DBS-C01 Practice Test 28 — 15 Questions

Question 1

A company is using Amazon Aurora MySQL-Compatible Edition. The security team wants to ensure that database credentials are not stored in application configuration files. They decide to use AWS Secrets Manager to manage credentials. The application is hosted on Amazon EC2 instances that have an IAM role attached. What is the most secure way to grant the application access to the secret?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Grant the IAM role attached to the EC2 instance permissions to read the secret, and use the Secrets Manager API to retrieve it at runtime.. The most secure approach is to grant the EC2 IAM role permission to read the secret using an IAM policy attached to the role, and then have the application call the Secrets Manager API to retrieve the secret at runtime. This avoids storing secrets in code or configuration files. Option B is wrong because storing the secret in application code is insecure. Option C is wrong because resource-based policies are not attached to EC2 instances; IAM roles are the correct mechanism. Option D is wrong because storing secrets in an S3 bucket introduces additional complexity and potential exposure; using Secrets Manager with IAM roles is more secure.

Answer

Store the secret in the application code and rotate it periodically.

Answer

Attach a resource-based policy to the EC2 instance allowing access to the secret.

Answer

Store the secret in an encrypted S3 bucket and have the application download it at startup.

Question 2

A startup is using Amazon ElastiCache for Redis to cache session data. They deployed a single Redis node (cache.t3.micro) in us-west-2. The application reports high latency when reading session data. CloudWatch metrics show CPUUtilization at 90% and Evictions at 100 per minute. The cache hit ratio is 80%. The database specialist suspects the node is overloaded. What should the specialist do to improve performance?

Accepted Answer

Scale up to a larger node type, such as cache.m5.large.. The CloudWatch metrics show CPUUtilization at 90% and Evictions at 100 per minute on a single cache.t3.micro node, indicating the node is both CPU- and memory-constrained. Scaling up to a larger node type such as cache.m5.large provides more CPU and memory, directly addressing the overload and reducing evictions. This is the correct first action for a single-node Redis cache under resource pressure.

Answer

Add a read replica to offload read traffic.

Answer

Enable cluster mode and add more shards.

Answer

Decrease the TTL for session keys to reduce memory usage.

Question 3

After migrating a database to Amazon RDS, an application on an EC2 instance in the same VPC cannot connect. The command in the exhibit shows the endpoint. What is the most likely cause?

Accepted Answer

The security group for the DB instance does not allow inbound traffic from the EC2 instance's security group.. The most likely cause is that the security group for the RDS DB instance does not have an inbound rule allowing traffic from the EC2 instance's security group on the database port (typically TCP 3306 for MySQL or 5432 for PostgreSQL). Even though both resources are in the same VPC, security groups act as virtual firewalls that must explicitly permit inbound connections from the source. The command output showing the endpoint confirms the DNS resolution works, so the issue is at the network access control layer.

Answer

The EC2 instance is in a different VPC and needs a VPN connection.

Answer

The DB instance endpoint is incorrect.

Answer

The DB instance is not publicly accessible.

Question 4

A company is migrating an on-premises MongoDB database to Amazon DocumentDB. The migration must be online with minimal downtime. Which AWS service should be used?

Accepted Answer

AWS DMS. AWS Database Migration Service (DMS) is the correct choice because it supports ongoing replication (change data capture) from MongoDB to Amazon DocumentDB, enabling an online migration with minimal downtime. DMS can perform a full load of existing data and then continuously replicate changes from the source MongoDB oplog to keep the target DocumentDB synchronized until cutover.

Answer

AWS DataSync

Answer

AWS S3

Answer

AWS Snowball Edge

Question 5

A gaming company uses Amazon RDS for PostgreSQL to store player profiles and game state data. The database is currently 500 GB and grows by 10 GB per day. The company runs weekly reports that scan the entire database, causing high I/O and CPU usage. The application experiences read latency spikes during report generation. The team wants to minimize performance impact on the application while maintaining the ability to run reports. Which solution should the team implement?

Accepted Answer

Create a read replica and direct all report queries to the read replica.. Creating a read replica for Amazon RDS for PostgreSQL allows the team to offload all report queries to a separate read-only endpoint, eliminating the I/O and CPU contention on the primary database. This directly addresses the read latency spikes during report generation without requiring any application changes beyond redirecting the reporting queries. The read replica asynchronously replicates data from the primary instance, ensuring the reports see a near-real-time snapshot of the data while the primary remains dedicated to the application workload.

Answer

Enable Multi-AZ deployment to provide a standby instance for failover and use it for reporting.

Answer

Scale up the RDS instance to a larger instance type to handle the additional load from reports.

Answer

Archive historical game state data to Amazon S3 and delete it from the database to reduce size.

Question 6

A company is running a MongoDB database on Amazon EC2. The database is experiencing high disk I/O latency. Which AWS service can be used to monitor the disk I/O metrics at the instance level?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch provides disk I/O metrics for EC2 instances. Option A is wrong because Amazon RDS is a managed database service. Option C is wrong because Amazon DynamoDB is a NoSQL database service. Option D is wrong because Amazon S3 is an object storage service.

Answer

Amazon RDS

Answer

Amazon DynamoDB

Answer

Amazon S3

Question 7

Which TWO are valid use cases for Amazon ElastiCache for Redis? (Choose 2)

Accepted Answer

Session management for web applications. Option B is correct because ElastiCache for Redis is commonly used for session management: it stores session state in-memory with low-latency reads/writes and can use TTL expiration to automatically expire sessions, making it ideal for stateless web/app tiers. Option D is correct because Redis is a high-performance in-memory cache, so caching frequently accessed database query results reduces read pressure and latency on Amazon RDS. Option A is not a primary ElastiCache use case; graph data with relationships is better handled by a graph database such as Amazon Neptune. Option C is not appropriate because complex analytical queries on large datasets are handled by analytical engines like Amazon Redshift or Athena, not an in-memory cache. Option E is not appropriate because ElastiCache is not a persistent relational data store; relational data belongs in Amazon RDS or Aurora.

Answer

Storing graph data with relationships

Answer

Running complex analytical queries on large datasets

Answer

Persistent storage of relational data

Question 8

A company is deploying a new application that requires a highly available DynamoDB table with eventual consistency. The table will be accessed from multiple AWS Regions. What is the most appropriate deployment strategy?

Accepted Answer

Use DynamoDB global tables. DynamoDB global tables provide a fully managed, multi-Region, multi-active solution that automatically replicates data across selected AWS Regions, delivering eventual consistency and high availability for applications accessed from multiple Regions. This is the most appropriate strategy because it natively supports the requirement without custom code or additional infrastructure.

Answer

Use DynamoDB auto scaling to handle regional traffic

Answer

Use DynamoDB Accelerator (DAX) to cache data across regions

Answer

Use DynamoDB Streams to replicate data to another region

Question 9

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database is 500 GB in size and has a 24/7 uptime requirement. The migration window is limited to 2 hours. Which strategy should be used to minimize downtime?

Accepted Answer

Use AWS Database Migration Service (DMS) with ongoing replication. AWS Database Migration Service (DMS) can perform ongoing replication from the source Oracle database to Amazon RDS for Oracle, allowing a minimal cutover window of under 2 hours. Option A is incorrect because AWS Schema Conversion Tool (SCT) only converts schema and does not handle data migration. Option B is incorrect because performing an on-premises backup and restoring via Oracle RMAN would require significant downtime and may exceed the 2-hour window for a 500 GB database. Option C is incorrect because exporting to a dump file and importing into RDS requires the database to be offline or in read-only mode, causing prolonged downtime.

Answer

Use AWS Schema Conversion Tool (SCT) to convert the schema and copy data

Answer

Take an on-premises backup and restore to RDS using Oracle RMAN

Answer

Export the database to a dump file and import into RDS

Question 10

A company is migrating a large Oracle data warehouse to Amazon Redshift. Which THREE design considerations are important for performance optimization?

Accepted Answer

Choose appropriate distribution styles (KEY, ALL, EVEN).. Option A is correct because choosing the right distribution style (KEY, ALL, or EVEN) controls how rows are placed across compute nodes, minimizing data movement during joins and aggregations — KEY colocates matching join columns, ALL replicates small dimension tables to every node, and EVEN spreads load for tables without joins. Option B is correct because applying compression encodings (e.g., AZ64, ZSTD, LZO, or BYTEDICT) reduces the amount of data read from disk and I/O, which is a primary performance lever in Redshift's columnar architecture. Option C is correct because sort keys (compound or interleaved) physically order data on disk, enabling zone-map block skipping so queries that filter on those columns scan far fewer blocks. Option D is not appropriate because cross-Region replication addresses disaster recovery and data locality, not single-cluster query performance optimization. Option E is incorrect because Redshift is a columnar store; fact tables benefit from columnar storage, and row-based storage is not a Redshift design choice for performance.

Answer

Enable cross-Region replication for data locality.

Answer

Use row-based storage for fact tables.

Question 11

A company needs to migrate a 2 TB PostgreSQL database from an on-premises data center to Amazon Aurora PostgreSQL. The network bandwidth is limited to 100 Mbps. The migration window is 5 days. Which approach is most cost-effective and likely to succeed?

Accepted Answer

Use AWS DMS with a VPN connection to the on-premises database. AWS DMS with a VPN connection can handle the migration of 2 TB over 100 Mbps within 5 days. At 100 Mbps, the theoretical maximum transfer is about 1.08 TB per day (100 Mbps * 86400 seconds / 8 bits per byte / 1024^3), so 2 TB would take roughly 1.85 days of continuous transfer, well within the 5-day window. DMS supports ongoing replication to minimize downtime, and a VPN is cost-effective compared to Direct Connect for a one-time migration.

Answer

Set up AWS Direct Connect and use DMS

Answer

Use AWS Snowball Edge to transfer data offline

Answer

Export to Amazon S3 and import into Aurora

Question 12

A company wants to store and analyze time-series sensor data from millions of IoT devices. The data is append-only and rarely updated. Queries aggregate data over time ranges. Which AWS database service is most cost-effective and performant for this workload?

Accepted Answer

Amazon Timestream. Amazon Timestream is purpose-built for time-series data, offering automatic tiered storage (in-memory for recent data and magnetic for historical data) and optimized query performance for time-range aggregations. Its serverless architecture eliminates provisioning overhead, making it the most cost-effective and performant choice for append-only IoT sensor data with infrequent updates.

Answer

Amazon DynamoDB with time-series design pattern

Answer

Amazon Redshift

Answer

Amazon RDS for MySQL with partitioning by date

Question 13

Which THREE actions can be performed using the AWS CLI for Amazon Aurora? (Choose three.)

Accepted Answer

Create a DB cluster from a snapshot using 'aws rds restore-db-cluster-from-snapshot'. Option A is correct because 'aws rds restore-db-cluster-from-snapshot' is the valid AWS CLI command that creates a new Aurora DB cluster from an existing DB cluster snapshot, which is a standard Aurora recovery/restore operation. Option B is correct because 'aws rds failover-db-cluster' is the documented AWS CLI command that forces a failover of an Aurora DB cluster, promoting an Aurora Replica to the primary writer instance. Option C is correct because 'aws rds modify-db-cluster-parameter-group' is the proper AWS CLI command to change parameters in a DB cluster parameter group, which Aurora clusters use for engine-level settings. Option D is not valid because Aurora storage is a distributed, SSD-backed, auto-scaling layer that is not user-configurable via 'modify-db-instance' (that command targets instance class, not Aurora's storage type). Option E is not valid because there is no 'aws rds enable-autoscaling' command; Aurora Replica auto-scaling is configured through Application Auto Scaling using 'register-scalable-target' and 'put-scaling-policy'.

Answer

Change the storage type of an Aurora cluster using 'aws rds modify-db-instance'

Answer

Enable auto-scaling for Aurora Replicas using 'aws rds enable-autoscaling'

Question 14

A company uses Amazon DynamoDB with AWS KMS customer managed keys for encryption at rest. The security team wants to audit who is using the KMS key to encrypt and decrypt data. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail logs all KMS API calls, including Encrypt and Decrypt, enabling auditing of who used the KMS key. Amazon S3 access logs (option A) are for S3 bucket access, not KMS. AWS Config (option B) tracks resource configuration changes, not API calls. Amazon CloudWatch Logs (option D) can store logs but does not capture KMS API calls by itself.

Answer

Amazon S3 access logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 15

A company uses Amazon Aurora MySQL and needs to audit all database logins, including failed attempts. Which feature should be enabled?

Accepted Answer

Database Activity Streams. Database Activity Streams (option A) is correct because it provides a near-real-time stream of all database activity in Aurora MySQL, including logins and failed authentication attempts, pushed to Amazon Kinesis for auditing. It captures connection-level and SQL-level events at the database engine level, which is exactly what auditing all logins and failed attempts requires. Enhanced Monitoring (B) only reports OS-level metrics such as CPU, memory, and disk I/O, not individual login events. VPC Flow Logs (C) capture IP traffic metadata at the network interface level and cannot identify database logins or authentication failures. AWS CloudTrail (D) records AWS API calls (e.g., RDS management actions), not database-level login activity.

Answer

Enhanced Monitoring

Answer

VPC Flow Logs

Answer

AWS CloudTrail