- A
Modify the security group to allow inbound traffic on port 5432 only from the private IP address of the application server. Store the database password in AWS Secrets Manager and configure automatic rotation. Update the application to retrieve the password from Secrets Manager.
Option A is correct because it addresses both the security group exposure and password management using AWS best practices (Secrets Manager with automatic rotation).
- B
Modify the security group to allow inbound traffic on port 5432 only from the public IP address of the application server. Rotate the password using the AWS CLI and store the new password in an encrypted file on the application server. Update the application to read the password from the encrypted file.
Why wrong: Option D is incorrect because using public IP is less secure and less reliable than private IP, and the password management is not best practice.
- C
Modify the security group to allow inbound traffic on port 5432 only from the private IP address of the application server. Rotate the master password by modifying the DB instance and store the new password in AWS Systems Manager Parameter Store as a SecureString. Update the application to retrieve the password from Parameter Store.
Why wrong: Option B is plausible but not the best practice because Parameter Store does not support automatic rotation of RDS credentials; manual rotation is error-prone and may require downtime.
- D
Modify the security group to allow inbound traffic on port 5432 only from the private IP address of the application server. Rotate the password using the AWS CLI and store the new password in an encrypted file on the application server. Update the application to read the password from the encrypted file.
Why wrong: Option C is flawed because storing the password in a file, even encrypted, is not as secure as a managed service and manual rotation can lead to downtime.
Quick Answer
The correct approach is to modify the security group to allow inbound traffic on port 5432 only from the private IP address of the application server, and to store the database password in AWS Secrets Manager with automatic rotation, updating the application to retrieve it from there. This solution directly remediates the RDS PostgreSQL open security group by restricting access to a single trusted source, eliminating the 0.0.0.0/0 vulnerability, while Secrets Manager removes the plain text password exposure and enforces AWS best practices for credential lifecycle management. On the AWS Certified Database Specialty DBS-C01 exam, this scenario tests your understanding of combining network-level controls with secrets management to achieve zero-downtime remediation—a common trap is to suggest changing the password in the RDS console without updating the application, which would cause downtime. Remember the mnemonic "Lock the door, hide the key": lock the security group to a specific IP and hide the password in Secrets Manager with rotation enabled.
DBS-C01 Database Security Practice Question
This DBS-C01 practice question tests your understanding of database security. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A financial services company runs a critical application on Amazon RDS for PostgreSQL with Multi-AZ and automated backups enabled. The database stores sensitive customer data, and the security team recently audited the environment and found that the database master user password is stored in plain text in a configuration file on the application server. Additionally, the security team noted that the database security group allows inbound traffic from 0.0.0.0/0 on port 5432. The company needs to remediate these issues immediately without downtime and must ensure that access to the database is restricted to only the application servers, and that password management follows AWS best practices. The application connects to the database using the master user credentials. What should the database specialist do to meet these requirements?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue:
"best"Why it matters: Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
Clue:
"immediately / without restart"Why it matters: Time or reboot constraint — the correct answer must take effect right away without requiring a reboot or reload.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Modify the security group to allow inbound traffic on port 5432 only from the private IP address of the application server. Store the database password in AWS Secrets Manager and configure automatic rotation. Update the application to retrieve the password from Secrets Manager.
Option A is correct because it restricts inbound traffic to the application server's private IP address, which is the secure approach for traffic within AWS, and it uses AWS Secrets Manager to store the master password with automatic rotation, following AWS best practices for secrets management. This eliminates the plain-text password exposure and ensures no downtime by updating the application to retrieve credentials dynamically from Secrets Manager.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Modify the security group to allow inbound traffic on port 5432 only from the private IP address of the application server. Store the database password in AWS Secrets Manager and configure automatic rotation. Update the application to retrieve the password from Secrets Manager.
Why this is correct
Option A is correct because it addresses both the security group exposure and password management using AWS best practices (Secrets Manager with automatic rotation).
Clue confirmation
The clue words "best", "immediately / without restart" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
Modify the security group to allow inbound traffic on port 5432 only from the public IP address of the application server. Rotate the password using the AWS CLI and store the new password in an encrypted file on the application server. Update the application to read the password from the encrypted file.
Why it's wrong here
Option D is incorrect because using public IP is less secure and less reliable than private IP, and the password management is not best practice.
- ✗
Modify the security group to allow inbound traffic on port 5432 only from the private IP address of the application server. Rotate the master password by modifying the DB instance and store the new password in AWS Systems Manager Parameter Store as a SecureString. Update the application to retrieve the password from Parameter Store.
Why it's wrong here
Option B is plausible but not the best practice because Parameter Store does not support automatic rotation of RDS credentials; manual rotation is error-prone and may require downtime.
- ✗
Modify the security group to allow inbound traffic on port 5432 only from the private IP address of the application server. Rotate the password using the AWS CLI and store the new password in an encrypted file on the application server. Update the application to read the password from the encrypted file.
Why it's wrong here
Option C is flawed because storing the password in a file, even encrypted, is not as secure as a managed service and manual rotation can lead to downtime.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may confuse AWS Systems Manager Parameter Store SecureString with Secrets Manager, not realizing that Parameter Store lacks native automatic rotation for RDS master passwords, which is a key requirement for this scenario.
Detailed technical explanation
How to think about this question
AWS Secrets Manager integrates directly with Amazon RDS to automatically rotate credentials for master users without application downtime, using a Lambda function that updates both the secret and the RDS instance. In contrast, Parameter Store SecureString requires manual rotation or custom automation, and encrypted files on the application server introduce key management complexity and potential exposure if the decryption key is compromised. Using private IP addresses within a VPC ensures traffic never traverses the internet, reducing attack surface and aligning with security best practices for internal communication.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
Database Security — study guide chapter
Learn the concepts, then practise the questions
- →
Database Security practice questions
Targeted practice on this topic area only
- →
All DBS-C01 questions
1,730 questions across all exam domains
- →
AWS Certified Database Specialty DBS-C01 study guide
Full concept coverage aligned to exam objectives
- →
DBS-C01 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related DBS-C01 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Workload-Specific Database Design practice questions
Practise DBS-C01 questions linked to Workload-Specific Database Design.
Deployment and Migration practice questions
Practise DBS-C01 questions linked to Deployment and Migration.
Management and Operations practice questions
Practise DBS-C01 questions linked to Management and Operations.
Monitoring and Troubleshooting practice questions
Practise DBS-C01 questions linked to Monitoring and Troubleshooting.
Database Security practice questions
Practise DBS-C01 questions linked to Database Security.
DBS-C01 fundamentals practice questions
Practise DBS-C01 questions linked to DBS-C01 fundamentals.
DBS-C01 scenario practice questions
Practise DBS-C01 questions linked to DBS-C01 scenario.
DBS-C01 troubleshooting practice questions
Practise DBS-C01 questions linked to DBS-C01 troubleshooting.
Practice this exam
Start a free DBS-C01 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this DBS-C01 question test?
Database Security — This question tests Database Security — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Modify the security group to allow inbound traffic on port 5432 only from the private IP address of the application server. Store the database password in AWS Secrets Manager and configure automatic rotation. Update the application to retrieve the password from Secrets Manager. — Option A is correct because it restricts inbound traffic to the application server's private IP address, which is the secure approach for traffic within AWS, and it uses AWS Secrets Manager to store the master password with automatic rotation, following AWS best practices for secrets management. This eliminates the plain-text password exposure and ensures no downtime by updating the application to retrieve credentials dynamically from Secrets Manager.
What should I do if I get this DBS-C01 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "best", "immediately / without restart". Signals that multiple options may be partially correct. Choose the option that most directly solves the exact problem described, not the one that sounds most complete.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.