Question 1,633 of 1,663
DBS-C01 Database Security Practice Question
Which TWO actions can help protect an RDS database from SQL injection attacks? (Choose 2.)
⚠ Common exam trap
Watch out — candidates often confuse network-level controls (security groups) or encryption features with application-layer input validation, mistakenly believing that restricting access or encrypting data can prevent SQL injection, when in fact only proper query construction and input handling can stop the attack.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use parameterized SQL statements in the application.
Parameterized SQL statements (also known as prepared statements) ensure that user input is treated strictly as data, not executable code, preventing SQL injection at the application layer. Option E is correct because input validation and sanitization filter out malicious characters or patterns before they reach the database, adding an extra layer of defense. Both measures are essential; network controls (security groups) and encryption do not prevent injection attacks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Multi-AZ for the RDS instance.
Why it's wrong here
Multi-AZ provides high availability, not security.
- ✗
Enable encryption at rest using KMS.
Why it's wrong here
Encryption protects data at rest, not from injection.
- ✓
Use parameterized SQL statements in the application.
Why this is correct
Parameterized queries separate SQL logic from data.
- ✗
Restrict network access using security groups.
Why it's wrong here
Network access control does not prevent SQL injection.
- ✓
Implement input validation and sanitization.
Why this is correct
Validates user input to remove malicious code.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DBS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO actions will help protect an Amazon RDS for MySQL database from a SQL injection attack? (Select TWO.)
medium- ✓ A.Use parameterized queries in the application code.
- B.Enable encryption at rest for the RDS instance.
- C.Place the RDS instance in a private VPC subnet.
- ✓ D.Restrict database user permissions to only required operations.
- E.Enable auto minor version upgrade on the RDS instance.
Why A: Using parameterized queries (prepared statements) prevents SQL injection. Also, restricting database user permissions to only necessary operations limits damage. Enabling encryption at rest does not prevent injection. Using a VPC does not prevent injection. Enabling auto minor version upgrade does not prevent injection.
Last reviewed: Jun 24, 2026
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.