RDS security (encryption, security groups) in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding RDS Encryption at Rest

Which statement correctly describes how encryption at rest works for an AWS RDS instance?

A Encryption at rest encrypts the data stored on the disk and backups using AWS KMS keys.

B Encryption at rest encrypts data only during transmission between the client and the RDS instance.

C Encryption at rest requires manual encryption of data before storing it in the database.

D Encryption at rest is enabled by default for all RDS instances regardless of configuration.

💡 Hint

Think about what 'at rest' means in terms of data storage.

Encryption at rest means data stored on disk and backups are encrypted using AWS KMS keys. It does not encrypt data in transit or require manual encryption.

❓ Configuration

intermediate

RDS Security Group Configuration

You want to allow only EC2 instances in a specific security group to access your RDS instance. Which security group rule should you add to the RDS security group?

A Inbound rule allowing TCP port 22 from the EC2 instances' security group ID.

B Outbound rule allowing all traffic to the EC2 instances' security group ID.

C Inbound rule allowing TCP port 3306 from the EC2 instances' security group ID.

D Inbound rule allowing UDP port 3306 from the EC2 instances' security group ID.

💡 Hint

Consider the default port for MySQL and the direction of traffic for database access.

RDS instances require inbound rules allowing the database port (e.g., 3306 for MySQL) from the EC2 security group. SSH (port 22) or UDP are incorrect.

❓ Architecture

advanced

Designing Secure RDS Access in a VPC

You have an RDS instance in a private subnet inside a VPC. You want to allow access only from a web server in a public subnet. Which architecture and security group setup is best?

A Create a security group for the RDS allowing inbound traffic on port 22 from the web server's security group.

B Assign a public IP to the RDS instance and allow inbound traffic from anywhere on the database port.

C Place the RDS instance in the public subnet and allow inbound traffic from the internet on the database port.

D Create a security group for the RDS allowing inbound traffic on the database port from the web server's security group. The web server is in the public subnet with a security group allowing outbound traffic to RDS.

💡 Hint

Think about subnet types and limiting exposure of the database.

RDS should be in a private subnet without public IP. Access is controlled by security groups allowing only the web server's security group on the database port. Public IP or open internet access is insecure.

❓ security

advanced

RDS Encryption Key Management

You enabled encryption for your RDS instance using a customer-managed AWS KMS key. What happens if you delete this KMS key?

A The RDS instance data is decrypted automatically and remains accessible.

B The RDS instance and its data become inaccessible because the encryption key is deleted.

C The RDS instance automatically switches to a default AWS-managed key without downtime.

D The RDS instance continues working normally because encryption is only applied during backups.

💡 Hint

Consider the role of the KMS key in decrypting data at rest.

Deleting the customer-managed KMS key makes the encrypted data inaccessible because the key is required to decrypt data at rest. AWS does not automatically switch keys or decrypt data.

❓ service_behavior

expert

RDS Security Group Behavior with Multiple Rules

An RDS security group has two inbound rules: one allows TCP port 5432 from 10.0.0.0/24, and another allows TCP port 5432 from security group sg-12345. An EC2 instance with security group sg-12345 and IP 10.0.1.10 tries to connect on port 5432. What is the outcome?

A The connection is allowed because the EC2 instance's security group matches the allowed security group rule.

B The connection is denied because the EC2 instance's IP is outside the 10.0.0.0/24 CIDR range.

C The connection is denied because both rules must match for access to be granted.

D The connection is allowed only if the EC2 instance's IP is within 10.0.0.0/24.

💡 Hint

Remember how security group rules are evaluated in AWS.

Security group rules are evaluated with OR logic. If any rule allows the traffic, it is permitted. The EC2 instance's security group matches one rule, so connection is allowed despite IP being outside the CIDR range.

Practice

1. What does enabling storage_encrypted on an AWS RDS instance do?

easy

A. It encrypts the data stored on the disk to protect it at rest.

B. It encrypts data only during transfer between client and database.

C. It automatically backs up the database to another region.

D. It restricts access to the database based on IP addresses.

Solution

1. Step 1: Understand storage encryption purpose

   Storage encryption protects data saved on disk, making it unreadable without keys.

2. Step 2: Differentiate encryption types

   Encryption at rest means data on disk is encrypted; encryption in transit protects data moving over network.

3. Final Answer:

   It encrypts the data stored on the disk to protect it at rest. -> Option A

4. Quick Check:

   Storage encryption = data safe at rest [OK]

Hint: Storage encryption means data on disk is protected [OK]

Common Mistakes:

• Confusing encryption at rest with encryption in transit
• Thinking storage_encrypted controls network access
• Assuming it automatically backs up data

2. Which of the following is the correct way to allow inbound traffic on port 3306 (MySQL) in an RDS security group?

easy

A. Allow inbound ICMP traffic on port 3306 from 0.0.0.0/0.

B. Allow outbound UDP traffic on port 3306 to any IP.

C. Allow inbound TCP traffic on port 3306 from the required IP range.

D. Allow inbound TCP traffic on port 22 from the required IP range.

Solution

1. Step 1: Identify correct protocol and port for MySQL

   MySQL uses TCP protocol on port 3306 for inbound connections.

2. Step 2: Confirm security group rule for inbound access

   Security groups must allow inbound TCP traffic on port 3306 from trusted IPs to permit database access.

3. Final Answer:

   Allow inbound TCP traffic on port 3306 from the required IP range. -> Option C

4. Quick Check:

   Inbound TCP 3306 = MySQL access allowed [OK]

Hint: Inbound TCP on port 3306 opens MySQL access [OK]

Common Mistakes:

• Using wrong protocol like UDP or ICMP
• Allowing outbound instead of inbound traffic
• Opening port 22 (SSH) instead of 3306

3. Given this security group rule for an RDS instance:
Inbound: TCP, Port 5432, Source: 192.168.1.0/24
Which client IP can connect successfully?

medium

A. 192.168.1.50

B. 192.168.2.10

C. 10.0.0.5

D. 172.16.0.1

Solution

1. Step 1: Understand CIDR range 192.168.1.0/24

   This range includes all IPs from 192.168.1.0 to 192.168.1.255.

2. Step 2: Check which IP falls inside this range

   192.168.1.50 is inside the range; others are outside.

3. Final Answer:

   192.168.1.50 -> Option A

4. Quick Check:

   192.168.1.0/24 includes 192.168.1.50 [OK]

Hint: Check if IP fits CIDR range to allow connection [OK]

Common Mistakes:

• Not understanding CIDR notation
• Assuming any 192.168.x.x IP is allowed
• Confusing inbound and outbound rules

4. You created an RDS instance with storage_encrypted: true but the console shows encryption as disabled. What is the likely cause?

medium

A. Encryption can only be enabled after instance creation.

B. The security group does not allow inbound traffic on the database port.

C. The IAM role lacks permissions to enable encryption.

D. The RDS instance was created from a snapshot that was not encrypted.

Solution

1. Step 1: Understand encryption behavior on RDS creation

   Encryption must be enabled when creating the instance or from an encrypted snapshot.

2. Step 2: Identify snapshot encryption impact

   If created from an unencrypted snapshot, encryption cannot be enabled later.

3. Final Answer:

   The RDS instance was created from a snapshot that was not encrypted. -> Option D

4. Quick Check:

   Unencrypted snapshot blocks encryption [OK]

Hint: Encryption depends on snapshot encryption at creation [OK]

Common Mistakes:

• Thinking encryption can be toggled anytime
• Confusing security group issues with encryption status
• Assuming IAM permissions control encryption flag

5. You want to secure an RDS instance so only your application servers in a private subnet can connect, and data is encrypted at rest. Which combination is best?

hard

A. Disable encryption and allow inbound from 0.0.0.0/0 for easy access.

B. Enable storage_encrypted on RDS and configure security group to allow inbound from private subnet CIDR only.

C. Enable encryption but allow inbound from all IPs to avoid connection issues.

D. Use a public subnet for RDS and restrict access by username only.

Solution

1. Step 1: Enable storage encryption for data safety

   Setting storage_encrypted ensures data is encrypted at rest.

2. Step 2: Restrict access via security group to private subnet

   Allowing inbound only from private subnet CIDR limits access to trusted app servers.

3. Final Answer:

   Enable storage_encrypted on RDS and configure security group to allow inbound from private subnet CIDR only. -> Option B

4. Quick Check:

   Encryption + restricted SG = secure RDS [OK]

Hint: Encrypt data and restrict SG to private subnet [OK]

Common Mistakes:

• Allowing open access (0.0.0.0/0) to RDS
• Disabling encryption for convenience
• Using public subnet exposing RDS to internet