DBS-C01 Database Security Practice Question
A company is using Amazon RDS for PostgreSQL and needs to ensure that all connections to the database use encryption in transit. The database is accessible over the internet. Which configuration is required?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the rds.force_ssl parameter to 1 and configure the client to use the AWS RDS SSL certificate.
To enforce encryption in transit for Amazon RDS for PostgreSQL, you must set the `rds.force_ssl` parameter to 1 in the DB parameter group. Additionally, clients need to be configured to use the AWS RDS SSL certificate (downloaded from AWS) to establish a secure connection. Option A is incorrect because security groups only control network traffic based on IP addresses, they do not enforce encryption. Option B is incorrect because changing the port to 443 does not enforce SSL; SSL is enforced through parameter settings and client configuration. Option D is incorrect because while a self-signed certificate could technically be used, the recommended and simpler method is to use the AWS-provided SSL certificate, especially since clients need to trust the certificate authority.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Restrict the security group to only allow traffic from trusted IP addresses.
Why it's wrong here
Security groups do not enforce encryption.
- ✗
Modify the DB instance to use a custom port 443 instead of 5432.
Why it's wrong here
Changing the port does not enforce encryption.
- ✓
Set the rds.force_ssl parameter to 1 and configure the client to use the AWS RDS SSL certificate.
Why this is correct
This enforces SSL connections.
- ✗
Use a self-signed certificate on the server and configure the client to trust it.
Why it's wrong here
RDS does not allow custom server certificates; you must use the AWS-provided certificate.
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.