RDS security (encryption, security groups) in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding RDS Encryption at Rest

Which statement correctly describes how encryption at rest works for an AWS RDS instance?

A Encryption at rest encrypts the data stored on the disk and backups using AWS KMS keys.

B Encryption at rest encrypts data only during transmission between the client and the RDS instance.

C Encryption at rest requires manual encryption of data before storing it in the database.

D Encryption at rest is enabled by default for all RDS instances regardless of configuration.

💡 Hint

Think about what 'at rest' means in terms of data storage.

Encryption at rest means data stored on disk and backups are encrypted using AWS KMS keys. It does not encrypt data in transit or require manual encryption.

❓ Configuration

intermediate

RDS Security Group Configuration

You want to allow only EC2 instances in a specific security group to access your RDS instance. Which security group rule should you add to the RDS security group?

A Inbound rule allowing TCP port 22 from the EC2 instances' security group ID.

B Outbound rule allowing all traffic to the EC2 instances' security group ID.

C Inbound rule allowing TCP port 3306 from the EC2 instances' security group ID.

D Inbound rule allowing UDP port 3306 from the EC2 instances' security group ID.

💡 Hint

Consider the default port for MySQL and the direction of traffic for database access.

RDS instances require inbound rules allowing the database port (e.g., 3306 for MySQL) from the EC2 security group. SSH (port 22) or UDP are incorrect.

❓ Architecture

advanced

Designing Secure RDS Access in a VPC

You have an RDS instance in a private subnet inside a VPC. You want to allow access only from a web server in a public subnet. Which architecture and security group setup is best?

A Create a security group for the RDS allowing inbound traffic on port 22 from the web server's security group.

B Assign a public IP to the RDS instance and allow inbound traffic from anywhere on the database port.

C Place the RDS instance in the public subnet and allow inbound traffic from the internet on the database port.

D Create a security group for the RDS allowing inbound traffic on the database port from the web server's security group. The web server is in the public subnet with a security group allowing outbound traffic to RDS.

💡 Hint

Think about subnet types and limiting exposure of the database.

RDS should be in a private subnet without public IP. Access is controlled by security groups allowing only the web server's security group on the database port. Public IP or open internet access is insecure.

❓ security

advanced

RDS Encryption Key Management

You enabled encryption for your RDS instance using a customer-managed AWS KMS key. What happens if you delete this KMS key?

A The RDS instance data is decrypted automatically and remains accessible.

B The RDS instance and its data become inaccessible because the encryption key is deleted.

C The RDS instance automatically switches to a default AWS-managed key without downtime.

D The RDS instance continues working normally because encryption is only applied during backups.

💡 Hint

Consider the role of the KMS key in decrypting data at rest.

Deleting the customer-managed KMS key makes the encrypted data inaccessible because the key is required to decrypt data at rest. AWS does not automatically switch keys or decrypt data.

❓ service_behavior

expert

RDS Security Group Behavior with Multiple Rules

An RDS security group has two inbound rules: one allows TCP port 5432 from 10.0.0.0/24, and another allows TCP port 5432 from security group sg-12345. An EC2 instance with security group sg-12345 and IP 10.0.1.10 tries to connect on port 5432. What is the outcome?

A The connection is allowed because the EC2 instance's security group matches the allowed security group rule.

B The connection is denied because the EC2 instance's IP is outside the 10.0.0.0/24 CIDR range.

C The connection is denied because both rules must match for access to be granted.

D The connection is allowed only if the EC2 instance's IP is within 10.0.0.0/24.

💡 Hint

Remember how security group rules are evaluated in AWS.

Security group rules are evaluated with OR logic. If any rule allows the traffic, it is permitted. The EC2 instance's security group matches one rule, so connection is allowed despite IP being outside the CIDR range.