DBS-C01 Database Security Practice Question
A developer needs to connect to an Amazon RDS for PostgreSQL DB instance from an EC2 instance in the same VPC. What is the most secure way to authenticate the connection without storing database credentials in the application code?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable IAM database authentication and generate an authentication token.
IAM database authentication for RDS PostgreSQL allows the application to connect using an IAM user or role without storing any database credentials. The authentication token is generated by the AWS SDK and is valid for 15 minutes. This eliminates the need to store credentials in the application code. Option A is incorrect because a hardcoded password is not secure. Option B (Secrets Manager) and Option D (Systems Manager Parameter Store SecureString) both require the application to retrieve a secret at runtime, which still introduces credential management overhead and potential exposure. IAM authentication is the most secure option as it removes static credentials entirely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a hardcoded password in the application configuration file.
Why it's wrong here
Hardcoding passwords is insecure.
- ✗
Store the database password in AWS Secrets Manager and retrieve it at runtime.
Why it's wrong here
While secure, this still involves retrieving a secret; IAM auth eliminates the need for a password entirely.
- ✓
Enable IAM database authentication and generate an authentication token.
Why this is correct
IAM database authentication eliminates the need for a stored password.
- ✗
Store the password in AWS Systems Manager Parameter Store as a SecureString.
Why it's wrong here
Similar to Secrets Manager, it still requires retrieval.
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.