DBS-C01 Practice Test 11 — 15 Questions

Question 1

A company is designing a disaster recovery strategy for an Amazon Aurora MySQL database. The database stores sensitive data that must be encrypted at rest. The primary region is us-east-1, and the secondary region is us-west-2. Which THREE steps are required to set up cross-region replication with encryption at rest?

Accepted Answer

Use a multi-Region KMS key to encrypt the Aurora cluster in the primary region.. Option A is correct because using a multi-Region KMS key allows the Aurora cluster in the primary region to be encrypted at rest with a key that can be replicated to the secondary region, ensuring that the cross-region read replica can decrypt the data without needing to re-encrypt it. This key is replicated automatically by AWS KMS to the secondary region, maintaining the same key material for encryption and decryption across regions.

Answer

Ensure the DB cluster parameter group is the same in both regions.

Answer

Create a cross-Region read replica in the secondary region.

Question 2

A company uses Amazon DynamoDB with a table that stores sensitive customer data. The security team requires that all data at rest be encrypted using a customer-managed AWS KMS key (CMK). Additionally, the company needs to ensure that only specific IAM roles can access the table. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Configure the DynamoDB table to use AWS KMS encryption with a CMK. Create an IAM role with a policy that grants access to the table and includes a condition that the encryption context matches the CMK.. Option D is correct because it combines DynamoDB encryption at rest with a customer-managed KMS CMK and uses an IAM role policy with an encryption context condition. This ensures that only specific IAM roles can access the table, and the encryption context condition ties the KMS key usage to the table, providing fine-grained access control with minimal operational overhead. The encryption context is automatically set by DynamoDB to the table ARN, so the condition key `kms:EncryptionContext:aws:dynamodb:tableName` can be used to restrict decryption to that specific table.

Answer

Enable encryption at rest using AWS KMS with a CMK and use column-level encryption with AWS KMS to restrict access.

Answer

Attach a resource-based policy to the DynamoDB table that grants access only to the specific IAM roles.

Answer

Use a DynamoDB Accelerator (DAX) cluster with encryption at rest using a CMK, and attach a resource-based policy to the table.

Answer

Configure the DynamoDB table to use AWS KMS encryption with a CMK, and attach a key policy to the CMK that allows only the specific IAM roles.

Question 3

A company is using Amazon RDS for MySQL with Multi-AZ deployment. The security team wants to ensure that database administrators cannot view sensitive data. Which TWO actions should be taken to achieve this goal?

Accepted Answer

Use IAM database authentication for application access.. Option A is correct because IAM database authentication allows you to authenticate to your RDS MySQL instance using an IAM user or role instead of a traditional database password. This eliminates the need for database administrators to know or manage database credentials, as they can only access the database through IAM policies that grant specific, auditable permissions. By using IAM authentication, you enforce a separation of duties where DBAs cannot view sensitive data unless explicitly authorized by IAM policies.

Answer

Enable audit logging to capture all data access.

Answer

Enable encryption at rest using a customer-managed KMS key.

Answer

Disable query logging to prevent sensitive data from being written to logs.

Question 4

A company stores financial data in an Amazon Aurora MySQL DB cluster. The security team requires that database audit logs be stored in Amazon CloudWatch Logs and encrypted at rest using a customer-managed KMS key. The database specialist enables audit log publishing to CloudWatch Logs and specifies a KMS key for log encryption. However, the audit logs are not appearing in CloudWatch Logs. What is the most likely cause?

Accepted Answer

The IAM role used for publishing logs does not have the necessary permissions to use the KMS key for CloudWatch Logs.. When publishing database audit logs to CloudWatch Logs with a customer-managed KMS key, the IAM role used by RDS must have explicit permissions for the `kms:Encrypt` and `kms:Decrypt` actions on the KMS key. Without these permissions, RDS cannot encrypt the log stream, and the logs will not appear. Option C correctly identifies this missing permission as the most likely cause.

Answer

The CloudWatch Logs log group does not exist and RDS cannot create it automatically.

Answer

The DB cluster is not configured to export error logs, only audit logs.

Answer

CloudWatch Logs does not support encryption with customer-managed KMS keys for audit logs.

Answer

The audit log parameter is static and requires a DB cluster reboot after modification.

Question 5

A company uses Amazon RDS for MySQL with encryption at rest enabled. The security team mandates that all access to the database must be authenticated using IAM database authentication. The database administrator has created a user 'app_user' and granted appropriate privileges. However, when the application tries to connect using an IAM authentication token, it receives an 'Access denied' error. Which action should be taken to resolve this issue?

Accepted Answer

Ensure the IAM role used by the application has a name that matches the database user 'app_user' and has the necessary policy attached.. Option C is correct because IAM database authentication for RDS MySQL requires that the database user name matches the IAM role or user name used to generate the authentication token. The IAM role must have a policy that allows the `rds-db:connect` action with a resource ARN specifying the database user. Without this exact match, the authentication token is rejected, resulting in an 'Access denied' error.

Answer

Create a password for 'app_user' and use that password in the connection string.

Answer

Modify the security group to allow inbound traffic on port 3306 from the application's IP address.

Answer

Download the latest Amazon RDS CA certificate and add it to the application trust store.

Question 6

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The compliance team requires that all database connections use SSL/TLS and that users authenticate using IAM database authentication. The database migration is completed, but the application team reports that connections using IAM authentication are failing. The company has already enabled IAM database authentication on the RDS instance. What is the most likely cause of the failure?

Accepted Answer

The database user has not been granted the necessary privileges for IAM authentication.. Option C is correct because IAM database authentication requires that the database user be created with the `IDENTIFIED WITH AWS_AUTHENTICATION` clause in Oracle. Without this privilege, the RDS instance will reject IAM-authenticated connections even if IAM authentication is enabled at the instance level. The application team must ensure the database user has been granted the `AWS_ORACLE_EXTENSIONS` role and that the user is mapped to an IAM policy allowing `rds-db:connect`.

Answer

The application is using an outdated root CA certificate for SSL.

Answer

The Security Group does not allow inbound traffic from the application.

Answer

The RDS instance is using a different KMS key for encryption.

Question 7

A financial services company uses Amazon DynamoDB to store sensitive customer data. The security team requires that all data at rest be encrypted using a customer-managed AWS KMS key (CMK) with automatic rotation enabled. The DynamoDB table was created with the default AWS-managed key. Which steps are necessary to transition to a customer-managed CMK while minimizing downtime and data loss?

Accepted Answer

Export the table data to Amazon S3, create a new DynamoDB table with the new CMK, import the data, and update the application to use the new table.. Option B is correct because DynamoDB does not support in-place modification of the encryption key for an existing table. To transition from an AWS-managed key to a customer-managed CMK, you must export the table data to Amazon S3, create a new DynamoDB table configured with the new CMK, import the data, and update the application to point to the new table. This approach minimizes downtime by allowing the original table to serve reads/writes during the export and import process, and avoids data loss by using DynamoDB's native export and import features.

Answer

Modify the DynamoDB table to update the encryption key to the new CMK using the AWS Console.

Answer

Disable encryption at rest, then re-enable it with the new CMK.

Answer

Update the KMS key policy to grant DynamoDB access to the new CMK, then rotate the key.

Question 8

Match each AWS database feature to its description.

Question 9

Match each RDS storage type to its description.

Question 10

A database engineer is troubleshooting high CPU usage on an Amazon RDS for PostgreSQL instance. Amazon CloudWatch shows CPU Utilization consistently above 90% during business hours. Which combination of actions should the engineer take to identify the root cause? (Choose TWO.)

Accepted Answer

Review the slow query log to identify long-running queries.. Option B is correct because reviewing the slow query log directly identifies long-running queries that can cause sustained high CPU usage on RDS for PostgreSQL. Option D is correct because Performance Insights provides a visual dashboard of database load and top SQL queries, making it easy to pinpoint which queries are consuming the most CPU resources.

Answer

Enable Enhanced Monitoring and review OS process list.

Answer

Scale up the DB instance to a larger instance class.

Answer

Install pg_stat_statements extension and query it.

Question 11

A security team needs to grant an IAM user permission to modify only the 'db_secrets' secret in AWS Secrets Manager. Which IAM policy statement is correct?

Accepted Answer

{ 'Effect': 'Allow', 'Action': 'secretsmanager:PutSecretValue', 'Resource': 'arn:aws:secretsmanager:us-east-1:123456789012:secret:db_secrets-??????' }. Option D is correct because it restricts to the specific secret ARN. Option A allows all secrets. Option B allows all secrets with 'db_secrets' in name. Option C allows all secrets.

Answer

{ 'Effect': 'Allow', 'Action': 'secretsmanager:UpdateSecret', 'Resource': '*' }

Answer

{ 'Effect': 'Allow', 'Action': 'secretsmanager:*', 'Resource': '*' }

Answer

{ 'Effect': 'Allow', 'Action': 'secretsmanager:PutSecretValue', 'Resource': 'arn:aws:secretsmanager:us-east-1:123456789012:secret:*' }

Question 12

A company needs to store and query time-series data from IoT sensors. The data is written continuously and queried by time range for dashboards. Which AWS database service is most cost-effective and scalable for this workload?

Accepted Answer

Amazon Timestream.. Amazon Timestream is purpose-built for time-series data, offering automatic tiering between in-memory and magnetic stores for cost efficiency, and built-in functions for time-based aggregations and windowed queries. It is serverless and scales automatically to handle continuous writes from IoT sensors and low-latency dashboard queries by time range, making it the most cost-effective and scalable choice.

Answer

Amazon ElastiCache for Redis with time-series data structures.

Answer

Amazon DynamoDB with time-based partition keys.

Answer

Amazon RDS for PostgreSQL with time-based indexing.

Question 13

A company needs to implement a database solution for a global e-commerce platform that requires strongly consistent reads and writes with automatic failover across AWS Regions. Which service should be used?

Accepted Answer

Amazon Aurora Global Database.. Amazon Aurora Global Database is the correct choice because it provides strongly consistent reads and writes across multiple AWS Regions with automatic failover. It uses a primary cluster in one Region and up to five secondary read-only clusters in other Regions, with replication typically under one second. Failover to a secondary Region can be promoted in as little as one minute, meeting the requirements for a global e-commerce platform.

Answer

Amazon DynamoDB global tables.

Answer

Amazon RDS for MySQL with Multi-AZ and cross-Region read replicas.

Answer

Amazon ElastiCache for Redis with Global Datastore.

Question 14

A company uses Amazon DynamoDB for a session management workload. The access pattern is random and requires single-digit millisecond latency. The table has a read capacity of 5000 RCU. During peak hours, read requests occasionally exceed this capacity, causing throttling. Which design change is most appropriate to handle traffic spikes?

Accepted Answer

Enable DynamoDB auto scaling for reads.. Option C is correct because DynamoDB auto scaling allows the table to dynamically adjust its provisioned read capacity (RCU) in response to traffic spikes, preventing throttling while maintaining single-digit millisecond latency. This is the most appropriate design change for a session management workload with random access patterns, as it handles occasional bursts without requiring manual intervention or architectural changes.

Answer

Switch to DynamoDB on-demand mode.

Answer

Add a global secondary index with different partition key.

Answer

Add a DAX cluster to cache read requests.

Question 15

A company is designing a social media application that requires storing user relationships (follows) and making graph queries like 'mutual friends.' Which database is most suitable?

Accepted Answer

Amazon Neptune. Amazon Neptune is a fully managed graph database service optimized for storing and querying highly connected data. It supports both property graph and RDF models, and it uses Gremlin or SPARQL to efficiently traverse relationships like 'mutual friends' in a social media application, making it the ideal choice for graph queries.

Answer

Amazon ElastiCache for Redis

Answer

Amazon DynamoDB

Answer

Amazon RDS for MySQL