DBS-C01 Practice Test 13 — 15 Questions

Question 1

A company is migrating an on-premises Oracle data warehouse to AWS. The warehouse contains 20 TB of data and supports complex SQL queries with joins and aggregations. The migration should minimize downtime and require minimal changes to existing SQL queries. Which database service is MOST appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon Redshift. Amazon Redshift is the most appropriate choice because it is a fully managed, petabyte-scale data warehouse service designed for complex SQL queries with joins and aggregations. It supports standard SQL with minimal changes to existing queries, and its columnar storage and massively parallel processing (MPP) architecture are optimized for analytical workloads. The 20 TB data size and requirement to minimize downtime align with Redshift's ability to perform online resizing and use features like RA3 nodes with managed storage for elastic scaling.

Answer

Amazon RDS for Oracle

Answer

Amazon DynamoDB

Answer

Amazon ElastiCache for Redis

Question 2

A company runs an Amazon RDS for MySQL DB instance in a VPC. Security requirements mandate that only specific EC2 instances in the same VPC can connect to the database. The security group attached to the RDS instance currently allows inbound traffic on port 3306 from 0.0.0.0/0. Which combination of steps should a database specialist take to meet the security requirement without impacting existing application connectivity? (Choose two.)

Accepted Answer

Remove the inbound rule for 0.0.0.0/0 on the RDS security group.. Removing the overly permissive inbound rule for 0.0.0.0/0 on the RDS security group eliminates unrestricted access, which is a direct violation of the security requirement. Option C is correct because adding an inbound rule that references the security group ID of the EC2 instances allows traffic only from those instances, leveraging security group referencing for granular, stateful access control within the same VPC.

Answer

Modify the network ACL for the DB subnet to allow inbound port 3306 from the EC2 instance's private IP.

Answer

Modify the DB subnet group to place the RDS instance in a public subnet with a route to the EC2 instance.

Answer

Add an inbound rule to the RDS security group allowing traffic from the VPC CIDR on port 3306.

Question 3

A company is deploying an Amazon Aurora MySQL database. The company requires that the database withstand the loss of two copies of data without impacting write availability. Which configuration should the company use?

Accepted Answer

Aurora with 6 copies of data across 3 Availability Zones. Aurora stores six copies of the data across three Availability Zones, with two copies in each AZ. This design tolerates the loss of an entire AZ plus one additional copy while still maintaining write availability, which satisfies the requirement to withstand the loss of two copies of data.

Answer

Aurora with 3 copies of data in 3 Availability Zones

Answer

Aurora with 2 copies of data in 2 Availability Zones

Answer

Aurora with 3 copies of data in 2 Availability Zones

Question 4

A company is using Amazon DynamoDB with AWS Lambda to process data. The Lambda function needs to read and write items to a DynamoDB table. The security team wants to follow the principle of least privilege. Which IAM policy statement should be attached to the Lambda execution role?

Accepted Answer

{"Effect":"Allow","Action":["dynamodb:GetItem","dynamodb:PutItem","dynamodb:UpdateItem","dynamodb:DeleteItem"],"Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/MyTable"}. It grants only the necessary DynamoDB actions (GetItem, PutItem, UpdateItem, DeleteItem) on the specific table. Option A is wrong because it grants full DynamoDB access on all resources, which is too permissive. Option B is wrong because it only allows DescribeTable and ListTables on all tables, which does not provide the read/write permissions needed. Option D is wrong because it allows all DynamoDB actions on a specific table, which is overly permissive and violates least privilege.

Answer

{"Effect":"Allow","Action":"dynamodb:*","Resource":"*"}

Answer

{"Effect":"Allow","Action":["dynamodb:DescribeTable","dynamodb:ListTables"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":"dynamodb:*","Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/MyTable"}

Question 5

Refer to the exhibit. An RDS for PostgreSQL instance shows frequent checkpoints every 10 seconds. What is the most likely cause?

Accepted Answer

The 'max_wal_size' parameter is set too low, causing frequent WAL switches.. Frequent checkpoints every 10 seconds in RDS for PostgreSQL are typically caused by the 'max_wal_size' parameter being set too low. When WAL (Write-Ahead Log) size exceeds max_wal_size, PostgreSQL triggers a checkpoint to flush dirty pages to disk, reducing recovery time. A low value causes frequent checkpoints, which can degrade performance.

Answer

Autovacuum is not running, causing bloat.

Answer

The instance is running out of storage space.

Answer

There are too many concurrent connections.

Question 6

A database specialist is responsible for an Amazon Aurora PostgreSQL DB cluster that supports a production application. Users report that read-only queries routed to Aurora Replicas sometimes return stale data that is several seconds behind the writer. The specialist must determine whether the lag is due to Aurora Replica lag or application read-after-write expectations. Which CloudWatch metric should be monitored to directly quantify Aurora Replica lag?

Accepted Answer

AuroraReplicaLag. AuroraReplicaLag is the precise metric that reports the replication delay in milliseconds for each Aurora Replica. When applications read from replicas, they may see stale data if the replica lags behind the writer. Monitoring this metric allows the specialist to confirm whether the stale reads are caused by replication lag and to take corrective action, such as redirecting reads to the writer or scaling replicas.

Answer

DBLoad

Answer

DiskQueueDepth

Answer

AuroraReplicaLagMaximum

Question 7

A company is designing a security strategy for Amazon RDS for SQL Server. Which TWO actions should be taken to encrypt data at rest? (Choose TWO.)

Accepted Answer

Enable Transparent Data Encryption (TDE) on the SQL Server database.. Option B is correct because Transparent Data Encryption (TDE) is the SQL Server-native feature that encrypts database files, log files, and backups at rest, and Amazon RDS for SQL Server supports enabling TDE so that data pages are encrypted before being written to storage. Option E is correct because RDS encryption at rest, when enabled at instance creation, uses AWS KMS customer master keys to encrypt the underlying storage volumes, snapshots, and automated backups for the DB instance. Option A is not correct because you cannot directly enable Amazon EBS encryption on the volumes underlying an RDS instance; RDS manages that storage and encryption is controlled through the RDS encryption-at-rest setting tied to KMS. Option C is not correct because CloudHSM is not the mechanism RDS uses to store encryption keys for RDS encryption at rest; RDS integrates with AWS KMS for key management. Option D is not correct because SSL/TLS encrypts data in transit between clients and the SQL Server instance, not data at rest.

Answer

Enable Amazon EBS encryption on the underlying volumes.

Answer

Use AWS CloudHSM to store encryption keys.

Answer

Enable SSL/TLS for connections.

Question 8

A company is migrating a 500 GB Oracle database to Amazon RDS for Oracle. They want to minimize downtime and use AWS DMS for ongoing replication. The source database is in a corporate data center behind a firewall. What is the recommended network setup for the DMS replication instance?

Accepted Answer

Deploy the DMS replication instance in a VPC that has a VPN or AWS Direct Connect connection to the corporate data center.. AWS DMS requires network connectivity between the replication instance and both the source and target databases. Since the source Oracle database is behind a corporate firewall, the DMS replication instance must be deployed in a VPC that has a VPN or AWS Direct Connect connection to the corporate data center. This establishes a private, secure, and low-latency network path for ongoing replication, minimizing downtime during migration.

Answer

Launch the DMS replication instance with a public IP address and allow inbound traffic from the corporate firewall.

Answer

Create a VPC endpoint for the DMS service and route traffic through it.

Answer

Install the DMS replication software on a server in the corporate data center to connect directly to the source.

Question 9

A company is running a MongoDB-compatible database on Amazon DocumentDB. The application performs frequent updates to a small subset of fields in documents. The company notices that write latency is high. What should the database specialist recommend to reduce write latency?

Accepted Answer

Review and remove unnecessary indexes on the collection.. Unnecessary indexes impose a write penalty on every insert, update, and delete operation. In Amazon DocumentDB, each write must update all indexes on the collection, so removing unused indexes reduces the per-document write overhead and directly lowers write latency for frequent updates to a small subset of fields.

Answer

Increase the instance size of the DocumentDB cluster.

Answer

Enable multi-master writes to distribute write load.

Answer

Change the storage type from standard to provisioned IOPS.

Question 10

A company is using Amazon DynamoDB with provisioned capacity for a table that experiences unpredictable traffic spikes. The table's read capacity is often underutilized, but occasionally throttling occurs. Which THREE steps should be taken to improve performance and cost? (Choose THREE.)

Accepted Answer

Switch the table to on-demand capacity mode.. Switching to on-demand capacity mode eliminates the need to manage provisioned capacity, automatically scaling to handle unpredictable traffic spikes without throttling. This improves performance by preventing throttling during spikes and optimizes cost by charging only for consumed reads/writes, avoiding the waste of underutilized provisioned capacity.

Answer

Reduce the provisioned read capacity units to save cost.

Answer

Disable auto scaling to avoid cost fluctuations.

Question 11

A company is building a microservices architecture and needs a database for a service that stores JSON documents with variable schema. The database must support high availability and automatic scaling. Which TWO services meet these requirements? (Choose two.)

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB (B) is correct because it is a fully managed NoSQL key-value and document database that natively stores JSON-style items with flexible, schema-less attributes, and it provides built-in high availability via multi-AZ replication plus automatic horizontal scaling of throughput and storage. Amazon DocumentDB (C) is correct because it is a fully managed document database with MongoDB compatibility, designed to store JSON-like documents with variable schema, and it supports high availability through a multi-AZ cluster with up to 15 read replicas and automatic storage scaling. Amazon ElastiCache for Redis (A) is an in-memory cache/store, not a durable primary document database for variable-schema JSON persistence. Amazon Neptune (D) is a graph database optimized for highly connected data using nodes and edges, not general JSON document storage. Amazon RDS for MySQL (E) is a relational database with a fixed schema, so it does not natively fit variable-schema JSON documents or the same automatic scaling model.

Answer

Amazon ElastiCache for Redis

Answer

Amazon Neptune

Answer

Amazon RDS for MySQL

Question 12

A developer is trying to connect to an RDS for PostgreSQL instance using the endpoint shown in the exhibit. The connection fails with a timeout. Which of the following is the most likely cause?

Accepted Answer

The security group does not allow inbound traffic on port 5432 from the client IP.. The most likely cause is that the security group does not allow inbound traffic on port 5432 from the client IP, causing a timeout. Option A is incorrect because the endpoint is correctly provided by AWS; an incorrect endpoint would produce a different error. Option B is incorrect because SSL encryption is not required by default; if it were, the error would be an SSL handshake failure, not a timeout. Option D is incorrect because Multi-AZ configurations use the same endpoint; no separate endpoint is needed.

Answer

The endpoint address is incorrect.

Answer

The DB instance requires SSL encryption to connect.

Answer

The DB instance is in a Multi-AZ configuration and requires a different endpoint.

Question 13

A company is using Amazon DynamoDB for a gaming leaderboard. The table has a partition key of 'game_id' and a sort key of 'score'. The table is configured with on-demand capacity. During a major tournament, the application experiences high latency and some requests return 'ProvisionedThroughputExceededException' errors. The CloudWatch metric 'ThrottledRequests' spikes. The application uses a single partition key for all writes during the tournament (game_id = 'tournament_final'). What is the most likely cause of the throttling, and what is the best solution?

Accepted Answer

The application is using a single partition key, causing all writes to go to one partition. The team should redesign the partition key to distribute writes across multiple partitions. The throttling is caused by using a single partition key ('tournament_final') for all writes, which concentrates all write activity on one partition. DynamoDB partitions have a maximum throughput limit (e.g., 1,000 WCU per partition for on-demand), so a single partition key cannot scale beyond that limit. The best solution is to redesign the partition key to distribute writes across multiple partitions, such as using a composite key or adding a random suffix.

Answer

The application is using a single partition key, causing all writes to go to one partition. The team should implement DAX to cache writes

Answer

The table has a global secondary index that is throttling writes; the team should remove the GSI

Answer

The table is using on-demand capacity, which has a maximum throughput limit per partition; the team should switch to provisioned capacity with auto scaling

Question 14

A company is migrating a 5 TB Oracle database to Amazon Aurora PostgreSQL. The database has a 4-hour maintenance window weekly. Which migration approach minimizes downtime?

Accepted Answer

Use AWS Database Migration Service (DMS) with change data capture (CDC).. AWS DMS with CDC allows you to perform an initial full load of the 5 TB database and then continuously replicate ongoing changes from the source Oracle database to the target Aurora PostgreSQL. This minimizes downtime because you can keep the source database fully operational during the migration and only perform a brief cutover to switch applications to the new database, well within the 4-hour maintenance window.

Answer

Use Oracle Data Pump to export and pg_restore to import.

Answer

Use AWS Schema Conversion Tool (SCT) to convert schema and then copy data.

Answer

Use AWS DMS full load only and then manually sync.

Question 15

A company is using Amazon RDS for MySQL and wants to restrict access to a specific database so that an application user can only perform SELECT and INSERT operations on tables within that database. The application user already exists. Which SQL statement should be executed?

Accepted Answer

GRANT SELECT, INSERT ON app_db.* TO 'app_user'@'%';. It grants exactly the required SELECT and INSERT privileges on all tables within the app_db database. Option A is incorrect because it only grants SELECT, missing INSERT. Option B is incorrect because it includes unnecessary DDL privileges (CREATE, ALTER) which are not needed and could be a security risk. Option D is incorrect because it grants ALL PRIVILEGES, which is too permissive for an application user.

Answer

GRANT SELECT ON app_db.* TO 'app_user'@'%';

Answer

GRANT CREATE, ALTER, SELECT, INSERT ON app_db.* TO 'app_user'@'%';

Answer

GRANT ALL PRIVILEGES ON app_db.* TO 'app_user'@'%';