DBS-C01 Database Security Practice Question
A security engineer is investigating an Amazon RDS for MySQL database that was compromised. The engineer finds that the compromise was due to a SQL injection vulnerability in a web application. The web application uses a database user with full administrative privileges. What is the BEST practice to prevent such incidents in the future?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create dedicated database users with minimal privileges required for each application function.
The best practice is to use dedicated database users with minimal privileges for each application function (Option A). This principle of least privilege limits the damage a SQL injection attack can cause because the compromised user cannot perform unauthorized actions beyond its specific scope. Option B is incorrect because the 'sql_mode' parameter can reject certain dangerous queries but does not address the root cause of excessive privileges and may not prevent all injection attacks. Option C is incorrect because audit logs only help detect incidents after they occur, not prevent them. Option D is incorrect because while placing the RDS instance in a private subnet and restricting inbound traffic reduces the network attack surface, it does not prevent SQL injection attacks that originate from the application itself; the vulnerability lies in how the application interacts with the database.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create dedicated database users with minimal privileges required for each application function.
Why this is correct
Least privilege ensures that even if compromised, the attacker has limited access.
- ✗
Configure the DB parameter group to use the 'sql_mode' option to reject dangerous queries.
Why it's wrong here
SQL mode settings can restrict some behaviors but are not a comprehensive solution for SQL injection.
- ✗
Enable RDS audit logs to capture all SQL queries.
Why it's wrong here
Audit logs help with detection and forensics, not prevention.
- ✗
Place the RDS instance in a private subnet with a security group that restricts inbound traffic.
Why it's wrong here
Network security reduces exposure but does not prevent SQL injection if the application is already allowed.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.