DBS-C01 Practice Test 19 — 15 Questions

Question 1

A company uses Amazon DynamoDB with a global secondary index (GSI) on a table that contains sensitive data. The security team requires that the GSI be encrypted with a different AWS KMS key than the base table. Can this be achieved, and if so, how?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

No, DynamoDB encrypts the entire table and all its indexes with the same KMS key.. DynamoDB encrypts all data at rest using a single KMS key per table. The base table and all of its GSIs are encrypted with the same key. It is not possible to use a different KMS key for a GSI. Option A is wrong because the GSI cannot have a separate key. Option B is wrong because KMS key policies do not allow per-index encryption. Option D is wrong because the table and its GSIs always use the same key.

Answer

Yes, by using a custom KMS key policy that differentiates between table and index.

Answer

Yes, by specifying a different KMS key ID when creating the GSI.

Answer

No, but you can use a different KMS key for the table and then the GSI will automatically use a different key.

Question 2

A company is migrating an on-premises MongoDB database to Amazon DocumentDB. They need to ensure that the migration is completed with minimal downtime and that data remains consistent. Which tool should they use?

Accepted Answer

Use AWS DMS with MongoDB as source and DocumentDB as target. AWS DMS supports continuous change data capture (CDC) from MongoDB to Amazon DocumentDB, enabling near-zero downtime migration by replicating ongoing changes after the initial full load. This ensures data consistency without requiring application downtime, unlike batch export/import methods.

Answer

Use mongoexport and mongoimport

Answer

Export data to Amazon S3 and load into DocumentDB

Answer

Use MongoDB Atlas Live Migration

Question 3

A company is deploying a MySQL database on Amazon RDS and needs to enforce encryption at rest. Which configuration step is required?

Accepted Answer

Select encryption option when creating the RDS instance.. Amazon RDS for MySQL requires encryption at rest to be enabled at instance creation time by selecting the encryption option in the AWS Management Console, CLI, or API. Encryption at rest uses AWS Key Management Service (KMS) to encrypt the underlying storage, automated backups, read replicas, and snapshots. This setting cannot be applied to an existing unencrypted DB instance, so it must be chosen during the initial launch.

Answer

Use a custom DB parameter group with SSL enabled.

Answer

Modify the DB instance to enable encryption after creation.

Answer

Enable SSL/TLS on the RDS instance.

Question 4

A healthcare company stores sensitive patient data in an Amazon RDS for SQL Server database. The security team requires that all data at rest be encrypted using a customer-managed AWS KMS key (CMK) and that the key be rotated annually. The database is currently unencrypted. Which sequence of actions should a database specialist take to meet these requirements with minimal downtime?

Accepted Answer

Take a snapshot of the unencrypted instance, copy the snapshot with encryption using a CMK, restore a new instance from the encrypted snapshot, and then update the application to point to the new instance.. To encrypt an existing unencrypted RDS instance, you cannot enable encryption in place. Instead, take a snapshot, copy it with encryption using a customer-managed KMS key, then restore a new instance from the encrypted snapshot. This approach minimizes downtime because the original instance remains operational until the new encrypted instance is ready. Finally, update the application to connect to the new instance.

Answer

Modify the existing RDS instance to enable encryption by selecting a CMK, which will apply encryption in place without downtime.

Answer

Enable encryption on the existing RDS instance by modifying the storage to use a CMK, then enable automatic key rotation on the CMK.

Answer

Create a new encrypted RDS for SQL Server instance using a CMK, then use native SQL Server backup and restore to migrate the data, and finally update the application connection string.

Question 5

A company is designing a secure strategy for managing Amazon RDS for Oracle encryption keys. They want to use AWS KMS with Customer Master Keys (CMKs) for encryption at rest. Which THREE best practices should they follow?

Accepted Answer

Grant the RDS service principal (rds.amazonaws.com) only the necessary KMS permissions to use the CMK.. Option A is correct because the RDS service principal (rds.amazonaws.com) must be granted only the specific KMS permissions it needs (such as kms:Decrypt, kms:GenerateDataKey, kms:CreateGrant, and kms:DescribeKey) via the key policy, following least-privilege so the CMK cannot be misused by other services or principals. Option B is correct because using separate KMS CMKs per environment (production, development) provides cryptographic isolation and blast-radius containment, ensuring that a key compromise or policy change in one environment does not affect the other, and it supports distinct access controls and audit trails. Option E is correct because enabling automatic annual rotation of the KMS CMK (a 365-day rotation period) limits the amount of data protected by a single key version and aligns with AWS KMS best practice, while RDS transparently re-wraps data keys so existing encrypted DB instances and snapshots remain accessible. Option C is incorrect because disabling key rotation weakens security and is not required for snapshot consistency; KMS rotation preserves the ability to decrypt older data. Option D is incorrect because the CMK never leaves AWS KMS and must never be stored inside the Oracle database; only the encrypted data keys are used by RDS.

Answer

Disable key rotation to maintain consistent encryption across all snapshots.

Answer

Store the KMS CMK inside the Oracle database for faster encryption.

Question 6

A company uses Amazon DocumentDB (with MongoDB compatibility) to store sensitive data. The security team wants to ensure that all data at rest is encrypted using a key that the company can rotate and audit. They also want to minimize operational overhead. Which solution should they implement?

Accepted Answer

Enable encryption at rest using an AWS KMS customer managed key when creating the DocumentDB cluster.. To encrypt DocumentDB data at rest with a customer managed key that can be rotated and audited, you must enable encryption at cluster creation using a KMS customer managed key. This provides the required control and auditability with minimal operational overhead, as it is a native feature.

Answer

Enable encryption at rest using an AWS managed key (aws/docdb) when creating the cluster.

Answer

Implement client-side encryption using the MongoDB driver's encryption features and store keys in AWS Secrets Manager.

Answer

Enable encryption at rest by modifying the existing DocumentDB cluster to use a customer managed key.

Question 7

A company uses an Amazon RDS for SQL Server DB instance with Transparent Data Encryption (TDE) enabled. The security team wants to ensure that the TDE certificates and private keys are stored in a secure, centralized location and can be audited. Which AWS service should they integrate with to meet these requirements?

Accepted Answer

AWS Key Management Service (KMS). RDS for SQL Server TDE uses AWS KMS to store and manage the TDE certificate and private key. The KMS customer managed key encrypts the certificate, and all API calls are logged in CloudTrail, providing auditability. Other services like ACM, Secrets Manager, and Parameter Store do not offer the required integration for TDE key management.

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager (ACM)

Answer

AWS Systems Manager Parameter Store

Question 8

A company is running an Amazon DocumentDB cluster. The application is experiencing high write latency. The cluster has a single instance. What should be done to identify the cause of the latency?

Accepted Answer

Enable Performance Insights and review the top wait events.. Enabling Performance Insights for Amazon DocumentDB allows you to monitor the database load and review top wait events, which helps identify the specific causes of high write latency, such as lock contention or I/O bottlenecks. Option A is wrong because simply upgrading to a larger instance size addresses symptoms but does not identify the root cause. Option C is wrong because adding a replica does not reduce write latency on the primary instance; it only offloads read traffic. Option D is wrong because changing to Provisioned IOPS may improve I/O performance but does not diagnose the underlying issue causing latency.

Answer

Upgrade the instance to a larger size.

Answer

Add a replica to distribute the write load.

Answer

Change the storage type to Provisioned IOPS.

Question 9

A company is migrating its on-premises Oracle database to Amazon RDS for Oracle. The database is 2 TB in size and has a 24-hour maintenance window. The company needs to minimize downtime during the migration. Which AWS service should be used to perform the migration with minimal downtime?

Accepted Answer

AWS Database Migration Service. AWS Database Migration Service (AWS DMS) can migrate the on-premises Oracle database to Amazon RDS for Oracle with minimal downtime by using ongoing replication. Option B (Oracle Data Guard) is not supported for cross-environment replication to Amazon RDS. Option C (AWS Schema Conversion Tool) is used for schema conversion, not data migration. Option D (AWS Data Pipeline) is a data orchestration service unrelated to database migration.

Answer

Oracle Data Guard

Answer

AWS Schema Conversion Tool (AWS SCT)

Answer

AWS Data Pipeline

Question 10

A company runs a MySQL-compatible database on Amazon RDS for a mission-critical application. The database experiences high write latency due to frequent index updates. The team wants to redesign the database to reduce write amplification and improve insert performance. Which TWO design changes could help?

Accepted Answer

Use batch INSERT statements instead of single-row inserts. Option B is correct because batching multiple rows into a single INSERT statement reduces per-statement overhead, transaction commit frequency, and round trips, which lowers write amplification and improves insert throughput on RDS for MySQL. Option D is correct because every secondary index must be updated on each write, so dropping unused or redundant indexes directly reduces the number of index maintenance operations per insert, cutting write amplification and latency. Option A is not appropriate because MyISAM lacks transaction support and crash safety, and it uses table-level locking, making it unsuitable for a mission-critical MySQL-compatible RDS workload. Option C does not address the root cause, since a larger instance class adds CPU/memory but does not reduce the index-update write amplification itself. Option E is not correct because normalization generally increases the number of tables and joins, which can add write operations rather than reduce index maintenance overhead.

Answer

Switch the storage engine from InnoDB to MyISAM

Answer

Upgrade to a larger RDS instance class

Answer

Normalize the database schema to reduce data redundancy

Question 11

A financial services company runs a critical application on Amazon RDS for PostgreSQL. The database stores sensitive customer financial data. The security team has mandated that all access to the database must be through IAM database authentication to eliminate the need for passwords. The application currently uses a master user password stored in AWS Secrets Manager. The DBA needs to implement IAM authentication without downtime. The application is deployed on Amazon ECS and connects to the database using a connection string. The DBA has already created an IAM role for the ECS task with a policy that allows rds-db:connect. The DBA has also modified the DB instance to require SSL. However, after making these changes, the application cannot connect. The error message indicates 'IAM authentication is not enabled for this user'. What step did the DBA miss?

Accepted Answer

The DBA did not create a database user that is set to use IAM authentication.. IAM database authentication requires that a database user be created with the IAM authentication method. Specifically, the user must be created with the CREATEROLE privilege and granted the rds_iam role. Without this step, the authentication fails even if the IAM role is correctly configured. Option B is incorrect because the IAM policy was already attached. Option C is incorrect because IAM authentication does not require a password; it uses authentication tokens. Option D is incorrect because the security group and port are not related to IAM authentication.

Answer

The DBA did not attach the IAM policy to the ECS task role.

Answer

The DBA did not enable the 'password' authentication method.

Answer

The DBA did not update the security group to allow traffic on port 5432.

Question 12

A company is using Amazon ElastiCache for Redis to cache database query results. They notice that the cache hit ratio is low and many requests are hitting the database. The 'Evictions' metric is high. What is the MOST likely cause?

Accepted Answer

The cache node is too small for the workload.. The high 'Evictions' metric indicates that the cache node is constantly full, causing it to evict old data to make room for new data. This leads to a low cache hit ratio because frequently accessed items are evicted and must be fetched from the database. Option D correctly identifies that the cache node is too small for the workload. Option A is incorrect because insufficient replication factor would affect availability, not evictions. Option B is incorrect because encryption in transit does not impact cache capacity or evictions. Option C is incorrect because high network latency would affect request latency but not directly cause evictions.

Answer

The replication factor is insufficient.

Answer

Encryption in transit is enabled.

Answer

The application is experiencing high network latency.

Question 13

A company is migrating a 2 TB Oracle database to Amazon Aurora PostgreSQL using AWS SCT and DMS. After migration, the application reports that some queries are significantly slower than before. The database schema was converted automatically. What is the most likely cause?

Accepted Answer

The schema conversion did not create appropriate indexes. The most likely cause is that AWS Schema Conversion Tool (SCT) converted the Oracle schema to Aurora PostgreSQL but did not automatically create optimal indexes. Oracle and PostgreSQL use different query optimizers and index strategies; SCT focuses on structural compatibility, not performance tuning. Without manual review and addition of appropriate indexes (e.g., for foreign keys, composite columns, or partial indexes), PostgreSQL may resort to sequential scans on large tables, causing significant query slowdowns.

Answer

Aurora storage is slower than Oracle's storage

Answer

DMS introduced data type conversions that slow down queries

Answer

Aurora PostgreSQL does not support partitioning, causing full table scans

Question 14

A company is running a production Amazon RDS for MySQL DB instance. The application team reports intermittent high latency and connection timeouts. A quick check shows that the DB instance's CPU utilization is consistently above 90% during peak hours. The database size is 500 GB and the instance class is db.r5.large. Which combination of actions should a database specialist take to resolve the performance issue?

Accepted Answer

Scale up the DB instance to db.r5.xlarge and review slow query logs to optimize poorly performing queries.. Sustained CPU above 90% on a db.r5.large indicates the instance class is undersized for the workload, so scaling up to db.r5.xlarge doubles vCPU and memory to relieve the bottleneck. Pairing that with slow query log review addresses the root cause — inefficient queries that consume disproportionate CPU — which is the standard RDS performance troubleshooting pattern.

Answer

Increase the allocated storage to 1 TB and enable auto-scaling for storage.

Answer

Enable Multi-AZ and increase the allocated storage to 1 TB to improve I/O performance.

Answer

Enable Performance Insights and create a CloudWatch alarm to notify when CPU exceeds 80%.

Question 15

A database specialist is monitoring an Amazon DynamoDB table that uses on-demand capacity mode. The application experiences sudden traffic surges, and the specialist observes throttling errors in CloudWatch metrics. Which of the following is the MOST likely cause of the throttling?

Accepted Answer

The table has a hot partition due to uneven access patterns.. In on-demand capacity mode, DynamoDB automatically scales to handle traffic, but it cannot instantly split a partition to handle a sudden surge on a single partition key. If the workload has a hot partition, that partition can exceed its throughput limit, causing throttling. The other options incorrectly assume provisioned capacity or item limits, which do not apply in on-demand mode.

Answer

The table has exceeded the maximum number of items allowed.

Answer

The table's global secondary index is under-provisioned.

Answer

The table's provisioned read/write capacity is set too low.