DBS-C01 Database Security Practice Question
A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all database connections use SSL and that the database is encrypted at rest. Which THREE steps are required to meet these requirements? (Choose THREE.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the DB parameter group to set 'require_ssl' to 'true'.
To meet the requirements, three steps are needed. First, enable encryption at rest by selecting the encryption option when creating the RDS instance (option E). Second, to enforce SSL connections, modify the DB parameter group to set require_ssl to true (option C). Third, download the RDS SSL certificate from AWS and configure the application to trust it (option D). Options A and B are incorrect because you cannot upload a custom SSL certificate to RDS, and the certificate must be trusted by the application, not necessarily installed on every client machine individually.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Upload a custom SSL certificate to the RDS instance.
Why it's wrong here
RDS provides its own certificate; you can use your own but not required.
- ✗
Install the SSL certificate on every client machine.
Why it's wrong here
The certificate is installed on the application server, not each client.
- ✓
Modify the DB parameter group to set 'require_ssl' to 'true'.
Why this is correct
This enforces SSL connections.
- ✓
Download the RDS SSL certificate and configure the application to trust it.
Why this is correct
Application must trust the RDS certificate to establish SSL connection.
- ✓
Enable encryption at rest when creating the RDS instance.
Why this is correct
Encryption at rest can only be enabled at creation time.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.