DBS-C01 Database Security Practice Question
A company is using Amazon RDS for PostgreSQL and wants to implement encryption in transit for all client connections. The security team has identified that some connections are not using SSL. Which TWO actions should the company take to enforce SSL for all connections?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the 'rds.force_ssl' parameter to '1' in the DB parameter group.
The correct actions to enforce SSL for all connections are A and E. Option A: Setting 'rds.force_ssl' to '1' in the DB parameter group forces the RDS PostgreSQL instance to require SSL for all incoming connections at the server level. Option E: Modifying the 'pg_hba.conf' file to require SSL for all users via 'hostssl' entries ensures that only SSL connections are allowed, complementing the server-side enforcement. Option C is incorrect because associating a custom SSL certificate is not required for enforcing SSL; AWS RDS provides a valid certificate. Option B is a client-side configuration that does not enforce server-side SSL. Option D is client-side and not a server-side enforcement action. Options A and E together provide robust server-side enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Set the 'rds.force_ssl' parameter to '1' in the DB parameter group.
Why this is correct
This parameter forces the PostgreSQL server to reject non-SSL connections.
- ✗
Install the RDS CA certificate on all client machines.
Why it's wrong here
This enables trust but does not enforce SSL; the client could still connect without SSL.
- ✗
Create a new SSL certificate and associate it with the RDS instance.
Why it's wrong here
RDS uses a default SSL certificate; creating a new one is not required.
- ✗
Configure the application connection string to use 'sslmode=require'.
Why it's wrong here
This is a client-side setting; it does not enforce server-side.
- ✓
Modify the pg_hba.conf file to require SSL for all users by setting 'hostssl' entries.
Why this is correct
pg_hba.conf controls authentication; requiring SSL for all hosts enforces encryption.
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DBS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company is using Amazon RDS for PostgreSQL. The security team wants to ensure that all connections to the database are encrypted in transit. Currently, applications connect using the PostgreSQL native encryption (SSL/TLS). What is the MOST secure way to enforce encrypted connections?
easy- A.Configure the security group to only allow traffic on port 5432 from trusted IP addresses.
- ✓ B.Enable the 'rds.force_ssl' parameter in the DB parameter group and restart the instance.
- C.Use a custom database port that is not commonly used, such as 5433, to avoid unencrypted traffic.
- D.Modify the DB parameter group to set 'ssl' to 'on' and 'require_ssl' to 'on', then reboot the instance.
Why B: In Amazon RDS for PostgreSQL, the parameter to enforce SSL is 'rds.force_ssl' (often abbreviated as 'force_ssl'). Setting this parameter to 1 in the DB parameter group and rebooting the instance forces all connections to use SSL/TLS. Option A is incorrect because security groups control network access but do not enforce encryption. Option C is incorrect because changing the port only obscures the port number, not enforce encryption. Option D is incorrect because 'require_ssl' is not a valid parameter in RDS PostgreSQL; the correct parameter is 'rds.force_ssl'.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.