DBS-C01 Practice Test 19 — 15 Questions

Question 1

A company wants to migrate a 2 TB PostgreSQL database from on-premises to Amazon Aurora PostgreSQL. The database has high write throughput and the migration must have minimal impact on source performance. Which solution is MOST appropriate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use pglogical to set up logical replication from the source to Aurora.. Pglogical is a PostgreSQL extension that provides logical replication with minimal overhead on the source, making it ideal for high-write-throughput databases. It allows selective table replication and does not require physical changes to the source, thus avoiding performance impact. AWS DMS (Option B) can also perform ongoing replication but introduces additional overhead and complexity, and it is not as tightly integrated with PostgreSQL's native replication mechanisms as pglogical.

Answer

Create a read replica of the on-premises database and promote it to Aurora.

Answer

Use AWS DMS with ongoing replication from the source to Aurora.

Answer

Set up native PostgreSQL streaming replication from on-premises to Aurora.

Question 2

A company needs to store and query JSON documents that have varying attributes. The workload is read-heavy, and the team wants to use SQL-like queries. Which service is most appropriate?

Accepted Answer

Amazon DocumentDB (with MongoDB compatibility). Amazon DocumentDB (with MongoDB compatibility) is the most appropriate service because it is purpose-built for storing and querying JSON documents with varying attributes, and it supports SQL-like queries via MongoDB's query language, which is familiar to developers. As a read-heavy workload, DocumentDB's architecture with distributed storage and read replicas provides high throughput and low latency for such patterns. The flexible schema of DocumentDB naturally handles documents with differing attributes without requiring schema migrations.

Answer

Amazon Neptune

Answer

Amazon DynamoDB with PartiQL

Answer

Amazon RDS for MySQL with JSON data type

Question 3

A gaming company uses Amazon DynamoDB with provisioned capacity. During a new game launch, the read activity spikes and some requests receive 'ProvisionedThroughputExceededException' errors. The operations team needs to monitor read throttling in real-time. Which CloudWatch metric should they create an alarm for?

Accepted Answer

ReadThrottleEvents. (ReadThrottleEvents) because this metric directly counts the number of read requests that are throttled due to exceeding provisioned read capacity. Option B (ConsumedReadCapacityUnits) shows the amount of read capacity used, not throttled events. Option D (ThrottledRequests) includes both read and write throttles, so it is not specific to reads. Option A (ReadLatency) measures response time, not throttling.

Answer

ReadLatency

Answer

ConsumedReadCapacityUnits

Answer

ThrottledRequests

Question 4

Which TWO strategies can improve query performance in Amazon Aurora MySQL for a read-heavy workload? (Select TWO.)

Accepted Answer

Enable Aurora Auto Scaling for read replicas. Amazon Aurora Auto Scaling automatically adjusts the number of Aurora Replicas in response to changes in read workload demand, ensuring consistent read performance without manual intervention. This is ideal for read-heavy workloads where traffic patterns fluctuate, as it dynamically adds or removes replicas based on target metrics like CPU utilization or connections.

Answer

Use Provisioned IOPS EBS volumes for the primary instance

Answer

Enable Multi-AZ to create a standby for read traffic

Answer

Migrate the read-heavy queries to Amazon DynamoDB

Question 5

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all database connections use SSL and that the database is encrypted at rest. Which THREE steps are required to meet these requirements? (Choose THREE.)

Accepted Answer

Modify the DB parameter group to set 'require_ssl' to 'true'.. To meet the requirements, three steps are needed. First, enable encryption at rest by selecting the encryption option when creating the RDS instance (option E). Second, to enforce SSL connections, modify the DB parameter group to set require_ssl to true (option C). Third, download the RDS SSL certificate from AWS and configure the application to trust it (option D). Options A and B are incorrect because you cannot upload a custom SSL certificate to RDS, and the certificate must be trusted by the application, not necessarily installed on every client machine individually.

Answer

Upload a custom SSL certificate to the RDS instance.

Answer

Install the SSL certificate on every client machine.

Question 6

A company is building a document management system where each document can have multiple tags and users need to query documents by any combination of tags. The number of tags per document is up to 20, and the total number of documents is expected to be 50 million. Which database design is most appropriate for this flexible tag-based querying?

Accepted Answer

Amazon DynamoDB with a global secondary index on the tag attribute. Amazon DynamoDB with a global secondary index on the tag attribute is the most appropriate design because it supports flexible, low-latency queries on any combination of tags at scale. DynamoDB's single-table design with a GSI allows you to query documents by a specific tag efficiently, and by using composite sort keys or multiple GSIs, you can support queries on multiple tag combinations without the overhead of joins or schema normalization. This approach handles 50 million documents with up to 20 tags per document while maintaining predictable performance.

Answer

Amazon RDS for MySQL with a normalized schema

Answer

Amazon Neptune

Answer

Amazon ElastiCache for Memcached

Question 7

A company is using Amazon RDS for MySQL with encryption at rest enabled. The security team requires that all access to the database be authenticated using IAM database authentication. Which combination of steps must the company take to meet this requirement?

Accepted Answer

Create an IAM policy that allows the rds-db:connect action and map the IAM role to a database user created with the AWSAuthenticationPlugin.. IAM database authentication for Amazon RDS MySQL requires creating an IAM policy that allows the rds-db:connect action, then mapping that IAM role/entity to a database user created with the AWSAuthenticationPlugin. This enables authentication via IAM credentials instead of a password. Option A is incorrect because rds:Connect is not a valid action; the correct action is rds-db:connect, and the IAM role is not attached to the RDS instance but mapped to a database user. Option B is incorrect because IAM database authentication does not use passwords; the database user must be created with AWSAuthenticationPlugin, not with a password. Option C is incorrect because SSL is not required for IAM database authentication, though it is recommended for encryption in transit; also, the correct action is rds-db:connect, not rds:Connect.

Answer

Create an IAM role with a policy that allows rds:Connect and attach it to the RDS instance.

Answer

Create a database user with a password and attach an IAM role that allows rds-db:connect to the database user.

Answer

Enable SSL on the RDS instance and create an IAM policy that allows rds:Connect.

Question 8

A startup is building a mobile app backend using Amazon DynamoDB. They anticipate unpredictable traffic spikes. Which DynamoDB feature should they use to handle the spikes without manual intervention?

Accepted Answer

Enable DynamoDB Auto Scaling for read and write capacity.. DynamoDB Auto Scaling (option B) automatically adjusts the provisioned read and write capacity based on actual traffic patterns, using CloudWatch alarms and the Application Auto Scaling service. This allows the startup to handle unpredictable spikes without manual intervention, as the service will increase capacity during high demand and decrease it during low demand, ensuring consistent performance and cost efficiency.

Answer

Use DynamoDB Accelerator (DAX) as a cache layer.

Answer

Set up a TTL (Time to Live) to automatically expire old items.

Answer

Implement DynamoDB Global Tables for multi-region replication.

Question 9

A DBA runs the above AWS CLI command. The DB instance is an Amazon RDS for MySQL instance. The DBA needs to connect to the database from an EC2 instance in the same VPC but cannot connect. Which action should be taken first?

Accepted Answer

Check the inbound rules of the security group for port 3306.. The most common cause of connectivity failure from an EC2 instance to an RDS for MySQL instance in the same VPC is that the security group associated with the RDS instance does not allow inbound traffic on port 3306 from the EC2 instance's security group or IP address. Checking the inbound rules of the security group for port 3306 is the first logical troubleshooting step because it directly addresses the network access control that governs whether the EC2 instance can initiate a TCP connection to the database.

Answer

Verify that the DB instance endpoint resolves correctly from the EC2 instance.

Answer

Enable encryption on the DB instance.

Answer

Check the DB instance status in the output.

Question 10

A company is moving a large-scale time-series application from Cassandra to a managed AWS service. The workload involves high-frequency writes (millions per second) and queries that aggregate data over time windows. Which THREE AWS services are suitable for this time-series workload?

Accepted Answer

Amazon OpenSearch Service. Amazon OpenSearch Service is suitable because it supports high-frequency writes via bulk indexing and provides powerful aggregation queries (e.g., date histograms, percentiles) over time windows, making it ideal for time-series analytics. It can ingest millions of events per second when properly scaled with optimized shard strategies and using the OpenSearch ingest pipeline.

Answer

Amazon Aurora

Answer

Amazon Redshift

Question 11

A company is migrating an on-premises MySQL database to Amazon RDS for MySQL. They need to validate that the schema is compatible. Which AWS service should they use?

Accepted Answer

AWS Schema Conversion Tool (SCT). The AWS Schema Conversion Tool (SCT) is designed specifically to assess and convert database schemas from one engine to another, including on-premises MySQL to Amazon RDS for MySQL. It analyzes the source schema for compatibility issues, identifies unsupported features or deprecated syntax, and generates a detailed assessment report. This makes it the correct choice for validating schema compatibility before migration.

Answer

Amazon Inspector

Answer

AWS Database Migration Service (DMS)

Answer

AWS Trusted Advisor

Question 12

Refer to the exhibit. An IAM policy is attached to a role used by an application that accesses the DynamoDB 'Orders' table. The application needs to perform a Scan operation on the table. According to the policy, is the Scan operation allowed?

Accepted Answer

Yes, because the policy explicitly allows Scan. The IAM policy includes an explicit Allow statement for the `dynamodb:Scan` action on the `Orders` table. In IAM policy evaluation logic, an explicit Allow overrides any default implicit Deny, and the Deny statement in the policy only blocks actions that match its `NotAction` element, which does not include Scan. Therefore, the Scan operation is allowed.

Answer

Yes, but only if the scan uses a filter expression

Answer

No, because the Deny statement blocks all actions

Answer

No, because the policy does not specify a condition

Question 13

Refer to the exhibit. A database administrator is writing an IAM policy to manage Amazon RDS snapshots. The policy allows actions on all RDS resources but denies deletion of any DB instance with the prefix 'production-'. A developer attempts to delete a snapshot named 'production-snapshot-2020'. Will this action be allowed?

Accepted Answer

Yes, because the Deny statement only applies to deleting DB instances, not snapshots.. The Deny statement in the policy only applies to the 'rds:DeleteDBInstance' action, not to 'rds:DeleteDBSnapshot'. The Allow statement explicitly allows all actions including 'rds:DeleteDBSnapshot' on all resources. Since there is no explicit deny for deleting snapshots, the allow takes effect. Option A is incorrect because the developer's permissions are not relevant; the policy allows the action. Option B is incorrect because the Deny does not apply to snapshots. Option D is incorrect because the Deny condition only matches deletions of DB instances, not snapshots.

Answer

Yes, but only if the developer has the necessary permissions.

Answer

No, because the Deny statement overrides the Allow statement.

Answer

No, because the snapshot name starts with 'production-', which matches the resource pattern in the Deny statement.

Question 14

A company uses Amazon Redshift for data warehousing. The security team has implemented column-level security using Redshift's column-level access controls. However, during a security audit, it is discovered that a user with SELECT privilege on a table can still see the content of a column that should be restricted. The column is defined with a GRANT statement that only allows SELECT on certain columns to specific users. What is the most likely cause of this issue?

Accepted Answer

The user was previously granted SELECT on the entire table, and the column-level GRANT did not revoke that broader permission.. Column-level GRANTs in Redshift do not revoke existing table-level permissions. If a user was previously granted SELECT on the entire table, that permission remains even after a column-level GRANT is applied. To restrict access, the table-level SELECT must be revoked first, then column-level GRANTs can be applied to specific columns. Option A is incorrect because distribution keys do not bypass column-level security. Option B is incorrect because stored procedures inherit the caller's permissions and do not bypass column-level security. Option C is incorrect because Redshift does support column-level security via GRANT statements.

Answer

The column is part of a distribution key that bypasses security controls.

Answer

The user is accessing the table via a stored procedure that bypasses column-level security.

Answer

The column-level security is not supported in Redshift; it must be implemented using views.

Question 15

A company has an Amazon RDS for PostgreSQL database that is experiencing intermittent connection timeouts. The application logs show 'FATAL: remaining connection slots are reserved for non-replication superuser connections'. The database has a max_connections parameter set to 200. The application uses a connection pool. The DBA checks the CloudWatch metric 'DatabaseConnections' and sees it at 195 during peak hours. The application is deployed on AWS Lambda with a provisioned concurrency of 100. The Lambda function creates a new connection for each invocation. What should the DBA do to resolve the issue?

Accepted Answer

Set up Amazon RDS Proxy to manage the database connections from Lambda.. Set up Amazon RDS Proxy. The issue is that Lambda functions create a new connection per invocation, quickly exhausting the connection pool. While the DatabaseConnections metric shows 195 out of 200 max_connections, the Lambda functions are opening connections and not closing them properly, leading to connection exhaustion. RDS Proxy manages connection pooling, reusing connections across invocations, reducing the number of connections needed. Option A is wrong because reducing provisioned concurrency does not address the underlying connection management issue and may impact application performance. Option B is wrong because increasing max_connections could lead to increased memory usage and potential performance degradation. Option D is wrong because decreasing max_connections would make the problem worse by reserving fewer slots.

Answer

Reduce the Lambda provisioned concurrency to 50.

Answer

Increase max_connections to 500 to accommodate more connections.

Answer

Decrease max_connections to 100 to reserve more slots.