DBS-C01 Practice Test 12 — 15 Questions

Question 1

A company wants to automate backups for an Amazon RDS for PostgreSQL DB instance. The backup retention period should be 35 days. Which step is required?

Accepted Answer

Enable automated backups with a retention period of 35 days.. Amazon RDS for PostgreSQL supports automated backups with a configurable retention period of up to 35 days. By enabling automated backups and setting the retention period to 35 days, the company meets the requirement without additional tooling or manual effort. Automated backups include transaction logs for point-in-time recovery, which is not available with manual snapshots alone.

Answer

Use AWS Backup to schedule backups.

Answer

Create a manual snapshot every day and delete after 35 days.

Answer

Set up a cross-region snapshot copy.

Question 2

A company is using Amazon DynamoDB to store sensitive customer data. They need to ensure that all data is encrypted at rest using a customer-managed AWS KMS key. The company also wants to rotate the KMS key every year. What is the simplest way to achieve key rotation?

Accepted Answer

Enable automatic key rotation in AWS KMS for the customer-managed key.. AWS KMS supports automatic annual key rotation for customer-managed KMS keys, which rotates the backing key material while preserving the same key ID, ARN, and aliases. Because DynamoDB references the key by ARN/ID, enabling rotation requires no changes to the DynamoDB table configuration. This is the simplest, least disruptive way to satisfy the yearly rotation requirement.

Answer

Create a new KMS key every year and update the DynamoDB table to use the new key.

Answer

Manually rotate the key by deleting and recreating the KMS key each year.

Answer

Import new key material into the existing KMS key every year.

Question 3

A company needs to encrypt data at rest for their Amazon Aurora PostgreSQL database. Which solution is the MOST secure and requires the least operational overhead?

Accepted Answer

Enable encryption at rest using AWS KMS when creating the Aurora cluster.. Enabling encryption at rest using AWS KMS when creating the Aurora cluster is the most secure and least operational overhead because it integrates seamlessly with Aurora, automatically encrypts data, backups, and snapshots, and requires no application changes. KMS manages keys, and you can use AWS-managed or customer-managed keys for additional control.

Answer

Use Amazon EBS encryption on the underlying volumes.

Answer

Encrypt the database after creation by modifying the DB instance.

Answer

Use client-side encryption in the application.

Question 4

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database is 2 TB in size and has a high transaction rate. The migration must have minimal downtime. Which migration strategy should a database specialist recommend?

Accepted Answer

Use AWS DMS with ongoing replication to capture changes.. AWS Database Migration Service (DMS) with ongoing replication (change data capture) performs a full load followed by continuous replication of changes from the source Oracle database to RDS for Oracle. This enables cutover with minimal downtime because the target stays in sync until the application is switched over.

Answer

Copy the data files to Amazon S3 and then load into RDS.

Answer

Use Oracle Data Pump to export and import the database.

Answer

Perform an RMAN backup and restore to RDS.

Question 5

A company runs a MySQL database on Amazon RDS and wants to capture data changes to replicate to a separate reporting database. Which AWS service should be used to capture these changes with minimal impact on the source database?

Accepted Answer

Use AWS Database Migration Service (DMS) with ongoing replication enabled.. AWS DMS with ongoing replication (change data capture) is the correct choice because it reads the binary logs (binlog) from the source RDS MySQL instance to capture inserts, updates, and deletes with minimal overhead. DMS uses a dedicated replication instance and can apply changes to a separate reporting database without requiring schema changes or additional load from application-level polling. This approach is fully managed and designed for low-impact, continuous replication.

Answer

Use Amazon DynamoDB Streams to capture changes from the RDS instance.

Answer

Enable MySQL native replication from the RDS instance to the reporting database.

Answer

Use Amazon Kinesis Data Streams with a custom application to poll the binlog.

Question 6

A developer is troubleshooting an application that uses Amazon DynamoDB. The application is experiencing throttled requests (ProvisionedThroughputExceededException). Which CloudWatch metric should be monitored to troubleshoot this issue?

Accepted Answer

ThrottledRequests. ThrottledRequests is a CloudWatch metric that directly counts the number of requests that were throttled due to exceeding provisioned throughput. For troubleshooting throttling issues, this metric provides immediate visibility into when throttling occurs. ConsumedWriteCapacityUnits (option D) shows capacity usage but does not directly indicate throttling; high consumption may lead to throttling but is not a direct measure. SuccessfulRequestLatency (option B) measures latency, not throttling, and UserErrors (option C) tracks client-side errors like invalid parameters, not capacity-related throttling.

Answer

SuccessfulRequestLatency

Answer

UserErrors

Answer

ConsumedWriteCapacityUnits

Question 7

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The database is experiencing increased latency and the application team reports slow queries. The DBA wants to identify the queries that consume the most resources. Which AWS service should be used to capture and analyze these queries?

Accepted Answer

Amazon RDS Performance Insights. Amazon RDS Performance Insights provides database performance tuning and monitoring with query-level metrics, enabling identification of resource-intensive queries. Option B is wrong because CloudWatch Logs collects log files but does not capture query-level performance. Option C is wrong because Enhanced Monitoring provides OS-level metrics (CPU, memory) but not query-level details. Option D is wrong because CloudTrail records AWS API activity, not database queries.

Answer

Amazon CloudWatch Logs

Answer

Amazon RDS Enhanced Monitoring

Answer

AWS CloudTrail

Question 8

A company is using Amazon DynamoDB and wants to restrict access to a specific table so that only users in a particular IAM group can perform read and write operations. Which THREE steps should be taken to achieve this?

Accepted Answer

Create an IAM policy that allows dynamodb:GetItem, dynamodb:PutItem, etc. on the specific table ARN.. The correct answers are A, B, and D. To restrict access to a specific DynamoDB table, you create an IAM policy that allows the required DynamoDB actions on that table's ARN (A). You then attach that policy to an IAM group (B), and add the users who need access to that group (D). Options C and E are incorrect because DynamoDB does not support resource-based policies, and IAM roles are not directly assigned to tables for access control.

Answer

Attach a resource-based policy to the DynamoDB table allowing access from the group.

Answer

Create an IAM role and assign it to the table.

Question 9

A database specialist manages an Amazon DynamoDB table for a retail application. The table uses provisioned capacity mode and stores point-in-time recovery backups. A new compliance rule requires that a copy of the table's data be retained for seven years in a cost-effective storage tier, and that the copy must be queryable with Amazon Athena without loading it into another database. Which solution should the specialist implement?

Accepted Answer

Export the table to Amazon S3 using the native DynamoDB export to S3 feature and query the exported data with Amazon Athena.. DynamoDB's native export to Amazon S3 creates a full snapshot of the table without consuming provisioned read capacity and without impacting table performance. Because the export lands in S3, lifecycle policies can move the data to lower-cost storage classes for long-term retention, and Athena can query the exported objects directly. Streams, DMS replication, and point-in-time recovery either capture only changes, add unnecessary cost, or retain data in the wrong place.

Answer

Use AWS Database Migration Service to continuously replicate the DynamoDB table to an Amazon S3 bucket in CSV format for Athena queries.

Answer

Enable DynamoDB Streams on the table and use an AWS Lambda function to archive each stream record to Amazon S3 in Apache Parquet format for Athena queries.

Answer

Enable point-in-time recovery on the table, then restore the table to a new table and run Athena queries against the restored table using the Athena DynamoDB connector.

Question 10

A security engineer needs to ensure that all access to an Amazon DynamoDB table is encrypted in transit. Which configuration achieves this?

Accepted Answer

Ensure all client applications use the DynamoDB HTTPS endpoint.. DynamoDB uses HTTPS for all API calls by default, ensuring encryption in transit. Option A is incorrect because configuring a VPC endpoint does not enable encryption; it provides private connectivity, but encryption in transit is already handled by HTTPS. Option C is incorrect because placing DynamoDB behind CloudFront is not a valid configuration; CloudFront is a CDN for content delivery, not for securing database access. Option D is incorrect because DynamoDB does not have an 'ssl_enabled' parameter; encryption in transit is always enforced via HTTPS.

Answer

Configure a VPC endpoint for DynamoDB and enable encryption.

Answer

Place the DynamoDB table behind Amazon CloudFront.

Answer

Enable SSL on the DynamoDB table by setting the 'ssl_enabled' parameter.

Question 11

A company uses Amazon RDS for PostgreSQL with Multi-AZ deployment. The security team wants to ensure that any access to the database is logged, including SELECT queries. What should be done to capture these logs?

Accepted Answer

Modify the DB parameter group to enable query logging and publish logs to Amazon CloudWatch Logs.. Enabling RDS Enhanced Monitoring does not capture query logs. Enabling automatic backups does not log queries. Enabling RDS Performance Insights does not log queries. To capture SELECT queries, you need to enable PostgreSQL query logging by setting the appropriate parameter group parameters (e.g., log_statement = 'all' or 'mod') and then export logs to CloudWatch Logs.

Answer

Enable automated backups and export logs to Amazon S3.

Answer

Enable RDS Performance Insights.

Answer

Enable RDS Enhanced Monitoring.

Question 12

Which THREE factors should be considered when choosing between Amazon RDS and Amazon DynamoDB for a new application? (Choose 3.)

Accepted Answer

Access patterns (predictable vs. ad-hoc). Option C is correct because access patterns drive the choice: DynamoDB excels at known, key-based, predictable access at scale, while RDS suits ad-hoc queries via SQL. Option D is correct because DynamoDB scales horizontally with partition keys and on-demand/provisioned capacity, whereas RDS primarily scales vertically by resizing instances (with read replicas for read scaling). Option E is correct because RDS supports complex joins, aggregations, and multi-table transactions through SQL, while DynamoDB has limited join support and requires denormalization or secondary indexes. Option A is not a primary differentiator since both services charge for storage and capacity in different ways, and Option B is not decisive because both RDS and DynamoDB support encryption at rest (KMS).

Answer

Cost of storage

Answer

Need for encryption at rest

Question 13

A company is designing a database for an e-commerce application that needs to store product catalog data. The data is highly structured with relationships between products, categories, and suppliers. The application requires ACID transactions to maintain data integrity when updating inventory. The company expects moderate read and write traffic. Which AWS database service is MOST suitable for this workload?

Accepted Answer

Amazon RDS for MySQL. Amazon RDS for MySQL is the most suitable choice because it provides a fully managed relational database that supports ACID transactions, which are essential for maintaining data integrity during inventory updates. The highly structured nature of product catalog data with relationships between products, categories, and suppliers maps naturally to MySQL's relational model with foreign keys and joins. RDS for MySQL handles moderate read/write traffic efficiently and offers features like Multi-AZ for high availability and read replicas for scaling reads.

Answer

Amazon ElastiCache for Redis

Answer

Amazon Neptune

Answer

Amazon DynamoDB

Question 14

A company runs a MongoDB workload on Amazon EC2 and wants to migrate to Amazon DocumentDB. The database has a total size of 2 TB and experiences 10,000 writes per second during peak. Which migration strategy minimizes downtime?

Accepted Answer

Use AWS DMS with continuous replication.. AWS DMS with continuous replication (change data capture) is the correct strategy because it allows you to keep the source MongoDB and target DocumentDB synchronized in near-real time, minimizing downtime to a brief cutover window. For a 2 TB database with 10,000 writes per second, a full export/import would take hours and require significant downtime, while DMS handles the initial full load and then continuously applies ongoing changes until you switch over.

Answer

Export data using mongodump and import with mongorestore.

Answer

Use AWS Glue to stream data to DocumentDB.

Answer

Copy data files to Amazon S3 and load into DocumentDB.

Question 15

An application uses an Amazon RDS for MySQL database. The security team requires that all traffic to the database be encrypted in transit. Which configuration ensures this?

Accepted Answer

Create a custom DB parameter group with the require_secure_transport parameter set to ON.. The require_secure_transport parameter in a custom DB parameter group enforces SSL/TLS encryption for all connections to the RDS for MySQL instance. Setting it to ON ensures that unencrypted connections are rejected, meeting the security requirement for encryption in transit. This is the correct configuration because it directly controls transport-layer security at the database level.

Answer

Use the default RDS parameter group.

Answer

Configure the security group to allow only port 3306 from the application.

Answer

Use a network ACL to restrict inbound traffic to port 3306.