DBS-C01 Database Security Practice Question
A company uses Amazon RDS for SQL Server with Multi-AZ deployment. The security team wants to ensure that all database connections use SSL/TLS encryption. Which TWO actions should the database specialist take to enforce SSL connections? (Choose two.)
⚠ Common exam trap
Test-takers frequently confuse MySQL-specific parameters (like `require_secure_transport`) with SQL Server parameters, or assume that security group rules can enforce encryption at the transport layer, when in fact they only control network access, not the encryption state of the connection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a server-level trigger that requires SSL for all logins.
SQL Server allows you to create a server-level DDL trigger that checks the login event and enforces SSL by examining the `@@OPTIONS` or `encrypt_option` in `sys.dm_exec_connections`. This is a supported method to force SSL for all connections to an RDS for SQL Server instance. Option E is correct because setting the `rds.force_ssl` parameter to 1 in the DB parameter group is the native RDS mechanism to enforce SSL/TLS for all connections to the DB instance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the RDS Console to enable 'Force SSL' on the DB instance.
Why it's wrong here
The RDS Console does not have a 'Force SSL' option for SQL Server; it must be done via parameter group.
- ✗
Modify the DB parameter group to set 'require_secure_transport' to ON.
Why it's wrong here
'require_secure_transport' is a MySQL parameter, not SQL Server.
- ✓
Create a server-level trigger that requires SSL for all logins.
Why this is correct
A trigger can enforce SSL by checking the session's protocol and denying non-SSL connections.
- ✗
Add an inbound rule to the security group that only allows traffic on port 1433 from IP addresses that use SSL.
Why it's wrong here
Security groups cannot inspect whether traffic is encrypted; they only filter by IP and port.
- ✓
Set the 'rds.force_ssl' parameter to 1 in the DB parameter group.
Why this is correct
This parameter forces all connections to use SSL for SQL Server RDS.
Go deeper
Related to this question
About these practice questions
One of 1,663 original DBS-C01 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.