DBS-C01 Practice Test 23 — 15 Questions

Question 1

A company wants to audit all API calls made to its Amazon RDS DB instances. Which AWS service should be used to capture these API calls?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the service that records API activity in an AWS account, including both management events (control plane) and data events. Every API call made to Amazon RDS — such as CreateDBInstance, ModifyDBInstance, or DeleteDBInstance — is captured as a CloudTrail event with the caller identity, source IP, timestamp, and request parameters. This makes CloudTrail the correct tool for auditing API calls against RDS DB instances.

Answer

AWS Config

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Question 2

A company is migrating an on-premises MongoDB database to AWS. The application uses MongoDB's aggregation pipeline for real-time analytics. Which AWS database service is most compatible and provides the least application changes?

Accepted Answer

Amazon DocumentDB (with MongoDB compatibility).. Amazon DocumentDB is designed to be MongoDB-compatible, supporting the MongoDB aggregation pipeline with minimal changes. This allows the company to migrate the existing MongoDB database and continue using the same aggregation pipeline for real-time analytics without rewriting application code, making it the most compatible option.

Answer

Amazon ElastiCache for Redis with RedisJSON module.

Answer

Amazon DynamoDB with DynamoDB Streams and Lambda for aggregation.

Answer

Amazon Aurora with JSON data type.

Question 3

A company needs to store JSON documents that are frequently accessed by a web application. The documents have varying attributes and the query pattern includes filtering on multiple fields. Which AWS database service is most suitable?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is the most suitable choice because it is a fully managed NoSQL key-value and document database that natively supports JSON documents with varying attributes. Its flexible schema allows each item to have different attributes, and its support for secondary indexes (Local Secondary Indexes and Global Secondary Indexes) enables efficient filtering and querying on multiple fields without requiring predefined schemas or complex joins.

Answer

Amazon Neptune

Answer

Amazon ElastiCache for Redis

Answer

Amazon RDS for MySQL

Question 4

A developer needs to securely store database credentials for an application that runs on Amazon EC2 and connects to an Amazon RDS for PostgreSQL database. The credentials must be automatically rotated every 90 days. Which AWS service should the developer use to meet these requirements?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager. Secrets Manager is designed to securely store and manage secrets such as database credentials. It natively supports automatic rotation of credentials for Amazon RDS databases, including PostgreSQL, with a customizable rotation interval (e.g., every 90 days). Option A (AWS Systems Manager Parameter Store) can store secrets but does not provide built-in automatic rotation for RDS credentials. Option B (AWS CloudHSM) provides hardware security modules for encryption key storage, not for managing database credentials. Option C (IAM roles) allow EC2 instances to assume roles for API access but do not store or rotate database credentials; while IAM database authentication can be used with RDS PostgreSQL, it does not meet the requirement to store and rotate credentials automatically.

Answer

AWS Systems Manager Parameter Store

Answer

AWS CloudHSM

Answer

AWS Identity and Access Management (IAM) roles

Question 5

A company uses Amazon DynamoDB with provisioned capacity. The application team reports occasional ProvisionedThroughputExceededException errors. The database administrator notices that the errors occur during periods of high traffic. What is the most cost-effective way to handle these errors without over-provisioning capacity?

Accepted Answer

Implement exponential backoff and retry logic in the application.. Implementing exponential backoff and retry logic allows the application to handle throttling errors gracefully by retrying requests after a delay, which is the most cost-effective solution as it avoids over-provisioning capacity. Option A is incorrect because increasing capacity to peak levels is costly and inefficient. Option B is incorrect because DAX is a caching layer that reduces read load but does not help with write throttling or prevent ProvisionedThroughputExceededException errors for writes. Option D is incorrect because switching to on-demand capacity mode can be more expensive for predictable traffic patterns, and the question asks for the most cost-effective approach without over-provisioning.

Answer

Increase the provisioned read and write capacity to the peak traffic level.

Answer

Use DynamoDB Accelerator (DAX) to cache frequently accessed items.

Answer

Switch to on-demand capacity mode.

Question 6

A company is using Amazon RDS for MySQL with Multi-AZ deployment. The security team wants to ensure that database administrators cannot view sensitive data. Which TWO actions should be taken to achieve this goal?

Accepted Answer

Use IAM database authentication for application access.. IAM database authentication allows you to authenticate to your RDS MySQL instance using an IAM user or role instead of a traditional database password. This eliminates the need for database administrators to know or manage database credentials, as they can only access the database through IAM policies that grant specific, auditable permissions. By using IAM authentication, you enforce a separation of duties where DBAs cannot view sensitive data unless explicitly authorized by IAM policies.

Answer

Enable audit logging to capture all data access.

Answer

Enable encryption at rest using a customer-managed KMS key.

Answer

Disable query logging to prevent sensitive data from being written to logs.

Question 7

A developer needs to migrate a 500 GB MongoDB database to Amazon DocumentDB. Which approach will minimize application downtime?

Accepted Answer

Use AWS DMS with ongoing replication from MongoDB to DocumentDB. AWS DMS with ongoing replication (change data capture) allows you to perform a full load of the existing 500 GB MongoDB data into DocumentDB while continuously replicating new changes from the source. This minimizes application downtime because you can cut over to DocumentDB only after the target is fully synchronized, rather than taking the source offline for the entire migration duration.

Answer

Write a custom script to migrate data in batches

Answer

Export data from MongoDB, upload to S3, and import into DocumentDB

Answer

Use AWS DataSync to transfer data files

Question 8

A company uses Amazon RDS for PostgreSQL with Multi-AZ deployment. The primary instance fails, and a failover occurs. After the failover, the application is still unable to connect to the database endpoint. The database administrator checks the RDS console and sees that the new primary is in 'available' state. What should the administrator do next to diagnose the connectivity issue?

Accepted Answer

Check the DNS resolution of the RDS endpoint from the application server. In an RDS Multi-AZ failover, the CNAME record for the DB endpoint is updated to point to the new primary's IP address, but DNS caching on the application server (or its JVM/.NET resolver) can retain the old IP for the TTL duration. Since the console shows the new primary as 'available', the failover itself succeeded, so the next diagnostic step is to verify that the application is resolving the endpoint to the new primary's IP. This is the classic post-failover connectivity issue documented by AWS.

Answer

Verify that the security group for the RDS instance allows inbound traffic from the application

Answer

Check if the subnet group for the RDS instance is correctly configured

Answer

Restart the RDS instance to force a new connection

Question 9

A company uses Amazon DynamoDB to store IoT sensor data. Each sensor sends data every second, and the application needs to query the latest reading from each sensor. The sensor ID is the partition key, and the timestamp is the sort key. The table has millions of sensors. Which query pattern is most efficient to get the latest reading for a specific sensor?

Accepted Answer

Use Query with KeyConditionExpression on sensor ID, ScanIndexForward=false, Limit=1. Query with ScanIndexForward=false and Limit=1 retrieves only the most recent item for a given partition key (sensor ID) by reading items in descending sort key (timestamp) order and stopping after one item. This is the most efficient pattern as it uses the primary key index directly, avoids scanning, and minimizes read capacity consumption.

Answer

Use BatchGetItem with the sensor ID and multiple timestamps

Answer

Use Scan with FilterExpression on sensor ID

Answer

Use GetItem with the sensor ID and the current timestamp

Question 10

A startup needs a cost-effective database for a small application that handles both transactional and analytical workloads. They expect low traffic initially but want the database to automatically scale as the business grows. Which database solution is BEST suited?

Accepted Answer

Amazon Aurora Serverless v2. Amazon Aurora Serverless v2 is the best fit because it automatically scales compute and memory capacity in fine-grained increments (down to 1 ACU) based on actual workload demand, supporting both transactional (OLTP) and analytical (OLAP) queries via the MySQL/PostgreSQL-compatible Aurora engine. It offers a pay-per-ACU model that is cost-effective for low-traffic startups while providing near-instant scaling to handle growth without manual intervention.

Answer

Amazon DynamoDB with on-demand capacity

Answer

Amazon RDS for MySQL with a Single-AZ deployment

Answer

Amazon Redshift Serverless

Question 11

A company is running an Amazon RDS for MySQL Multi-AZ DB instance. The application experiences a brief write disruption during automatic failover. The database workload has low write latency requirements. Which configuration change would minimize application impact during failover?

Accepted Answer

Change the DB instance to use a Multi-AZ DB cluster configuration.. Changing to a Multi-AZ DB cluster (option B) reduces application impact during failover because it uses a writer and two reader instances in separate Availability Zones. Failover to a reader is typically faster than the standard Multi-AZ standby failover, minimizing write disruption. Option A (promoting a read replica) is not automatic and introduces significant delay. Option C (single-AZ with backups) does not address failover impact. Option D (increasing instance class) does not significantly reduce failover time.

Answer

Create a read replica in a different Availability Zone and promote it during failover.

Answer

Use a single-AZ deployment and rely on automated backups for recovery.

Answer

Increase the DB instance class to reduce failover time.

Question 12

A company is storing sensitive customer data in an Amazon RDS for MySQL DB instance. They need to ensure that data is encrypted at rest. What is the simplest way to achieve this?

Accepted Answer

Launch a new encrypted DB instance and migrate the data.. For Amazon RDS, encryption at rest can only be enabled when the DB instance is created. To encrypt an existing unencrypted instance, you must create a new encrypted instance and migrate the data. Modifying an existing instance to enable encryption is not supported. Therefore, launching a new encrypted DB instance and migrating data is the simplest way.

Answer

Enable encryption on the existing DB instance by modifying the DB instance settings.

Answer

Enable Transparent Data Encryption (TDE) on the MySQL instance.

Answer

Use client-side encryption with AWS KMS to encrypt data before inserting into the database.

Question 13

A company wants to audit all SQL statements executed on their RDS for PostgreSQL database. Which AWS service should they use?

Accepted Answer

CloudWatch Logs with PostgreSQL audit logs. Amazon RDS for PostgreSQL can publish PostgreSQL audit logs (e.g., pgaudit extension logs) to CloudWatch Logs. Enabling the pgaudit extension and configuring the RDS instance to export logs to CloudWatch allows auditing of all SQL statements. CloudWatch Logs provides centralized storage, search, and analysis. This is the correct AWS service for auditing SQL statements on RDS.

Answer

AWS Database Migration Service (DMS)

Answer

VPC Flow Logs

Answer

Amazon RDS Performance Insights

Question 14

A team is using AWS DMS to migrate a 3 TB Oracle database to Amazon Aurora PostgreSQL. They configured the task as shown. After the full load completes, they notice that the target tables have no indexes, primary keys, or foreign keys. What is the most likely cause?

Accepted Answer

The TargetTablePrepMode is set to DROP_AND_CREATE, which creates tables without indexes or constraints.. When TargetTablePrepMode is set to DROP_AND_CREATE, AWS DMS drops the target table if it exists and then creates a new one using only the basic column definitions from the source. It does not migrate indexes, primary keys, or foreign keys because DMS is not designed to replicate schema objects beyond table structure and data. To preserve constraints and indexes, you must either pre-create them on the target or use a different prep mode like TRUNCATE_BEFORE_LOAD.

Answer

The migration task did not include transformation rules to create indexes and constraints.

Answer

The table selection rule uses wildcards and excludes system tables, which also excludes index definitions.

Answer

The task is using a full load without LOB support, which prevents index creation.

Question 15

Which TWO CloudWatch metrics should be monitored to detect storage performance issues for an Amazon RDS for MySQL instance? (Choose two.)

Accepted Answer

WriteIOPS. WriteIOPS (C) and ReadIOPS (E) are the correct CloudWatch metrics for detecting storage performance issues on an Amazon RDS for MySQL instance, because they directly measure the number of read and write operations per second hitting the underlying EBS storage, and degraded storage performance typically manifests as elevated I/O latency or throughput saturation visible through these I/O metrics. DatabaseConnections (B) only reflects the count of active client connections and indicates connection pressure rather than storage performance. CPUUtilization (D) measures compute load on the DB instance and, while it can be affected by I/O waits, it does not directly isolate storage performance. NetworkReceiveThroughput (A) tracks inbound network traffic to the instance, which is unrelated to disk-level read/write performance.

Answer

NetworkReceiveThroughput

Answer

DatabaseConnections

Answer

CPUUtilization