DBS-C01 Management and Operations Practice Question
A healthcare company runs a critical application on Amazon RDS for PostgreSQL with a Multi-AZ deployment. The database stores patient records and must comply with HIPAA regulations. Recently, a security audit revealed that the database is using the default port 5432 and that SSL connections are not enforced. The security team requires that all connections to the database use SSL and that the default port be changed to 5439 to reduce the risk of automated attacks. The database administrator needs to implement these changes with minimal downtime. What should the administrator do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the DB parameter group associated with the instance to set 'ssl' to '1' and 'port' to 5439. Reboot the instance to apply the changes.
Modifying the DB parameter group to require SSL (set 'ssl' to '1') and change the port to 5439, then rebooting the instance, applies the changes with minimal downtime (a few minutes). Option A is wrong because creating a new RDS instance and migrating with pg_dump involves significant downtime and complexity. Option B is wrong because updating security group inbound rules only controls network access, not database-level SSL enforcement; SSL must be enabled on the database itself. Option C is wrong because you cannot modify the default DB parameter group; you must use a custom parameter group, and changing the port requires a reboot.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a new RDS instance with the desired settings, migrate the data using pg_dump, and update the application connection string.
Why it's wrong here
Creating a new RDS instance and migrating with pg_dump introduces significant downtime during the data transfer and application cutover, which violates the minimal-downtime requirement; the correct approach uses in-place modification of the existing instance’s parameter group and security group to enforce SSL and change the port without rebuilding. This option is tempting because pg_dump is a standard migration tool for moving databases between instances, and it would be correct if the existing instance could not be altered in place or if a full version upgrade were needed.
- ✗
Update the security group inbound rules to only allow traffic on port 5439 and enforce SSL at the network level.
Why it's wrong here
Security group changes do not enforce SSL encryption at the database level.
- ✗
Modify the default DB parameter group to change the port and enable SSL, then apply it to the instance without a reboot.
Why it's wrong here
Default parameter groups cannot be modified; you must use a custom parameter group.
- ✓
Modify the DB parameter group associated with the instance to set 'ssl' to '1' and 'port' to 5439. Reboot the instance to apply the changes.
Why this is correct
Parameter changes require a reboot; this method has minimal downtime.
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.