DBS-C01 Practice Test 3 — 10 Questions

Question 1

A company is using Amazon RDS for MySQL and notices that database connections are being rejected intermittently. The application logs show 'Too many connections' errors. The DB instance has 1000 max_connections. Which action should the DBA take to troubleshoot and resolve this issue without impacting performance?

Accepted Answer

Enable Performance Insights and review the 'DB Connections' metric to identify spikes and troubleshoot application connection pooling. Option C is correct because enabling Performance Insights allows the DBA to monitor the 'DB Connections' metric in near real-time, identify exactly when connection spikes occur, and correlate those spikes with application behavior. This diagnostic approach pinpoints the root cause—such as a connection leak or insufficient connection pooling—without making changes that could degrade performance. Increasing max_connections or lowering wait_timeout without understanding the usage pattern can lead to resource exhaustion or premature connection termination.

Answer

Increase the max_connections parameter to 5000 in the DB parameter group

Answer

Create a read replica to offload read traffic

Answer

Set the 'wait_timeout' parameter to a lower value to close idle connections faster

Question 2

A company is migrating its on-premises Oracle database to Amazon RDS for Oracle. The database specialist needs to monitor the migration process and ensure data consistency. Which TWO AWS services should be used together to continuously monitor the replication lag and data integrity?

Accepted Answer

AWS Database Migration Service (AWS DMS). AWS DMS is the correct service because it is specifically designed for database migrations and provides built-in monitoring of replication lag via the 'CDC latency' metric. Amazon CloudWatch is the correct complementary service because it collects and visualizes DMS metrics, including replication lag and task status, and can trigger alarms if data integrity or latency thresholds are breached.

Answer

Amazon RDS Performance Insights

Answer

AWS Schema Conversion Tool (AWS SCT)

Answer

AWS Glue

Question 3

A database engineer is reviewing Amazon RDS for MySQL error logs and sees repeated authentication failures from the same IP address. The application team confirms the password is correct. What is the most likely cause of these errors?

Accepted Answer

The user 'app_user' does not have access from host '10.0.1.50'. The error logs show authentication failures despite the password being correct, which indicates the issue is not with the password itself but with the host-based access control. In MySQL, user accounts are defined as 'user'@'host', and if the application is connecting from an IP address (e.g., 10.0.1.50) that is not included in the user's allowed hosts, MySQL will reject the connection with an authentication error even if the password is correct. This is a common misconfiguration when migrating or scaling applications across different subnets.

Answer

The password is incorrect

Answer

The 'app_user' account is locked

Answer

The database requires SSL connections

Question 4

Refer to the exhibit. A security engineer has applied this key policy to a customer managed KMS key used to encrypt a Secrets Manager secret containing database credentials. An application running on an Amazon EC2 instance in the same account and region is unable to decrypt the secret. What is the MOST likely cause?

Accepted Answer

The condition kms:ViaService restricts the decryption to requests made via Secrets Manager, but the application is calling KMS directly.. The condition `kms:ViaService` in the key policy restricts the `Decrypt` permission to requests that originate specifically from the AWS Secrets Manager service. When the application on the EC2 instance calls KMS directly (e.g., via the `Decrypt` API) to decrypt the secret, the request does not come through Secrets Manager, so the condition is not satisfied and the request is denied. This is the most likely cause of the decryption failure.

Answer

The KMS key ARN in the resource field is incorrect.

Answer

The policy is missing an encryption context that matches the secret's encryption context.

Answer

The policy only allows Decrypt, but the application needs Encrypt permission.

Question 5

A gaming company uses Amazon RDS for PostgreSQL to store player profiles and game state data. The database is currently 500 GB and grows by 10 GB per day. The company runs weekly reports that scan the entire database, causing high I/O and CPU usage. The application experiences read latency spikes during report generation. The team wants to minimize performance impact on the application while maintaining the ability to run reports. Which solution should the team implement?

Accepted Answer

Create a read replica and direct all report queries to the read replica.. Creating a read replica for Amazon RDS for PostgreSQL allows the team to offload all report queries to a separate read-only endpoint, eliminating the I/O and CPU contention on the primary database. This directly addresses the read latency spikes during report generation without requiring any application changes beyond redirecting the reporting queries. The read replica asynchronously replicates data from the primary instance, ensuring the reports see a near-real-time snapshot of the data while the primary remains dedicated to the application workload.

Answer

Enable Multi-AZ deployment to provide a standby instance for failover and use it for reporting.

Answer

Scale up the RDS instance to a larger instance type to handle the additional load from reports.

Answer

Archive historical game state data to Amazon S3 and delete it from the database to reduce size.

Question 6

A financial services company uses Amazon DynamoDB to store transaction records. Each transaction has a unique transaction_id as the partition key and a timestamp as the sort key. The application frequently queries all transactions for a given customer within a date range. However, customer_id is not an attribute indexed for querying. The company wants to optimize these queries without redesigning the entire table schema. Which action should the company take?

Accepted Answer

Create a Global Secondary Index (GSI) with customer_id as the partition key and timestamp as the sort key.. Option C is correct because creating a Global Secondary Index (GSI) with customer_id as the partition key and timestamp as the sort key allows efficient querying of all transactions for a given customer within a date range without redesigning the base table. The GSI provides a new access pattern with its own partition and sort keys, enabling the Query operation on customer_id and timestamp, which is far more efficient than a Scan. This approach preserves the existing table schema and supports the required query pattern with minimal overhead.

Answer

Change the table's partition key to customer_id and use a composite sort key.

Answer

Create a Local Secondary Index (LSI) on customer_id.

Answer

Use the Scan operation with a filter expression for customer_id and timestamp.

Question 7

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all data be encrypted at rest using a customer-managed KMS key. Additionally, the database should be accessible only from a specific VPC. Which THREE steps should the database specialist take to meet these requirements? (Choose three.)

Accepted Answer

Configure the security group for the RDS instance to allow inbound traffic only from the application security group.. Option A is correct because security groups act as a virtual firewall for RDS instances. By configuring the security group to allow inbound traffic only from the application security group, you restrict database access to specific application servers, meeting the requirement that the database be accessible only from a specific VPC.

Answer

Create a VPC endpoint for RDS and associate it with the DB instance.

Answer

Store the encryption key in Amazon S3 and configure RDS to use it.

Question 8

A company is designing a multi-tier application that uses Amazon RDS for PostgreSQL. The application must encrypt data at rest and in transit. Which combination of steps should be taken to meet these requirements? (Choose the single best answer.)

Accepted Answer

Enable encryption at rest when launching the RDS instance, and configure the DB parameter group to require SSL connections.. Option B is correct because Amazon RDS for PostgreSQL supports encryption at rest only when enabled at instance launch, and SSL/TLS encryption in transit is enforced by configuring the DB parameter group to require SSL connections (e.g., setting `rds.force_ssl=1`). Encryption at rest cannot be added after creation, and SSL ensures data is encrypted between the application and the database.

Answer

Use client-side encryption for data before sending to RDS, and enable encryption at rest after the instance is created.

Answer

Launch the RDS instance without encryption, then enable encryption at rest using the AWS Console.

Answer

Use AWS KMS to encrypt the connection between the application and RDS.

Question 9

A security engineer is troubleshooting an issue where an application using IAM role 'app-role' with a trust policy to assume the 'app-user' user is unable to decrypt an RDS database that uses a customer-managed KMS key. The above key policy is attached to the KMS key. What is the likely cause of the failure?

Accepted Answer

The principal in the policy is 'app-user', but the application uses an IAM role that does not have the necessary permissions.. Option C is correct because the KMS key policy specifies the principal as 'app-user', which is an IAM user. However, the application uses an IAM role 'app-role' to make the decryption requests. Since the principal in the key policy does not include the role or its associated permissions, the KMS key policy denies access to the role, causing the decryption failure. The trust policy on the role allows the user to assume it, but that does not grant the role any KMS permissions unless explicitly added.

Answer

The 'kms:ViaService' condition requires the request to come from RDS, but the application is making KMS API calls directly.

Answer

The policy has a missing 'Effect': 'Deny' statement that is blocking access.

Answer

The condition 'kms:ViaService' restricts the key to be used only with RDS, but the application is using a different service.

Question 10

Match each database engine to its default port number.