DBS-C01 Database Security Practice Question
A financial services company uses Amazon RDS for MySQL to store sensitive customer data. The compliance team requires that all database administrators (DBAs) must authenticate using IAM database authentication, and no static database passwords should be used. A junior DBA has been granted the rds_iam role in the database. However, the junior DBA is unable to connect using the AWS CLI command: aws rds generate-db-auth-token --hostname mydb.xyz.us-east-1.rds.amazonaws.com --port 3306 --username jdba. The error message says 'Access denied'. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The RDS instance does not have IAM database authentication enabled.
For IAM database authentication to work, the RDS instance must have the 'IAM DB authentication' setting enabled. If it is not enabled, the authentication token generated by `generate-db-auth-token` will be rejected with an 'Access denied' error. Option A is incorrect because RDS does not use resource-based policies; IAM policies are attached to users/roles. Option B is incorrect because SSL is required for IAM auth, but a missing SSL connection would result in a different error (e.g., 'SSL required'). Option C is incorrect because network issues would typically cause a timeout or connection refused, not an authentication error.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The RDS instance does not have a resource-based policy that grants the junior DBA access.
Why it's wrong here
RDS does not support resource-based policies for IAM auth; the IAM policy must be attached to the user or role.
- ✗
The junior DBA is not using an SSL connection to the database.
Why it's wrong here
IAM database authentication requires SSL, but the error would be about SSL handshake, not access denied.
- ✗
The security group does not allow inbound traffic on port 3306 from the junior DBA's IP address.
Why it's wrong here
A network connectivity issue would result in a timeout or connection refused, not 'Access denied'.
- ✓
The RDS instance does not have IAM database authentication enabled.
Why this is correct
Without IAM DB auth enabled on the instance, the authentication token is not accepted.
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.