DBS-C01 Practice Exam 3 — 20 Questions

Question 1

A company has an Amazon RDS for PostgreSQL DB instance that needs to be accessed by an application running on an Amazon EC2 instance. Both resources are in the same VPC. The security team insists that all traffic between the application and the database be encrypted in transit. Which configuration ensures this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable SSL/TLS on the RDS instance and configure the application to connect using SSL.. Encryption in transit between an EC2 application and an RDS PostgreSQL instance is achieved by enabling SSL/TLS on the RDS instance and configuring the application's connection string to use SSL (e.g., sslmode=require or verify-full with the RDS CA). Being in the same VPC does not encrypt traffic — VPC networking is isolated but not encrypted at the application layer.

Answer

Add a security group rule that allows traffic only from the EC2 instance's private IP.

Answer

Create an AWS Site-to-Site VPN connection between the EC2 instance and the RDS instance.

Answer

Set up VPC peering between the EC2 instance's VPC and the RDS instance's VPC.

Question 2

A social media application stores user posts in an Amazon RDS for PostgreSQL instance. The application experiences a sudden spike in read traffic during peak hours, causing database bottlenecks. The team needs to improve read scalability without changing the application code. Which solution is MOST cost-effective?

Accepted Answer

Use Amazon RDS for PostgreSQL Read Replicas. Amazon RDS for PostgreSQL Read Replicas allow you to offload read traffic from the primary DB instance to one or more read-only replicas, improving read scalability without any application code changes. This is the most cost-effective solution as it leverages the existing PostgreSQL engine and requires only minimal additional compute and storage costs for the replicas.

Answer

Migrate to Amazon DynamoDB with DAX

Answer

Enable Multi-AZ on the RDS instance

Answer

Use Amazon ElastiCache to cache query results

Question 3

Refer to the exhibit. A developer created an IAM policy with the above command and attached it to a user. What is the security implication of this policy?

Accepted Answer

The policy grants full administrative access to all RDS resources in the account.. The policy allows all RDS actions on all resources, granting full administrative access to all RDS resources in the account. This is overly permissive and violates the principle of least privilege. Option A is wrong because the policy does not restrict to a specific region. Option B is wrong because it does not restrict to a specific region. Option D is wrong because it does not restrict to read-only access.

Answer

The policy restricts access to only one specific DB instance.

Answer

The policy allows only actions in the us-east-1 region.

Answer

The policy only allows read-only access to RDS.

Question 4

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. During the migration, the database administrator notices that the CPU utilization on the RDS instance is consistently above 90% during peak hours, even though the on-premises server had similar specifications. The application queries are mostly SELECT statements with occasional DML. The RDS instance is db.r5.large with 500 GB of General Purpose SSD (gp2) storage. Which change would most likely reduce CPU utilization?

Accepted Answer

Upgrade to a larger instance type, such as db.r5.xlarge.. The db.r5.large instance type has 2 vCPUs and 16 GiB of memory. Sustained CPU utilization above 90% during peak hours indicates that the instance is compute-bound for the workload. Upgrading to db.r5.xlarge (4 vCPUs, 32 GiB memory) doubles the available CPU capacity, directly reducing CPU utilization for the same query load. The on-premises server had similar specifications, but RDS instances may have different CPU architectures or hypervisor overhead, making the larger instance the most direct fix.

Answer

Create a read replica and redirect all SELECT queries to the replica.

Answer

Enable Multi-AZ to offload CPU to the standby instance.

Answer

Increase the allocated storage to 1 TB to improve I/O performance.

Question 5

A company uses Amazon DynamoDB for a time-series IoT workload. Each device sends a data point every minute. The primary key consists of device_id (partition key) and timestamp (sort key). The company wants to efficiently retrieve the latest 10 data points for a specific device. Which query design is most efficient?

Accepted Answer

Query the table with ScanIndexForward=false and Limit=10.. Query with ScanIndexForward=false retrieves items in descending order by the sort key (timestamp), and Limit=10 stops after the first 10 items, which are the most recent 10 data points for the given device_id. This is the most efficient design as it reads only the 10 items needed, leveraging the DynamoDB local secondary index or table's sort key order without any post-processing.

Answer

Use GetItem on the device_id partition key with the maximum timestamp.

Answer

Query the table with ScanIndexForward=true and Limit=10, then reverse the result set.

Answer

Scan the entire table and filter by device_id, then sort by timestamp.

Question 6

An administrator runs the CLI command shown in the exhibit and sees the output. The DB instance 'mydb' is currently running MySQL 5.7.22. What does the output indicate?

Accepted Answer

The DB instance has a pending minor version upgrade to 5.7.23. The output shows 'Pending maintenance: Yes' with 'Minor version upgrade to 5.7.23' listed. This indicates that the DB instance has a pending minor version upgrade that will be applied during the next maintenance window. The CLI command 'aws rds describe-db-instances --db-instance-identifier mydb' returns this information when a minor version upgrade is scheduled but not yet applied.

Answer

The master user password has been changed

Answer

The DB instance has failed to apply modifications

Answer

The DB instance is using a custom DB parameter group

Question 7

A company is deploying a new microservices application on Amazon ECS. Each microservice needs its own database. Which AWS database service should be used to minimize operational overhead?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a fully managed NoSQL database that provides single-digit millisecond latency at any scale, making it ideal for microservices that each require their own isolated database. It eliminates operational overhead by handling hardware provisioning, setup, configuration, replication, and patching automatically, with no servers to manage. DynamoDB also supports on-demand capacity mode, which scales automatically based on traffic, perfectly aligning with the dynamic nature of microservices on Amazon ECS.

Answer

Amazon Aurora

Answer

Amazon Redshift

Answer

Amazon RDS for MySQL

Question 8

A company needs to store JSON documents that are up to 10 KB in size. The documents are accessed by a primary key, and the company requires single-digit millisecond latency. Which database service should be used?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is the correct choice because it is a fully managed NoSQL key-value and document database that delivers single-digit millisecond latency at any scale. It natively supports JSON documents up to 400 KB in size (well above the 10 KB requirement) and provides primary key access with consistent low-latency performance, making it ideal for this workload.

Answer

Amazon Neptune

Answer

Amazon S3

Answer

Amazon RDS for MySQL with JSON data type

Question 9

A company has an Amazon Redshift cluster that contains sensitive data. The security team requires that data be encrypted at rest using a customer-managed AWS KMS key. The cluster was initially launched without encryption. How can the company enable encryption with minimal downtime?

Accepted Answer

Take a snapshot of the cluster and restore it to a new cluster with encryption enabled.. Amazon Redshift does not allow enabling encryption in place on an existing unencrypted cluster. The supported path is to take a snapshot of the unencrypted cluster and restore it to a new cluster with encryption enabled using a customer-managed KMS key. This preserves data and requires only the cutover downtime.

Answer

Unload the data to Amazon S3, create a new encrypted cluster, and reload the data from S3.

Answer

Use the AWS CLI to update the cluster encryption setting.

Answer

Modify the cluster and enable encryption using the AWS Management Console.

Question 10

A startup is building a real-time leaderboard for a mobile game using Amazon DynamoDB. The leaderboard must update frequently and support global access with low latency. Which database design approach is most suitable?

Accepted Answer

Use Amazon DynamoDB global tables with appropriate partition key design.. Amazon DynamoDB global tables provide multi-Region, fully managed, multi-master replication, which is ideal for a real-time leaderboard requiring frequent updates and low-latency global access. By designing an appropriate partition key (e.g., game ID or time-based composite key), you can distribute write traffic evenly and avoid hot partitions, ensuring consistent performance under high update frequency.

Answer

Use Amazon ElastiCache for Redis with replication across Regions.

Answer

Use Amazon Aurora Global Database with a single writer and multiple readers.

Answer

Use Amazon S3 with event notifications to update a leaderboard file.

Question 11

A startup is building a social media analytics platform that requires storing time-series data with frequent writes and queries for the last hour. Which AWS database service is BEST suited for this workload?

Accepted Answer

Amazon Timestream. Amazon Timestream is a purpose-built time-series database that efficiently handles high-frequency writes and recent-time queries (e.g., last hour) with automatic data tiering (in-memory store for recent data, magnetic store for historical). Its serverless architecture and built-in time-series functions (e.g., interpolation, smoothing) make it ideal for social media analytics workloads requiring low-latency queries on recent data.

Answer

Amazon RDS with MySQL

Answer

Amazon Neptune

Answer

Amazon DynamoDB

Question 12

A company is running an Amazon RDS for PostgreSQL DB instance with Multi-AZ deployment. They notice that the primary DB instance is experiencing high CPU utilization. The read replica shows normal CPU. Which action should the DBA take to reduce the load on the primary instance?

Accepted Answer

Offload SELECT queries to the read replica. Offloading SELECT queries to the read replica reduces CPU utilization on the primary instance because read replicas can handle read traffic independently. Option A is incorrect: failing over to the standby instance does not reduce CPU load—the standby is only for high availability and becomes the new primary, still handling the same workload. Option B is incorrect: increasing the DB instance size would help but is not the best first step; it involves scaling costs and potential downtime, whereas using a read replica is more efficient and cost-effective for read-heavy workloads. Option C is incorrect: converting the read replica to a Multi-AZ standby would make it a synchronous replica for failover, not for offloading reads, so it would not reduce CPU on the primary.

Answer

Failover to the standby instance

Answer

Increase the DB instance size

Answer

Convert the read replica to a Multi-AZ standby

Question 13

A company is migrating an on-premises MySQL database to Amazon RDS for MySQL. They need to validate that the schema is compatible. Which AWS service should they use?

Accepted Answer

AWS Schema Conversion Tool (SCT). The AWS Schema Conversion Tool (SCT) is designed specifically to assess and convert database schemas from one engine to another, including on-premises MySQL to Amazon RDS for MySQL. It analyzes the source schema for compatibility issues, identifies unsupported features or deprecated syntax, and generates a detailed assessment report. This makes it the correct choice for validating schema compatibility before migration.

Answer

Amazon Inspector

Answer

AWS Database Migration Service (DMS)

Answer

AWS Trusted Advisor

Question 14

A company is using Amazon ElastiCache for Redis to cache database query results. The application team reports that cache hit ratio has dropped significantly. What is the first step to investigate?

Accepted Answer

Check the CacheHitRate and Evictions metrics in CloudWatch. When the cache hit ratio drops significantly, the first step is to investigate whether the cache is evicting keys due to memory pressure or if the working set no longer fits. CloudWatch metrics such as `CacheHitRate` and `Evictions` provide immediate visibility into these conditions without requiring direct Redis access. This aligns with the AWS Well-Architected Framework's principle of observability before making configuration changes.

Answer

Run the Redis INFO command to see memory usage

Answer

Review the ElastiCache event logs for node failures

Answer

Check the Redis AOF persistence logs

Question 15

A company wants to audit all SQL statements executed on their Amazon Aurora MySQL database for compliance. Which AWS feature should be enabled?

Accepted Answer

Database Activity Streams. Database Activity Streams provide a stream of database activities including SQL queries. Option B is wrong because VPC Flow Logs capture network traffic, not SQL statements. Option C is wrong because CloudWatch Logs can store logs but the source should be Database Activity Streams; CloudWatch Logs alone does not audit SQL statements. Option D is wrong because CloudTrail logs API calls, not SQL statements.

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 16

A security engineer is investigating an Amazon RDS for MySQL database that was compromised. The engineer finds that the compromise was due to a SQL injection vulnerability in a web application. The web application uses a database user with full administrative privileges. What is the BEST practice to prevent such incidents in the future?

Accepted Answer

Create dedicated database users with minimal privileges required for each application function.. The best practice is to use dedicated database users with minimal privileges for each application function (Option A). This principle of least privilege limits the damage a SQL injection attack can cause because the compromised user cannot perform unauthorized actions beyond its specific scope. Option B is incorrect because the 'sql_mode' parameter can reject certain dangerous queries but does not address the root cause of excessive privileges and may not prevent all injection attacks. Option C is incorrect because audit logs only help detect incidents after they occur, not prevent them. Option D is incorrect because while placing the RDS instance in a private subnet and restricting inbound traffic reduces the network attack surface, it does not prevent SQL injection attacks that originate from the application itself; the vulnerability lies in how the application interacts with the database.

Answer

Configure the DB parameter group to use the 'sql_mode' option to reject dangerous queries.

Answer

Enable RDS audit logs to capture all SQL queries.

Answer

Place the RDS instance in a private subnet with a security group that restricts inbound traffic.

Question 17

A financial services company runs an Amazon Aurora MySQL database. The application performs complex joins and aggregations on large tables, causing high CPU utilization on the writer instance. The team wants to reduce load without changing the application code. Which solution would best address this issue?

Accepted Answer

Create one or more Aurora Replicas and route read traffic to them.. Creating one or more Aurora Replicas and routing read traffic to them offloads the complex joins and aggregations from the writer instance, reducing CPU utilization without requiring application code changes. Aurora Replicas share the same underlying storage volume as the writer, so they serve read queries with minimal replication lag while the writer focuses on write operations.

Answer

Switch to asynchronous replication to reduce load on the primary.

Answer

Enable Aurora Auto Scaling to increase storage capacity.

Answer

Migrate to Aurora Serverless v2 for automatic scaling.

Question 18

A company wants to migrate an on-premises MySQL database to Amazon RDS for MySQL with minimal downtime. They plan to use AWS DMS. Which source database configuration is required to enable ongoing replication (CDC)?

Accepted Answer

Enable binary logging (binlog) on the source database. AWS DMS requires binary logging (binlog) enabled on the source MySQL database to capture ongoing changes for continuous replication (CDC). The binlog records all data modifications (INSERT, UPDATE, DELETE) in a sequential log, which DMS reads to apply those changes to the target RDS instance with minimal downtime. Without binlog enabled, DMS can only perform a full load migration and cannot support ongoing replication.

Answer

Set auto_increment_increment to 1

Answer

Enable the slow query log

Answer

Enable the query cache

Question 19

A company uses Amazon Aurora MySQL-Compatible Edition. The security team wants to implement database activity streams to monitor database activity. Which THREE statements are true about Aurora database activity streams?

Accepted Answer

Activity streams can be started and stopped without restarting the database.. Options A, B, and E are correct. Activity streams can be started and stopped without a database restart (A). They are encrypted using a KMS key (B). They publish database activity to Amazon CloudWatch Logs and Amazon Kinesis Firehose (E). Option C is incorrect because activity streams do not automatically mask sensitive data; they capture the actual queries. Option D is incorrect because activity streams capture all SQL statements, including DDL, DML, and SELECT.

Answer

Activity streams automatically mask sensitive data in the logs.

Answer

Activity streams only capture DDL statements, not DML or SELECT.

Question 20

A company is running an Amazon RDS for MySQL DB instance in a VPC. The security team requires that all connections to the database use SSL/TLS. The DBA has enabled 'require_secure_transport' parameter in the DB parameter group. However, after applying the change and rebooting, some applications that were previously connecting successfully are now failing. What is the most likely cause?

Accepted Answer

The application is not configured to connect using SSL/TLS.. The most likely cause is that the application is not configured to connect using SSL/TLS. When 'require_secure_transport' is enabled, the database rejects any non-SSL connections. Applications that were previously connecting without SSL will fail until they are updated to use SSL/TLS in their connection strings. The parameter change itself is correct and does not require an option group modification for RDS MySQL.

Answer

The security group inbound rule for the database port is missing.

Answer

The option group does not have the SSL option enabled.

Answer

The DB subnet group does not include the application's subnet.