Courseiva
← DBS-C01
Full test
Database Security →hardMultiple ChoiceObjective-mapped

DBS-C01 Database Security Practice Question

A company is using Amazon Aurora MySQL-Compatible Edition. The security team requires that all connections to the database use SSL/TLS. The application currently connects using a standard JDBC connection string without SSL. What changes are needed to enforce SSL connections?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Modify the DB cluster parameter group to set require_secure_transport to ON and update the application connection string to use SSL parameters.

To enforce SSL for all connections to an Amazon Aurora MySQL database, you must modify the DB cluster parameter group to set require_secure_transport to ON, which rejects non-SSL connections. Additionally, the application's JDBC connection string must be updated to include SSL parameters (e.g., useSSL=true) so that the application initiates an SSL connection. Option A is incomplete because modifying the parameter group alone does not enforce SSL on existing connections if the application does not use SSL. Option C is incorrect because security groups do not have an SSL flag; they control network access based on IP and port. Option D is incorrect because IAM roles do not enforce SSL encryption; they handle authentication and authorization.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    Modify the DB cluster parameter group to set require_secure_transport to ON.

    Why it's wrong here

    This enforces SSL for new connections, but the application must also use SSL in the connection string.

  • ✓

    Modify the DB cluster parameter group to set require_secure_transport to ON and update the application connection string to use SSL parameters.

    Why this is correct

    This enforces SSL and ensures the application uses it.

  • ✗

    Modify the security group to only allow traffic on port 3306 with the SSL flag.

    Why it's wrong here

    Security groups cannot enforce SSL; they only filter traffic based on IP/port.

  • ✗

    Create an IAM role that requires SSL for database access and assign it to the application.

    Why it's wrong here

    IAM roles do not enforce SSL for database connections.

About these practice questions

This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more way this is tested on DBS-C01

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A company is setting up an Amazon Aurora MySQL-compatible database. The security policy requires that all traffic between the application and database be encrypted in transit. Which TWO steps should be taken?

easy
  • A.Use a Network Load Balancer with a TLS listener in front of the Aurora cluster.
  • B.Place the Aurora cluster in a private subnet with a VPN connection.
  • ✓ C.Set the 'require_secure_transport' parameter to 'ON' in the DB cluster parameter group.
  • ✓ D.Configure the application connection string to use the SSL-enabled endpoint (port 3306 with SSL).
  • E.Enable encryption at rest using AWS KMS.

Why C: To encrypt data in transit, you need to enforce SSL on the server side and ensure the client uses SSL. Setting the 'require_secure_transport' parameter to 'ON' in the DB cluster parameter group (Option C) forces the server to require SSL connections. Configuring the application connection string to use the SSL-enabled endpoint (Option D) ensures the client connects using SSL. Option A is unnecessary because Aurora supports SSL natively without a load balancer. Option B does not encrypt traffic; a VPN only secures the network path but does not enforce encryption at the database layer. Option E encrypts data at rest, not in transit.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.