CCNA Db Security Questions — Page 5 of 5

301

MCQhard

Refer to the exhibit. A company has an S3 bucket with server-side encryption using AWS KMS. The bucket policy allows access to a user, but the user receives 'Access Denied' when trying to download an object. The IAM policy for the user is shown. What is the MOST likely cause?

A.The user does not have MFA enabled.

B.The KMS key ID in the policy is incorrect.

C.The policy does not allow kms:Decrypt for the S3 bucket.

D.The policy has a condition that limits kms:Decrypt to when the request is made through the S3 service, but the user might be using a different service to access the object (e.g., directly via KMS API).

AnswerD

The condition 'kms:ViaService' ensures decryption only through S3.

Why this answer

The IAM policy includes a condition that restricts kms:Decrypt to requests made through the S3 service (via the S3 service principal). If the user attempts to decrypt the object directly using the KMS API (e.g., using AWS CLI with `kms decrypt` command), the condition is not met, resulting in an 'Access Denied' error. Option A is incorrect because MFA is not mentioned in the policy.

Option B is incorrect because the KMS key ID is assumed correct as per the scenario. Option C is incorrect because the policy does allow kms:Decrypt, but only conditionally.

Practice this question →

302

MCQhard

A company uses Amazon DynamoDB with fine-grained access control based on user identity. The IAM policy for a user includes a condition that restricts access to items where the 'department' attribute equals 'engineering'. However, the user is receiving an 'AccessDeniedException' when trying to query items. What is the most likely cause?

A.The user is not using the correct IAM role.

B.The 'department' attribute is not the partition key of the table.

C.The DynamoDB table is not configured to require SSL.

D.The IAM policy is missing a 'Condition' block.

AnswerB

Fine-grained access control using 'LeadingKeys' requires the condition on the partition key.

Why this answer

Fine-grained access control in DynamoDB uses IAM policy conditions with the 'dynamodb:LeadingKeys' or 'dynamodb:Attributes' condition keys. The 'department' attribute must be the partition key of the table for 'LeadingKeys' to work. If 'department' is not the partition key, the condition cannot be evaluated for the query.

Option A is possible but less likely if the user is using the correct role. Option C is wrong because DynamoDB does not require SSL for all operations. Option D is wrong because Condition check is exactly how it works.

Practice this question →

303

MCQeasy

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database contains sensitive data that must be encrypted at rest. Which action should the company take to enable encryption on the RDS instance?

A.Modify the existing RDS DB instance and enable encryption.

B.Create a new RDS DB instance with encryption enabled and migrate the data.

C.Enable Oracle Transparent Data Encryption (TDE) on the existing RDS instance.

D.Take a snapshot of the existing database, encrypt the snapshot, and restore from it.

AnswerB

Encryption can only be enabled at creation time.

Why this answer

Amazon RDS for Oracle supports encryption at rest using AWS KMS. Encryption can only be enabled when the DB instance is created; you cannot encrypt an existing unencrypted RDS instance. Therefore, to enable encryption for an existing on-premises Oracle database being migrated, you must create a new RDS DB instance with encryption enabled at launch and then migrate the data into that new instance.

This makes option B the correct choice. Option A is incorrect because you cannot modify an existing unencrypted RDS instance to add encryption. Option C is incorrect because while Oracle Transparent Data Encryption (TDE) can be used to encrypt data within the database, it is not the native Amazon RDS encryption method and requires additional configuration; moreover, the scenario assumes a new RDS instance is being created, not an existing one.

Option D is incorrect because the source database is on-premises, not an RDS instance, so there is no RDS snapshot to take; even if there were an existing unencrypted RDS instance, encrypting a snapshot requires copying it with encryption enabled, not directly encrypting the snapshot. Thus D is not a valid action for this migration.

Practice this question →

304

MCQmedium

A company is using Amazon RDS for MySQL with automated backups enabled. The security team requires that all backups be encrypted at rest. Which configuration ensures that new automated backups are encrypted?

A.Create a new encrypted DB instance and migrate the data. Automated backups will inherit encryption.

B.Modify the DB instance to enable encryption at rest after creation.

C.Use AWS KMS to encrypt the S3 bucket where automated backups are stored.

D.Enable encryption at rest on the DB instance and also enable encryption on automated backups using the DBSnapshot option.

AnswerA

Creating an encrypted instance ensures all backups (automated and manual) are encrypted.

Why this answer

Encryption at rest must be enabled at creation time on an RDS instance. When you enable encryption at rest on a new DB instance, all automated backups, snapshots, and replicas inherit that encryption automatically. Option B is incorrect because you cannot enable encryption at rest on an existing RDS instance after creation; you must create a new encrypted instance and migrate.

Option C is incorrect because automated backups are stored in an S3 bucket managed by RDS, but you cannot directly encrypt the bucket or backups separately; encryption is tied to the DB instance. Option D is incorrect because it incorrectly suggests both enabling encryption on the instance and a separate DBSnapshot option; encryption on the instance already covers backups, and there is no separate DBSnapshot option for enabling encryption.

Practice this question →

305

MCQhard

A security engineer is designing a VPC with an RDS instance. The database must not be accessible from the internet, but EC2 instances in a private subnet must connect. Which security group configuration is MOST secure?

A.Set the RDS security group inbound rule to allow traffic from the VPC CIDR on port 3306.

B.Set the RDS security group inbound rule to allow traffic from 0.0.0.0/0 on port 3306.

C.Set the RDS security group inbound rule to allow traffic from the private subnet CIDR on port 3306.

D.Set the RDS security group inbound rule to allow traffic from the EC2 security group on port 3306.

AnswerD

This is the most secure, least-privilege approach.

Why this answer

The most secure because it uses a security group reference instead of a CIDR block. By referencing the EC2 security group as the source in the RDS security group inbound rule, only instances associated with that specific security group can communicate with the database on port 3306. This approach adheres to the principle of least privilege and automatically scales as instances are added or removed from the EC2 security group, without needing to update CIDR ranges.

Exam trap

The trap here is that candidates often choose a CIDR-based rule (like the private subnet CIDR) thinking it is sufficiently restrictive, but they overlook the superior security and operational benefits of using a security group reference, which is a key concept tested in the DBS-C01 exam for database security.

How to eliminate wrong answers

Option A is wrong because allowing traffic from the entire VPC CIDR (e.g., 10.0.0.0/16) is overly permissive; any resource in the VPC, including those in public subnets or unintended services, could reach the RDS instance, increasing the attack surface. Option B is wrong because allowing traffic from 0.0.0.0/0 on port 3306 makes the database publicly accessible from the internet, directly violating the requirement that the database must not be accessible from the internet. Option C is wrong because while it restricts traffic to the private subnet CIDR, it still allows any instance in that subnet (including compromised or unauthorized ones) to connect, and it does not automatically adjust if the subnet CIDR changes or if instances are added to a different private subnet.

Practice this question →

306

Multi-Selecthard

Which THREE of the following are best practices for securing an Amazon Aurora MySQL database? (Select THREE.)

Select 3 answers

A.Enable encryption at rest using AWS KMS.

B.Enable audit logging to track database activity.

C.Store database credentials in application code for simplicity.

D.Use IAM database authentication for access.

E.Disable automated backups to reduce attack surface.

AnswersA, B, D

Encryption at rest protects data if storage is compromised.

Why this answer

Options A, B, and D are correct. Enabling encryption at rest with AWS KMS (A) protects data stored on disk. Audit logging (B) tracks database activity for security monitoring.

IAM database authentication (D) provides a secure, managed method for access control without storing credentials. Option C is wrong because storing credentials in application code is insecure and violates best practices. Option E is wrong because disabling automated backups reduces data durability and recovery capabilities.

Practice this question →

307

MCQeasy

A company wants to ensure that only specific IAM users can perform certain operations on an Amazon RDS DB instance, such as creating snapshots or modifying the instance. Which AWS feature should be used to define these permissions?

A.VPC security groups

B.IAM policies

C.DB parameter groups

D.DB subnet groups

AnswerB

IAM policies define permissions for AWS actions on resources like RDS.

Why this answer

IAM policies are used to grant or deny permissions to AWS resources, including Amazon RDS DB instances. By attaching an IAM policy to a user, group, or role, you can control which actions (e.g., CreateDBSnapshot, ModifyDBInstance) are allowed. Options A, C, and D are incorrect: VPC security groups control network traffic, DB parameter groups manage database engine settings, and DB subnet groups define which subnets the DB instance can use—none of these define permissions for specific operations.

Practice this question →

308

MCQhard

Refer to the exhibit. A database administrator has this IAM policy attached to their user. They are trying to authorize ingress to a DB security group named 'my-security-group' in the us-east-1 region. The operation fails. What is the most likely reason?

A.The user is not allowed to create DB security groups, which is a prerequisite.

B.The policy does not grant 'rds:AuthorizeDBSecurityGroupIngress' on the specific security group.

C.The security group ARN in the policy is incorrect; it should include the security group ID instead of the name.

D.The user is missing the 'rds:DescribeDBSecurityGroups' permission, which is required to perform the authorize operation.

AnswerD

IAM requires the corresponding Describe action for many APIs.

Why this answer

The policy grants the `rds:AuthorizeDBSecurityGroupIngress` action on a specific DB security group. However, to authorize ingress, the user must also be able to describe the security group to verify its existence and details. The policy does not include `rds:DescribeDBSecurityGroups`, which is a prerequisite for the authorization operation.

Therefore, the operation fails due to missing describe permission.

Practice this question →

309

MCQeasy

A company is using Amazon Aurora MySQL and needs to audit all database logins and query activity. Which feature should be enabled to meet this requirement?

A.Enable database audit logs by setting the audit_log_enabled parameter to 1.

B.Enable RDS Enhanced Monitoring.

C.Enable AWS CloudTrail to log database queries.

D.Enable Advanced Auditing through the DB cluster parameter group by setting the server_audit_logging parameter and related parameters.

AnswerD

This is the correct feature for auditing queries and logins in Aurora MySQL.

Why this answer

Amazon Aurora MySQL's Advanced Auditing feature, enabled by setting the server_audit_logging parameter and related parameters in the DB cluster parameter group, captures all database logins and query activity. Option A (audit_log_enabled) is a different, less detailed audit log feature, not the full advanced auditing. Option B (Enhanced Monitoring) monitors OS-level metrics, not database activity.

Option C (CloudTrail) logs AWS API calls, not database queries.

Practice this question →

310

MCQmedium

A developer needs to allow an application running on EC2 to access an Amazon RDS database without storing database credentials in the application code. Which solution is the MOST secure?

A.Use IAM database authentication for the RDS instance and assign an IAM role to the EC2 instance.

B.Store the database password in AWS Systems Manager Parameter Store as a SecureString.

C.Store the database password in the application configuration file.

D.Store the database password in AWS Secrets Manager and enable automatic rotation.

AnswerA

Correct. IAM database authentication uses IAM roles to grant access without passwords, eliminating credential storage.

Why this answer

IAM database authentication allows the EC2 instance to use an IAM role to authenticate to the RDS database, eliminating the need to store any credentials in the application code. This is the most secure method. Options B and C still rely on storing and retrieving a password, which introduces risk.

Option D stores credentials in a config file, which is insecure.

Exam trap

Candidates often assume that any solution using a secrets vault (Parameter Store or Secrets Manager) is the most secure, but IAM database authentication avoids credentials entirely, making it more secure.

Practice this question →