← DBS-C01·Amazon Web Services

Question 329 of 1,730

Database Security →hardMultiple ChoiceObjective-mapped

DBS-C01 Database Security Practice Question

This DBS-C01 practice question tests your understanding of database security. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A financial services company runs a critical application on Amazon RDS for PostgreSQL. The database stores sensitive customer financial data. The security team has mandated that all access to the database must be through IAM database authentication to eliminate the need for passwords. The application currently uses a master user password stored in AWS Secrets Manager. The DBA needs to implement IAM authentication without downtime. The application is deployed on Amazon ECS and connects to the database using a connection string. The DBA has already created an IAM role for the ECS task with a policy that allows rds-db:connect. The DBA has also modified the DB instance to require SSL. However, after making these changes, the application cannot connect. The error message indicates 'IAM authentication is not enabled for this user'. What step did the DBA miss?

A
The DBA did not create a database user that is set to use IAM authentication.
When using IAM database authentication, you must create a database user that is set to authenticate using IAM. This is done by creating the user with the CREATEROLE option and granting rds_iam role. Without this, authentication fails. This is the missed step.
B
The DBA did not attach the IAM policy to the ECS task role.
Why wrong: The IAM policy was already attached to the ECS task role, so this is not the issue.
C
The DBA did not enable the 'password' authentication method.
Why wrong: IAM authentication does not require a password; it uses authentication tokens generated by AWS. Enabling password authentication is unnecessary and not relevant.
D
The DBA did not update the security group to allow traffic on port 5432.
Why wrong: The security group configuration for port 5432 is not related to IAM authentication. The connection error is about IAM authentication not enabled for the user, not network connectivity.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The DBA did not create a database user that is set to use IAM authentication.

The correct answer is A. IAM database authentication requires that a database user be created with the IAM authentication method. Specifically, the user must be created with the CREATEROLE privilege and granted the rds_iam role. Without this step, the authentication fails even if the IAM role is correctly configured. Option B is incorrect because the IAM policy was already attached. Option C is incorrect because IAM authentication does not require a password; it uses authentication tokens. Option D is incorrect because the security group and port are not related to IAM authentication.

Key principle: Authentication proves identity; authorization controls what that identity can do after login. Both must work for full privileged access.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
The DBA did not create a database user that is set to use IAM authentication.
Why this is correct
When using IAM database authentication, you must create a database user that is set to authenticate using IAM. This is done by creating the user with the CREATEROLE option and granting rds_iam role. Without this, authentication fails. This is the missed step.
Related concept
Authentication checks who the user is.
✗
The DBA did not attach the IAM policy to the ECS task role.
Why it's wrong here
The IAM policy was already attached to the ECS task role, so this is not the issue.
✗
The DBA did not enable the 'password' authentication method.
Why it's wrong here
IAM authentication does not require a password; it uses authentication tokens generated by AWS. Enabling password authentication is unnecessary and not relevant.
✗
The DBA did not update the security group to allow traffic on port 5432.
Why it's wrong here
The security group configuration for port 5432 is not related to IAM authentication. The connection error is about IAM authentication not enabled for the user, not network connectivity.

Common exam traps

Common exam trap: authentication is not authorization

Logging in proves the user can authenticate. It does not automatically mean the user is allowed to enter privileged or configuration mode. Watch for AAA authorization, privilege level and command authorization details.

Detailed technical explanation

How to think about this question

This kind of question is testing the difference between identity and permission. A user may successfully log in to a router because authentication is working, but still fail to enter configuration mode because authorization is missing, misconfigured or mapped to a lower privilege level.

KKey Concepts to Remember

Authentication checks who the user is.
Authorization controls what the user is allowed to do after login.
Privilege levels affect access to EXEC and configuration commands.
AAA, TACACS+ and RADIUS can separate login success from command access.

TExam Day Tips

Do not assume successful login means full administrative access.
Look for words such as cannot enter configuration mode, privilege level, authorization or command access.
Separate login problems from permission problems before choosing the answer.

Key takeaway

Authentication proves identity; authorization controls what that identity can do after login. Both must work for full privileged access.

Real-world example

How this comes up in practice

A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.

What to study next

Got this wrong? Here's your next step.

Review Cisco AAA concepts — authentication, authorization, and accounting. Study privilege levels (0–15), command authorization under TACACS+, and how RADIUS differs. Then practise related DBS-C01 questions on access control and AAA configuration.

Related DBS-C01 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

Workload-Specific Database Design practice questions

Practise DBS-C01 questions linked to Workload-Specific Database Design.

Deployment and Migration practice questions

Practise DBS-C01 questions linked to Deployment and Migration.

Management and Operations practice questions

Practise DBS-C01 questions linked to Management and Operations.

Monitoring and Troubleshooting practice questions

Practise DBS-C01 questions linked to Monitoring and Troubleshooting.

Database Security practice questions

Practise DBS-C01 questions linked to Database Security.

DBS-C01 fundamentals practice questions

Practise DBS-C01 questions linked to DBS-C01 fundamentals.

DBS-C01 scenario practice questions

Practise DBS-C01 questions linked to DBS-C01 scenario.

DBS-C01 troubleshooting practice questions

Practise DBS-C01 questions linked to DBS-C01 troubleshooting.

Practice this exam

Start a free DBS-C01 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

DBS-C01 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this DBS-C01 question test?

Database Security — This question tests Database Security — Authentication checks who the user is..

What is the correct answer to this question?

The correct answer is: The DBA did not create a database user that is set to use IAM authentication. — The correct answer is A. IAM database authentication requires that a database user be created with the IAM authentication method. Specifically, the user must be created with the CREATEROLE privilege and granted the rds_iam role. Without this step, the authentication fails even if the IAM role is correctly configured. Option B is incorrect because the IAM policy was already attached. Option C is incorrect because IAM authentication does not require a password; it uses authentication tokens. Option D is incorrect because the security group and port are not related to IAM authentication.

What should I do if I get this DBS-C01 question wrong?

What is the key concept behind this question?

Authentication checks who the user is.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.