanced configuration (option B), which provides detailed audit data. Option A is incorrect because sending KMS audit logs to Amazon CloudWatch Logs is not a required step; CloudWatch Logs can store logs but you must first enable auditing via CloudTrail or key auditing. Option C is incorrect because AWS Config records configuration changes to the KMS key, not the usage of the key for cryptographic operations. Option E is incorrect because VPC Flow Logs capture network traffic, not KMS API calls.
+15 more Database Security questions available
Practice all Database Security questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Database Security. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Database Security questions on the DBS-C01 frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Database Security is tested as part of the AWS Certified Database Specialty DBS-C01 blueprint. Practicing with targeted Database Security questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free DBS-C01 practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Database Security is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Database Security practice session with instant scoring and detailed explanations.
Start Database Security Practice →