DBS-C01 Database Security Practice Question
A financial company uses Amazon RDS for PostgreSQL with a custom parameter group. The security team wants to ensure that all connections to the database are encrypted in transit. Which action should the database administrator take?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the parameter 'rds.force_ssl' to 1 in the custom parameter group.
Setting the parameter 'rds.force_ssl' to 1 in the RDS for PostgreSQL custom parameter group forces all connections to use SSL/TLS, ensuring encryption in transit. Option A is incorrect because IAM roles provide authentication, not transport encryption. Option B is incorrect because changing the port does not encrypt data. Option C is incorrect because setting 'ssl' to off disables encryption. Option E is incorrect because modifying a security group to allow inbound traffic on port 5432 does not enforce encryption; the '--ssl' option is a client-side parameter, not enforceable via security groups.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Attach an IAM role to the RDS instance to authenticate users.
Why it's wrong here
IAM roles provide authentication, not encryption in transit.
- ✗
Change the database port to 8432 to use a non-standard port.
Why it's wrong here
Changing the port does not encrypt data.
- ✗
Set 'ssl' to 'off' in the parameter group.
Why it's wrong here
Setting 'ssl' to off disables encryption, opposite of the requirement.
- ✓
Set the parameter 'rds.force_ssl' to 1 in the custom parameter group.
Why this is correct
Setting 'rds.force_ssl' to 1 forces all connections to use SSL/TLS, ensuring encryption in transit.
- ✗
Modify the security group to allow inbound traffic only on port 5432 with the '--ssl' option.
Why it's wrong here
Security groups control network access but cannot enforce encryption. The '--ssl' option is a client-side parameter, not a security group setting.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.