DBS-C01 Database Security Practice Question
A company is designing a secure strategy for managing Amazon RDS for Oracle encryption keys. They want to use AWS KMS with Customer Master Keys (CMKs) for encryption at rest. Which THREE best practices should they follow?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Grant the RDS service principal (rds.amazonaws.com) only the necessary KMS permissions to use the CMK.
Options A, B, and E are correct. Using separate KMS keys for different environments provides isolation (option B), enabling automatic key rotation is a security best practice (option E), and granting least privilege access to KMS keys is fundamental (option A). Option C is incorrect because disabling key rotation is not recommended and can lead to security risks. Option D is incorrect because storing the CMK inside the database is insecure and defeats the purpose of using KMS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Grant the RDS service principal (rds.amazonaws.com) only the necessary KMS permissions to use the CMK.
Why this is correct
Least privilege ensures that only RDS can use the key for encryption operations.
- ✓
Create separate KMS keys for different environments (e.g., production, development).
Why this is correct
Separation of keys limits blast radius and allows different access controls.
- ✗
Disable key rotation to maintain consistent encryption across all snapshots.
Why it's wrong here
Disabling rotation is not a best practice; AWS KMS supports rotating keys without affecting existing data.
- ✗
Store the KMS CMK inside the Oracle database for faster encryption.
Why it's wrong here
Storing keys inside the database defeats the purpose of KMS and is insecure.
- ✓
Enable automatic rotation of the KMS CMK annually.
Why this is correct
Automatic rotation helps meet compliance requirements.
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.