DBS-C01 Database Security Practice Question
A security administrator is setting up a new Amazon RDS for SQL Server database. The company requires that all data be encrypted at rest and in transit. Additionally, the database must be accessible only from a specific CIDR range. Which TWO actions should the administrator take? (Choose TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable encryption at rest using AWS KMS.
Enabling encryption at rest using AWS KMS is a straightforward way to meet the encryption-at-rest requirement for RDS. Option B: Configuring a security group to allow inbound traffic from the specific CIDR range restricts network access to the database. Option C is incorrect because encryption in transit is handled by the database engine (e.g., SSL/TLS) and is not an RDS option group feature; you enable it on the client side or by modifying the DB parameter group. Option D is incorrect because DB parameter groups do not control network access; they manage database engine parameters. Option E is incorrect because AWS KMS is the default service for RDS encryption at rest; CloudHSM is an alternative for key management but not required.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable encryption at rest using AWS KMS.
Why this is correct
Encryption at rest is a requirement.
- ✓
Configure a security group that allows inbound traffic from the specific CIDR range.
Why this is correct
Security groups act as a virtual firewall to restrict network access.
- ✗
Enable encryption in transit by modifying the RDS option group to include SSL.
Why it's wrong here
SSL is configured via the DB parameter group or client side, not the option group for SQL Server.
- ✗
Modify the DB parameter group to restrict network access.
Why it's wrong here
Parameter groups do not control network access.
- ✗
Use AWS CloudHSM to manage encryption keys for the database.
Why it's wrong here
RDS encryption at rest uses KMS; CloudHSM is not directly supported for RDS encryption at rest.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.