DBS-C01 Database Security Practice Question
A company uses Amazon RDS for SQL Server with Multi-AZ deployment. The security team has mandated that all connections to the database must use SSL/TLS. The database is accessed by multiple applications running on EC2 instances. Which configuration ensures that all connections use SSL/TLS?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the parameter rds.force_ssl to 1 in the DB parameter group.
Setting the rds.force_ssl parameter to 1 in the DB parameter group enforces SSL/TLS for all connections to the RDS for SQL Server instance. No additional steps are needed; this parameter alone ensures that any connection attempt without SSL is rejected. Option B is incorrect because it includes an unnecessary step of revoking permissions from users that do not use SSL; the rds.force_ssl setting already forces SSL for all users and revoking permissions is redundant. Option A is incorrect because the 'Require SSL' option does not exist in the RDS console; SSL enforcement is controlled via parameter group settings. Option D is incorrect because configuring applications to use a trusted certificate only addresses the client side; the server must also require SSL, which is achieved through the parameter group setting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Modify the DB instance by enabling the 'Require SSL' option in the RDS console.
Why it's wrong here
Incorrect. The 'Require SSL' option does not exist in the RDS console; SSL enforcement is controlled via parameter group settings.
- ✗
Set the parameter rds.force_ssl to 1 in the DB parameter group and revoke permissions from users that do not use SSL.
Why it's wrong here
Incorrect. While setting rds.force_ssl=1 is necessary, revoking permissions from users that do not use SSL is redundant because the parameter already forces SSL for all connections. Option C alone is sufficient.
- ✓
Set the parameter rds.force_ssl to 1 in the DB parameter group.
Why this is correct
Correct. Setting rds.force_ssl=1 in the DB parameter group enforces SSL/TLS for all connections to the RDS for SQL Server instance without any additional steps.
- ✗
Configure the applications to use a certificate from a trusted certificate authority and connect using SSL.
Why it's wrong here
Incorrect. Configuring applications to use a trusted certificate only addresses the client side; the server must also require SSL, which is achieved through the parameter group setting.
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.