DBS-C01 Practice Test 26 — 15 Questions

Question 1

A company is using a Multi-AZ RDS for MySQL instance. The primary instance recently experienced an unexpected failover, and the application experienced a brief interruption. The database administrator wants to investigate the root cause. Which AWS service should be used to review the failover event and its details?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon RDS Event Notifications. Amazon RDS Event Notifications publish events related to DB instances, including failovers. They provide details such as the event source, message, and time, enabling root cause analysis. While AWS CloudTrail can record API calls that trigger failovers (e.g., RebootDBInstance with Failover), automatic failovers due to underlying issues are not captured as API calls. AWS Config tracks configuration changes, and AWS Trusted Advisor offers best practice checks but does not log specific events. Therefore, to review the failover event and its details, RDS Event Notifications is the most appropriate service.

Answer

AWS Config

Answer

AWS Support (Trusted Advisor)

Answer

AWS CloudTrail

Question 2

A company is deploying a new application that uses Amazon RDS for PostgreSQL. The application must be highly available with automatic failover in the event of a database failure. Which configuration should be used?

Accepted Answer

Deploy a Multi-AZ RDS instance with a standby in a different Availability Zone. Multi-AZ RDS for PostgreSQL provides synchronous replication to a standby instance in a different Availability Zone, ensuring automatic failover with minimal data loss. This configuration meets the requirement for high availability and automatic failover without manual intervention, as the RDS service handles the DNS change and standby promotion.

Answer

Use a read replica in a different Availability Zone

Answer

Deploy the RDS instance in a single Availability Zone with automated backups

Answer

Deploy the RDS instance in a Cross-Region replication configuration

Question 3

A company runs a customer relationship management (CRM) application on Amazon RDS for PostgreSQL. The application stores customer data in a table with over 50 million rows. The company recently added a new query that searches for customers by their email domain (e.g., '@example.com'). The query uses a LIKE pattern: 'WHERE email LIKE ''%@example.com'''. The query takes over 30 seconds to complete. The DBA has already created a B-tree index on the email column, but it does not help. Which action should the database specialist recommend to improve query performance?

Accepted Answer

Create a trigram index (using pg_trgm extension) on the email column.. The query uses a leading wildcard LIKE pattern ('%@example.com'), which prevents a standard B-tree index from being used because the search string does not have a fixed prefix. A trigram index, provided by the pg_trgm extension, breaks strings into three-character substrings (trigrams) and allows the database to efficiently match patterns with leading wildcards. This index type is specifically designed for fuzzy text matching and LIKE queries with wildcards, reducing the query time from over 30 seconds to milliseconds.

Answer

Create a hash index on the email column.

Answer

Increase the shared_buffers parameter to improve caching.

Answer

Create a B-tree index on the reversed email string.

Question 4

A company is using Amazon RDS for MySQL with automated backups enabled. The security team requires that all backups be encrypted at rest. Which configuration ensures that new automated backups are encrypted?

Accepted Answer

Create a new encrypted DB instance and migrate the data. Automated backups will inherit encryption.. For RDS, encryption at rest must be enabled at instance creation time — you cannot enable it on an existing unencrypted instance. Creating a new encrypted DB instance and migrating data ensures that the instance's automated backups inherit the same KMS encryption, satisfying the security requirement.

Answer

Modify the DB instance to enable encryption at rest after creation.

Answer

Use AWS KMS to encrypt the S3 bucket where automated backups are stored.

Answer

Enable encryption at rest on the DB instance and also enable encryption on automated backups using the DBSnapshot option.

Question 5

A healthcare company is migrating its patient records database to Amazon RDS for SQL Server. The database contains Protected Health Information (PHI). The compliance team requires that all PHI data be encrypted at rest and that the encryption keys be stored in a dedicated AWS CloudHSM cluster. Additionally, the database must be replicated to a second AWS region for disaster recovery. The DBA has enabled RDS encryption at rest using a KMS key, but the compliance team insists on using CloudHSM. What should the DBA do to meet the compliance requirement while maintaining disaster recovery?

Accepted Answer

Enable Transparent Data Encryption (TDE) using a CloudHSM key and create a cross-region read replica for DR.. RDS for SQL Server supports Transparent Data Encryption (TDE) with CloudHSM as the key store, and RDS read replicas can be created across regions for disaster recovery. Option A is incorrect because RDS encryption at rest with a KMS key does not meet the CloudHSM requirement; KMS custom key stores (backed by CloudHSM) are not supported for RDS encryption at rest. Option B is incorrect because DynamoDB encryption with CloudHSM via KMS custom key store is possible but unnecessary and does not maintain the existing SQL Server database. Option C is incorrect because using RDS Custom with TDE and manual log shipping is more complex and not the standard approach for cross-region disaster recovery with RDS.

Answer

Use RDS encryption at rest with a KMS key backed by CloudHSM (custom key store).

Answer

Migrate the database to Amazon DynamoDB with encryption using CloudHSM via KMS custom key store.

Answer

Use an RDS Custom for SQL Server instance and configure TDE with CloudHSM, then set up log shipping to another region.

Question 6

A company runs an Amazon Aurora MySQL database with read replicas to handle read traffic. During a recent load test, the primary instance CPU utilization reached 90%, but read replicas remained below 50%. The application uses a custom ORM that connects to a single endpoint. Which change will best distribute read traffic?

Accepted Answer

Configure the application to use the Aurora reader endpoint for read queries.. Aurora provides a reader endpoint that automatically load-balances connections across all Aurora Replicas in the cluster. Configuring the application's ORM to send read queries to the reader endpoint and writes to the cluster (writer) endpoint is the standard way to distribute read traffic without adding infrastructure. This directly offloads the primary and uses the idle replica capacity.

Answer

Use Amazon RDS Proxy with read/write splitting.

Answer

Place the read replicas behind an Application Load Balancer.

Answer

Enable Aurora Auto Scaling for replicas and use the cluster endpoint for both read and write.

Question 7

A company runs a production Amazon RDS for MySQL DB instance with Multi-AZ. The database is used by a web application. The application team reports that the database is experiencing intermittent connection timeouts and increased latency. The CloudWatch metrics show that the database connections spike to the maximum allowed (max_connections) during peak hours, and the CPU utilization is high. The team needs to resolve the connection issues without modifying the application code. The application uses connection pooling at the application layer. Which action should be taken?

Accepted Answer

Deploy an Amazon RDS Proxy in front of the DB instance.. Amazon RDS Proxy pools and shares database connections across application instances, which directly addresses connection exhaustion without requiring application code changes. It sits between the application and the database, multiplexing many client connections onto a smaller number of database connections. This reduces the connection count hitting max_connections and lowers CPU load from connection overhead, resolving the timeouts.

Answer

Create a read replica and direct read queries to it.

Answer

Increase the 'max_connections' parameter to allow more connections.

Answer

Change the DB instance class to a smaller size to reduce the maximum connections.

Question 8

A company wants to migrate an on-premises Oracle database to Amazon RDS for Oracle with minimal downtime. Which AWS service should be used for the initial data load and ongoing replication?

Accepted Answer

AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) is the correct choice because it supports both full-load migration and ongoing change data capture (CDC) replication from Oracle to Amazon RDS for Oracle. DMS uses Oracle LogMiner or binary reader to capture incremental changes from the source database's redo logs, enabling near-zero downtime migration without requiring application modifications.

Answer

AWS Snowball

Answer

AWS Direct Connect

Answer

AWS Schema Conversion Tool (SCT)

Question 9

Refer to the exhibit. A DynamoDB table has a primary key of pk (partition key) and sk (sort key). An application needs to perform GetItem and Query operations but should only be allowed to retrieve the pk and sk attributes. The IAM policy above is applied to the application's IAM role. Why does the policy fail to achieve the goal?

Accepted Answer

The Deny statement does not prevent retrieval of all attributes when no ProjectionExpression is specified.. The Deny statement only denies access when the request includes a ProjectionExpression that specifies attributes other than pk and sk. However, if the application performs a GetItem or Query without specifying any ProjectionExpression, DynamoDB returns all attributes by default, which violates the requirement to restrict retrieval to only pk and sk. The policy does not block this default behavior, so it fails to achieve the goal.

Answer

The Deny statement uses the wrong condition key; it should use 'dynamodb:Select' instead of 'dynamodb:Attributes'.

Answer

The policy should use 'dynamodb:ReturnValues' condition key.

Answer

The Allow statement should include 'dynamodb:Scan' to allow Query operations.

Question 10

A developer needs to connect to the RDS instance from an EC2 instance in the same VPC. The EC2 instance's security group allows outbound traffic to 0.0.0.0/0. The RDS security group inbound rules currently allow traffic from 0.0.0.0/0 on port 3306. After a security review, the company decides to restrict inbound traffic to the VPC only. Which inbound rule should be added to the RDS security group?

Accepted Answer

An inbound rule allowing traffic from the EC2 instance's security group ID on port 3306.. Referencing the EC2 instance's security group ID as the source in the RDS security group inbound rule is the AWS-recommended pattern for instance-to-instance access within a VPC. It creates a logical reference that automatically follows instances as they are added or replaced, and it satisfies the requirement to restrict access to VPC resources only. This avoids hardcoding IP ranges that could drift or be spoofed.

Answer

An inbound rule allowing traffic from the RDS endpoint address on port 3306.

Answer

An inbound rule allowing traffic from 10.0.0.0/8 on port 3306.

Answer

An inbound rule allowing traffic from the VPC CIDR (e.g., 10.0.0.0/16) on port 3306.

Question 11

A startup is building a mobile app that requires a scalable NoSQL database. The data model includes user profiles with variable attributes that change over time. The database must support high read throughput and low latency. Which AWS database is best suited?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a fully managed NoSQL key-value and document database that delivers single-digit millisecond latency at any scale. It supports flexible schema with variable attributes, making it ideal for user profiles that change over time, and its provisioned or on-demand capacity modes enable high read throughput with consistent low latency.

Answer

Amazon Neptune

Answer

Amazon RDS for MySQL

Answer

Amazon Redshift

Question 12

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. During the migration, they need to ensure minimal downtime. Which AWS service should be used for the migration?

Accepted Answer

AWS Database Migration Service. AWS Database Migration Service (DMS) is the correct choice because it is specifically designed for migrating databases to AWS with minimal downtime. DMS supports homogeneous migrations (e.g., Oracle to Oracle) and heterogeneous migrations (e.g., Oracle to Amazon Aurora), and it can perform continuous replication using change data capture (CDC) to keep the source and target databases synchronized during the migration, allowing you to cut over with only a brief pause.

Answer

AWS DataSync

Answer

Amazon S3 Transfer Acceleration

Answer

AWS Server Migration Service

Question 13

A media company is storing large video files (up to 10 GB each) in Amazon S3 and needs to maintain metadata about each file, including title, duration, and upload timestamp. The workload involves frequent writes (1000+ per second) and occasional read queries by title. Which database is best suited for this metadata store?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is the best choice because it supports single-digit millisecond latency at any scale, handles over 1000 writes per second with auto-scaling, and can efficiently serve occasional read queries by title using a global secondary index (GSI) on the title attribute. Its fully managed, serverless nature eliminates operational overhead for high-throughput metadata storage.

Answer

Amazon Neptune

Answer

Amazon RDS for MySQL

Answer

Amazon ElastiCache for Memcached

Question 14

A database specialist is troubleshooting an Amazon DynamoDB table that is experiencing high throttling on write requests. The table has on-demand capacity and uses a composite primary key (partition key and sort key). Which TWO actions should the specialist take to identify and resolve the issue?

Accepted Answer

Examine the partition key value distribution to identify hot partitions. Option A is correct because with a composite primary key, throttling on writes often stems from an uneven partition key value distribution that creates hot partitions; examining the key distribution lets the specialist detect and redesign the key to spread writes evenly. Option E is correct because CloudWatch publishes DynamoDB metrics such as WriteThrottleEvents and ConsumedWriteCapacityUnits, which directly reveal write throttling and capacity consumption patterns needed to diagnose the issue. Option B is not correct because DAX is an in-memory cache that offloads read traffic, not write throttling, so it does not address the problem. Option C is not correct because switching to provisioned capacity mode does not by itself resolve throttling and can worsen it if capacity is under-provisioned. Option D is not correct because increasing read capacity units affects reads, not the write throttling being experienced.

Answer

Implement DynamoDB Accelerator (DAX) to offload read traffic

Answer

Change the table to provisioned capacity mode

Answer

Increase the read capacity units on the table

Question 15

A security team needs to grant an IAM user permission to modify only the 'db_secrets' secret in AWS Secrets Manager. Which IAM policy statement is correct?

Accepted Answer

{ 'Effect': 'Allow', 'Action': 'secretsmanager:PutSecretValue', 'Resource': 'arn:aws:secretsmanager:us-east-1:123456789012:secret:db_secrets-??????' }. It grants the specific `secretsmanager:PutSecretValue` action on the exact ARN of the `db_secrets` secret, including the required six-character random suffix (`-??????`) that AWS Secrets Manager appends to secret names. This ensures the IAM user can only modify that single secret, meeting the security requirement of least privilege.

Answer

{ 'Effect': 'Allow', 'Action': 'secretsmanager:UpdateSecret', 'Resource': '*' }

Answer

{ 'Effect': 'Allow', 'Action': 'secretsmanager:*', 'Resource': '*' }

Answer

{ 'Effect': 'Allow', 'Action': 'secretsmanager:PutSecretValue', 'Resource': 'arn:aws:secretsmanager:us-east-1:123456789012:secret:*' }