Courseiva
← DBS-C01
Full test
Database Security →hardMultiple ChoiceObjective-mapped

DBS-C01 Database Security Practice Question

Exhibit

Refer to the exhibit.

CloudFormation snippet:
Resources:
  MyDBInstance:
    Type: AWS::RDS::DBInstance
    Properties:
      Engine: mysql
      DBInstanceClass: db.t3.medium
      AllocatedStorage: 100
      StorageEncrypted: true
      KmsKeyId: !Ref MyKMSKey
      MasterUsername: admin
      MasterUserPassword: !Ref DBPassword
  MyKMSKey:
    Type: AWS::KMS::Key
    Properties:
      KeyPolicy:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
            Action: "kms:*"
            Resource: "*"

A CloudFormation template is used to create an RDS DB instance with encryption, as shown in the exhibit. The stack creation fails because the DB instance creation fails. What is the most likely cause?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The DB instance depends on the KMS key, but there is no DependsOn clause to ensure the key is created first.

KMS key creation must be completed before the DB instance can use it; CloudFormation does not automatically order creation unless dependencies are defined. Option A is wrong because the KMS key policy allows the account root full access. Option B is wrong because the KMS key ID is passed correctly via !Ref. Option C is wrong because encryption is set to true and the KMS key is provided.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    The DB instance has StorageEncrypted set to true but KmsKeyId is not a valid ARN.

    Why it's wrong here

    KmsKeyId can be a key ID.

  • ✗

    The KMS key policy does not grant permissions to the RDS service principal.

    Why it's wrong here

    RDS uses the account's permissions to use the key, not the service principal.

  • ✗

    The KmsKeyId property requires the key ARN, not a reference.

    Why it's wrong here

    !Ref returns the key ID, which is acceptable.

  • ✓

    The DB instance depends on the KMS key, but there is no DependsOn clause to ensure the key is created first.

    Why this is correct

    Without DependsOn, the DB instance may be created before the key.

About these practice questions

One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.