DBS-C01 Practice Test 1 — 25 Questions

Question 1

A company is deploying a new application on Amazon RDS for PostgreSQL. The security policy requires that all data be encrypted at rest and in transit. Which TWO actions should the company take to meet these requirements?

Accepted Answer

Enable encryption at rest by specifying a KMS key when creating the DB instance.. To encrypt data at rest, you must enable encryption when creating the DB instance by specifying a KMS key (Option C). RDS automatically encrypts automated backups for encrypted instances, so Option B is unnecessary. To encrypt data in transit, you must enforce SSL/TLS connections by setting the parameter rds.force_ssl to 1 in the DB parameter group (Option E). Option A is incorrect because client-side encryption is not required when using RDS encryption and SSL; the requirement is to use RDS features. Option D is incorrect because creating an encrypted read replica does not encrypt the original master instance; you need to enable encryption on the master from the start.

Answer

Use a client-side encryption library to encrypt data before sending to the database.

Answer

Enable encryption for automated backups separately.

Answer

Create an encrypted read replica and promote it to master.

Question 2

Match each AWS service to its primary purpose.

Accepted Answer

RDS: Managed relational database service supporting multiple engines. These are core AWS database services with distinct use cases. Common confusions include mixing up Redshift (data warehouse) with ElastiCache (in-memory cache) and Neptune (graph) with DocumentDB (document).

Answer

Redshift: Fully managed in-memory caching service

Answer

ElastiCache: Fully managed petabyte-scale data warehouse

Answer

Neptune: Fully managed document database

Question 3

A financial services company runs a production Amazon Aurora MySQL database cluster (1 writer, 2 readers) in us-east-1. The database stores critical trading data. The company's disaster recovery policy requires an RPO of 5 seconds and an RTO of 1 minute for a regional failure. The current setup does not include any cross-region replication. The database is 5 TB in size. The operations team needs to implement a solution that meets the DR requirements with minimal cost and operational overhead. Which solution should the team implement?

Accepted Answer

Deploy an Aurora Global Database with a secondary cluster in us-west-2. Configure the secondary cluster as a failover target.. Aurora Global Database provides replication across regions with typical RPO of seconds and RTO of minutes. It is the most appropriate solution for low RPO/RTO with minimal overhead. Option B is correct. Option A (automated backups) have an RPO of 5 minutes, which exceeds the required 5 seconds. Option C (DMS) adds cost and complexity. Option D (cross-Region read replicas) can have replication lag exceeding 5 seconds.

Answer

Enable automated backups and configure cross-Region snapshot copy. Use point-in-time recovery in the secondary region.

Answer

Use AWS Database Migration Service (DMS) to continuously replicate changes to an Aurora cluster in us-west-2.

Answer

Create cross-Region read replicas in us-west-2 and set up a replication channel. In disaster, promote a replica.

Question 4

A company is designing a database for a global e-commerce platform that requires low-latency reads and writes from multiple AWS regions. The data must be strongly consistent within a region but can be eventually consistent across regions. Which TWO services should the company consider?

Accepted Answer

Amazon DynamoDB Global Tables. Amazon DynamoDB Global Tables is correct because it provides a fully managed, multi-region, multi-active database solution that delivers low-latency reads and writes to globally distributed applications. It uses DynamoDB Streams to replicate data across regions with eventual consistency, meeting the requirement for strong consistency within a region and eventual consistency across regions.

Answer

Amazon ElastiCache for Redis Global Datastore

Answer

Amazon RDS Cross-Region Read Replicas

Answer

Amazon Redshift

Question 5

A security auditor reviews the output of a DynamoDB table description command as shown in the exhibit. Which statement accurately describes the encryption configuration of the Users table?

Accepted Answer

The table is encrypted using a customer managed KMS key.. Option D is correct. The output shows SSEDescription with Status ENABLED, SSEType KMS, and a KMSMasterKeyArn, which indicates that the table is encrypted using a customer-managed KMS key. Option A is incorrect because AWS managed KMS keys do not have an ARN like the one shown; they would have an alias like 'aws/dynamodb'. Option B is incorrect because DynamoDB does not use S3 managed keys; the SSEType is KMS. Option C is incorrect because the status is ENABLED, indicating encryption at rest is enabled.

Answer

The table is encrypted using an AWS managed KMS key.

Answer

The table uses server-side encryption with an S3 managed key.

Answer

The table is not encrypted at rest.

Question 6

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database contains sensitive data that must be encrypted at rest. Which action should the company take to enable encryption on the RDS instance?

Accepted Answer

Create a new RDS DB instance with encryption enabled and migrate the data.. Amazon RDS for Oracle supports encryption at rest using AWS KMS. Encryption can only be enabled when the DB instance is created; you cannot encrypt an existing unencrypted RDS instance. Therefore, to enable encryption for an existing on-premises Oracle database being migrated, you must create a new RDS DB instance with encryption enabled at launch and then migrate the data into that new instance. This makes option B the correct choice. Option A is incorrect because you cannot modify an existing unencrypted RDS instance to add encryption. Option C is incorrect because while Oracle Transparent Data Encryption (TDE) can be used to encrypt data within the database, it is not the native Amazon RDS encryption method and requires additional configuration; moreover, RDS encryption via KMS cannot be added on an existing instance. Option D is incorrect because you cannot encrypt a snapshot of an unencrypted database and then restore it to get an encrypted instance; the restored instance will inherit the encryption setting of the snapshot, which for an unencrypted source database cannot be retroactively encrypted.

Answer

Modify the existing RDS DB instance and enable encryption.

Answer

Enable Oracle Transparent Data Encryption (TDE) on the existing RDS instance.

Answer

Take a snapshot of the existing database, encrypt the snapshot, and restore from it.

Question 7

A company runs a critical application on Amazon RDS for PostgreSQL with Multi-AZ. The database has a large table (over 500 GB) that is frequently updated. The operations team notices that the primary instance's CPU usage is consistently above 90%, and the replica lag between the primary and standby is increasing during peak hours. The application can tolerate a few seconds of downtime. The team needs to reduce CPU load and improve write performance without changing the application code. Which action should be taken?

Accepted Answer

Upgrade the DB instance class to a larger size with more vCPUs.. Option A is correct because upgrading to a larger DB instance class provides additional vCPUs, reducing CPU utilization and alleviating replication lag. Option B is wrong: increasing the backup retention period does not reduce I/O during backups; it only keeps backups longer and does not address CPU or write performance. Option C is wrong: Multi-AZ RDS for PostgreSQL uses synchronous replication; switching to asynchronous replication is not possible without compromising durability, and it would not reduce CPU load on the primary. Option D is wrong: creating a read replica offloads read queries, but it does not reduce write load or CPU usage from writes on the primary instance; replication lag may persist or increase.

Answer

Increase the backup retention period to reduce I/O during backups.

Answer

Modify the DB instance to use asynchronous replication instead of synchronous.

Answer

Create a read replica in the same region and offload read queries to it.

Question 8

A company stores sensitive data in an Amazon RDS for PostgreSQL DB instance. The security team requires that all data at rest be encrypted. The instance is currently unencrypted. What is the simplest way to enable encryption with minimal downtime?

Accepted Answer

Create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the snapshot to a new encrypted DB instance.. Option A is correct because an existing unencrypted Amazon RDS instance cannot be directly encrypted. The standard approach to enable encryption with minimal downtime is to create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the snapshot to a new encrypted DB instance. This process typically involves a brief outage during the restore but is simpler than other methods. Option B is incorrect because the AWS CLI does not support enabling encryption on an existing instance. Option C is incorrect because migrating to RDS Custom adds unnecessary complexity and does not directly enable encryption on the current instance. Option D is incorrect because the AWS Management Console also does not allow enabling encryption on an existing instance.

Answer

Use the AWS CLI to modify the DB instance and enable encryption.

Answer

Migrate the data to an Amazon RDS for PostgreSQL DB instance using RDS Custom.

Answer

Modify the DB instance and enable encryption in the console.

Question 9

A company needs to migrate a 100 GB MongoDB database to Amazon DocumentDB (with MongoDB compatibility). The migration must have minimal impact on the source database performance. Which approach should the company take?

Accepted Answer

Use AWS Database Migration Service (AWS DMS) with ongoing replication from the MongoDB source.. AWS DMS with ongoing replication is the correct approach because it supports continuous change data capture (CDC) from MongoDB, enabling a live migration with minimal performance impact on the source. DMS reads the MongoDB oplog to capture changes without locking the database, which is critical for a 100 GB production database. This allows the target DocumentDB to stay synchronized until cutover, reducing downtime and avoiding the need for a full export/import that would strain the source.

Answer

Use AWS DataSync to transfer the MongoDB data files.

Answer

Set up a MongoDB replica set on Amazon EC2 and promote it to primary, then migrate to DocumentDB.

Answer

Use mongodump to export the data and mongorestore to import into DocumentDB.

Question 10

A company is designing a database for an IoT application that ingests sensor data from thousands of devices. Each device sends a reading every minute. The data includes device_id, timestamp, temperature, humidity, and pressure. The application needs to store this data and support queries that retrieve all readings for a specific device within a time range. The company expects high write throughput and moderate read frequency. The data must be stored with high durability. Which TWO database designs are appropriate for this workload? (Choose TWO.)

Accepted Answer

Use Amazon DynamoDB with device_id as partition key and timestamp as sort key.. Option C is correct because DynamoDB's partition key (device_id) and sort key (timestamp) design allows efficient retrieval of all readings for a specific device within a time range using a Query operation with a KeyConditionExpression on the sort key. This schema supports high write throughput by distributing writes across partitions based on device_id, and DynamoDB's multi-AZ replication provides high durability.

Answer

Use Amazon DynamoDB with device_id as partition key and store all readings for a device as a list attribute in a single item, updating the list every minute.

Answer

Use Amazon S3 to store compressed JSON files per device per hour, and query using Amazon Athena.

Answer

Use Amazon RDS for MySQL with a single table and index on device_id and timestamp.

Question 11

A company is migrating a 500 GB on-premises PostgreSQL database to Amazon RDS for PostgreSQL. The migration must have minimal downtime and support ongoing replication after the initial load. Which AWS service should be used?

Accepted Answer

AWS Database Migration Service (DMS) with ongoing replication. AWS Database Migration Service (DMS) with ongoing replication (change data capture, CDC) is required because the scenario demands minimal downtime and continuous synchronization after the initial 500 GB load. DMS uses transaction logs (e.g., PostgreSQL WAL) to capture and apply ongoing changes, enabling a near-zero-duration cutover. Full load only (Option B) would cause downtime during the final sync and cannot support ongoing replication.

Answer

AWS Schema Conversion Tool (SCT)

Answer

AWS Database Migration Service (DMS) with full load only

Answer

AWS Glue

Question 12

A team is migrating an on-premises database to Amazon RDS using AWS DMS. After the full load completed, the task stopped. The team needs to perform ongoing replication to minimize downtime. What change should the team make to the DMS task?

Accepted Answer

Modify the replication task to change the migration type to 'full-load-and-cdc'.. After a full load completes and the task stops, the team needs to enable ongoing replication to capture and apply changes made to the source database during the migration window. Modifying the DMS task to use the 'full-load-and-cdc' migration type allows the task to perform the initial full load and then seamlessly transition to Change Data Capture (CDC) to replicate incremental changes, minimizing downtime. This is the correct approach because DMS supports switching a completed full-load task to include CDC without re-running the full load.

Answer

Restart the replication task with the same settings.

Answer

Create a new replication instance and start a new full-load task.

Answer

Use AWS Schema Conversion Tool to convert the schema again.

Question 13

A company is migrating an on-premises MongoDB database to Amazon DocumentDB (with MongoDB compatibility). They want to validate that the data is consistent after migration. Which tool should they use?

Accepted Answer

AWS DMS data validation. AWS DMS data validation is the correct tool because it provides built-in, row-level checksum-based validation that compares source and target data after a full load or ongoing replication. For DocumentDB migrations, DMS can compute and compare checksums on the fly, ensuring consistency without requiring manual scripting or external tools. This is the recommended AWS approach for validating data integrity during and after a migration to DocumentDB.

Answer

mongoexport and mongoimport

Answer

dbHash command on both databases

Answer

DocumentDB native consistency check tool

Question 14

A team is using AWS DMS to migrate a 3 TB Oracle database to Amazon Aurora PostgreSQL. They configured the task as shown. After the full load completes, they notice that the target tables have no indexes, primary keys, or foreign keys. What is the most likely cause?

Accepted Answer

The TargetTablePrepMode is set to DROP_AND_CREATE, which creates tables without indexes or constraints.. When TargetTablePrepMode is set to DROP_AND_CREATE, AWS DMS drops the target table if it exists and then creates a new one using only the basic column definitions from the source. It does not migrate indexes, primary keys, or foreign keys because DMS is not designed to replicate schema objects beyond table structure and data. To preserve constraints and indexes, you must either pre-create them on the target or use a different prep mode like TRUNCATE_BEFORE_LOAD.

Answer

The migration task did not include transformation rules to create indexes and constraints.

Answer

The table selection rule uses wildcards and excludes system tables, which also excludes index definitions.

Answer

The task is using a full load without LOB support, which prevents index creation.

Question 15

A company is migrating an on-premises Microsoft SQL Server database to Amazon RDS for SQL Server. The database uses SQL Server Agent jobs, custom CLR assemblies, and cross-database queries. Which of the following will require modification before migration?

Accepted Answer

SQL Server Agent jobs. SQL Server Agent jobs are not supported in Amazon RDS for SQL Server because RDS is a managed service that does not provide access to the underlying operating system or the SQL Server Agent service. To migrate job scheduling, you must use alternatives such as AWS Database Migration Service (DMS) tasks, AWS Lambda, or Amazon RDS for SQL Server native scheduling via stored procedures and Windows Task Scheduler on an EC2 instance.

Answer

Cross-database queries

Answer

Custom CLR assemblies

Answer

Stored procedures that use dynamic SQL

Question 16

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database is 2 TB and has a high number of small transactions. The company needs to minimize downtime during the migration. Which TWO strategies should be used together? (Choose two.)

Accepted Answer

Use AWS Database Migration Service (DMS) to perform a full load and ongoing replication.. AWS DMS with ongoing replication (CDC) is the correct choice because it allows a full load of the 2 TB database followed by continuous replication of changes, minimizing downtime by keeping the target RDS instance nearly synchronized with the source until cutover. This approach is specifically designed for large databases with high transaction volumes, as it reduces the final outage window to seconds or minutes.

Answer

Use Oracle Data Pump to export the database and import into RDS.

Answer

Set up a VPN connection between on-premises and AWS for direct database link.

Answer

Create a manual snapshot of the RDS instance during the migration.

Question 17

A company is running a production Amazon DynamoDB table with on-demand capacity. The table experiences occasional throttling during traffic spikes. The table's partition key is a timestamp, and the workload is write-heavy. The operations team needs to reduce throttling. Which THREE actions should the team take? (Choose three.)

Accepted Answer

Add a random suffix to the partition key to distribute writes evenly.. Option A is correct because adding a random suffix to the timestamp partition key breaks the sequential write pattern, distributing writes evenly across all partitions. This prevents hot partitions, which are the root cause of throttling in a write-heavy workload with a monotonically increasing partition key.

Answer

Increase the read capacity units for the table.

Answer

Enable DynamoDB global tables to distribute write traffic.

Question 18

A company is using an Amazon RDS for PostgreSQL database to store sensitive customer data. The security team requires that all data be encrypted at rest and in transit, and that access to the database is restricted to only specific applications. Currently, the database is encrypted at rest using AWS KMS, and connections are made over SSL. However, the security team wants to ensure that even if the database credentials are compromised, an attacker cannot access the database from unauthorized IP addresses. What should be done to meet this requirement?

Accepted Answer

Modify the security group associated with the RDS instance to allow inbound traffic only from the application's IP addresses.. Option C is correct because modifying the security group associated with the RDS instance to allow inbound traffic only from the application's IP addresses restricts network access at the instance level, preventing unauthorized IP addresses from connecting even if credentials are compromised. Option A (attaching a resource-based policy) does not restrict network access—it controls IAM permissions. Option B (creating a new RDS instance in a VPC with a network ACL) is unnecessarily complex and involves migrating data; the requirement can be met by modifying the existing security group without creating a new instance. Option D (enabling IAM database authentication) authenticates database users via IAM but does not restrict source IP addresses, so it does not meet the stated requirement.

Answer

Attach a resource-based policy to the RDS instance to allow only specific IAM roles.

Answer

Create a new RDS instance in a VPC with a network ACL that allows inbound traffic only from specific IP ranges, and migrate the data.

Answer

Enable IAM database authentication for the RDS instance.

Question 19

A company is using Amazon RDS for PostgreSQL and wants to implement encryption in transit for all client connections. The security team has identified that some connections are not using SSL. Which TWO actions should the company take to enforce SSL for all connections?

Accepted Answer

Set the 'rds.force_ssl' parameter to '1' in the DB parameter group.. The correct actions to enforce SSL for all connections are A and E. Option A: Setting 'rds.force_ssl' to '1' in the DB parameter group forces the RDS PostgreSQL instance to require SSL for all incoming connections at the server level. Option E: Modifying the 'pg_hba.conf' file to require SSL for all users via 'hostssl' entries ensures that only SSL connections are allowed, complementing the server-side enforcement. Option C is incorrect because associating a custom SSL certificate is not required for enforcing SSL; AWS RDS provides a valid certificate. Option B is a client-side configuration that does not enforce server-side SSL. Option D is client-side and not a server-side enforcement action. Options A and E together provide robust server-side enforcement.

Answer

Install the RDS CA certificate on all client machines.

Answer

Create a new SSL certificate and associate it with the RDS instance.

Answer

Configure the application connection string to use 'sslmode=require'.

Question 20

A company is using Amazon RDS for MySQL and notices that database connections are being rejected intermittently. The application logs show 'Too many connections' errors. The DB instance has 1000 max_connections. Which action should the DBA take to troubleshoot and resolve this issue without impacting performance?

Accepted Answer

Enable Performance Insights and review the 'DB Connections' metric to identify spikes and troubleshoot application connection pooling. Option C is correct because enabling Performance Insights allows the DBA to monitor the 'DB Connections' metric in near real-time, identify exactly when connection spikes occur, and correlate those spikes with application behavior. This diagnostic approach pinpoints the root cause—such as a connection leak or insufficient connection pooling—without making changes that could degrade performance. Increasing max_connections or lowering wait_timeout without understanding the usage pattern can lead to resource exhaustion or premature connection termination.

Answer

Increase the max_connections parameter to 5000 in the DB parameter group

Answer

Create a read replica to offload read traffic

Answer

Set the 'wait_timeout' parameter to a lower value to close idle connections faster