DBS-C01 Database Security Practice Question
A company is using Amazon RDS for MySQL with Multi-AZ deployment. The security team wants to ensure that database administrators cannot view sensitive data. Which TWO actions should be taken to achieve this goal?
⚠ Common exam trap
Many exam-takers confuse encryption at rest (which protects data on disk) with access control (which protects data from being queried), leading them to select encryption options when the real requirement is to prevent DBAs from viewing data through database connections.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use IAM database authentication for application access.
IAM database authentication allows you to authenticate to your RDS MySQL instance using an IAM user or role instead of a traditional database password. This eliminates the need for database administrators to know or manage database credentials, as they can only access the database through IAM policies that grant specific, auditable permissions. By using IAM authentication, you enforce a separation of duties where DBAs cannot view sensitive data unless explicitly authorized by IAM policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use IAM database authentication for application access.
Why this is correct
IAM database authentication allows applications to connect without passwords, reducing the need for DBAs to handle credentials.
- ✗
Enable audit logging to capture all data access.
Why it's wrong here
Audit logging captures access but does not prevent DBAs from viewing data.
- ✓
Store database credentials in AWS Secrets Manager and enforce automatic rotation.
Why this is correct
This prevents DBAs from knowing the credentials used by applications.
- ✗
Enable encryption at rest using a customer-managed KMS key.
Why it's wrong here
Encryption at rest protects data on disk but does not prevent DBAs from querying data through the database engine.
- ✗
Disable query logging to prevent sensitive data from being written to logs.
Why it's wrong here
Disabling logs does not prevent DBAs from accessing data directly.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.