DBS-C01 rds.force_ssl Practice Question
A company is migrating an Oracle database to Amazon RDS for Oracle. Security policy requires that all database connections be encrypted in transit. The security team wants to enforce that clients must use TLS 1.2 or higher. How can this be achieved?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the rds.force_ssl parameter to 1 in the DB parameter group.
Amazon RDS for Oracle supports SSL/TLS encryption, and setting the rds.force_ssl parameter to 1 in the DB parameter group enforces SSL connections, which ensures all connections use TLS 1.2 or higher (as per Oracle's implementation). Option A is incorrect because modifying the DB subnet group controls network-level access, not encryption requirements. Option B is incorrect because IAM policies cannot enforce encryption in transit at the database level; they can only control authentication and authorization. Option C is incorrect because require_secure_transport is a MySQL parameter, not applicable to Oracle.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Modify the DB subnet group to only allow traffic from specific IP ranges.
Why it's wrong here
Modifying the DB subnet group controls network access but does not enforce encryption requirements.
- ✗
Create an IAM policy that denies access unless the connection uses TLS.
Why it's wrong here
IAM policies can control authentication and authorization, but cannot enforce encryption in transit at the database level.
- ✗
Set the require_secure_transport parameter to ON in the DB parameter group.
Why it's wrong here
The require_secure_transport parameter is not applicable to Amazon RDS for Oracle.
- ✓
Set the rds.force_ssl parameter to 1 in the DB parameter group.
Why this is correct
Correct. Setting rds.force_ssl to 1 requires SSL/TLS encryption for all connections, enforcing TLS 1.2 or higher.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.