DBS-C01 Practice Test 2 — 25 Questions

Question 1

A company is migrating a 500 GB MongoDB database to Amazon DocumentDB. The migration must have minimal impact on the source database. Which approach should the company take?

Accepted Answer

Use AWS Database Migration Service (DMS) with MongoDB as source and DocumentDB as target.. AWS DMS supports ongoing replication from MongoDB to Amazon DocumentDB, enabling a live migration with minimal impact on the source database. DMS uses the MongoDB oplog to capture changes continuously, so the source is only read during the initial load and then tailed for CDC, avoiding heavy locks or performance degradation.

Answer

Use mongodump to export the data, then use mongorestore to import into DocumentDB.

Answer

Use mongoexport to export CSV, then use the DocumentDB import tool.

Answer

Use AWS Schema Conversion Tool (SCT) to convert schema, then copy data.

Question 2

Refer to the exhibit. A company is creating an Aurora MySQL cluster using the AWS CLI. The command fails with an error. The company has a default KMS key but the command specifies a customer-managed KMS key. What is the most likely cause of the failure?

Accepted Answer

The IAM user does not have permission to use the specified KMS key. The most likely cause of the failure is that the IAM user does not have the required permissions to use the specified customer-managed KMS key. When you specify a KMS key in the `--kms-key-id` parameter for an Aurora MySQL cluster, the IAM user must have `kms:CreateGrant`, `kms:Decrypt`, and `kms:Encrypt` permissions on that key. If the user lacks these permissions, the command fails even if the key exists and is in the correct region.

Answer

The --kms-key-id parameter is not supported for aurora-mysql engine

Answer

The KMS key does not exist

Answer

The KMS key is in a different region

Question 3

A company needs to audit all SQL queries executed on an Amazon RDS for PostgreSQL instance. Which feature should the company enable?

Accepted Answer

pgAudit extension. PgAudit (PostgreSQL Audit Extension) is the native, supported way to log all SQL queries on Amazon RDS for PostgreSQL. It provides detailed session and object audit logging via the shared_preload_libraries parameter, capturing every executed statement without requiring external tools or additional infrastructure.

Answer

Advanced Audit

Answer

Database Activity Streams

Answer

Fine-Grained Auditing

Question 4

A company is running an Amazon RDS for MySQL instance as shown in the exhibit. The application is experiencing high write latency. The instance has a high number of write operations and the storage queue depth is consistently above 100. Which change would most effectively reduce write latency?

Accepted Answer

Modify the storage type to Provisioned IOPS (io1) with 3000 IOPS.. The instance is experiencing high write latency with a consistently high storage queue depth (above 100), which indicates that the current storage (likely gp2 or magnetic) cannot keep up with the write IOPS demand. Provisioned IOPS (io1) with 3000 IOPS guarantees a dedicated level of IOPS, reducing queue depth and write latency by ensuring the storage subsystem can handle the write workload without throttling.

Answer

Change the instance class to db.m5.xlarge.

Answer

Enable Multi-AZ to offload writes to a standby.

Answer

Increase the allocated storage to 200 GB.

Question 5

A startup needs a fully managed, serverless database for a new web application with unpredictable traffic. The application requires ACID transactions and SQL queries. Which AWS database service should they use?

Accepted Answer

Amazon Aurora Serverless v2. Amazon Aurora Serverless v2 is the correct choice because it provides a fully managed, serverless relational database that automatically scales capacity based on application demand, supports ACID transactions, and uses standard SQL queries. It is ideal for unpredictable traffic patterns as it can scale from zero to hundreds of thousands of transactions per minute without manual intervention.

Answer

Amazon Neptune

Answer

Amazon DynamoDB

Answer

Amazon Redshift

Question 6

A company is deploying a new Amazon RDS for SQL Server database. They need to ensure that the database is encrypted at rest using a customer-managed AWS KMS key. Which action should be taken?

Accepted Answer

Enable encryption at rest when creating the RDS instance and select the customer-managed KMS key.. Encryption at rest for RDS must be enabled at instance creation, and you can select a customer-managed KMS key at that time. Once enabled, the key cannot be changed. The other options are either impossible or do not meet the requirement of using a customer-managed KMS key.

Answer

Enable encryption at rest using the default AWS managed key for RDS, then change the key to a customer-managed key after creation.

Answer

Create the RDS instance without encryption, then modify the instance to enable encryption using the AWS Management Console.

Answer

Use Transparent Data Encryption (TDE) at the database level with a customer-managed key stored in AWS KMS.

Question 7

A company uses Amazon DynamoDB with global tables. They notice that changes made in one region are not appearing in another region after several minutes. Which CloudWatch metric should be monitored to check the replication lag?

Accepted Answer

ReplicationLatency. ReplicationLatency measures the time between the last update on the source table and the last update on the replica table. Option A (ConsumedWriteCapacityUnits) is wrong because it measures write capacity usage, not replication lag. Option B (SuccessfulRequestLatency) is wrong because it measures request latency, not replication lag. Option D (ThrottledRequests) is wrong because it indicates throttling, not replication lag.

Answer

ConsumedWriteCapacityUnits

Answer

SuccessfulRequestLatency

Answer

ThrottledRequests

Question 8

A company is designing a relational database for an e-commerce application that requires high availability and automated failover across AWS Regions. Which AWS database service should they use?

Accepted Answer

Amazon Aurora Global Database. Amazon Aurora Global Database is the correct choice because it is designed for cross-Region disaster recovery and high availability, replicating data with a typical latency of under one second across multiple AWS Regions. It supports automated failover from the primary Region to one of the secondary Regions, meeting the requirement for automated cross-Region failover without manual intervention.

Answer

Amazon DynamoDB Global Tables

Answer

Amazon RDS with Multi-AZ deployment

Answer

Amazon Redshift with cross-Region snapshot copy

Question 9

A financial services company is using Amazon DynamoDB to store customer transaction data. The compliance team requires that all data be encrypted at rest using a customer-managed AWS KMS key, and that access to the key be auditable via AWS CloudTrail. Additionally, the security team wants to ensure that DynamoDB can only be accessed from within the VPC using a VPC endpoint. Which combination of steps should the company take to meet these requirements?

Accepted Answer

Enable server-side encryption with a customer-managed KMS key and create an interface VPC endpoint for DynamoDB.. Option C. To meet the encryption requirement, the company must use a customer-managed KMS key, not an AWS managed key. For VPC-only access, DynamoDB supports interface VPC endpoints (via AWS PrivateLink), which provide private connectivity. Option C correctly uses a customer-managed KMS key and an interface VPC endpoint. Option D is incorrect because it uses an AWS managed KMS key. Option A is incorrect because CloudHSM is unnecessary and VPC peering is not the correct method. Option B is incorrect because a NAT gateway still routes traffic over the internet.

Answer

Use a CloudHSM key for encryption and create a VPC peering connection to DynamoDB.

Answer

Enable server-side encryption with a customer-managed KMS key and route all traffic through a NAT gateway.

Answer

Use AWS managed KMS key and a gateway VPC endpoint for DynamoDB.

Question 10

A database administrator needs to audit all SQL statements executed on an Amazon RDS for PostgreSQL DB instance. Which service should be used to capture and log the SQL statements?

Accepted Answer

Amazon RDS for PostgreSQL database activity streams. Amazon RDS for PostgreSQL supports database activity streams, which can be integrated with services like Amazon CloudWatch and AWS CloudTrail to provide a near real-time stream of database activities. The other options do not capture SQL statements: CloudTrail records API calls to RDS, Config records resource configuration changes, and Inspector is for vulnerability assessment.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon Inspector

Question 11

A company is deploying a new application that requires a MySQL-compatible database with automatic scaling of compute and storage resources. Which AWS service should be used?

Accepted Answer

Amazon Aurora MySQL. Amazon Aurora MySQL is the correct choice because it is a MySQL-compatible relational database that automatically scales compute (up to 128 vCPUs and 244 GiB of memory) and storage (up to 128 TiB in 10 GiB increments) without downtime. Aurora's storage subsystem is distributed and self-healing, scaling as data grows, and its compute can be scaled via Auto Scaling policies or by modifying the instance class with minimal disruption.

Answer

Amazon RDS for MySQL

Answer

Amazon DynamoDB

Answer

Amazon Redshift

Question 12

A company wants to restrict access to an Amazon RDS for MySQL DB instance so that only applications running in a specific VPC can connect. Which solution should be implemented?

Accepted Answer

Configure the DB instance's security group to allow inbound traffic only from the application's security group.. RDS security groups control inbound traffic at the instance/ENI level, and referencing the application's security group as the source is the canonical way to allow only that application tier to connect. This creates a dynamic, identity-based rule that follows the application instances regardless of their IP addresses. It is the standard AWS pattern for tiered VPC architectures and satisfies the requirement to restrict access to a specific VPC's applications.

Answer

Use an IAM policy to restrict database connections based on source IP.

Answer

Configure the subnet's network ACL to allow inbound traffic only from the application's IP range.

Answer

Attach a security group to the subnet that allows inbound traffic from the application's VPC.

Question 13

A team is migrating an on-premises Oracle database to Amazon Aurora PostgreSQL. The database is 2 TB and has a 6-hour maintenance window. Which AWS service should the team use to minimize downtime?

Accepted Answer

AWS Database Migration Service (AWS DMS). AWS DMS is the correct choice because it can perform a live migration from Oracle to Aurora PostgreSQL with minimal downtime using ongoing replication (change data capture). It supports heterogeneous migrations, automatically converting the source schema and data types, and can handle a 2 TB database within the 6-hour maintenance window by using multiple parallel tasks and large instance types.

Answer

Amazon S3 Transfer Acceleration

Answer

AWS Snowball Edge

Answer

Amazon EC2 with Oracle installed

Question 14

A database specialist is troubleshooting an Amazon RDS for MySQL DB instance that is running out of storage. The instance has automated backups enabled. The specialist needs to free up storage space immediately without losing backup capability. Which action should the specialist take?

Accepted Answer

Delete older automated backups that are no longer needed.. None of the provided options will free up DB instance storage. Automated backups are stored in Amazon S3, not in the instance's allocated storage. To free up instance storage, you would need to increase the allocated storage or delete actual data from the database. Reducing backup retention deletes backups from S3, not instance storage. Manual snapshots are also in S3. Disabling backups stops future backups but does not free existing storage.

Answer

Modify the DB instance to reduce the backup retention period to 0 days.

Answer

Delete manual snapshots from the RDS console.

Answer

Disable automated backups to stop storage consumption.

Question 15

A company runs a production Amazon DynamoDB table with on-demand capacity. The table stores session data for a web application. Recently, users have reported occasional slow response times. The operations team notices that the table's ConsumedWriteCapacityUnits metric shows occasional spikes that exceed the provisioned throughput (though on-demand auto-scales), and ThrottledWriteEvents metrics show occasional throttling. The application uses the AWS SDK with default retry logic. The database specialist is asked to investigate. Upon reviewing the table configuration, the specialist finds that the table has a simple primary key (partition key only) and the data access pattern is heavily skewed toward a small number of partition keys. The application writes in batches of 25 items using the BatchWriteItem API. What should the specialist recommend to reduce throttling and improve performance?

Accepted Answer

Implement write sharding by adding a random suffix to the partition key to distribute writes more evenly.. The throttling is caused by a hot partition: the table uses a single partition key, and writes are heavily skewed toward a few keys. By adding a random suffix to the partition key (write sharding), the writes are distributed evenly across all partitions, eliminating hot spots and reducing throttling. The on-demand capacity mode already handles overall throughput, but it cannot prevent throttling on individual partitions when access is skewed.

Answer

Increase the provisioned read capacity units to handle the load.

Answer

Switch the table to provisioned capacity mode and increase write capacity.

Answer

Enable DynamoDB Accelerator (DAX) to cache write operations.

Question 16

A company has an Amazon RDS for PostgreSQL DB instance that needs to be accessed by an application running on an Amazon EC2 instance. Both resources are in the same VPC. The security team insists that all traffic between the application and the database be encrypted in transit. Which configuration ensures this?

Accepted Answer

Enable SSL/TLS on the RDS instance and configure the application to connect using SSL.. Encryption in transit between an EC2 application and an RDS PostgreSQL instance is achieved by enabling SSL/TLS on the RDS instance and configuring the application's connection string to use SSL (e.g., sslmode=require or verify-full with the RDS CA). Being in the same VPC does not encrypt traffic — VPC networking is isolated but not encrypted at the application layer.

Answer

Add a security group rule that allows traffic only from the EC2 instance's private IP.

Answer

Create an AWS Site-to-Site VPN connection between the EC2 instance and the RDS instance.

Answer

Set up VPC peering between the EC2 instance's VPC and the RDS instance's VPC.

Question 17

A social media application stores user posts in an Amazon RDS for PostgreSQL instance. The application experiences a sudden spike in read traffic during peak hours, causing database bottlenecks. The team needs to improve read scalability without changing the application code. Which solution is MOST cost-effective?

Accepted Answer

Use Amazon RDS for PostgreSQL Read Replicas. Amazon RDS for PostgreSQL Read Replicas allow you to offload read traffic from the primary DB instance to one or more read-only replicas, improving read scalability without any application code changes. This is the most cost-effective solution as it leverages the existing PostgreSQL engine and requires only minimal additional compute and storage costs for the replicas.

Answer

Migrate to Amazon DynamoDB with DAX

Answer

Enable Multi-AZ on the RDS instance

Answer

Use Amazon ElastiCache to cache query results

Question 18

Refer to the exhibit. A developer created an IAM policy with the above command and attached it to a user. What is the security implication of this policy?

Accepted Answer

The policy grants full administrative access to all RDS resources in the account.. The policy allows all RDS actions on all resources, granting full administrative access to all RDS resources in the account. This is overly permissive and violates the principle of least privilege. Option A is wrong because the policy does not restrict to a specific region. Option B is wrong because it does not restrict to a specific region. Option D is wrong because it does not restrict to read-only access.

Answer

The policy restricts access to only one specific DB instance.

Answer

The policy allows only actions in the us-east-1 region.

Answer

The policy only allows read-only access to RDS.

Question 19

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. During the migration, the database administrator notices that the CPU utilization on the RDS instance is consistently above 90% during peak hours, even though the on-premises server had similar specifications. The application queries are mostly SELECT statements with occasional DML. The RDS instance is db.r5.large with 500 GB of General Purpose SSD (gp2) storage. Which change would most likely reduce CPU utilization?

Accepted Answer

Upgrade to a larger instance type, such as db.r5.xlarge.. The db.r5.large instance type has 2 vCPUs and 16 GiB of memory. Sustained CPU utilization above 90% during peak hours indicates that the instance is compute-bound for the workload. Upgrading to db.r5.xlarge (4 vCPUs, 32 GiB memory) doubles the available CPU capacity, directly reducing CPU utilization for the same query load. The on-premises server had similar specifications, but RDS instances may have different CPU architectures or hypervisor overhead, making the larger instance the most direct fix.

Answer

Create a read replica and redirect all SELECT queries to the replica.

Answer

Enable Multi-AZ to offload CPU to the standby instance.

Answer

Increase the allocated storage to 1 TB to improve I/O performance.

Question 20

A company uses Amazon DynamoDB for a time-series IoT workload. Each device sends a data point every minute. The primary key consists of device_id (partition key) and timestamp (sort key). The company wants to efficiently retrieve the latest 10 data points for a specific device. Which query design is most efficient?

Accepted Answer

Query the table with ScanIndexForward=false and Limit=10.. Query with ScanIndexForward=false retrieves items in descending order by the sort key (timestamp), and Limit=10 stops after the first 10 items, which are the most recent 10 data points for the given device_id. This is the most efficient design as it reads only the 10 items needed, leveraging the DynamoDB local secondary index or table's sort key order without any post-processing.

Answer

Use GetItem on the device_id partition key with the maximum timestamp.

Answer

Query the table with ScanIndexForward=true and Limit=10, then reverse the result set.

Answer

Scan the entire table and filter by device_id, then sort by timestamp.