DBS-C01 Database Security Practice Question
A company is using Amazon Redshift for data warehousing. The security team requires that all data is encrypted at rest using a hardware security module (HSM). Additionally, the team wants to ensure that only specific IAM roles can access the database. Which configuration will meet these requirements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create the Redshift cluster with encryption enabled using an HSM, and attach an IAM role to the cluster to control access.
Redshift supports HSM for encryption at rest, and IAM roles can be attached to the cluster for access control. Option A is wrong because HSM and KMS are mutually exclusive. Option C is wrong because KMS does not meet the HSM requirement. Option D is wrong because encryption cannot be enabled after cluster creation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create the Redshift cluster with encryption enabled using a KMS key, and configure the cluster to use an HSM for key storage.
Why it's wrong here
Redshift does not support HSM and KMS simultaneously; you must choose one.
- ✓
Create the Redshift cluster with encryption enabled using an HSM, and attach an IAM role to the cluster to control access.
Why this is correct
HSM provides hardware-based encryption and IAM roles can be used for access control.
- ✗
Create the Redshift cluster without encryption, then use the AWS CLI to enable encryption using a KMS key.
Why it's wrong here
Redshift does not support enabling encryption on an existing cluster.
- ✗
Create the Redshift cluster with encryption using a KMS key, and then import the HSM certificate into the cluster.
Why it's wrong here
KMS and HSM are separate encryption options; cannot combine.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.