DBS-C01 Database Security Practice Question
A company is using an Amazon RDS for PostgreSQL database to store sensitive customer data. The security team requires that all data be encrypted at rest and in transit, and that access to the database is restricted to only specific applications. Currently, the database is encrypted at rest using AWS KMS, and connections are made over SSL. However, the security team wants to ensure that even if the database credentials are compromised, an attacker cannot access the database from unauthorized IP addresses. What should be done to meet this requirement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the security group associated with the RDS instance to allow inbound traffic only from the application's IP addresses.
Modifying the security group associated with the RDS instance to allow inbound traffic only from the application's IP addresses restricts network access at the instance level, preventing unauthorized IP addresses from connecting even if credentials are compromised. Option A (attaching a resource-based policy) does not restrict network access—it controls IAM permissions. Option B (creating a new RDS instance in a VPC with a network ACL) is unnecessarily complex and involves migrating data; the requirement can be met by modifying the existing security group without creating a new instance. Option D (enabling IAM database authentication) authenticates database users via IAM but does not restrict source IP addresses, so it does not meet the stated requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attach a resource-based policy to the RDS instance to allow only specific IAM roles.
Why it's wrong here
RDS does not support resource-based policies; access is controlled via security groups or IAM policies for actions.
- ✗
Create a new RDS instance in a VPC with a network ACL that allows inbound traffic only from specific IP ranges, and migrate the data.
Why it's wrong here
While a new instance could be created, the existing instance can also be placed in a VPC with a security group.
- ✓
Modify the security group associated with the RDS instance to allow inbound traffic only from the application's IP addresses.
Why this is correct
Security groups act as a virtual firewall and can restrict inbound traffic based on IP addresses.
- ✗
Enable IAM database authentication for the RDS instance.
Why it's wrong here
IAM database authentication controls access via IAM roles, not IP addresses.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.