DBS-C01 Practice Test 28 — 15 Questions

Question 1

A company is building a microservices architecture and needs a database for a service that stores JSON documents with variable schema. The database must support high availability and automatic scaling. Which TWO services meet these requirements? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is correct because it is a fully managed NoSQL key-value and document database that natively supports JSON documents with variable schema, offers high availability through multi-AZ replication, and provides automatic scaling via its on-demand capacity mode or auto-scaling policies. It is ideal for microservices architectures that require low-latency, serverless, and elastic throughput.

Answer

Amazon ElastiCache for Redis

Answer

Amazon Neptune

Answer

Amazon RDS for MySQL

Question 2

A company is deploying a new Amazon RDS for MySQL database. The security team requires that all data at rest be encrypted. What is the simplest way to meet this requirement?

Accepted Answer

Enable encryption at rest when creating the RDS instance using an AWS KMS key. Amazon RDS for MySQL supports encryption at rest using AWS KMS keys, which must be enabled at instance creation time because encryption cannot be added to an existing unencrypted RDS instance. Option C is correct because it describes the simplest and most direct method: enabling encryption at rest during the initial RDS instance creation with an AWS KMS key, which transparently encrypts the underlying storage, automated backups, read replicas, and snapshots.

Answer

Enable encryption using AWS Certificate Manager

Answer

Use client-side encryption in the application

Answer

Enable encryption at rest on the RDS instance after creation

Question 3

Which THREE factors should be considered when selecting a database for a time-series workload (e.g., IoT sensor data) that requires high write throughput and efficient data retention?

Accepted Answer

Configure automatic data expiration using TTL (Time-to-Live).. TTL (Time-to-Live) is a critical feature for time-series workloads, allowing automatic deletion of data that has exceeded a specified retention period. This reduces storage costs and manual maintenance overhead, which is essential for high-volume IoT sensor data where old data loses value over time.

Answer

Normalize the schema to reduce data duplication.

Answer

Use Amazon RDS Proxy to manage database connections.

Question 4

A company is migrating an on-premises Oracle database to Amazon Aurora PostgreSQL. They used AWS SCT to convert the schema, but some stored procedures failed to convert automatically. What is the best course of action?

Accepted Answer

Manually rewrite the unconverted stored procedures to PostgreSQL-compatible code based on SCT's assessment report.. AWS SCT provides an assessment report that identifies unconverted stored procedures and suggests manual rewrites. Since Oracle and PostgreSQL have fundamentally different procedural languages (PL/SQL vs. PL/pgSQL), automated conversion cannot handle all syntax and semantic differences. Manually rewriting the unconverted procedures based on SCT's report ensures compatibility and correctness, as SCT highlights the specific lines and constructs that need attention.

Answer

Use AWS Lambda to automatically convert the stored procedures.

Answer

Use AWS DMS to replicate the Oracle stored procedures as-is to Aurora.

Answer

Switch to Amazon RDS for Oracle to avoid conversion issues.

Question 5

A database specialist is troubleshooting a connectivity issue with an Amazon RDS for PostgreSQL instance. The instance is in a VPC with a public subnet. The security group allows inbound traffic on port 5432 from the application server's IP address. The application server is in the same VPC but in a private subnet. Despite the security group configuration, the application cannot connect. Which action should the specialist take to resolve the issue?

Accepted Answer

Update the security group inbound rule to allow traffic from the application server's private IP address.. The application server is in a private subnet, so it communicates with the RDS instance using its private IP address. The security group inbound rule must allow traffic from the application server's private IP (or the security group of the application server) on port 5432. The current rule only allows the application server's public IP, which is not used for traffic within the VPC, causing the connection failure.

Answer

Launch the RDS instance in the default VPC.

Answer

Change the DB subnet group to include the application server's subnet.

Answer

Add a network ACL rule allowing inbound traffic on port 5432 from the application server's public IP.

Answer

Modify the RDS instance to be publicly accessible.

Question 6

Which THREE factors should be considered when choosing between a native database migration tool (e.g., pg_dump) and AWS DMS for migrating a database to Amazon RDS? (Choose three.)

Accepted Answer

Downtime tolerance during migration. Downtime tolerance directly influences the choice between a one-time logical dump (pg_dump) and AWS DMS, which supports minimal-downtime migrations via ongoing replication. pg_dump requires the source database to be read-consistent during the dump, often necessitating a read-only or quiesced state, whereas DMS can perform a full load followed by continuous change data capture (CDC) to keep the target nearly in sync with minimal application downtime.

Answer

Whether the target database is in a different AWS region

Answer

Need to perform complex data transformations during migration

Question 7

A company uses Amazon DocumentDB (with MongoDB compatibility) for its application. The application is experiencing high write latency. The DB cluster has one primary instance and two replicas. Which action should be taken to identify the cause?

Accepted Answer

Enable Enhanced Monitoring and review OS-level metrics like CPU, memory, and I/O.. Enabling Enhanced Monitoring at the instance level provides OS-level metrics (CPU, memory, I/O) that can help identify resource bottlenecks causing high write latency on the primary instance. Option A is incorrect because switching to Amazon DynamoDB is a major architectural change, not a troubleshooting step. Option B is incorrect because adding read replicas does not reduce write latency on the primary; replicas handle read traffic, not writes. Option D is incorrect because while slow query logging can identify poorly performing queries, high write latency may also be caused by OS-level resource contention, which Enhanced Monitoring captures.

Answer

Migrate the database to Amazon DynamoDB for better write performance.

Answer

Add more read replicas to distribute the load.

Answer

Enable slow query logging and analyze slow queries.

Question 8

Refer to the exhibit. A database specialist is troubleshooting an issue where an application cannot connect to an RDS for MySQL instance using IAM database authentication. The application uses the database user 'db_user1'. The IAM policy shown is attached to the IAM role used by the application. What is the most likely reason for the connection failure?

Accepted Answer

The resource ARN in the policy uses an incorrect RDS resource ID.. IAM database authentication for RDS MySQL requires the resource ARN in the IAM policy to include the correct RDS resource ID (the 'db-xxxxx' identifier from the RDS console), not the DB instance name or endpoint. If the ARN uses an incorrect resource ID, the policy will not match the target RDS instance, causing the authentication to fail even if the user name and action are correct.

Answer

The action 'rds-db:connect' is not allowed for RDS MySQL.

Answer

The policy should have 'Deny' effect instead of 'Allow'.

Answer

The database user name in the ARN must be 'admin', not 'db_user1'.

Question 9

A startup is running an Amazon RDS for PostgreSQL database for its web application. The database size is 50 GB. The company wants to implement a backup strategy that allows point-in-time recovery (PITR) to any point within the last 35 days with minimal storage cost. Which backup strategy should be used?

Accepted Answer

Enable automated backups with a retention period of 35 days.. Automated backups in Amazon RDS provide point-in-time recovery (PITR) within the retention period, and the maximum retention period is 35 days. Enabling automated backups with a 35-day retention period meets the requirement for PITR to any point within the last 35 days with minimal storage cost, as the backup storage is charged only for the incremental changes. Option B (AWS Backup) introduces additional cost and complexity without adding value for this scenario. Option C (7-day retention with cross-region copy) does not achieve 35-day PITR and incurs cross-region transfer costs. Option D (daily manual snapshots) does not provide PITR and results in higher storage costs due to full snapshots.

Answer

Use AWS Backup to schedule daily snapshots with 35-day retention.

Answer

Enable automated backups with 7-day retention and copy snapshots to another region.

Answer

Take manual snapshots daily and retain 35 snapshots.

Question 10

A CloudFormation template is used to create an RDS DB instance with encryption, as shown in the exhibit. The stack creation fails because the DB instance creation fails. What is the most likely cause?

Accepted Answer

The DB instance depends on the KMS key, but there is no DependsOn clause to ensure the key is created first.. KMS key creation must be completed before the DB instance can use it; CloudFormation does not automatically order creation unless dependencies are defined. Option A is wrong because the KMS key policy allows the account root full access. Option B is wrong because the KMS key ID is passed correctly via !Ref. Option C is wrong because encryption is set to true and the KMS key is provided.

Answer

The DB instance has StorageEncrypted set to true but KmsKeyId is not a valid ARN.

Answer

The KMS key policy does not grant permissions to the RDS service principal.

Answer

The KmsKeyId property requires the key ARN, not a reference.

Question 11

A company needs to run complex analytical queries on structured data in Amazon S3 without loading data into a database. The queries must execute quickly and support standard SQL. Which service should they use?

Accepted Answer

Amazon Athena. Amazon Athena is a serverless interactive query service that allows you to run standard SQL directly on data stored in Amazon S3 without loading or transforming it. It uses Presto under the hood and supports complex analytical queries on structured data with fast execution, making it the ideal choice for this use case.

Answer

Amazon QuickSight

Answer

AWS Glue ETL jobs

Answer

Amazon Redshift Spectrum

Question 12

A company wants to automate the creation of a new Amazon RDS for SQL Server instance with specific configurations, including VPC, subnet, and security group settings. Which AWS service should be used to deploy this infrastructure as code?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the correct service because it allows you to define your entire infrastructure, including Amazon RDS for SQL Server instances, VPCs, subnets, and security groups, as code using a JSON or YAML template. This enables automated, repeatable deployments and version control of your infrastructure, which is the core requirement for infrastructure as code (IaC).

Answer

AWS CodeDeploy

Answer

AWS Elastic Beanstalk

Answer

AWS OpsWorks

Question 13

A company runs an e-commerce platform on AWS. The application uses an Amazon RDS for MySQL Multi-AZ database instance. The security team recently conducted an audit and found that the database is accessible from the internet because the public accessibility setting is enabled. The security team has disabled public accessibility and updated the security group to allow inbound traffic only from the application's security group. However, after these changes, the application can no longer connect to the database. The application is running on EC2 instances in the same VPC. The RDS instance is also in the same VPC. The security group for the RDS instance allows inbound MySQL traffic (port 3306) from the application's security group. The application's security group allows all outbound traffic. The application's EC2 instances have a public IP address and are in a public subnet. The RDS instance is in a private subnet. The VPC has an internet gateway attached. What is the most likely cause of the connection failure?

Accepted Answer

The security group for the RDS instance still allows traffic from the public IP addresses of the EC2 instances, but the EC2 instances now have different public IPs.. The most likely cause is that the security group for the RDS instance still contains a rule allowing inbound traffic from the public IP addresses of the EC2 instances. After disabling public accessibility, the EC2 instances in the public subnet may receive new public IPs if they are stopped and started, or the original rule may have referenced specific public IPs that are no longer valid. The application's connection attempts using the old public IPs fail. Although the security group was updated to allow traffic from the application's security group, the old rule might not have been removed, or the application was not using the security group reference. Since the EC2 instances are in the same VPC, the private IP communication should work with the security group reference, but if the old rule is still present and the public IPs changed, the connection might fail. Options A and D are incorrect because same-VPC communication does not require VPC peering or a NAT gateway. Option C is incorrect because the public DNS name resolves to the private IP within the VPC even after public accessibility is disabled, so it should work.

Answer

The RDS instance is in a private subnet and cannot receive inbound traffic from the public subnet EC2 instances without a VPC peering or VPN.

Answer

The application is using the RDS public DNS name, which no longer resolves after disabling public accessibility.

Answer

The EC2 instances need a NAT gateway to communicate with the RDS instance in the private subnet.

Question 14

A company is deploying a new web application that uses Amazon RDS for MySQL. To meet high availability requirements, the database must automatically failover to a standby in a different Availability Zone with minimal downtime. Which deployment configuration should be used?

Accepted Answer

Multi-AZ deployment with automatic failover. A Multi-AZ deployment for Amazon RDS automatically provisions and maintains a synchronous standby replica in a different Availability Zone. If the primary DB instance fails, Amazon RDS automatically fails over to the standby, typically within 60–120 seconds, without requiring manual intervention. This meets the high availability requirement with minimal downtime.

Answer

Single-AZ deployment with enhanced monitoring

Answer

Multi-AZ cluster deployment

Answer

Single-AZ deployment with a read replica

Question 15

A database team notices that the Amazon Aurora MySQL-Compatible DB cluster is experiencing frequent failovers during peak hours. The failover events are not correlated with any maintenance windows or manual interventions. Which metric in Amazon CloudWatch should be investigated first to identify the root cause?

Accepted Answer

WriteIOPS.. (WriteIOPS) is correct because during peak hours, high write IOPS can overwhelm the primary instance's capacity, leading to replication lag or resource exhaustion that triggers a failover. Monitoring WriteIOPS helps identify if the write workload exceeds the instance's limits. Option A (FreeableMemory) is incorrect because low freeable memory can cause performance degradation but is less likely to directly cause failover unless memory is severely exhausted. Option B (DatabaseConnections) is incorrect because high connection counts can cause performance issues but typically do not directly trigger failovers unless combined with other resource constraints. Option C (ReadLatency) is incorrect because it is a symptom of issues like high read load or replication lag, but not a direct cause of failover; failovers are usually triggered by primary instance failure or unreachability.

Answer

FreeableMemory.

Answer

DatabaseConnections.

Answer

ReadLatency.