Match each AWS security feature to its purpose for databases.
Drag a concept onto its matching description — or click a concept then click the description.
Virtual firewall controlling inbound/outbound traffic at instance level
Use IAM users/roles to authenticate to RDS/Aurora
Protects data stored on disk using KMS keys
Encrypts data in transit between client and database
Managed service to create and control encryption keys
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
AWS KMS: Encrypts data at rest and manages encryption keys
AWS KMS handles encryption keys, IAM controls access, Security Groups provide network firewall, and Secrets Manager manages credentials. Common confusions include mixing up KMS with IAM for key management vs. access control.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
AWS KMS: Encrypts data at rest and manages encryption keys
Why this is correct
AWS KMS is used for encryption key management and encrypting data at rest.
AWS IAM: Controls access to AWS services and resources via users, groups, and roles
Why this is correct
IAM manages authentication and authorization for AWS resources.
AWS Security Groups: Acts as a virtual firewall for instances to control traffic
Why this is correct
Security Groups filter traffic at the instance level, commonly used for database instances.
AWS Secrets Manager: Stores and rotates database credentials automatically
Why this is correct
Secrets Manager securely stores secrets and can rotate them for supported databases.
AWS KMS: Controls user access to resources
Why it's wrong here
Incorrect — this describes IAM, not KMS.
AWS IAM: Encrypts data at rest using keys
Why it's wrong here
Incorrect — this describes KMS, not IAM.
Go deeper
About these practice questions
Courseiva writes every DBS-C01 question from scratch — 1,663 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.