DBS-C01 Database Security Practice Question
A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all connections to the database be encrypted in transit. Which TWO steps should be taken to enforce this requirement?
⚠ Common exam trap
Watch out — candidates often confuse Oracle Native Network Encryption (NNE) with SSL/TLS, but RDS for Oracle does not support NNE; only SSL/TLS is available for encryption in transit.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the rds.force_ssl parameter to 1 in the DB parameter group.
The correct steps are A and B. Setting the rds.force_ssl parameter to 1 in the DB parameter group forces all connections to use SSL/TLS on the server side. Additionally, configuring the database to require a client-side SSL/TLS certificate provides mutual authentication and ensures that only clients with valid certificates can connect, thereby enforcing encryption in transit from both ends.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set the rds.force_ssl parameter to 1 in the DB parameter group.
Why this is correct
Setting the rds.force_ssl parameter to 1 in the DB parameter group forces all connections to the Oracle RDS instance to use SSL/TLS encryption. This is the direct method to enforce encryption in transit for Amazon RDS for Oracle, as it rejects any non-SSL connections at the database level.
- ✓
Configure the database to require a client-side SSL/TLS certificate.
Why this is correct
Configuring the database to require a client-side SSL/TLS certificate ensures that only clients with a valid certificate can establish an encrypted connection. This adds an extra layer of security by authenticating the client and enforcing encryption in transit.
- ✗
Enable Oracle native network encryption (NNE) in the sqlnet.ora file.
Why it's wrong here
Oracle Native Network Encryption (NNE) is not supported in Amazon RDS for Oracle. RDS supports SSL/TLS for encryption in transit, but not NNE. Therefore, this option is not valid.
- ✗
Use AWS Secrets Manager to store database credentials and enable Kerberos authentication.
Why it's wrong here
AWS Secrets Manager is used to securely store database credentials, but it does not enforce encryption in transit. Kerberos authentication is for identity verification, not for encrypting connections. This option does not meet the requirement.
- ✗
Use AWS Direct Connect or a VPN to connect to the VPC.
Why it's wrong here
AWS Direct Connect or a VPN can provide encrypted network connectivity between on-premises and AWS, but they do not enforce encryption at the database level. The requirement is to enforce encryption in transit for all connections to the database itself.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.