DBS-C01 Practice Test 5 — 25 Questions

Question 1

A database administrator runs the above AWS CLI command to troubleshoot replication issues. The DB instance 'mydb' is a read replica of 'my-source-db'. The administrator notices that the replica lag is increasing. Which of the following is the MOST likely cause?

Accepted Answer

The read replica is in a different AWS Region than the source.. Option D is correct because when a read replica is in a different AWS Region than the source, the replication traffic must traverse the public internet or a VPN connection, introducing network latency and potential bandwidth constraints. This cross-region lag is a common cause of increasing replica lag, as the asynchronous MySQL replication relies on a single I/O thread to download the binary log events from the source, and any network delay directly impacts the replica's ability to keep up.

Answer

The source DB instance is running a different MySQL version.

Answer

The read replica has Multi-AZ disabled.

Answer

The read replica is using a smaller instance class than the source.

Question 2

A company runs an Amazon Aurora MySQL database cluster with a primary instance and two Aurora Replicas. The application is experiencing occasional deadlocks on the primary instance during peak hours. The deadlocks cause transaction rollbacks that impact customer experience. Which design change should the company implement to minimize deadlocks?

Accepted Answer

Enable Aurora Auto Scaling for read replicas and offload read-only queries to replicas.. Option A is correct because offloading read-only queries to Aurora Replicas reduces the volume of read-write contention on the primary instance. Deadlocks often arise when concurrent transactions compete for the same resources; by directing read traffic to replicas, the primary handles fewer overlapping transactions, lowering the probability of lock conflicts. Aurora Replicas share the same underlying storage volume and serve read traffic without blocking writes on the primary, making this a targeted solution for deadlock reduction.

Answer

Set the transaction isolation level to READ UNCOMMITTED to avoid locks.

Answer

Configure Multi-AZ deployment to automatically failover during deadlocks.

Answer

Increase the DB instance class size to handle more concurrent transactions.

Question 3

A company is using Amazon DynamoDB for a gaming leaderboard. The table has a partition key of 'game_id' and a sort key of 'score'. The application performs a query to retrieve the top 10 scores for a given game_id. The query uses ScanIndexForward: false and Limit: 10. Recently, the query response time has increased. The table's read capacity is 1000 RCU, and the average item size is 1 KB. Which is the most likely cause of the increased latency?

Accepted Answer

A hot partition on the game_id key is causing throttling for that specific partition.. The increased latency is most likely due to a hot partition on the 'game_id' key. When a specific game_id receives a disproportionate amount of write or read traffic, that single partition can exceed its throughput limits (1/1000th of provisioned RCU per partition), causing throttling and retries that degrade query response time. Even though the query uses ScanIndexForward: false and Limit: 10, the request is still constrained by the partition's capacity, and throttling at the partition level leads to increased latency.

Answer

The table lacks a global secondary index on game_id, causing a full table scan.

Answer

The query is using strongly consistent reads instead of eventually consistent reads.

Answer

The provisioned read capacity is too low for the query pattern.

Question 4

A developer accidentally deleted a critical table from an Amazon RDS for MySQL DB instance. Automated backups are enabled with a retention period of 7 days. The deletion occurred 3 hours ago. What is the fastest way to restore the deleted table without affecting other tables?

Accepted Answer

Perform a point-in-time restore of the DB instance to a time just before the deletion, then export the table.. Option D is correct because point-in-time recovery (PITR) allows you to restore the entire DB instance to any second within the automated backup retention period (7 days). By restoring to a time just before the deletion, you can then extract the deleted table using mysqldump or SELECT INTO OUTFILE, and import it back into the original instance. This is the fastest method because it leverages existing automated backups without requiring a manual snapshot or waiting for a full restore of a large instance.

Answer

Use the RDS Query Editor to run a flashback query that retrieves the deleted data.

Answer

Restore the DB instance from the latest manual snapshot and extract the table.

Answer

Restore the table from the automated backup using the AWS Management Console table-level restore feature.

Question 5

A company is using Amazon RDS for MySQL and notices that the Read IOPS metric is consistently high during business hours. The application is read-heavy. Which configuration change would most likely reduce Read IOPS?

Accepted Answer

Create one or more read replicas and redirect read traffic to them.. Creating read replicas offloads read queries from the primary DB instance to replica instances, directly reducing the number of read I/O operations on the primary. Since the application is read-heavy and Read IOPS is high during business hours, distributing read traffic to replicas alleviates the I/O bottleneck on the primary instance without requiring a larger instance or storage changes.

Answer

Add a Multi-AZ standby instance.

Answer

Increase the DB instance size to a larger instance type.

Answer

Enable storage Auto Scaling on the RDS instance.

Question 6

A company uses Amazon RDS for SQL Server with Multi-AZ deployment. The security team wants to ensure that all database connections use SSL/TLS encryption. Which TWO actions should the database specialist take to enforce SSL connections? (Choose two.)

Accepted Answer

Create a server-level trigger that requires SSL for all logins.. Option C is correct because SQL Server allows you to create a server-level DDL trigger that checks the login event and enforces SSL by examining the `@@OPTIONS` or `encrypt_option` in `sys.dm_exec_connections`. This is a supported method to force SSL for all connections to an RDS for SQL Server instance. Option E is correct because setting the `rds.force_ssl` parameter to 1 in the DB parameter group is the native RDS mechanism to enforce SSL/TLS for all connections to the DB instance.

Answer

Use the RDS Console to enable 'Force SSL' on the DB instance.

Answer

Modify the DB parameter group to set 'require_secure_transport' to ON.

Answer

Add an inbound rule to the security group that only allows traffic on port 1433 from IP addresses that use SSL.

Question 7

A developer reports that an application using Amazon DynamoDB is experiencing high latency during peak hours. The table has a provisioned capacity of 500 read capacity units (RCUs) and 500 write capacity units (WCUs). The application uses eventually consistent reads and the table is about 50 GB. The developer notices throttled write requests in CloudWatch. Which action would most effectively reduce write throttling?

Accepted Answer

Increase the provisioned write capacity for the table.. The developer reports throttled write requests, which directly indicates that the provisioned write capacity (500 WCUs) is insufficient to handle the peak write traffic. Increasing the provisioned write capacity for the table is the most direct and effective action to eliminate write throttling, as it raises the limit on write operations per second. Option C is correct because it addresses the root cause—write capacity exhaustion—without introducing unnecessary components or changing read behavior.

Answer

Enable DynamoDB Accelerator (DAX) for the table.

Answer

Create a global secondary index on the table.

Answer

Switch from eventually consistent reads to strongly consistent reads.

Question 8

A team manages an Amazon Aurora MySQL database. They observe that the 'Deadlocks' metric in CloudWatch is spiking. The application uses a single writer instance and multiple read replicas. Which action is most effective at reducing deadlocks?

Accepted Answer

Review application code to ensure transactions are as short as possible and access tables in a consistent order.. Deadlocks in Aurora MySQL occur when two or more transactions hold locks that the other needs, and they wait indefinitely. The most effective way to reduce deadlocks is to keep transactions short and access tables in a consistent order, which minimizes lock contention and avoids circular wait conditions. This directly addresses the root cause of deadlocks, unlike scaling or redirecting traffic, which only reduce the probability of contention without fixing the underlying locking pattern.

Answer

Increase the instance size to handle more concurrent connections.

Answer

Redirect read traffic to read replicas to reduce load on the writer.

Answer

Enable Multi-AZ to distribute the load.

Question 9

A company is migrating an on-premises PostgreSQL database to Amazon RDS for PostgreSQL. The migration must have minimal downtime. Which TWO AWS services should be used together to achieve this?

Accepted Answer

AWS Database Migration Service (AWS DMS). AWS Database Migration Service (DMS) is used for the actual data migration with minimal downtime, supporting ongoing replication via change data capture (CDC) from the on-premises PostgreSQL database to Amazon RDS for PostgreSQL. AWS Schema Conversion Tool (SCT) is required to convert the source database schema and code to match the target RDS for PostgreSQL, identifying and resolving any compatibility issues. Together, SCT pre-processes the schema and DMS performs the data migration with replication, enabling a near-zero downtime migration.

Answer

AWS DataSync

Answer

AWS CloudEndure Migration

Answer

AWS Direct Connect

Question 10

A company runs an Amazon RDS for MySQL DB instance in a VPC. Security requirements mandate that only specific EC2 instances in the same VPC can connect to the database. The security group attached to the RDS instance currently allows inbound traffic on port 3306 from 0.0.0.0/0. Which combination of steps should a database specialist take to meet the security requirement without impacting existing application connectivity? (Choose two.)

Accepted Answer

Remove the inbound rule for 0.0.0.0/0 on the RDS security group.. Option B is correct because removing the overly permissive inbound rule for 0.0.0.0/0 on the RDS security group eliminates unrestricted access, which is a direct violation of the security requirement. Option C is correct because adding an inbound rule that references the security group ID of the EC2 instances allows traffic only from those instances, leveraging security group referencing for granular, stateful access control within the same VPC.

Answer

Modify the network ACL for the DB subnet to allow inbound port 3306 from the EC2 instance's private IP.

Answer

Modify the DB subnet group to place the RDS instance in a public subnet with a route to the EC2 instance.

Answer

Add an inbound rule to the RDS security group allowing traffic from the VPC CIDR on port 3306.

Question 11

A database engineer is monitoring an Amazon RDS for PostgreSQL instance and notices that the 'DiskQueueDepth' metric is consistently above 100. The instance uses gp2 storage with 1000 GB allocated. What is the most likely cause of the high disk queue depth?

Accepted Answer

The instance has reached the IOPS limit of the gp2 volume. Option B is correct because a consistently high DiskQueueDepth (above 100) on an Amazon RDS for PostgreSQL instance with gp2 storage indicates that the volume is saturating its IOPS limit. gp2 volumes provide a baseline of 3 IOPS per GB (up to 16,000 IOPS), so a 1000 GB gp2 volume has a baseline of 3000 IOPS. When the workload exceeds this baseline, the volume relies on burst credits, and once credits are exhausted, IOPS are throttled to the baseline, causing I/O requests to queue up and the DiskQueueDepth metric to rise.

Answer

Replication lag between the primary and standby instance

Answer

Insufficient memory allocated to the instance

Answer

Network throughput limit is being exceeded

Question 12

A company uses Amazon ElastiCache for Redis to cache session data. The security team requires that all data in transit be encrypted. The Redis cluster currently does not have encryption in transit enabled. The database specialist needs to enable encryption in transit with minimal downtime. Which action should the specialist take?

Accepted Answer

Create a new Redis cluster with encryption in transit enabled, and migrate the data from the existing cluster.. Encryption in transit for ElastiCache for Redis can only be enabled at cluster creation time; it cannot be added to an existing cluster. Therefore, the correct approach is to create a new Redis cluster with encryption in transit enabled, migrate the session data from the existing cluster (e.g., using replication or a manual export/import), and then redirect application traffic to the new cluster. This ensures minimal downtime if the migration is performed during a maintenance window or using a blue/green deployment strategy.

Answer

Update the Redis parameter group to enable the 'encryption-in-transit' parameter and reboot the cluster.

Answer

Use a security group to enforce encrypted connections by allowing only TLS traffic.

Answer

Modify the existing Redis cluster to enable encryption in transit using the AWS CLI.

Answer

Enable encryption in transit on the existing cluster by using the AWS Management Console.

Question 13

A database engineer is troubleshooting a production Amazon Aurora MySQL DB cluster. The application is experiencing high latency on write operations. The engineer checks the Amazon CloudWatch metrics and sees that the 'AuroraBinlogReplicaLag' metric is high. What is the most likely cause of the write latency?

Accepted Answer

The binlog replication to a downstream MySQL instance is falling behind. Option C is correct because the 'AuroraBinlogReplicaLag' metric specifically measures the lag between the Aurora MySQL cluster and an external MySQL instance that is replicating from Aurora using binary log (binlog) replication. When this lag is high, it indicates that the downstream MySQL instance is falling behind in applying binlog events, which can cause write operations on the Aurora cluster to stall or slow down due to the synchronous nature of binlog generation and the need to retain binlogs until they are consumed by the replica.

Answer

The DB cluster has insufficient storage capacity for the binlog files

Answer

The DB cluster has a high CPU utilization that is causing replication lag

Answer

A recent failover event caused the binlog to be replayed from the last checkpoint

Question 14

A database specialist is troubleshooting a connectivity issue with an Amazon RDS for PostgreSQL instance. The instance is in a VPC with a public subnet. The security group allows inbound traffic on port 5432 from the application server's IP address. The application server is in the same VPC but in a private subnet. Despite the security group configuration, the application cannot connect. Which action should the specialist take to resolve the issue?

Accepted Answer

Update the security group inbound rule to allow traffic from the application server's private IP address.. Option E is correct because the application server is in a private subnet, so it communicates with the RDS instance using its private IP address. The security group inbound rule must allow traffic from the application server's private IP (or the security group of the application server) on port 5432. The current rule only allows the application server's public IP, which is not used for traffic within the VPC, causing the connection failure.

Answer

Launch the RDS instance in the default VPC.

Answer

Change the DB subnet group to include the application server's subnet.

Answer

Add a network ACL rule allowing inbound traffic on port 5432 from the application server's public IP.

Answer

Modify the RDS instance to be publicly accessible.

Question 15

A company is running a production Amazon DynamoDB table with on-demand capacity. The application is experiencing increased latency and throttled requests during peak hours. Which monitoring tool should the database specialist use to identify the specific partition keys causing the throttling?

Accepted Answer

Amazon CloudWatch Contributor Insights for DynamoDB. Amazon CloudWatch Contributor Insights for DynamoDB is the correct tool because it analyzes DynamoDB request logs to identify the most frequently accessed partition keys, including those causing throttling. It provides top-N keys by request count or throttled events, enabling the database specialist to pinpoint hot partitions responsible for increased latency and throttled requests during peak hours.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS CloudTrail logs

Question 16

A company uses Amazon DynamoDB with a table that stores sensitive customer data. The security team requires that all data at rest be encrypted using a customer-managed AWS KMS key (CMK). Additionally, the company needs to ensure that only specific IAM roles can access the table. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Configure the DynamoDB table to use AWS KMS encryption with a CMK. Create an IAM role with a policy that grants access to the table and includes a condition that the encryption context matches the CMK.. Option D is correct because it combines DynamoDB encryption at rest with a customer-managed KMS CMK and uses an IAM role policy with an encryption context condition. This ensures that only specific IAM roles can access the table, and the encryption context condition ties the KMS key usage to the table, providing fine-grained access control with minimal operational overhead. The encryption context is automatically set by DynamoDB to the table ARN, so the condition key `kms:EncryptionContext:aws:dynamodb:tableName` can be used to restrict decryption to that specific table.

Answer

Enable encryption at rest using AWS KMS with a CMK and use column-level encryption with AWS KMS to restrict access.

Answer

Attach a resource-based policy to the DynamoDB table that grants access only to the specific IAM roles.

Answer

Use a DynamoDB Accelerator (DAX) cluster with encryption at rest using a CMK, and attach a resource-based policy to the table.

Answer

Configure the DynamoDB table to use AWS KMS encryption with a CMK, and attach a key policy to the CMK that allows only the specific IAM roles.

Question 17

A company is using Amazon RDS for MySQL with Multi-AZ deployment. The security team wants to ensure that database administrators cannot view sensitive data. Which TWO actions should be taken to achieve this goal?

Accepted Answer

Use IAM database authentication for application access.. Option A is correct because IAM database authentication allows you to authenticate to your RDS MySQL instance using an IAM user or role instead of a traditional database password. This eliminates the need for database administrators to know or manage database credentials, as they can only access the database through IAM policies that grant specific, auditable permissions. By using IAM authentication, you enforce a separation of duties where DBAs cannot view sensitive data unless explicitly authorized by IAM policies.

Answer

Enable audit logging to capture all data access.

Answer

Enable encryption at rest using a customer-managed KMS key.

Answer

Disable query logging to prevent sensitive data from being written to logs.

Question 18

A company stores financial data in an Amazon Aurora MySQL DB cluster. The security team requires that database audit logs be stored in Amazon CloudWatch Logs and encrypted at rest using a customer-managed KMS key. The database specialist enables audit log publishing to CloudWatch Logs and specifies a KMS key for log encryption. However, the audit logs are not appearing in CloudWatch Logs. What is the most likely cause?

Accepted Answer

The IAM role used for publishing logs does not have the necessary permissions to use the KMS key for CloudWatch Logs.. When publishing database audit logs to CloudWatch Logs with a customer-managed KMS key, the IAM role used by RDS must have explicit permissions for the `kms:Encrypt` and `kms:Decrypt` actions on the KMS key. Without these permissions, RDS cannot encrypt the log stream, and the logs will not appear. Option C correctly identifies this missing permission as the most likely cause.

Answer

The CloudWatch Logs log group does not exist and RDS cannot create it automatically.

Answer

The DB cluster is not configured to export error logs, only audit logs.

Answer

CloudWatch Logs does not support encryption with customer-managed KMS keys for audit logs.

Answer

The audit log parameter is static and requires a DB cluster reboot after modification.

Question 19

A company uses Amazon RDS for MySQL with encryption at rest enabled. The security team mandates that all access to the database must be authenticated using IAM database authentication. The database administrator has created a user 'app_user' and granted appropriate privileges. However, when the application tries to connect using an IAM authentication token, it receives an 'Access denied' error. Which action should be taken to resolve this issue?

Accepted Answer

Ensure the IAM role used by the application has a name that matches the database user 'app_user' and has the necessary policy attached.. Option C is correct because IAM database authentication for RDS MySQL requires that the database user name matches the IAM role or user name used to generate the authentication token. The IAM role must have a policy that allows the `rds-db:connect` action with a resource ARN specifying the database user. Without this exact match, the authentication token is rejected, resulting in an 'Access denied' error.

Answer

Create a password for 'app_user' and use that password in the connection string.

Answer

Modify the security group to allow inbound traffic on port 3306 from the application's IP address.

Answer

Download the latest Amazon RDS CA certificate and add it to the application trust store.

Question 20

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The compliance team requires that all database connections use SSL/TLS and that users authenticate using IAM database authentication. The database migration is completed, but the application team reports that connections using IAM authentication are failing. The company has already enabled IAM database authentication on the RDS instance. What is the most likely cause of the failure?

Accepted Answer

The database user has not been granted the necessary privileges for IAM authentication.. Option C is correct because IAM database authentication requires that the database user be created with the `IDENTIFIED WITH AWS_AUTHENTICATION` clause in Oracle. Without this privilege, the RDS instance will reject IAM-authenticated connections even if IAM authentication is enabled at the instance level. The application team must ensure the database user has been granted the `AWS_ORACLE_EXTENSIONS` role and that the user is mapped to an IAM policy allowing `rds-db:connect`.

Answer

The application is using an outdated root CA certificate for SSL.

Answer

The Security Group does not allow inbound traffic from the application.

Answer

The RDS instance is using a different KMS key for encryption.