DBS-C01 Practice Test 24 — 15 Questions

Question 1

A company is deploying a new Amazon RDS for MariaDB instance. The database must be accessible from a specific set of EC2 instances in a VPC. How should the company configure security to allow access?

Accepted Answer

Create a security group for the RDS instance that allows inbound traffic from the EC2 instances' security group.. The correct approach is to create a security group for the RDS instance whose inbound rules reference the EC2 instances' security group as the source. This allows any EC2 instance in that group to connect without hardcoding IP addresses, and it dynamically adapts as instances scale. Security group referencing is the AWS-recommended pattern for tiered application access.

Answer

Assign the same security group to both the RDS instance and the EC2 instances.

Answer

Attach an IAM role to the EC2 instances that grants access to the RDS database.

Answer

Configure a network ACL to allow inbound traffic from the EC2 instance IPs.

Question 2

A company runs a PostgreSQL database on Amazon RDS for a CRM application. The database is 500 GB and experiences high read traffic. The company wants to improve read scalability and reduce latency. Which TWO actions should the company take? (Choose two.)

Accepted Answer

Implement Amazon ElastiCache for Redis to cache common queries.. Amazon ElastiCache for Redis can cache the results of frequently executed read queries, offloading read traffic from the RDS PostgreSQL instance and reducing latency for repeated queries. This is especially effective for read-heavy workloads where the same data is requested many times, as Redis provides sub-millisecond response times and reduces the load on the database.

Answer

Store large objects in Amazon S3 and reference them.

Answer

Enable Multi-AZ for automatic failover.

Answer

Migrate data to Amazon DynamoDB with Global Tables.

Question 3

Arrange the steps to set up cross-Region read replicas for an Amazon Aurora MySQL DB cluster in the correct order.

Accepted Answer

Enable binary logging on the source Aurora MySQL DB cluster, then create a cross-Region read replica in the target Region, then verify replication status.. Cross-Region replicas require binary logging enabled on the source, then creating a read replica in another Region and verifying replication.

Answer

Create a cross-Region read replica in the target Region, then enable binary logging on the source cluster, then verify replication.

Answer

Enable binary logging on the source cluster, then promote the read replica to a standalone cluster, then verify replication.

Answer

Create a read replica in the same Region, then enable cross-Region replication by modifying the source cluster, then verify.

Question 4

A company is migrating its on-premises Oracle database to Amazon RDS for Oracle. As part of the migration, they need to ensure that all sensitive data is encrypted at rest using AWS Key Management Service (AWS KMS). Which configuration step is required to achieve this?

Accepted Answer

Create a new encrypted DB instance by enabling encryption and specifying a KMS key.. Amazon RDS encryption at rest can only be enabled at the time the DB instance is created; it cannot be turned on for an existing unencrypted instance. To encrypt an existing Oracle database, you must create a new encrypted DB instance (or restore from a snapshot with encryption enabled) and specify a KMS key. This is why option D is the required configuration step.

Answer

Modify the existing DB instance to enable encryption.

Answer

Configure SSL/TLS on the DB instance to encrypt data at rest.

Answer

Use AWS CloudHSM to generate and store the encryption keys.

Question 5

A database administrator notices that Amazon RDS for MySQL is experiencing high CPU utilization during peak hours. The application is read-heavy with many SELECT queries. Which action is most cost-effective to improve performance?

Accepted Answer

Create one or more read replicas and direct read traffic to them.. Creating one or more read replicas and directing read traffic to them (A) is the most cost-effective solution because it offloads SELECT queries from the primary instance, distributing the read load horizontally. Read replicas are billed at the same rate as a standard DB instance but can be smaller or scaled independently, and they directly address the read-heavy workload pattern without over-provisioning the primary.

Answer

Increase the DB instance class to a larger size.

Answer

Increase the allocated storage to improve I/O throughput.

Answer

Scale up the DB instance vertically to a higher vCPU count.

Question 6

A company runs a critical PostgreSQL database on Amazon RDS and needs to implement point-in-time recovery (PITR) with a recovery window of the last 35 days. Currently, automated backups are set to retain for 35 days. The database size is 500 GB. What additional configuration is required?

Accepted Answer

No additional configuration is required; automated backups enable PITR. Amazon RDS for PostgreSQL automated backups include transaction logs, which are required for point-in-time recovery. With automated backups retained for 35 days, RDS can restore the database to any second within that retention period by replaying transaction logs against a full backup. No additional configuration is needed because PITR is an inherent feature of automated backups when the retention period is set to 35 days.

Answer

Enable manual snapshots every hour

Answer

Set up a replication slot and stream transaction logs to S3

Answer

Enable Multi-AZ deployment

Question 7

A company is using Amazon Redshift and needs to encrypt data at rest with a customer-managed key. Which TWO steps are required to enable encryption with a customer-managed AWS KMS key?

Accepted Answer

Create a customer-managed key in AWS KMS.. Option A is correct because enabling encryption with a customer-managed key requires first creating that key in AWS KMS, since Redshift cannot use a key that does not yet exist in the account. Option B is correct because the KMS key must be supplied as part of the cluster's encryption configuration when the Redshift cluster is created, for example via the CreateCluster API's Encrypted=true and KmsKeyId parameters. Option C is not required because encryption with a KMS key is specified at cluster creation; you cannot simply modify an existing unencrypted cluster to enable KMS encryption, and the AWS CLI is only a tool, not a required step. Option D is wrong because HSM (CloudHSM) is a separate encryption option, not the customer-managed KMS key scenario described. Option E is wrong because enabling Redshift encryption does not require an AWS Support request.

Answer

Use the AWS CLI to modify the cluster to enable encryption.

Answer

Configure the Redshift cluster to use an HSM.

Answer

Request AWS Support to enable encryption.

Question 8

A company is running an Amazon RDS for PostgreSQL DB instance with Multi-AZ. The database experiences a failover during a maintenance window. After the failover, the application connection pool continues to use the old primary endpoint, causing connection errors. What is the BEST way to ensure application connections automatically redirect to the new primary after a failover?

Accepted Answer

Use the RDS endpoint (CNAME) provided by RDS, which automatically points to the primary instance.. The RDS endpoint (CNAME) provided by Amazon RDS automatically points to the current primary instance. After a failover, RDS updates the CNAME record to point to the new primary, so application connections using the endpoint are seamlessly redirected without manual intervention. This is the simplest and most reliable approach. Option B (Custom Route 53 failover routing) is unnecessary because RDS already provides a managed DNS endpoint. Option C (modifying connection string manually) is not automated and prone to human error. Option D (static IP) is not practical as RDS instances do not have static IPs; the DNS endpoint handles failover transparently.

Answer

Create a custom Route 53 failover routing policy pointing to both DB instances.

Answer

Modify the application connection string to point to the new primary IP address after each failover.

Answer

Configure the application to use a static IP address of the primary instance.

Question 9

A company needs to run complex analytical queries on structured data in Amazon S3 without loading data into a database. The queries must execute quickly and support standard SQL. Which service should they use?

Accepted Answer

Amazon Athena. Amazon Athena is a serverless interactive query service that allows you to run standard SQL directly on data stored in Amazon S3 without loading or transforming it. It uses Presto under the hood and supports complex analytical queries on structured data with fast execution, making it the ideal choice for this use case.

Answer

Amazon QuickSight

Answer

AWS Glue ETL jobs

Answer

Amazon Redshift Spectrum

Question 10

A database administrator notices that an Amazon RDS for MySQL instance's CPU utilization is consistently above 80% during peak hours. The DB instance is a db.r5.large with 16 GB memory and 500 GB gp2 storage. The application is a read-intensive web application. Which action is MOST effective to reduce CPU load without significant cost increase?

Accepted Answer

Create a read replica and redirect read traffic to it. For a read-intensive web application, the most effective way to reduce CPU load on the primary RDS instance without significant cost increase is to create a read replica and redirect read traffic to it. This offloads the read queries from the primary instance, distributing the workload and reducing CPU utilization on the primary. Read replicas are cost-effective because they can be smaller instances or use the same instance class, and they scale horizontally for read-heavy workloads.

Answer

Increase the instance size to db.r5.xlarge

Answer

Enable Performance Insights to identify slow queries and optimize them

Answer

Increase the allocated storage to 1000 GB to improve I/O performance

Question 11

A company runs an Amazon RDS for SQL Server DB instance in a VPC. The security group for the DB instance allows inbound traffic on port 1433 from the application servers' security group. The application servers can connect to the database, but a database administrator cannot connect from their workstation using SQL Server Management Studio (SSMS). What is the MOST likely cause?

Accepted Answer

The security group does not allow inbound traffic from the DBA workstation's IP address.. The security group for the RDS instance only allows inbound traffic from the application servers' security group. The DBA's workstation is not a member of that security group, so its connection attempt on port 1433 is blocked. To allow the DBA to connect, the security group must be updated to permit inbound traffic from the DBA's IP address or from a security group that includes the workstation.

Answer

The DBA is using an incompatible version of SSMS.

Answer

The DB instance is configured as Multi-AZ, which restricts direct connections.

Answer

The DB instance has encryption enabled, which blocks non-encrypted connections.

Question 12

A company is migrating a 10 TB Oracle Data Warehouse to Amazon Redshift. The source database runs on premises with limited bandwidth (100 Mbps). The migration must complete within 5 days. Which approach is most cost-effective and meets the timeline?

Accepted Answer

Use AWS Snowball Edge to transfer the initial full load, then AWS DMS for ongoing changes.. The 10 TB dataset over a 100 Mbps link would take approximately 10 days (10 TB * 8 / 100 Mbps / 86400 seconds/day) for a full load, exceeding the 5-day window. AWS Snowball Edge provides a physical, high-bandwidth transfer for the initial full load, bypassing network constraints, and AWS DMS then captures and applies ongoing changes (CDC) to keep the target in sync. This combination is the most cost-effective as it avoids expensive Direct Connect and meets the timeline.

Answer

Use AWS DMS over the internet to migrate data.

Answer

Use AWS Schema Conversion Tool (SCT) to convert and then upload to S3.

Answer

Use AWS DMS with AWS Direct Connect at 1 Gbps.

Question 13

A company is designing a database for an IoT application that ingests sensor data from thousands of devices. Each device sends a reading every minute. The data includes device_id, timestamp, temperature, humidity, and pressure. The application needs to store this data and support queries that retrieve all readings for a specific device within a time range. The company expects high write throughput and moderate read frequency. The data must be stored with high durability. Which TWO database designs are appropriate for this workload? (Choose TWO.)

Accepted Answer

Use Amazon DynamoDB with device_id as partition key and timestamp as sort key.. DynamoDB's partition key (device_id) and sort key (timestamp) design allows efficient retrieval of all readings for a specific device within a time range using a Query operation with a KeyConditionExpression on the sort key. This schema supports high write throughput by distributing writes across partitions based on device_id, and DynamoDB's multi-AZ replication provides high durability.

Answer

Use Amazon DynamoDB with device_id as partition key and store all readings for a device as a list attribute in a single item, updating the list every minute.

Answer

Use Amazon S3 to store compressed JSON files per device per hour, and query using Amazon Athena.

Answer

Use Amazon RDS for MySQL with a single table and index on device_id and timestamp.

Question 14

A company is migrating a 3 TB Oracle database from on-premises to Amazon RDS for Oracle. The migration must have zero downtime. The on-premises server uses Oracle Data Guard for disaster recovery. The network bandwidth is 200 Mbps. The team plans to use AWS DMS with CDC from Oracle redo logs. During the initial full load, DMS reports that the source table 'ORDERS' has a table-level supplemental log missing. The migration fails. What should the team do first to resolve this issue?

Accepted Answer

Enable supplemental logging on the Oracle source database for the 'ORDERS' table.. AWS DMS requires supplemental logging on the source Oracle tables to capture change data for CDC. Without it, DMS cannot track changes. Option A is incorrect because switching to Oracle GoldenGate would not address the root cause and adds complexity. Option B is incorrect because using AWS SCT and native export/import does not provide zero-downtime migration. Option D is incorrect because recreating the task with 'full load only' would lose the CDC requirement, causing downtime for ongoing changes.

Answer

Switch to Oracle GoldenGate for migration.

Answer

Use AWS SCT to convert the schema and then use a native export/import.

Answer

Recreate the DMS task with 'full load only' to bypass CDC.

Question 15

A company is migrating an on-premises PostgreSQL database to Amazon RDS for PostgreSQL. The database is 2 TB in size and has a high write workload. The company needs to minimize downtime during the migration. Which AWS service or feature should the company use to achieve this?

Accepted Answer

Use AWS Database Migration Service (AWS DMS) with ongoing replication.. AWS DMS with ongoing replication (change data capture, CDC) is the correct choice because it allows continuous synchronization of the source PostgreSQL database with the target RDS for PostgreSQL instance after an initial full load. This minimizes downtime by enabling the target to stay up-to-date with changes until the cutover, which is critical for a 2 TB database with a high write workload.

Answer

Use pg_dump and pg_restore to export and import the database.

Answer

Use the AWS Schema Conversion Tool (AWS SCT) to convert the schema and migrate data.

Answer

Use AWS DataSync to replicate the database files.