DBS-C01 Practice Test 10 — 10 Questions

Question 1

A company uses Amazon RDS for SQL Server with Multi-AZ deployment. The security team wants to ensure that all database connections use SSL/TLS encryption. Which TWO actions should the database specialist take to enforce SSL connections? (Choose two.)

Accepted Answer

Create a server-level trigger that requires SSL for all logins.. Option C is correct because SQL Server allows you to create a server-level DDL trigger that checks the login event and enforces SSL by examining the `@@OPTIONS` or `encrypt_option` in `sys.dm_exec_connections`. This is a supported method to force SSL for all connections to an RDS for SQL Server instance. Option E is correct because setting the `rds.force_ssl` parameter to 1 in the DB parameter group is the native RDS mechanism to enforce SSL/TLS for all connections to the DB instance.

Answer

Use the RDS Console to enable 'Force SSL' on the DB instance.

Answer

Modify the DB parameter group to set 'require_secure_transport' to ON.

Answer

Add an inbound rule to the security group that only allows traffic on port 1433 from IP addresses that use SSL.

Question 2

A developer reports that an application using Amazon DynamoDB is experiencing high latency during peak hours. The table has a provisioned capacity of 500 read capacity units (RCUs) and 500 write capacity units (WCUs). The application uses eventually consistent reads and the table is about 50 GB. The developer notices throttled write requests in CloudWatch. Which action would most effectively reduce write throttling?

Accepted Answer

Increase the provisioned write capacity for the table.. The developer reports throttled write requests, which directly indicates that the provisioned write capacity (500 WCUs) is insufficient to handle the peak write traffic. Increasing the provisioned write capacity for the table is the most direct and effective action to eliminate write throttling, as it raises the limit on write operations per second. Option C is correct because it addresses the root cause—write capacity exhaustion—without introducing unnecessary components or changing read behavior.

Answer

Enable DynamoDB Accelerator (DAX) for the table.

Answer

Create a global secondary index on the table.

Answer

Switch from eventually consistent reads to strongly consistent reads.

Question 3

A team manages an Amazon Aurora MySQL database. They observe that the 'Deadlocks' metric in CloudWatch is spiking. The application uses a single writer instance and multiple read replicas. Which action is most effective at reducing deadlocks?

Accepted Answer

Review application code to ensure transactions are as short as possible and access tables in a consistent order.. Deadlocks in Aurora MySQL occur when two or more transactions hold locks that the other needs, and they wait indefinitely. The most effective way to reduce deadlocks is to keep transactions short and access tables in a consistent order, which minimizes lock contention and avoids circular wait conditions. This directly addresses the root cause of deadlocks, unlike scaling or redirecting traffic, which only reduce the probability of contention without fixing the underlying locking pattern.

Answer

Increase the instance size to handle more concurrent connections.

Answer

Redirect read traffic to read replicas to reduce load on the writer.

Answer

Enable Multi-AZ to distribute the load.

Question 4

A database specialist is troubleshooting an Amazon DynamoDB table that is experiencing high throttling on write requests. The table has on-demand capacity and uses a composite primary key (partition key and sort key). Which THREE actions should the specialist take to identify and resolve the issue?

Accepted Answer

Examine the partition key value distribution to identify hot partitions. Option A is correct because high throttling on write requests in DynamoDB often results from uneven partition key value distribution, creating 'hot partitions' that exceed the per-partition throughput limits. By examining the distribution, the specialist can identify which keys are causing the bottleneck and then apply strategies like write sharding or adjusting the partition key design to spread traffic evenly.

Answer

Change the table to provisioned capacity mode

Answer

Increase the read capacity units on the table

Question 5

A company runs an Amazon RDS for MySQL DB instance in a VPC. Security requirements mandate that only specific EC2 instances in the same VPC can connect to the database. The security group attached to the RDS instance currently allows inbound traffic on port 3306 from 0.0.0.0/0. Which combination of steps should a database specialist take to meet the security requirement without impacting existing application connectivity? (Choose two.)

Accepted Answer

Remove the inbound rule for 0.0.0.0/0 on the RDS security group.. Option B is correct because removing the overly permissive inbound rule for 0.0.0.0/0 on the RDS security group eliminates unrestricted access, which is a direct violation of the security requirement. Option C is correct because adding an inbound rule that references the security group ID of the EC2 instances allows traffic only from those instances, leveraging security group referencing for granular, stateful access control within the same VPC.

Answer

Modify the network ACL for the DB subnet to allow inbound port 3306 from the EC2 instance's private IP.

Answer

Modify the DB subnet group to place the RDS instance in a public subnet with a route to the EC2 instance.

Answer

Add an inbound rule to the RDS security group allowing traffic from the VPC CIDR on port 3306.

Question 6

A database engineer is monitoring an Amazon RDS for PostgreSQL instance and notices that the 'DiskQueueDepth' metric is consistently above 100. The instance uses gp2 storage with 1000 GB allocated. What is the most likely cause of the high disk queue depth?

Accepted Answer

The instance has reached the IOPS limit of the gp2 volume. Option B is correct because a consistently high DiskQueueDepth (above 100) on an Amazon RDS for PostgreSQL instance with gp2 storage indicates that the volume is saturating its IOPS limit. gp2 volumes provide a baseline of 3 IOPS per GB (up to 16,000 IOPS), so a 1000 GB gp2 volume has a baseline of 3000 IOPS. When the workload exceeds this baseline, the volume relies on burst credits, and once credits are exhausted, IOPS are throttled to the baseline, causing I/O requests to queue up and the DiskQueueDepth metric to rise.

Answer

Replication lag between the primary and standby instance

Answer

Insufficient memory allocated to the instance

Answer

Network throughput limit is being exceeded

Question 7

A company uses Amazon ElastiCache for Redis to cache session data. The security team requires that all data in transit be encrypted. The Redis cluster currently does not have encryption in transit enabled. The database specialist needs to enable encryption in transit with minimal downtime. Which action should the specialist take?

Accepted Answer

Create a new Redis cluster with encryption in transit enabled, and migrate the data from the existing cluster.. Encryption in transit for ElastiCache for Redis can only be enabled at cluster creation time; it cannot be added to an existing cluster. Therefore, the correct approach is to create a new Redis cluster with encryption in transit enabled, migrate the session data from the existing cluster (e.g., using replication or a manual export/import), and then redirect application traffic to the new cluster. This ensures minimal downtime if the migration is performed during a maintenance window or using a blue/green deployment strategy.

Answer

Update the Redis parameter group to enable the 'encryption-in-transit' parameter and reboot the cluster.

Answer

Use a security group to enforce encrypted connections by allowing only TLS traffic.

Answer

Modify the existing Redis cluster to enable encryption in transit using the AWS CLI.

Answer

Enable encryption in transit on the existing cluster by using the AWS Management Console.

Question 8

A database engineer is troubleshooting a production Amazon Aurora MySQL DB cluster. The application is experiencing high latency on write operations. The engineer checks the Amazon CloudWatch metrics and sees that the 'AuroraBinlogReplicaLag' metric is high. What is the most likely cause of the write latency?

Accepted Answer

The binlog replication to a downstream MySQL instance is falling behind. Option C is correct because the 'AuroraBinlogReplicaLag' metric specifically measures the lag between the Aurora MySQL cluster and an external MySQL instance that is replicating from Aurora using binary log (binlog) replication. When this lag is high, it indicates that the downstream MySQL instance is falling behind in applying binlog events, which can cause write operations on the Aurora cluster to stall or slow down due to the synchronous nature of binlog generation and the need to retain binlogs until they are consumed by the replica.

Answer

The DB cluster has insufficient storage capacity for the binlog files

Answer

The DB cluster has a high CPU utilization that is causing replication lag

Answer

A recent failover event caused the binlog to be replayed from the last checkpoint

Question 9

A database specialist is troubleshooting a connectivity issue with an Amazon RDS for PostgreSQL instance. The instance is in a VPC with a public subnet. The security group allows inbound traffic on port 5432 from the application server's IP address. The application server is in the same VPC but in a private subnet. Despite the security group configuration, the application cannot connect. Which action should the specialist take to resolve the issue?

Accepted Answer

Update the security group inbound rule to allow traffic from the application server's private IP address.. Option E is correct because the application server is in a private subnet, so it communicates with the RDS instance using its private IP address. The security group inbound rule must allow traffic from the application server's private IP (or the security group of the application server) on port 5432. The current rule only allows the application server's public IP, which is not used for traffic within the VPC, causing the connection failure.

Answer

Launch the RDS instance in the default VPC.

Answer

Change the DB subnet group to include the application server's subnet.

Answer

Add a network ACL rule allowing inbound traffic on port 5432 from the application server's public IP.

Answer

Modify the RDS instance to be publicly accessible.

Question 10

A company is running a production Amazon DynamoDB table with on-demand capacity. The application is experiencing increased latency and throttled requests during peak hours. Which monitoring tool should the database specialist use to identify the specific partition keys causing the throttling?

Accepted Answer

Amazon CloudWatch Contributor Insights for DynamoDB. Amazon CloudWatch Contributor Insights for DynamoDB is the correct tool because it analyzes DynamoDB request logs to identify the most frequently accessed partition keys, including those causing throttling. It provides top-N keys by request count or throttled events, enabling the database specialist to pinpoint hot partitions responsible for increased latency and throttled requests during peak hours.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS CloudTrail logs