Courseiva

CCNA Database Security Questions

75 of 310 questions · Page 2/5 · Database Security · Answers revealed

Practice these questionsDomain overviewAll questions
76
MCQeasy

A company is using Amazon DynamoDB and wants to ensure that all data is automatically encrypted at rest. What is the default encryption status for a new DynamoDB table?

A.Encryption is optional and can be enabled during table creation.
B.Encryption is disabled by default and must be enabled manually.
C.Encryption is enabled by default using an AWS-owned key.
D.Encryption is enabled by default using a customer-managed key.
AnswerC

Default encryption uses AWS-owned KMS keys.

Why this answer

All new DynamoDB tables are encrypted at rest by default using an AWS-owned key. Option A is wrong because encryption is not optional; it is always enabled by default. Option B is wrong because encryption is enabled by default, not disabled.

Option D is wrong because the default key is AWS-owned, not a customer-managed key.

Practice this question →
77
MCQeasy

A company wants to store database credentials for an Amazon RDS instance securely. Which AWS service should be used to rotate the credentials automatically?

A.AWS Secrets Manager
B.AWS CloudHSM
C.AWS Systems Manager Parameter Store
D.AWS IAM roles
AnswerA

Secrets Manager supports automatic rotation for RDS databases.

Why this answer

AWS Secrets Manager is the correct service because it can automatically rotate database credentials for Amazon RDS, simplifying credential management and improving security. AWS Systems Manager Parameter Store can store parameters but does not natively rotate RDS credentials. AWS IAM roles are used for authentication and authorization, not for storing credentials.

AWS CloudHSM provides hardware security module (HSM) for encryption key management, not credential storage or rotation.

Practice this question →
78
MCQhard

A company has an Amazon DynamoDB table with a global secondary index (GSI). The security team wants to ensure that only certain attributes are returned in query results based on the IAM policy of the calling user. What is the most secure and scalable approach?

A.Use an AWS Lambda function as a middleware to filter attributes before returning results.
B.Create multiple global secondary indexes that include only the allowed attributes for each user group.
C.Use IAM condition keys with 'dynamodb:Attributes' to restrict access to specific attributes.
D.Create a VPC endpoint for DynamoDB and attach a bucket policy that limits attribute access.
AnswerC

IAM policies can limit which attributes are returned in query results.

Why this answer

Using IAM condition keys with 'dynamodb:Attributes' allows fine-grained access control at the attribute level. This is the recommended way to restrict access to specific attributes. Option A is incorrect because using a Lambda middleware adds latency and complexity, and it is not the most secure or scalable approach compared to native IAM attribute-level conditions.

Option B is incorrect because creating multiple GSIs for attribute access would be costly and not scalable, and GSIs are not designed for attribute-level access control; they are for querying. Option D is incorrect because VPC endpoints do not control attribute access; they provide network-level security. A bucket policy is for S3, not DynamoDB.

Practice this question →
79
Multi-Selectmedium

A security engineer needs to restrict access to an Amazon DynamoDB table so that only users from a specific AWS account can read and write data. Which of the following can be used to achieve this? (Choose TWO.)

Select 2 answers
A.Use a VPC endpoint policy for DynamoDB.
B.Use a resource-based policy on the DynamoDB table.
C.Use an IAM policy with a condition key such as 'aws:SourceAccount'.
D.Use a security group to restrict access to the DynamoDB table.
E.Use an S3 bucket policy to allow access to the DynamoDB table.
AnswersA, C

VPC endpoint policies can restrict access to DynamoDB resources.

Why this answer

To restrict access to a DynamoDB table from a specific AWS account, you can use a VPC endpoint policy for DynamoDB (Option A) to control access through VPC endpoints, and an IAM policy with a condition key such as 'aws:SourceAccount' (Option C) to restrict API calls to those originating from the specified account. Option B is incorrect because DynamoDB does not support resource-based policies. Option D is incorrect because security groups are used for network-level access to EC2 instances, not DynamoDB.

Option E is incorrect because S3 bucket policies apply only to S3 resources, not DynamoDB.

Practice this question →
80
MCQeasy

A company is using Amazon DynamoDB to store user session data. The security team requires that all access to the table be authenticated and authorized using AWS IAM. Which mechanism should the developer use to achieve this?

A.Create a VPC endpoint for DynamoDB and allow only traffic from the VPC.
B.Use Amazon Cognito identity pools to grant access to the DynamoDB table.
C.Use IAM policies to grant permissions to the DynamoDB table.
D.Use a DynamoDB resource-based policy to restrict access.
AnswerC

Correct. IAM policies are the mechanism for authenticating and authorizing access to DynamoDB tables.

Why this answer

DynamoDB is integrated with AWS IAM for authentication and authorization. IAM policies can be attached to users, groups, or roles to grant specific permissions to DynamoDB tables. Option A is wrong because VPC endpoints provide network isolation but do not authenticate or authorize access.

Option B is wrong because Amazon Cognito identity pools are used for federated user authentication, not for direct IAM-based access to DynamoDB. Option D is wrong because DynamoDB does not support resource-based policies; access control is managed through IAM policies.

Practice this question →
81
Multi-Selectmedium

A company is using Amazon Aurora MySQL and needs to audit database logins. Which of the following can be used to capture login events? (Choose TWO.)

Select 2 answers
A.VPC Flow Logs
B.Database Activity Streams
C.Enhanced Monitoring
D.AWS CloudTrail
E.Aurora MySQL audit plugin
AnswersB, E

DAS captures database activity including logins.

Why this answer

Options B and E are correct. Database Activity Streams (DAS) in Amazon Aurora capture login events and other database activities. Additionally, the Aurora MySQL audit plugin can be enabled to log connections, including login attempts.

Option A (VPC Flow Logs) captures network traffic, not database logins. Option C (Enhanced Monitoring) captures OS-level metrics from the database host. Option D (AWS CloudTrail) records API calls made to AWS services, not database-level events.

Practice this question →
82
MCQmedium

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security policy requires that all connections to the database use SSL/TLS. What should the database administrator do to meet this requirement?

A.Download the RDS certificate bundle and set the 'rds.force_ssl' parameter to 1 in the DB parameter group.
B.Enable IAM database authentication for the DB instance.
C.Modify the DB instance security group to only allow traffic on port 443.
D.Set the DB instance to be publicly accessible and use a VPN connection.
AnswerA

This enforces SSL connections to the database.

Why this answer

To enforce SSL/TLS connections to Amazon RDS for Oracle, you must download the RDS certificate bundle and set the 'rds.force_ssl' parameter to 1 in the DB parameter group. This forces all connections to use SSL/TLS. Option B is incorrect because IAM database authentication controls access but does not enforce SSL encryption.

Option C is incorrect because security groups control network access at the instance level, not database-level encryption. Option D is incorrect because making the DB instance publicly accessible increases exposure and does not enforce SSL; a VPN encrypts traffic but SSL enforcement is still needed at the database level.

Practice this question →
83
MCQhard

A company uses Amazon DynamoDB with a global secondary index (GSI) and client-side encryption using the AWS Encryption SDK. The security team requires that the partition key and sort key be searchable by the application but not stored in plaintext in the table. Which approach should be taken?

A.Encrypt the entire item client-side and use a secondary index on the encrypted keys.
B.Use server-side encryption with a KMS key and enable DynamoDB Streams to decrypt on read.
C.Use client-side encryption to encrypt only the non-key attributes, leaving the partition and sort keys in plaintext.
D.Use DynamoDB encryption at rest with a customer-managed KMS key.
AnswerA

Correct. Deterministic encryption of the entire item, including keys, allows a GSI on the encrypted keys to be searchable without storing plaintext keys.

Why this answer

The requirement is to prevent partition and sort keys from being stored in plaintext while still allowing the application to search by them. Option A achieves this by using client-side deterministic encryption (supported by the AWS Encryption SDK) for the entire item, which encrypts the keys. Because the encryption is deterministic, the same plaintext key always produces the same ciphertext, so a global secondary index can be built on the encrypted key attributes.

The application encrypts the search key and queries the GSI using that encrypted value, enabling search without exposing plaintext keys. Option C leaves keys in plaintext, violating the requirement. Options B and D do not address client-side encryption and cannot prevent plaintext key storage in the database.

Exam trap

Candidates often assume that partition and sort keys must be stored in plaintext to be indexed, but deterministic encryption allows indexed attributes to be encrypted while still supporting equality searches via a GSI.

Practice this question →
84
MCQeasy

A database administrator needs to audit all SQL statements executed on an Amazon RDS for PostgreSQL DB instance. Which service should be used to capture and log the SQL statements?

A.AWS CloudTrail
B.AWS Config
C.Amazon Inspector
D.Amazon RDS for PostgreSQL database activity streams
AnswerD

Database activity streams provide a near real-time stream of database activities including SQL statements.

Why this answer

Amazon RDS for PostgreSQL supports database activity streams, which can be integrated with services like Amazon CloudWatch and AWS CloudTrail to provide a near real-time stream of database activities. The other options do not capture SQL statements: CloudTrail records API calls to RDS, Config records resource configuration changes, and Inspector is for vulnerability assessment.

Practice this question →
85
MCQeasy

A company is using Amazon RDS for MySQL with encryption at rest enabled. The security team wants to ensure that the database backups stored in Amazon S3 are also encrypted using a customer-managed KMS key. What should be done to meet this requirement?

A.Create a new KMS key and specify it when creating the DB instance to encrypt backups differently.
B.No additional action is required; RDS automatically uses the same KMS key for backups.
C.Modify the DB instance to enable backup encryption using a new KMS key.
D.Enable default encryption on the S3 bucket where backups are stored.
AnswerB

RDS automatically encrypts backups with the same key.

Why this answer

When encryption at rest is enabled for an RDS DB instance, RDS automatically encrypts automated backups, snapshots, and read replicas with the same KMS key used for the DB instance. No additional action is required. Option A is incorrect because you cannot specify a separate KMS key for backups; the key is inherited.

Option C is incorrect because you cannot modify the DB instance to enable backup encryption with a different key; it is automatically encrypted with the same key. Option D is incorrect because enabling S3 default encryption does not affect RDS backups, as RDS manages the backup storage and encryption directly.

Practice this question →
86
MCQhard

A financial services company uses Amazon DynamoDB to store sensitive customer data. The security team requires that all data at rest be encrypted using a customer-managed AWS KMS key (CMK) with automatic rotation enabled. The DynamoDB table was created with the default AWS-managed key. Which steps are necessary to transition to a customer-managed CMK while minimizing downtime and data loss?

A.Modify the DynamoDB table to update the encryption key to the new CMK using the AWS Console.
B.Export the table data to Amazon S3, create a new DynamoDB table with the new CMK, import the data, and update the application to use the new table.
C.Disable encryption at rest, then re-enable it with the new CMK.
D.Update the KMS key policy to grant DynamoDB access to the new CMK, then rotate the key.
AnswerB

This is the only way to change the encryption key, as DynamoDB does not allow in-place key changes.

Why this answer

DynamoDB does not support in-place modification of the encryption key for an existing table. To transition from an AWS-managed key to a customer-managed CMK, you must export the table data to Amazon S3, create a new DynamoDB table configured with the new CMK, import the data, and update the application to point to the new table. This approach minimizes downtime by allowing the original table to serve reads/writes during the export and import process, and avoids data loss by using DynamoDB's native export and import features.

Exam trap

The trap here is that candidates assume DynamoDB allows in-place encryption key changes (like some other AWS services), but DynamoDB requires a table recreation to change the encryption key, making the export/import workflow necessary.

How to eliminate wrong answers

Option A is wrong because the AWS Console does not allow modifying the encryption key of an existing DynamoDB table; encryption settings can only be set at table creation time. Option C is wrong because DynamoDB does not support disabling encryption at rest on an existing table; encryption is always enabled and cannot be toggled off or changed in place. Option D is wrong because updating the KMS key policy or rotating the key does not change the encryption key used by the table; the table continues to use the originally assigned key, and key rotation only affects future encryption operations, not the key used for existing data.

Practice this question →
87
MCQmedium

A database administrator needs to audit all SQL statements executed on an Amazon RDS for Oracle DB instance. The audit logs must be stored in Amazon S3 for long-term retention and analysis with Amazon Athena. Which solution meets these requirements?

A.Enable Enhanced Monitoring on the RDS instance and publish logs to CloudWatch Logs.
B.Configure Oracle's unified auditing and stream audit logs to CloudWatch Logs, then export to S3.
C.Enable AWS CloudTrail to capture RDS API calls and store them in S3.
D.Enable detailed billing reports and configure them to include database queries.
AnswerB

Oracle's unified auditing can be configured to stream audit logs to CloudWatch Logs, which can then be exported to Amazon S3 for long-term retention and analysis with Athena.

Why this answer

Oracle's unified auditing can be configured to stream audit logs to CloudWatch Logs, which can then be exported to Amazon S3 for long-term retention and analysis with Athena. Option A is incorrect because Enhanced Monitoring provides OS-level metrics, not SQL audit logs. Option C is incorrect because AWS CloudTrail captures API calls to RDS, not SQL statements executed within the database.

Option D is incorrect because detailed billing reports do not include database query logs.

Practice this question →
88
MCQmedium

Refer to the exhibit. An IAM policy is attached to a user. What is the effect when the user attempts to delete the RDS DB instance named 'prod-db'?

A.The user can delete any other instance except 'prod-db'.
B.The user can delete the instance because the Deny statement only applies to snapshots.
C.The user cannot delete the instance because of the explicit Deny statement.
D.The user can delete the instance because of the Allow on DescribeDBInstances.
AnswerC

Explicit Deny overrides Allow.

Why this answer

The policy explicitly denies the rds:DeleteDBInstance action on the specific resource. Even though there is an Allow on other actions, an explicit Deny overrides any Allow. The user cannot delete the instance.

Option A is wrong because the Deny takes precedence. Option B is wrong because the policy explicitly prevents deletion. Option D is wrong because the Deny is on the specific instance.

Practice this question →
89
MCQeasy

A company wants to encrypt an existing unencrypted Amazon RDS for PostgreSQL DB instance. What is the correct procedure?

A.Take a snapshot of the instance, create an encrypted copy of the snapshot, and restore the encrypted snapshot to a new DB instance.
B.Take a snapshot of the instance and restore it with encryption enabled.
C.Modify the DB instance and enable encryption in the RDS console.
D.Create a read replica of the instance and enable encryption on the replica.
AnswerA

This is the standard procedure to migrate to an encrypted instance.

Why this answer

Encryption for an existing unencrypted Amazon RDS for PostgreSQL DB instance cannot be enabled directly. The correct procedure is to take a snapshot of the instance, create an encrypted copy of that snapshot, and then restore the encrypted snapshot to a new DB instance. Option A accurately describes this process.

Option B is incorrect because restoring a snapshot does not allow enabling encryption during the restore; encryption must be applied at the time of snapshot copy. Option C is incorrect because you cannot modify a running DB instance to enable encryption. Option D is incorrect because creating a read replica does not encrypt the primary instance; encryption must be set up before replica creation.

Practice this question →
90
MCQhard

A database administrator has the IAM policy shown in the exhibit. Which action will be allowed by this policy?

A.Modify the prod-db instance.
B.Create a snapshot of the prod-db instance.
C.Delete the prod-db instance.
D.Describe all DB instances in the account.
AnswerB

Explicitly allowed.

Why this answer

The policy explicitly allows CreateDBSnapshot on the resource. Option A is denied. Option C is not in the policy.

Option D is not in the policy.

Practice this question →
91
Multi-Selecthard

A company uses Amazon Aurora MySQL-Compatible Edition. The security team wants to implement database activity streams to monitor database activity. Which THREE statements are true about Aurora database activity streams?

Select 3 answers
A.Activity streams can be started and stopped without restarting the database.
B.Activity streams are encrypted using a KMS key.
C.Activity streams automatically mask sensitive data in the logs.
D.Activity streams only capture DDL statements, not DML or SELECT.
E.Activity streams publish database activity to CloudWatch Logs and Kinesis Firehose.
AnswersA, B, E

Activity streams are started via the RDS console or API and do not require a restart.

Why this answer

Options A, B, and E are correct. Activity streams can be started and stopped without a database restart (A). They are encrypted using a KMS key (B).

They publish database activity to Amazon CloudWatch Logs and Amazon Kinesis Firehose (E). Option C is incorrect because activity streams do not automatically mask sensitive data; they capture the actual queries. Option D is incorrect because activity streams capture all SQL statements, including DDL, DML, and SELECT.

Practice this question →
92
MCQhard

A company needs to comply with PCI DSS requirements for an Amazon RDS for Oracle DB instance. The requirements include encryption of sensitive data at rest and in transit, and automated key rotation. Which combination of services and configurations should be used? (Select THREE.)

A.Use AWS CloudHSM to generate and store encryption keys.
B.Enable encryption at rest on the RDS instance using AWS KMS.
C.Use AWS Secrets Manager to automatically rotate database credentials.
D.Enable SSL/TLS for connections to the database.
E.Enable VPC Flow Logs to audit database connections.
AnswerB, C, D

Encryption at rest is required for PCI DSS.

Why this answer

Options B, C, and D are correct. Option B: Enable encryption at rest on the RDS instance using AWS KMS. Option C: Use AWS Secrets Manager to automatically rotate database credentials.

Option D: Enable SSL/TLS for connections to the database. Option A is incorrect because AWS CloudHSM is not required for key rotation; KMS can handle key rotation automatically. Option E is incorrect because VPC Flow Logs are for network traffic monitoring, not encryption.

Practice this question →
93
MCQhard

A security team needs to grant an IAM user permission to modify only the 'db_secrets' secret in AWS Secrets Manager. Which IAM policy statement is correct?

A.{ 'Effect': 'Allow', 'Action': 'secretsmanager:UpdateSecret', 'Resource': '*' }
B.{ 'Effect': 'Allow', 'Action': 'secretsmanager:*', 'Resource': '*' }
C.{ 'Effect': 'Allow', 'Action': 'secretsmanager:PutSecretValue', 'Resource': 'arn:aws:secretsmanager:us-east-1:123456789012:secret:*' }
D.{ 'Effect': 'Allow', 'Action': 'secretsmanager:PutSecretValue', 'Resource': 'arn:aws:secretsmanager:us-east-1:123456789012:secret:db_secrets-??????' }
AnswerD

This restricts to the specific secret and allows PutSecretValue.

Why this answer

It grants the specific `secretsmanager:PutSecretValue` action on the exact ARN of the `db_secrets` secret, including the required six-character random suffix (`-??????`) that AWS Secrets Manager appends to secret names. This ensures the IAM user can only modify that single secret, meeting the security requirement of least privilege.

Exam trap

The trap here is that candidates often forget the mandatory six-character random suffix in Secrets Manager ARNs and use only the secret name, leading them to choose a wildcard resource like option C, which grants unintended access to multiple secrets.

How to eliminate wrong answers

Option A is wrong because it uses a wildcard resource (`'*'`), which would allow modifying any secret in the account, violating the requirement to restrict access to only `db_secrets`. Option B is wrong because it allows all Secrets Manager actions (`secretsmanager:*`) on all resources, granting far too broad permissions, including deleting or creating secrets. Option C is wrong because the resource ARN uses a wildcard (`'*'`) instead of the specific secret name with its random suffix, which would match multiple secrets and not restrict to `db_secrets` alone.

Practice this question →
94
MCQhard

A company uses Amazon RDS for SQL Server with Multi-AZ deployment. The security team has mandated that all connections to the database must use SSL/TLS. The database is accessed by multiple applications running on EC2 instances. Which configuration ensures that all connections use SSL/TLS?

A.Modify the DB instance by enabling the 'Require SSL' option in the RDS console.
B.Set the parameter rds.force_ssl to 1 in the DB parameter group and revoke permissions from users that do not use SSL.
C.Set the parameter rds.force_ssl to 1 in the DB parameter group.
D.Configure the applications to use a certificate from a trusted certificate authority and connect using SSL.
AnswerC

Correct. Setting rds.force_ssl=1 in the DB parameter group enforces SSL/TLS for all connections to the RDS for SQL Server instance without any additional steps.

Why this answer

Setting the rds.force_ssl parameter to 1 in the DB parameter group enforces SSL/TLS for all connections to the RDS for SQL Server instance. No additional steps are needed; this parameter alone ensures that any connection attempt without SSL is rejected. Option B is incorrect because it includes an unnecessary step of revoking permissions from users that do not use SSL; the rds.force_ssl setting already forces SSL for all users and revoking permissions is redundant.

Option A is incorrect because the 'Require SSL' option does not exist in the RDS console; SSL enforcement is controlled via parameter group settings. Option D is incorrect because configuring applications to use a trusted certificate only addresses the client side; the server must also require SSL, which is achieved through the parameter group setting.

Practice this question →
95
MCQeasy

A developer retrieved a database secret using the AWS CLI as shown. What is the MOST secure way to store and rotate this secret?

A.Store the secret in AWS Secrets Manager and enable automatic rotation with a Lambda function.
B.Store the secret in AWS Systems Manager Parameter Store as a SecureString.
C.Store the secret in a configuration file on the EC2 instance.
D.Use the secret as-is and change it manually every 90 days.
AnswerA

Secrets Manager handles rotation securely.

Why this answer

Secrets Manager can automatically rotate secrets, and the secret should be retrieved using IAM permissions. Option B is insecure. Option C is not best practice.

Option D is not needed.

Practice this question →
96
MCQmedium

A company stores sensitive customer data in an Amazon S3 bucket. The data is accessed by an Amazon Redshift cluster using the COPY command. The security team wants to ensure that data is encrypted in transit between S3 and Redshift. Which configuration should be used?

A.Use a VPC endpoint for S3 with a bucket policy that denies HTTP.
B.Use the 'SSH' option in the COPY command to encrypt the transfer.
C.Use the 'ENCRYPTED' option with the COPY command and ensure the S3 bucket policy requires HTTPS.
D.Enable S3 server-side encryption on the bucket.
AnswerC

The 'ENCRYPTED' option forces the COPY command to use HTTPS encryption in transit.

Why this answer

The COPY command supports encryption in transit via HTTPS when using the 'ENCRYPTED' option or using an S3 endpoint that enforces HTTPS. Option A is wrong because S3 supports HTTPS, and specifying 'ENCRYPTED' is needed. Option B is wrong because the COPY command does not use SSH; it uses HTTPS.

Option D is wrong because S3 server-side encryption protects data at rest, not in transit.

Practice this question →
97
Multi-Selecthard

A company is running an Amazon RDS for SQL Server DB instance with Multi-AZ deployment. The security team wants to ensure that all data at rest is encrypted using a customer-managed key stored in AWS KMS. Which steps must be taken to achieve this? (Choose THREE.)

Select 3 answers
A.Modify the DB instance and enable encryption.
B.Enable Multi-AZ deployment to encrypt data at rest.
C.Copy the snapshot and specify encryption with a KMS key.
D.Create a manual snapshot of the existing DB instance.
E.Restore the DB instance from the encrypted snapshot.
AnswersC, D, E

Copying a snapshot allows you to enable encryption.

Why this answer

To encrypt an existing unencrypted RDS instance, you must create a manual snapshot (D), copy the snapshot with encryption using a KMS key (C), and then restore the DB instance from the encrypted snapshot (E). Option A is incorrect because you cannot enable encryption on an existing DB instance directly. Option B is incorrect because Multi-AZ deployment does not automatically encrypt data.

Practice this question →
98
MCQhard

A company is using Amazon DynamoDB Accelerator (DAX) for caching. The security team is concerned about data in transit between the application and DAX. What should the team do to ensure that all traffic to DAX is encrypted?

A.Launch the DAX cluster in a private subnet with a VPC endpoint.
B.Enable encryption in transit when creating the DAX cluster.
C.Use AWS Certificate Manager to issue a certificate for the DAX cluster.
D.Use client-side encryption to encrypt data before sending it to DAX.
AnswerB

DAX supports TLS encryption in transit when enabled at cluster creation.

Why this answer

DAX supports encryption in transit, which must be enabled when creating the cluster. Option A is incorrect because launching in a private subnet with a VPC endpoint does not encrypt traffic; it only provides private connectivity. Option C is incorrect because DAX manages its own encryption certificates and does not use AWS Certificate Manager.

Option D is incorrect because client-side encryption encrypts data at the application layer, but it does not ensure encryption in transit between the application and DAX; enabling encryption in transit on the DAX cluster is required.

Practice this question →
99
MCQhard

A company stores financial data in an Amazon Aurora MySQL DB cluster. The security team requires that database audit logs be stored in Amazon CloudWatch Logs and encrypted at rest using a customer-managed KMS key. The database specialist enables audit log publishing to CloudWatch Logs and specifies a KMS key for log encryption. However, the audit logs are not appearing in CloudWatch Logs. What is the most likely cause?

A.The CloudWatch Logs log group does not exist and RDS cannot create it automatically.
B.The DB cluster is not configured to export error logs, only audit logs.
C.The IAM role used for publishing logs does not have the necessary permissions to use the KMS key for CloudWatch Logs.
D.CloudWatch Logs does not support encryption with customer-managed KMS keys for audit logs.
E.The audit log parameter is static and requires a DB cluster reboot after modification.
AnswerC

The IAM role must have kms:Encrypt permission on the KMS key to allow log delivery.

Why this answer

When publishing database audit logs to CloudWatch Logs with a customer-managed KMS key, the IAM role used by RDS must have explicit permissions for the `kms:Encrypt` and `kms:Decrypt` actions on the KMS key. Without these permissions, RDS cannot encrypt the log stream, and the logs will not appear. Option C correctly identifies this missing permission as the most likely cause.

Exam trap

The trap here is that candidates often assume the issue is a missing log group or a static parameter, but the exam tests the nuanced requirement that the IAM role must have explicit KMS key permissions for log encryption to work.

How to eliminate wrong answers

Option A is wrong because RDS can automatically create the CloudWatch Logs log group when publishing is enabled; the log group does not need to pre-exist. Option B is wrong because the question specifically states audit logs are enabled, and the issue is that no logs appear at all, not that only error logs are missing. Option D is wrong because CloudWatch Logs fully supports encryption with customer-managed KMS keys for audit logs; this is a supported feature.

Option E is wrong because the audit log parameter (`server_audit_logging`) is dynamic and does not require a reboot; it takes effect immediately after modification.

Practice this question →
100
MCQeasy

A company runs an e-commerce application on AWS using an Aurora MySQL database cluster. The security team mandates that all database audit logs must be stored in Amazon S3 for at least one year for compliance. The database is currently configured to publish audit logs to Amazon CloudWatch Logs. The security team wants to use AWS Database Migration Service (DMS) to migrate the database to a new Aurora MySQL cluster, and during the migration, the audit logs must continue to be captured uninterrupted. Which solution meets these requirements with the LEAST operational overhead?

A.Enable Performance Insights on the source cluster and export the data to S3.
B.Create an Aurora MySQL read replica and enable audit logs on the replica, then migrate from the replica.
C.Use AWS CloudTrail to capture SQL queries and deliver them to S3.
D.Enable the Aurora MySQL advanced audit feature with file-based output, and configure the DMS task to use these log files as a source for ongoing replication.
AnswerD

The Aurora MySQL advanced audit feature can write audit logs to files by setting `aurora_audit_log_type` to `FILE`. These files can be uploaded to S3, and DMS can read them as a source for ongoing replication, ensuring uninterrupted audit log capture with minimal operational overhead.

Why this answer

Enabling the Aurora MySQL advanced audit feature allows audit logs to be output to files on the DB instance. These files can then be exported to Amazon S3 (e.g., via a scheduled script or Lambda function) for compliance. During the DMS migration, change data capture is handled by binary logs, not audit logs, so the audit logging remains uninterrupted.

This approach minimizes operational overhead by using the built-in audit feature and a simple export mechanism, without requiring additional services like CloudTrail or Performance Insights.

Exam trap

The trap here is that candidates may confuse CloudTrail (which logs AWS API calls) with database-level audit logging, or assume that a read replica can seamlessly inherit and forward audit logs from the source, when in fact it only logs its own activity.

How to eliminate wrong answers

Option A is wrong because Performance Insights provides performance metrics, not database audit logs, and cannot export SQL audit data to S3. Option B is wrong because creating a read replica and enabling audit logs on it would not capture audit logs from the source cluster during migration; the replica only logs its own activity, and the migration from the replica would still require uninterrupted audit capture from the source. Option C is wrong because CloudTrail captures AWS API calls (e.g., RDS management actions), not SQL queries or database-level audit logs, so it cannot fulfill the requirement to store database audit logs.

Practice this question →
101
MCQeasy

A company wants to restrict access to an Amazon RDS for MySQL DB instance so that only applications running in a specific VPC can connect. Which solution should be implemented?

A.Use an IAM policy to restrict database connections based on source IP.
B.Configure the DB instance's security group to allow inbound traffic only from the application's security group.
C.Configure the subnet's network ACL to allow inbound traffic only from the application's IP range.
D.Attach a security group to the subnet that allows inbound traffic from the application's VPC.
AnswerB

Security groups can reference other security groups.

Why this answer

Security groups act as a virtual firewall for the DB instance, and by allowing inbound traffic only from the application's security group, access is restricted to resources in that VPC. Option A is incorrect because IAM policies control API-level permissions, not network-level access. Option C is incorrect because network ACLs are stateless and apply at the subnet level, not at the instance level.

Option D is incorrect because security groups are not attached to subnets; they are attached to network interfaces.

Practice this question →
102
MCQhard

A database administrator is troubleshooting connectivity to an Amazon RDS for MySQL DB instance. The application is running on an EC2 instance in the same VPC and security group. The application can connect using the endpoint shown in the exhibit. However, the security team requires that all connections be encrypted using SSL. The DBA has enabled SSL on the DB instance and modified the parameter group to set require_secure_transport to ON. The application is now failing to connect. What is the most likely cause?

A.The DB instance endpoint is not resolving to the correct IP address.
B.The database user account does not have the SSL privilege granted.
C.The application's JDBC connection string does not include SSL parameters such as useSSL=true.
D.The security group does not allow inbound traffic on port 3307, which is used for SSL connections.
AnswerC

The application must explicitly request SSL connections; otherwise, the server rejects the connection.

Why this answer

When require_secure_transport is set to ON, the database server rejects non-SSL connections. The application must be configured to use SSL by adding the useSSL=true and requireSSL=true parameters to the JDBC connection string. Option A is incorrect because the application could connect before SSL was enforced, indicating that DNS resolution was working.

Option B is incorrect because the server enforces SSL at the transport level, and no separate SSL privilege is needed for the user account. Option D is incorrect because SSL connections use the same port as non-SSL (3306 for MySQL), and the security group was already configured to allow traffic on that port.

Practice this question →
103
MCQmedium

A company uses Amazon RDS for PostgreSQL and needs to ensure that only specific IP addresses can connect to the database. Which configuration should be used?

A.Configure the DB subnet group to allow only specific IP addresses.
B.Set the rds.force_ssl parameter in the DB parameter group.
C.Create an IAM policy that restricts access to the RDS API based on source IP.
D.Modify the VPC security group associated with the DB instance to allow inbound traffic only from specific IP addresses.
AnswerD

Security groups act as a virtual firewall and can restrict inbound traffic based on IP addresses.

Why this answer

VPC security groups act as a virtual firewall that controls inbound and outbound traffic to the DB instance. By modifying the security group to allow inbound traffic only from specific IP addresses, you restrict database access to those IPs. Option A is incorrect because DB subnet groups define which subnets the RDS instance can reside in, not IP filtering.

Option B is incorrect because the rds.force_ssl parameter enforces SSL connections, not IP restrictions. Option C is incorrect because IAM policies control permissions to AWS API actions, not network-level access to the database.

Practice this question →
104
Multi-Selecthard

A company is using Amazon Redshift for analytics. The security team wants to audit all SQL queries executed against the database, including the actual query text, for compliance. They also want to ensure that the audit logs are stored in a secure, immutable location. Which THREE services or features should they use together to meet these requirements?

Select 3 answers
A.Redshift Audit Logging
B.VPC Flow Logs
C.Amazon CloudWatch Logs
D.Redshift Spectrum
E.S3 Object Lock
AnswersA, C, E

Captures SQL query logs.

Why this answer

Options A, C, and E are correct. Redshift Audit Logging captures SQL queries. CloudWatch Logs can be used as a destination for audit logs (via streaming).

Then, CloudWatch Logs can export logs to S3, and S3 Object Lock provides immutability. Option B is for performance, not auditing. Option D is for network monitoring.

Practice this question →
105
MCQmedium

A company uses Amazon ElastiCache for Redis and needs to encrypt data in transit between the application and the cache cluster. Which feature should be enabled?

A.Enable encryption in transit on the replication group.
B.Enable encryption at rest.
C.Use AWS KMS customer master keys.
D.Configure the VPC security group to allow only HTTPS traffic.
AnswerA

ElastiCache for Redis supports TLS encryption for data in transit.

Why this answer

Amazon ElastiCache for Redis supports encryption in transit using TLS (Transport Layer Security) when enabled on the replication group. This ensures data is encrypted between the application and the cache cluster. Option B is incorrect because encryption at rest protects data stored on disk, not data in transit.

Option C is incorrect because AWS KMS customer master keys are used for encryption at rest, not for transit encryption. Option D is incorrect because VPC security groups control network access at the IP/port level, not encryption; allowing HTTPS traffic does not enable encryption for ElastiCache communication.

Practice this question →
106
MCQhard

A financial services company is using Amazon DynamoDB to store customer transaction data. The compliance team requires that all data be encrypted at rest using a customer-managed AWS KMS key, and that access to the key be auditable via AWS CloudTrail. Additionally, the security team wants to ensure that DynamoDB can only be accessed from within the VPC using a VPC endpoint. Which combination of steps should the company take to meet these requirements?

A.Use a CloudHSM key for encryption and create a VPC peering connection to DynamoDB.
B.Enable server-side encryption with a customer-managed KMS key and route all traffic through a NAT gateway.
C.Enable server-side encryption with a customer-managed KMS key and create an interface VPC endpoint for DynamoDB.
D.Use AWS managed KMS key and a gateway VPC endpoint for DynamoDB.
AnswerC

Correct. Customer-managed KMS key meets encryption requirement; interface VPC endpoint ensures private VPC-only access.

Why this answer

Option C. To meet the encryption requirement, the company must use a customer-managed KMS key, not an AWS managed key. For VPC-only access, DynamoDB supports interface VPC endpoints (via AWS PrivateLink), which provide private connectivity.

Option C correctly uses a customer-managed KMS key and an interface VPC endpoint. Option D is incorrect because it uses an AWS managed KMS key. Option A is incorrect because CloudHSM is unnecessary and VPC peering is not the correct method.

Option B is incorrect because a NAT gateway still routes traffic over the internet.

Exam trap

A common trap is assuming that DynamoDB only supports gateway VPC endpoints. DynamoDB also supports interface VPC endpoints, providing private connectivity within the VPC. Also, ensure the KMS key is customer-managed for full control and auditing.

Practice this question →
107
Multi-Selectmedium

A company is using Amazon Redshift and needs to encrypt data at rest with a customer-managed key. Which TWO steps are required to enable encryption with a customer-managed AWS KMS key?

Select 2 answers
A.Create a customer-managed key in AWS KMS.
B.Specify the KMS key when creating the Redshift cluster.
C.Use the AWS CLI to modify the cluster to enable encryption.
D.Configure the Redshift cluster to use an HSM.
E.Request AWS Support to enable encryption.
AnswersA, B

Correct. A customer-managed KMS key must be created to control access to the encryption key.

Why this answer

Options A and B are correct. To enable encryption with a customer-managed AWS KMS key, you must first create a customer-managed KMS key (A) and then specify that KMS key when creating a new Redshift cluster (B). Option C is incorrect because you cannot modify an existing unencrypted Redshift cluster to enable encryption; encryption must be set at cluster creation or by restoring from an encrypted snapshot.

Option D is incorrect because Redshift encryption with KMS does not require an HSM. Option E is incorrect because AWS Support cannot enable encryption; it must be performed by the customer via the AWS Management Console, CLI, or API.

Exam trap

Encryption must be enabled at cluster creation or by restoring from an encrypted snapshot; it cannot be added to an existing unencrypted cluster.

Practice this question →
108
MCQmedium

A company is using Amazon Redshift for data warehousing. The security team requires that all data be encrypted at rest using a customer-managed AWS KMS key. Additionally, the team wants to ensure that the key must be used only for this specific Redshift cluster. Which configuration should be applied?

A.Create a new KMS key and associate it with the Redshift cluster's subnet group.
B.Create a new KMS key with a key policy that grants access only to the Redshift cluster's IAM role.
C.Use the default AWS managed KMS key for Redshift.
D.Use an HSM-backed key from CloudHSM.
AnswerB

KMS key can be restricted to a specific role used by Redshift.

Why this answer

To enforce encryption at rest with a customer-managed AWS KMS key and restrict key usage to a specific Redshift cluster, you create a new KMS key and configure its key policy to grant encrypt/decrypt permissions only to the IAM role associated with the Redshift cluster. This ensures the key is only used by that cluster. Option A is incorrect because associating a key with a subnet group does not limit usage to the cluster; key policies control access.

Option C is incorrect because the default AWS managed key is not customer-managed. Option D is incorrect because CloudHSM keys are not directly used with Redshift; KMS is the required service for integration.

Practice this question →
109
Drag & Dropmedium

Arrange the steps to troubleshoot a connection timeout issue from an EC2 instance to an Amazon RDS for SQL Server DB instance in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Troubleshooting connectivity involves checking security groups, network ACLs, network configuration, and testing with telnet.

Practice this question →
110
MCQhard

A financial services company uses Amazon DynamoDB to store transaction records. The security team requires that all items be encrypted at rest using a customer-managed AWS KMS key. Additionally, the company must be able to audit key usage and rotation. What is the MOST secure and auditable approach?

A.Enable default encryption on the DynamoDB table using SSE-S3.
B.Use SSE-KMS with a customer-managed key and manually rotate the key every 90 days.
C.Use SSE-KMS with a customer-managed key, enable automatic key rotation, and enable CloudTrail data events for the key.
D.Use client-side encryption with the AWS Encryption SDK.
AnswerC

SSE-KMS with customer-managed key and automatic rotation, combined with CloudTrail data events, meets the requirements for control and audit.

Why this answer

Using a customer-managed KMS key with automatic annual rotation and enabling CloudTrail logging of key usage provides encryption control and auditing. Option A is wrong because SSE-S3 does not provide customer control or audit. Option B is wrong because manual rotation is less secure and auditable than automatic rotation.

Option D is wrong because client-side encryption would require managing encryption keys on the client side, which does not leverage the AWS KMS infrastructure for automatic key rotation and auditing, and is not as integrated or auditable as server-side encryption with KMS.

Practice this question →
111
MCQhard

A company uses Amazon DynamoDB to store sensitive user data. The security team wants to ensure that all data is encrypted at rest using a customer-managed AWS KMS key. The DynamoDB table was created with the default AWS managed key. What is the required action to change the encryption key?

A.Use the UpdateTable API to specify the new KMS key.
B.Create a new DynamoDB table with the desired KMS key, export data from the old table, and import into the new table.
C.Enable automatic key rotation on the existing KMS key.
D.Delete the default AWS managed key and create a new customer managed key.
AnswerB

Encryption key can only be set at table creation.

Why this answer

DynamoDB does not allow changing the encryption key on an existing table. To use a customer-managed KMS key, you must create a new table with the desired key, export data from the old table, and import it into the new table. Option A is incorrect because the UpdateTable API does not support changing the encryption key.

Option C is incorrect because enabling automatic key rotation on the existing KMS key does not change the key used by DynamoDB; it rotates the key material but the table still uses the same key ID. Option D is incorrect because deleting the default AWS managed key would break encryption for any tables using it, and it does not allow you to change the key for the existing table.

Practice this question →
112
MCQeasy

A startup is using Amazon RDS for MySQL as its primary database. The database contains user profiles and payment information. The security team wants to ensure that database snapshots are encrypted and that the encryption key is managed by the company. The team also wants to enforce that all future snapshots are encrypted automatically. The current RDS instance is not encrypted. What should they do?

A.Enable encryption on the existing RDS instance by modifying the DB instance.
B.Create a new encrypted RDS instance, migrate the data, and point the application to the new instance.
C.Use AWS KMS to encrypt the underlying EBS volumes of the RDS instance.
D.Take a snapshot of the current instance, copy it with encryption enabled, and restore from the encrypted snapshot.
AnswerB, D

Correct. Creating a new encrypted RDS instance and migrating data is a valid approach to achieve encryption.

Why this answer

For an unencrypted RDS instance, you cannot enable encryption directly. You have two valid options: either create a new encrypted instance and migrate the data (Option B), or take a snapshot, copy it with encryption enabled, and restore from that encrypted snapshot (Option D). Both methods result in an encrypted instance.

Option D is often simpler and faster. Option A is incorrect because encryption cannot be enabled on an existing instance. Option C is incorrect because RDS encryption is not applied at the EBS volume level; it is managed at the instance level.

Practice this question →
113
MCQmedium

An IAM policy is shown in the exhibit. What is the effect of this policy when a user tries to create an unencrypted RDS DB instance?

A.The user is denied from creating the unencrypted instance because of the Deny statement.
B.The user is allowed to create the unencrypted instance because the Deny statement is not valid.
C.The user is denied from creating any DB instance because of an implicit deny.
D.The user is allowed to create the unencrypted instance because of the Allow statement.
AnswerA

The Deny statement explicitly denies creation when encryption is false.

Why this answer

The IAM policy includes an Allow statement for 'rds:CreateDBInstance' and a Deny statement with a condition 'rds:StorageEncrypted=false'. When the user attempts to create an unencrypted RDS instance, the Deny statement explicitly denies the action because the condition is met (encryption is not enabled). Explicit Deny always overrides any Allow, so the user is denied.

Option B is incorrect because the Deny statement is valid under IAM policy evaluation logic. Option C is incorrect because the Deny is explicit, not implicit, and only applies to unencrypted instances, not all DB instances. Option D is incorrect because the Deny explicitly overrides the Allow for unencrypted instances.

Practice this question →
114
Multi-Selecthard

Which THREE of the following are best practices for securing an Amazon DynamoDB table? (Select THREE.)

Select 3 answers
A.Enable point-in-time recovery (PITR) to protect against accidental writes or deletes.
B.Enable encryption at rest using AWS KMS.
C.Enable public access to the table to allow easy data sharing.
D.Use IAM policies to restrict access to the table based on the principle of least privilege.
E.Limit the maximum item size to 100 KB to reduce storage costs.
AnswersA, B, D

PITR allows restoring to any point within the last 35 days.

Why this answer

Options A, B, and D are correct. Point-in-time recovery (PITR) protects against accidental writes or deletes by allowing you to restore the table to any point within the last 35 days. Encryption at rest using AWS KMS secures data at rest.

IAM policies based on least privilege restrict access to only necessary actions and resources. Option C (public access) is not a best practice; DynamoDB tables are private by default and should not be exposed publicly. Option E (limiting item size) is a performance consideration, not a security best practice.

Practice this question →
115
MCQhard

A company hosts a critical application on Amazon RDS for PostgreSQL. The security team requires that all database connections be encrypted in transit. Which configuration step is necessary?

A.Create a VPN connection between the application and the database.
B.Set the rds.force_ssl parameter to 1 in the DB parameter group.
C.Modify the security group to allow only port 5432 from the application.
D.Enable encryption at rest using AWS KMS.
AnswerB

Setting rds.force_ssl to 1 in the DB parameter group enforces SSL/TLS for connections.

Why this answer

Enforcing SSL/TLS for connections is required for encryption in transit. Option B is correct. Option A is wrong because a VPN encrypts network traffic but does not enforce database-level SSL.

Option C is wrong because modifying security group rules to allow only port 5432 does not encrypt connections. Option D is wrong because enabling encryption at rest does not encrypt data in transit.

Practice this question →
116
Multi-Selecthard

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all database connections use SSL and that the database is encrypted at rest. Which THREE steps are required to meet these requirements? (Choose THREE.)

Select 3 answers
A.Upload a custom SSL certificate to the RDS instance.
B.Install the SSL certificate on every client machine.
C.Modify the DB parameter group to set 'require_ssl' to 'true'.
D.Download the RDS SSL certificate and configure the application to trust it.
E.Enable encryption at rest when creating the RDS instance.
AnswersC, D, E

This enforces SSL connections.

Why this answer

To meet the requirements, three steps are needed. First, enable encryption at rest by selecting the encryption option when creating the RDS instance (option E). Second, to enforce SSL connections, modify the DB parameter group to set require_ssl to true (option C).

Third, download the RDS SSL certificate from AWS and configure the application to trust it (option D). Options A and B are incorrect because you cannot upload a custom SSL certificate to RDS, and the certificate must be trusted by the application, not necessarily installed on every client machine individually.

Practice this question →
117
MCQmedium

A company is using Amazon RDS for MySQL with encryption at rest enabled. The security team requires that all access to the database be authenticated using IAM database authentication. Which combination of steps must the company take to meet this requirement?

A.Create an IAM role with a policy that allows rds:Connect and attach it to the RDS instance.
B.Create a database user with a password and attach an IAM role that allows rds-db:connect to the database user.
C.Enable SSL on the RDS instance and create an IAM policy that allows rds:Connect.
D.Create an IAM policy that allows the rds-db:connect action and map the IAM role to a database user created with the AWSAuthenticationPlugin.
AnswerD

This is the correct procedure for IAM database authentication with RDS MySQL.

Why this answer

IAM database authentication for Amazon RDS MySQL requires creating an IAM policy that allows the rds-db:connect action, then mapping that IAM role/entity to a database user created with the AWSAuthenticationPlugin. This enables authentication via IAM credentials instead of a password. Option A is incorrect because rds:Connect is not a valid action; the correct action is rds-db:connect, and the IAM role is not attached to the RDS instance but mapped to a database user.

Option B is incorrect because IAM database authentication does not use passwords; the database user must be created with AWSAuthenticationPlugin, not with a password. Option C is incorrect because SSL is not required for IAM database authentication, though it is recommended for encryption in transit; also, the correct action is rds-db:connect, not rds:Connect.

Practice this question →
118
MCQhard

A company uses Amazon Redshift for data warehousing. The security team has implemented column-level security using Redshift's column-level access controls. However, during a security audit, it is discovered that a user with SELECT privilege on a table can still see the content of a column that should be restricted. The column is defined with a GRANT statement that only allows SELECT on certain columns to specific users. What is the most likely cause of this issue?

A.The column is part of a distribution key that bypasses security controls.
B.The user is accessing the table via a stored procedure that bypasses column-level security.
C.The column-level security is not supported in Redshift; it must be implemented using views.
D.The user was previously granted SELECT on the entire table, and the column-level GRANT did not revoke that broader permission.
AnswerD

Column-level GRANTs are additive; they do not remove existing table-level permissions.

Why this answer

Column-level GRANTs in Redshift do not revoke existing table-level permissions. If a user was previously granted SELECT on the entire table, that permission remains even after a column-level GRANT is applied. To restrict access, the table-level SELECT must be revoked first, then column-level GRANTs can be applied to specific columns.

Option A is incorrect because distribution keys do not bypass column-level security. Option B is incorrect because stored procedures inherit the caller's permissions and do not bypass column-level security. Option C is incorrect because Redshift does support column-level security via GRANT statements.

Practice this question →
119
Multi-Selecthard

Which THREE components are required to set up IAM database authentication for an Amazon RDS for MySQL DB instance? (Choose three.)

Select 3 answers
A.An IAM role that the application can assume.
B.An AWS KMS key to encrypt the authentication token.
C.A database user that is mapped to the IAM role.
D.A DB parameter group with require_secure_transport set to ON.
E.An RDS Proxy to manage connections.
AnswersA, C, D

The application assumes the IAM role to get authentication tokens.

Why this answer

The three required components for setting up IAM database authentication for an Amazon RDS for MySQL DB instance are: (A) an IAM role that the application can assume to retrieve an authentication token from IAM; (C) a database user that is mapped to the IAM role in the RDS MySQL database; and (D) a DB parameter group with `require_secure_transport` set to ON to enforce SSL/TLS connections, which are mandatory for IAM authentication. Option B (AWS KMS key) is not required because the authentication token is signed by IAM, not encrypted with KMS. Option E (RDS Proxy) is optional and not a requirement; while it can provide connection pooling, it is not needed to set up IAM authentication itself.

Practice this question →
120
MCQeasy

A company is using Amazon RDS for SQL Server with Multi-AZ deployment. The security team wants to ensure that database audit logs are stored in a secure S3 bucket for long-term retention. The audit logs are currently stored on the RDS instance. Which approach should be used to export the audit logs to S3?

A.Use the Amazon RDS for Oracle 'Audit' feature and specify an S3 bucket as the audit trail destination.
B.Modify the RDS instance to use the 'SQLSERVER_AUDIT' option and specify an S3 bucket as the audit destination.
C.Enable the 'General Log' option in the RDS parameter group and configure the log destination as S3.
D.Configure the RDS instance to publish logs to CloudWatch Logs, and then export CloudWatch Logs to S3 using a subscription filter.
AnswerB

RDS for SQL Server supports this option group for exporting audit logs to S3.

Why this answer

RDS for SQL Server provides the 'SQLSERVER_AUDIT' option to export audit logs directly to an S3 bucket. This option is configured in the RDS option group and allows specifying the S3 bucket as the destination. Option A is incorrect because it refers to Oracle's 'Audit' feature, not SQL Server.

Option C is incorrect because the 'General Log' is for MySQL/MariaDB and does not apply to SQL Server audit logs. Option D, while feasible, is not the most direct or recommended approach for exporting audit logs to S3; exporting via CloudWatch Logs adds complexity and latency compared to the native 'SQLSERVER_AUDIT' option.

Practice this question →
121
Multi-Selecthard

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The security team wants to audit all database logins and queries. Which TWO actions should be taken to enable auditing?

Select 2 answers
A.Enable AWS CloudTrail data events for RDS.
B.Create an RDS event notification subscription.
C.Publish MySQL logs to Amazon CloudWatch Logs.
D.Set the general_log parameter to 1.
E.Enable Enhanced Monitoring.
AnswersC, D

Correct because it allows analysis of database logs.

Why this answer

Options C and D are correct. Setting the general_log parameter to 1 (D) captures all queries, and publishing MySQL logs to CloudWatch Logs (C) allows analysis. Option A is wrong because AWS CloudTrail data events capture API calls to RDS, not database queries.

Option B is wrong because event notifications are for instance events, not queries. Option E is wrong because Enhanced Monitoring provides OS-level metrics, not query logs.

Practice this question →
122
MCQmedium

A security engineer needs to ensure that all access to an Amazon DynamoDB table is encrypted in transit. Which configuration achieves this?

A.Configure a VPC endpoint for DynamoDB and enable encryption.
B.Ensure all client applications use the DynamoDB HTTPS endpoint.
C.Place the DynamoDB table behind Amazon CloudFront.
D.Enable SSL on the DynamoDB table by setting the 'ssl_enabled' parameter.
AnswerB

All DynamoDB requests must be made over HTTPS; this is the only way to encrypt data in transit.

Why this answer

DynamoDB uses HTTPS for all API calls by default, ensuring encryption in transit. Option A is incorrect because configuring a VPC endpoint does not enable encryption; it provides private connectivity, but encryption in transit is already handled by HTTPS. Option C is incorrect because placing DynamoDB behind CloudFront is not a valid configuration; CloudFront is a CDN for content delivery, not for securing database access.

Option D is incorrect because DynamoDB does not have an 'ssl_enabled' parameter; encryption in transit is always enforced via HTTPS.

Practice this question →
123
MCQeasy

A company is using Amazon RDS for PostgreSQL and needs to ensure that all connections to the database use encryption in transit. The database is accessible over the internet. Which configuration is required?

A.Restrict the security group to only allow traffic from trusted IP addresses.
B.Modify the DB instance to use a custom port 443 instead of 5432.
C.Set the rds.force_ssl parameter to 1 and configure the client to use the AWS RDS SSL certificate.
D.Use a self-signed certificate on the server and configure the client to trust it.
AnswerC

This enforces SSL connections.

Why this answer

To enforce encryption in transit for Amazon RDS for PostgreSQL, you must set the `rds.force_ssl` parameter to 1 in the DB parameter group. Additionally, clients need to be configured to use the AWS RDS SSL certificate (downloaded from AWS) to establish a secure connection. Option A is incorrect because security groups only control network traffic based on IP addresses, they do not enforce encryption.

Option B is incorrect because changing the port to 443 does not enforce SSL; SSL is enforced through parameter settings and client configuration. Option D is incorrect because while a self-signed certificate could technically be used, the recommended and simpler method is to use the AWS-provided SSL certificate, especially since clients need to trust the certificate authority.

Practice this question →
124
Multi-Selecthard

A company is designing a security architecture for Amazon DynamoDB. They need to ensure that only authorized applications can access the data, and that data in transit is encrypted. Which THREE steps should be taken? (Choose THREE.)

Select 3 answers
A.Use a customer-managed KMS key to encrypt data in transit.
B.Attach an IAM policy that grants access only to specific IAM roles or users.
C.Use an AWS PrivateLink VPC endpoint to access DynamoDB from within a VPC.
D.Configure a security group to restrict inbound traffic to the DynamoDB table.
E.Use HTTPS (TLS) for all API calls to DynamoDB.
AnswersB, C, E

IAM policies control access to DynamoDB.

Why this answer

The correct answers are B, C, and E. IAM policies ensure only authorized principals can access DynamoDB. AWS PrivateLink VPC endpoints keep traffic within the AWS network, enhancing security.

HTTPS (TLS) encrypts data in transit, which is required for confidentiality. Option A is incorrect because KMS keys are for encryption at rest, not in transit. Option D is incorrect because security groups are associated with network interfaces, not DynamoDB tables; they can be used with VPC endpoints but not directly on the table.

Practice this question →
125
MCQmedium

A company is using Amazon RDS for Oracle with Transparent Data Encryption (TDE) enabled. They need to rotate the TDE master key. What is the correct procedure?

A.Use Oracle's ALTER SYSTEM SET ENCRYPTION KEY command to rotate the key.
B.Use the AWS KMS RotateKey operation to rotate the customer master key (CMK) that is used for TDE.
C.Create a new encrypted RDS instance and migrate the data.
D.Modify the DB instance to use a new KMS key.
AnswerB

KMS key rotation is the supported method for TDE key rotation.

Why this answer

In Amazon RDS for Oracle with TDE, the master key is stored in AWS KMS. To rotate the TDE master key, you can call the AWS KMS RotateKey operation on the customer master key (CMK) used for TDE, or use the Amazon RDS procedure rds.rds_rotate_tde_key. Option B is correct.

Option A is incorrect because Oracle's ALTER SYSTEM SET ENCRYPTION KEY command rotates the Oracle-internal master key, not the KMS CMK, and RDS does not support direct Oracle TDE key rotation. Option C is incorrect because full migration is unnecessary. Option D is incorrect because modifying the DB instance to use a new KMS key changes the key, but does not rotate the existing TDE key.

Practice this question →
126
MCQmedium

A company is migrating an Oracle database to Amazon RDS for Oracle. Security policy requires that all database connections be encrypted in transit. The security team wants to enforce that clients must use TLS 1.2 or higher. How can this be achieved?

A.Modify the DB subnet group to only allow traffic from specific IP ranges.
B.Create an IAM policy that denies access unless the connection uses TLS.
C.Set the require_secure_transport parameter to ON in the DB parameter group.
D.Set the rds.force_ssl parameter to 1 in the DB parameter group.
AnswerD

Correct. Setting rds.force_ssl to 1 requires SSL/TLS encryption for all connections, enforcing TLS 1.2 or higher.

Why this answer

Amazon RDS for Oracle supports SSL/TLS encryption, and setting the rds.force_ssl parameter to 1 in the DB parameter group enforces SSL connections, which ensures all connections use TLS 1.2 or higher (as per Oracle's implementation). Option A is incorrect because modifying the DB subnet group controls network-level access, not encryption requirements. Option B is incorrect because IAM policies cannot enforce encryption in transit at the database level; they can only control authentication and authorization.

Option C is incorrect because require_secure_transport is a MySQL parameter, not applicable to Oracle.

Practice this question →
127
MCQhard

A KMS key has the grant shown. An IAM role named AdminRole is the grantee. What additional permission does this grant provide to AdminRole beyond what the role's IAM policy allows?

A.The role can use the key to encrypt and decrypt, regardless of its IAM policy.
B.The role can use the key to encrypt and decrypt, but only if its IAM policy also allows it.
C.The role can delete the KMS key.
D.The role can create new grants for this key.
AnswerA

The grant explicitly allows Encrypt and Decrypt operations, and grants bypass IAM policy restrictions.

Why this answer

A KMS grant allows the grantee to perform the specified operations (in this case, Encrypt and Decrypt) on the KMS key without needing additional permissions in the IAM policy. The grant provides these permissions directly to the grantee, independent of IAM policies. Option B is incorrect because the grant's permissions are effective regardless of the IAM policy; they do not require IAM policy to also allow the operations.

Option C is incorrect because the grant does not include permission to delete the key; deletion requires separate IAM permissions. Option D is incorrect because creating new grants is a separate permission (CreateGrant) that is not included in a grant that only allows Encrypt and Decrypt.

Practice this question →
128
MCQmedium

A development team is building a serverless application that uses Amazon DynamoDB. The team needs to ensure that only the application's Lambda function can read and write data to a specific DynamoDB table. The Lambda function uses an IAM role. How should the team configure access?

A.Place the DynamoDB table and Lambda function in the same VPC and use a VPC endpoint to control access.
B.Encrypt the DynamoDB table with an AWS KMS key and grant the Lambda function decryption permissions.
C.Create an IAM role for the Lambda function with DynamoDB access, and configure a resource-based policy on the DynamoDB table that allows only that role.
D.Create an IAM role for the Lambda function with a policy that allows DynamoDB access, and attach the role to the function.
AnswerC

The resource-based policy on DynamoDB restricts access to the specified IAM role, ensuring only the Lambda function can access the table.

Why this answer

DynamoDB supports resource-based policies (also known as table policies) that allow you to specify which IAM roles or users can access the table. By attaching such a policy that grants access only to the Lambda function's execution role, you ensure that only that function can read/write to the table. Option A is incorrect because using a VPC endpoint does not inherently control access to the table; it only controls network traffic.

Option B is incorrect because KMS encryption protects data at rest but does not authorize access. Option D is incomplete because while an IAM role with a DynamoDB access policy is necessary, without a resource-based policy on the table that restricts access to that role, other principals with DynamoDB permissions could still access the table.

Practice this question →
129
Multi-Selecteasy

A company is using Amazon RDS for Oracle and needs to comply with regulatory requirements that mandate encryption of all data at rest and in transit. Which TWO actions should be taken to meet these requirements?

Select 2 answers
A.Enable encryption at rest by specifying a KMS key when creating the DB instance.
B.Use Oracle Transparent Data Encryption (TDE) to encrypt the data at rest.
C.Enable encryption for CloudWatch Logs.
D.Configure Oracle Native Network Encryption in the sqlnet.ora file.
E.Enable SSL/TLS encryption by setting the rds.force_ssl parameter and using the RDS SSL certificate.
AnswersA, E

Encryption at rest is enabled by specifying a KMS key when creating the DB instance. This meets the encryption at rest requirement.

Why this answer

Options A and E are correct. Option A enables encryption at rest by specifying a KMS key when creating the DB instance. Option E enables encryption in transit by setting the rds.force_ssl parameter and using the RDS SSL certificate.

Option B is incorrect because Oracle TDE is not required when RDS encryption at rest is used; RDS native encryption with KMS is sufficient. Option C is incorrect because CloudWatch Logs encryption does not encrypt the database data. Option D is incorrect because Oracle Native Network Encryption is less secure than SSL/TLS and is not the recommended method for encryption in transit.

Practice this question →
130
Multi-Selectmedium

A company is migrating an on-premises MongoDB database to Amazon DocumentDB (with MongoDB compatibility). The security team requires that data be encrypted at rest and in transit. Additionally, the team wants to use IAM roles to authenticate applications. Which THREE steps should the database specialist take to meet these requirements?

Select 3 answers
A.Use IAM roles to authenticate applications to the DocumentDB cluster.
B.Use a custom certificate authority for SSL/TLS.
C.Enable encryption at rest for the DocumentDB cluster.
D.Create a VPC endpoint for DocumentDB to enforce encryption.
E.Enable encryption in transit by using TLS for all connections.
AnswersA, C, E

Correct. IAM roles can be used to authenticate applications to DocumentDB, providing a secure and manageable authentication method.

Why this answer

Options A, C, and E are correct. IAM roles (A) can be used for authentication to DocumentDB, enabling fine-grained access control. Encryption at rest (C) can be enabled when creating the cluster, as DocumentDB supports encrypted storage using AWS KMS.

Encryption in transit (E) is achieved by using TLS for all connections. Option B is incorrect because DocumentDB uses a trusted certificate authority for TLS, not a custom CA. Option D is incorrect because VPC endpoints provide private connectivity but do not enforce encryption; encryption is handled at the cluster level and via TLS.

Practice this question →
131
MCQeasy

A company is using Amazon Aurora MySQL-Compatible Edition. The security team wants to audit all database login attempts and store the logs in Amazon S3 for 90 days. Which solution meets these requirements with the LEAST operational overhead?

A.Enable the Aurora audit log and publish logs to Amazon CloudWatch Logs. Create a CloudWatch Logs subscription filter to stream the logs to an Amazon S3 bucket.
B.Enable the Aurora audit log and configure the DB cluster to publish logs directly to an S3 bucket.
C.Install a custom audit plugin on the Aurora cluster that writes logs to a file, then use an AWS Lambda function to upload the file to S3.
D.Enable the Aurora audit log and use Amazon Kinesis Data Firehose to stream the logs to S3.
AnswerA

This uses managed services with minimal configuration.

Why this answer

Amazon Aurora can publish audit logs to Amazon CloudWatch Logs. A CloudWatch Logs subscription filter can then stream those logs to an Amazon S3 bucket for long-term storage. This approach requires minimal operational overhead because it uses native AWS services without custom scripts or additional infrastructure.

Option B is incorrect because Aurora does not support writing audit logs directly to S3. Option C is incorrect because installing a custom audit plugin and using a Lambda function introduces unnecessary complexity and operational overhead. Option D is incorrect because using Amazon Kinesis Data Firehose adds an extra streaming service that is not needed; a CloudWatch Logs subscription filter is simpler and more direct.

Practice this question →
132
Multi-Selectmedium

Which TWO actions will help protect an Amazon RDS for MySQL database from a SQL injection attack? (Select TWO.)

Select 2 answers
A.Use parameterized queries in the application code.
B.Enable encryption at rest for the RDS instance.
C.Place the RDS instance in a private VPC subnet.
D.Restrict database user permissions to only required operations.
E.Enable auto minor version upgrade on the RDS instance.
AnswersA, D

Parameterized queries prevent injection.

Why this answer

Using parameterized queries (prepared statements) prevents SQL injection. Also, restricting database user permissions to only necessary operations limits damage. Enabling encryption at rest does not prevent injection.

Using a VPC does not prevent injection. Enabling auto minor version upgrade does not prevent injection.

Practice this question →
133
MCQmedium

A company's security team wants to encrypt data at rest for an existing RDS for PostgreSQL DB instance. The instance is currently unencrypted. Which steps should the team take to enable encryption with minimal downtime?

A.Modify the DB instance and enable encryption in the RDS console.
B.Create a read replica of the DB instance and promote it to a standalone instance.
C.Create a new option group with encryption enabled and associate it with the DB instance.
D.Take a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore a new DB instance from the encrypted snapshot.
AnswerD

This is the standard method to encrypt an existing unencrypted RDS instance.

Why this answer

Amazon RDS does not support enabling encryption directly on an existing unencrypted DB instance. The only supported method is to take a snapshot of the instance, copy the snapshot with encryption enabled, and restore a new DB instance from the encrypted snapshot. Option A is incorrect because the RDS console does not allow enabling encryption on an existing instance.

Option B is incorrect because a read replica of an unencrypted instance is also unencrypted; promoting it does not add encryption. Option C is incorrect because option groups control database engine configuration, not encryption at rest. Encryption at rest is a storage-level feature that can only be enabled during instance creation or via snapshot operations.

Practice this question →
134
MCQmedium

A company uses Amazon RDS for MySQL and wants to ensure that database users are authenticated using IAM database authentication. Which action must be performed to enable this?

A.Create database users with MySQL native password authentication.
B.Attach an IAM role to the RDS instance for database authentication.
C.Change the database port to 3306 to enable IAM authentication.
D.Set the parameter 'require_secure_transport' to ON and use the AWSAuthenticationPlugin.
AnswerD

IAM auth requires SSL and the AWSAuthenticationPlugin.

Why this answer

IAM database authentication requires a specific parameter group setting (require_secure_transport=ON) and authentication plugin. Option A is wrong because native MySQL authentication is not IAM. Option B is wrong because IAM roles for RDS are for API access, not database authentication.

Option C is wrong because the standard MySQL port is 3306.

Practice this question →
135
MCQmedium

A company is using Amazon RDS for MySQL and needs to encrypt data at rest for an existing DB instance. Which approach meets this requirement with minimal downtime?

A.Take a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore from the encrypted snapshot.
B.Enable encryption directly on the existing DB instance by modifying it.
C.Use the AWS CLI command modify-db-instance with the --storage-encrypted flag.
D.Create a read replica of the DB instance with encryption enabled, then promote it.
AnswerA

This is the standard method to encrypt an existing RDS instance with minimal downtime.

Why this answer

To encrypt an existing unencrypted RDS MySQL DB instance, you cannot directly modify the instance. The standard approach is to take a snapshot, create an encrypted copy of the snapshot, and then restore that encrypted snapshot to a new DB instance. This method typically involves minimal downtime compared to other options.

Option A correctly describes this process. Option B is incorrect because encryption cannot be enabled directly on an existing instance. Option C is incorrect because the AWS CLI modify-db-instance command does not support enabling encryption on an existing instance; the --storage-encrypted flag only applies to new instances.

Option D is incorrect because creating a read replica with encryption does not encrypt the primary instance; you would still need to perform a snapshot restore for the primary's encryption.

Practice this question →
136
MCQeasy

A developer is checking the encryption status of an RDS MySQL instance. The CLI output shows StorageEncrypted is true. What does this indicate?

A.Connections to the database are encrypted in transit.
B.The database is encrypted using the AWS managed key for RDS.
C.The database does not have encryption at rest enabled.
D.The database is encrypted at rest using a KMS key.
AnswerD

StorageEncrypted true confirms at-rest encryption.

Why this answer

When StorageEncrypted is true, it indicates that the RDS MySQL instance is encrypted at rest using a KMS key. Option A is incorrect because StorageEncrypted does not relate to encryption in transit. Option B is incorrect because it can be either AWS managed or customer managed KMS key.

Option C is incorrect because StorageEncrypted: true means encryption at rest is enabled.

Practice this question →
137
MCQhard

A company is designing a security strategy for an Amazon Aurora MySQL database. They need to ensure that database activity is monitored for suspicious behavior and that alerts are sent when anomalies are detected. Which AWS services should be combined to achieve this? (Select TWO.)

A.Amazon GuardDuty
B.Amazon RDS Database Activity Streams
C.AWS WAF
D.Amazon EventBridge
E.Amazon Inspector
AnswerA, B

Amazon GuardDuty is a threat detection service that monitors for suspicious activity and anomalous behavior across AWS workloads, including Aurora database activity when integrated with Database Activity Streams.

Why this answer

Options A and B are correct. Amazon GuardDuty (A) is a threat detection service that monitors for suspicious activity and anomalous behavior. Amazon RDS Database Activity Streams (B) provide a near-real-time stream of database activity, which can be integrated with GuardDuty for monitoring.

Option C (AWS WAF) is a web application firewall, not for database activity monitoring. Option D (Amazon EventBridge) is an event bus service that can trigger alerts but does not itself detect anomalies. Option E (Amazon Inspector) is for vulnerability assessment on EC2 instances.

Practice this question →
138
Multi-Selectmedium

Which THREE measures can help protect an Amazon RDS database from a DDoS attack? (Choose 3.)

Select 3 answers
A.Place the RDS instance in a private subnet without direct internet access.
B.Use security groups to restrict inbound traffic to known IP addresses.
C.Make the RDS instance publicly accessible for easy monitoring.
D.Use AWS Shield Advanced.
E.Disable audit logging to reduce resource usage.
AnswersA, B, D

Reduces exposure to DDoS attacks.

Why this answer

Placing the RDS instance in a private subnet without direct internet access (Option A) prevents any external traffic from reaching the database endpoint, removing the attack surface entirely. Using security groups to restrict inbound traffic to known IP addresses (Option B) limits the sources that can initiate connections, reducing the potential for volumetric attacks. AWS Shield Advanced (Option D) provides additional DDoS mitigation capabilities, including detection and automatic application-layer protections.

These three measures work together to defend against different attack vectors.

Exam trap

The trap here is that candidates may think making an RDS instance publicly accessible is acceptable for monitoring purposes, but AWS best practices require all database access to go through a bastion host or VPN, and disabling audit logging is a common distractor that appears to reduce overhead but actually removes critical security visibility without any DDoS benefit.

Practice this question →
139
Multi-Selecthard

Which THREE are valid methods to encrypt data at rest in Amazon DynamoDB? (Choose 3.)

Select 3 answers
A.Use a customer managed CMK.
B.Use S3 server-side encryption.
C.Use an AWS-owned CMK.
D.Use an AWS managed CMK.
E.Use client-side encryption with the DynamoDB Encryption Client.
AnswersA, C, D

Correct. Customer managed CMKs are fully supported for DynamoDB encryption at rest, providing control over key policies and rotation.

Why this answer

DynamoDB encryption at rest is implemented through AWS KMS, supporting three types of customer master keys (CMKs): AWS-owned CMKs (default), AWS managed CMKs, and customer managed CMKs. Option A is correct because customer managed CMKs are fully supported, allowing you to create, manage, and control key policies and rotation. Option C (AWS-owned) and D (AWS managed) are also correct.

Option E (client-side encryption with DynamoDB Encryption Client) is not an encryption-at-rest method provided by DynamoDB; it encrypts data before transmission, but data at rest is still encrypted by DynamoDB's server-side encryption. Option B is irrelevant as S3 server-side encryption does not apply to DynamoDB.

Exam trap

The trap is that candidates often assume client-side encryption counts as 'encryption at rest' for DynamoDB, but encryption at rest refers to server-side encryption by the service itself. Additionally, some may think customer managed CMKs are not supported, but they are.

Practice this question →
140
MCQeasy

A company wants to ensure that an Amazon RDS for MySQL DB instance is encrypted at rest. Which action should be taken to enable encryption for the first time?

A.Enable encryption on the existing DB instance using the AWS CLI.
B.Create a new encrypted DB instance using AWS KMS.
C.Set the rds.encrypted parameter to true in the DB parameter group.
D.Modify the existing DB instance and enable encryption.
AnswerB

This is correct. Encryption at rest for RDS must be enabled when the DB instance is created, using an AWS KMS key.

Why this answer

Encryption at rest for Amazon RDS can only be enabled when creating a new DB instance. To enable encryption for the first time, you must create a new encrypted DB instance using AWS KMS. Option A is incorrect because encryption cannot be enabled on an existing DB instance via the AWS CLI; it requires creating a new instance.

Option C is incorrect because there is no rds.encrypted parameter in a DB parameter group; encryption is set at instance creation, not via parameters. Option D is incorrect because modifying an existing DB instance does not allow enabling encryption; you must create a new encrypted instance.

Practice this question →
141
MCQhard

A company is migrating its on-premises Oracle database to Amazon RDS for Oracle. The database contains sensitive data that must be encrypted at rest and in transit. The security team also requires that the encryption keys be rotated every year. The DBA has enabled encryption at rest using a customer-managed KMS key and SSL/TLS for in-transit encryption. What additional step is needed to meet the key rotation requirement?

A.Manually create a new KMS key every year and update the RDS instance to use the new key.
B.Configure the RDS option group to rotate the encryption key.
C.Use an AWS CloudHSM key and configure automatic rotation.
D.Enable automatic KMS key rotation for the customer-managed key.
AnswerD

KMS can rotate the key automatically every year.

Why this answer

Enable automatic KMS key rotation for the customer-managed key. AWS KMS supports automatic annual rotation of customer-managed keys, which meets the key rotation requirement without manual intervention. Option A is incorrect because manually creating a new key and updating the RDS instance each year is an unnecessary manual process when automatic rotation is available.

Option B is incorrect because RDS option groups do not control encryption key rotation; they are used for managing additional database features. Option C is incorrect because CloudHSM is not integrated with RDS for key management; KMS is the service used for RDS encryption at rest.

Practice this question →
142
MCQmedium

A company uses Amazon RDS for PostgreSQL with Multi-AZ deployment. The security team wants to ensure that any access to the database is logged, including SELECT queries. What should be done to capture these logs?

A.Modify the DB parameter group to enable query logging and publish logs to Amazon CloudWatch Logs.
B.Enable automated backups and export logs to Amazon S3.
C.Enable RDS Performance Insights.
D.Enable RDS Enhanced Monitoring.
AnswerA

This captures query logs and stores them in CloudWatch.

Why this answer

Enabling RDS Enhanced Monitoring does not capture query logs. Enabling automatic backups does not log queries. Enabling RDS Performance Insights does not log queries.

To capture SELECT queries, you need to enable PostgreSQL query logging by setting the appropriate parameter group parameters (e.g., log_statement = 'all' or 'mod') and then export logs to CloudWatch Logs.

Practice this question →
143
MCQhard

Refer to the exhibit. The output is from the AWS CLI for an RDS instance. The security team suspects that the encryption key used for this DB instance has been compromised. What is the required action to re-encrypt the instance with a new key?

A.Create a snapshot of the DB instance, copy the snapshot with a new KMS key, and restore the DB instance from the copied snapshot.
B.Modify the DB instance to use a new KMS key.
C.Restore the DB instance to a point in time and specify a new KMS key.
D.Enable encryption on a new DB instance and migrate the data.
AnswerA

This process allows re-encryption with a new key.

Why this answer

RDS does not allow changing the encryption key of an existing encrypted DB instance directly. The correct method is to create a snapshot of the DB instance, copy the snapshot with a new KMS key, and then restore the DB instance from the copied snapshot. Option B is incorrect because modifying the DB instance does not allow changing the KMS key.

Option C is incorrect because restoring to a point in time uses the same encryption key as the original instance. Option D is incorrect because this instance is already encrypted; to use a new key, a snapshot copy and restore is required.

Practice this question →
144
MCQmedium

A company has an Amazon Redshift cluster that contains sensitive data. The security team requires that data be encrypted at rest using a customer-managed AWS KMS key. The cluster was initially launched without encryption. How can the company enable encryption with minimal downtime?

A.Unload the data to Amazon S3, create a new encrypted cluster, and reload the data from S3.
B.Use the AWS CLI to update the cluster encryption setting.
C.Take a snapshot of the cluster and restore it to a new cluster with encryption enabled.
D.Modify the cluster and enable encryption using the AWS Management Console.
AnswerC

Taking a snapshot and restoring it to a new cluster with encryption enabled is the correct method with minimal downtime. The original cluster remains available during the process.

Why this answer

To enable encryption on an existing unencrypted Redshift cluster with minimal downtime, the recommended approach is to take a snapshot of the cluster and restore it to a new cluster with encryption enabled. This allows the original cluster to remain operational while the encrypted cluster is being created, minimizing downtime. Once the new cluster is ready, traffic can be redirected.

Option A (unload to S3, create new encrypted cluster, reload) also achieves encryption but requires significant downtime for data transfer. Option B is incorrect because there is no direct CLI command to enable encryption on an existing cluster; a new cluster must be created. Option D is incorrect because the AWS Management Console does not allow enabling encryption on an existing cluster.

Practice this question →
145
MCQmedium

A healthcare company is migrating its patient records database to Amazon RDS for SQL Server. The database contains Protected Health Information (PHI). The compliance team requires that all PHI data be encrypted at rest and that the encryption keys be stored in a dedicated AWS CloudHSM cluster. Additionally, the database must be replicated to a second AWS region for disaster recovery. The DBA has enabled RDS encryption at rest using a KMS key, but the compliance team insists on using CloudHSM. What should the DBA do to meet the compliance requirement while maintaining disaster recovery?

A.Use RDS encryption at rest with a KMS key backed by CloudHSM (custom key store).
B.Migrate the database to Amazon DynamoDB with encryption using CloudHSM via KMS custom key store.
C.Use an RDS Custom for SQL Server instance and configure TDE with CloudHSM, then set up log shipping to another region.
D.Enable Transparent Data Encryption (TDE) using a CloudHSM key and create a cross-region read replica for DR.
AnswerD

RDS for SQL Server supports TDE, which can use a CloudHSM key as the key store. Cross-region read replicas are available for RDS for SQL Server, providing disaster recovery. This meets both the encryption and DR requirements.

Why this answer

RDS for SQL Server supports Transparent Data Encryption (TDE) with CloudHSM as the key store, and RDS read replicas can be created across regions for disaster recovery. Option A is incorrect because RDS encryption at rest with a KMS key does not meet the CloudHSM requirement; KMS custom key stores (backed by CloudHSM) are not supported for RDS encryption at rest. Option B is incorrect because DynamoDB encryption with CloudHSM via KMS custom key store is possible but unnecessary and does not maintain the existing SQL Server database.

Option C is incorrect because using RDS Custom with TDE and manual log shipping is more complex and not the standard approach for cross-region disaster recovery with RDS.

Practice this question →
146
MCQhard

A company uses Amazon DynamoDB to store user session data. The security team requires that all data be encrypted at rest using a customer-managed AWS KMS key. The DynamoDB table is already configured with AWS managed KMS encryption. How can the company meet the encryption requirement without recreating the table?

A.Enable DynamoDB Streams and use a Lambda function to copy data to a new table with the desired encryption.
B.Export the table to Amazon S3 using the on-demand backup feature, then import it into a new table encrypted with the desired KMS key.
C.Use the UpdateTable API to specify the new KMS key in the SSESpecification parameter.
D.Delete the table and recreate it with the new KMS key.
AnswerC

DynamoDB allows updating the encryption key on an existing table via UpdateTable.

Why this answer

DynamoDB supports updating the server-side encryption settings on an existing table using the UpdateTable API with the SSESpecification parameter. This allows you to change from an AWS managed KMS key to a customer managed KMS key without recreating the table or causing downtime. Option A is incorrect because DynamoDB Streams are used for change data capture and cannot modify encryption settings.

Option B is incorrect because exporting to S3 and importing into a new table is unnecessary and introduces additional complexity and potential downtime when an in-place update is available. Option D is incorrect because deleting and recreating the table would result in data loss and downtime, and is not required as the UpdateTable API can change encryption directly.

Practice this question →
147
Multi-Selecthard

Which THREE practices should be implemented to secure an Amazon DynamoDB table that stores personally identifiable information (PII)? (Select THREE.)

Select 3 answers
A.Use a VPC endpoint to access the table.
B.Enable encryption at rest using an AWS KMS customer-managed key.
C.Use an IAM policy to restrict who can access the table.
D.Enable AWS CloudTrail to log all DynamoDB API calls.
E.Enable encryption in transit using SSL/TLS.
AnswersB, C, D

Encryption at rest protects data.

Why this answer

Using IAM policies to restrict access is a security best practice. Encrypting the table at rest with a KMS key protects data. Monitoring with CloudTrail provides audit trail.

VPC endpoints help but are not a security practice for the table itself. Encryption in transit is done by DynamoDB automatically via HTTPS. Fine-grained access control can be achieved with IAM conditions, not attribute-based access control on the table itself.

Practice this question →
148
Multi-Selecthard

A company uses Amazon DynamoDB with a global secondary index (GSI). The security team requires that only specific IAM users can query the GSI. Which THREE conditions must be met to restrict access to the GSI?

Select 3 answers
A.The policy must include a condition 'dynamodb:IndexName' with the index name.
B.The policy must include a condition key 'dynamodb:Attributes' to restrict which attributes are returned.
C.The user must have permission to query the base table as well.
D.The policy must allow the 'dynamodb:Query' action on the index.
E.The IAM policy must specify the index ARN in the Resource element.
AnswersC, D, E

Querying a GSI requires access to the base table.

Why this answer

The correct answers are C, D, and E. To restrict access to a GSI, you must ensure the user has permission to query the base table (C), allow the dynamodb:Query action on the index (D), and specify the index ARN in the Resource element (E). Option A is incorrect because the dynamodb:IndexName condition key is not used for IAM authorization; access to a GSI is controlled via the resource ARN, not a condition key.

Option B is incorrect because the dynamodb:Attributes condition key restricts which attributes are returned, not access to the GSI itself.

Exam trap

A common mistake is to think the dynamodb:IndexName condition key restricts access to a GSI, but in IAM, you must specify the index ARN in the Resource element of the policy.

Practice this question →
149
MCQmedium

A company wants to enforce encryption in transit for all connections to their ElastiCache for Redis cluster. Which security measure should they implement?

A.Set a parameter group with 'require_secure_transport' to ON.
B.Enable Encryption in-transit when creating the cluster.
C.Use VPC Flow Logs to monitor connections.
D.Enable encryption at rest using KMS.
AnswerB

This enforces TLS for all connections.

Why this answer

ElastiCache for Redis enforces encryption in transit by enabling the feature at cluster creation time. This uses TLS to encrypt data moving between clients and the Redis nodes, ensuring that all connections are secured against eavesdropping or man-in-the-middle attacks. The setting cannot be changed after the cluster is provisioned, so it must be enabled during the initial setup.

Exam trap

The trap here is that candidates confuse the 'require_secure_transport' parameter from RDS with ElastiCache, or assume that encryption in transit can be enabled after cluster creation via a parameter group change, when in fact it is a one-time setting at launch.

How to eliminate wrong answers

Option A is wrong because ElastiCache for Redis does not support a 'require_secure_transport' parameter; that parameter exists in Amazon RDS for MySQL/MariaDB, not in ElastiCache. Option C is wrong because VPC Flow Logs capture metadata about network traffic (source/destination IPs, ports, protocols) but do not enforce or enable encryption in transit; they are a monitoring tool, not a security control for encryption. Option D is wrong because encryption at rest using KMS protects data stored on disk, not data in transit over the network; it addresses a different threat model.

Practice this question →
150
MCQhard

A company is using Amazon DynamoDB with server-side encryption enabled. They need to ensure that all access to the table is audited. Which service should be used to capture data-plane API calls?

A.VPC Flow Logs
B.AWS Config
C.Amazon CloudWatch Logs
D.AWS CloudTrail
AnswerD

CloudTrail can log data events for DynamoDB, including GetItem, PutItem, etc., when configured.

Why this answer

AWS CloudTrail, when configured to capture data events, can record DynamoDB data-plane API calls such as GetItem and PutItem. Option A (VPC Flow Logs) captures network traffic, not API calls. Option B (AWS Config) records configuration changes, not data-plane actions.

Option C (Amazon CloudWatch Logs) can store logs but does not directly capture API calls; it would require another service to send logs to it.

Practice this question →
← PreviousPage 2 of 5 · 310 questions totalNext →

Ready to test yourself?

Try a timed practice session using only Database Security questions.

Start 20-question session