DBS-C01 Database Security Practice Question
A company is running an Amazon RDS for MySQL DB instance in a VPC. The security team requires that all connections to the database use SSL/TLS. Which combination of steps should be taken to enforce this? (Choose two.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Require database users to connect using the --ssl-ca parameter with the RDS certificate.
To enforce SSL on RDS MySQL, you set the rds.force_ssl parameter to 1 in the DB parameter group and require users to connect using the --ssl-ca option. The option group is for features like Oracle TDE, not SSL enforcement. Security group rules control network access, not encryption enforcement. Option E is unnecessary if you set the parameter.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a new DB subnet group that isolates the DB instance in a private subnet without internet access.
Why it's wrong here
Network isolation does not enforce SSL encryption.
- ✗
Update the security group for the DB instance to deny inbound traffic on port 3306 from sources that do not have SSL.
Why it's wrong here
Security groups cannot inspect SSL; they only control IP-based access.
- ✓
Require database users to connect using the --ssl-ca parameter with the RDS certificate.
Why this is correct
This ensures the client verifies the server certificate, which is necessary for SSL connections.
- ✓
Modify the DB parameter group associated with the DB instance, setting the 'rds.force_ssl' parameter to 1.
Why this is correct
This enforces SSL connections at the database level.
- ✗
Modify the DB option group associated with the DB instance, enabling the SSL option.
Why it's wrong here
Option groups are for additional features like Oracle TDE, not SSL enforcement on MySQL.
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.