DBS-C01 Database Security Practice Question
A company hosts a critical application on Amazon RDS for PostgreSQL. The security team requires that all database connections be encrypted in transit. Which configuration step is necessary?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the rds.force_ssl parameter to 1 in the DB parameter group.
Enforcing SSL/TLS for connections is required for encryption in transit. Option B is correct. Option A is wrong because a VPN encrypts network traffic but does not enforce database-level SSL. Option C is wrong because modifying security group rules to allow only port 5432 does not encrypt connections. Option D is wrong because enabling encryption at rest does not encrypt data in transit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a VPN connection between the application and the database.
Why it's wrong here
A VPN encrypts network traffic but does not enforce database-level SSL.
- ✓
Set the rds.force_ssl parameter to 1 in the DB parameter group.
Why this is correct
Setting rds.force_ssl to 1 in the DB parameter group enforces SSL/TLS for connections.
- ✗
Modify the security group to allow only port 5432 from the application.
Why it's wrong here
Modifying security group rules does not encrypt connections; it only controls network access.
- ✗
Enable encryption at rest using AWS KMS.
Why it's wrong here
Enabling encryption at rest does not encrypt data in transit.
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DBS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An application uses an Amazon RDS for MySQL database. The security team requires that all traffic to the database be encrypted in transit. Which configuration ensures this?
medium- A.Use the default RDS parameter group.
- ✓ B.Create a custom DB parameter group with the require_secure_transport parameter set to ON.
- C.Configure the security group to allow only port 3306 from the application.
- D.Use a network ACL to restrict inbound traffic to port 3306.
Why B: Setting require_secure_transport to ON in a custom DB parameter group enforces SSL/TLS for all connections to the RDS MySQL database, ensuring encryption in transit. Option A is wrong because the default parameter group does not enforce SSL. Option C is wrong because security groups control network access at the port level, not encryption. Option D is wrong because network ACLs are stateless and do not enforce encryption.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.