DBS-C01 Practice Test 2 — 30 Questions

Question 1

A company is deploying a new Amazon RDS for SQL Server database. They need to ensure that the database is encrypted at rest using a customer-managed AWS KMS key. Which action should be taken?

Accepted Answer

Enable encryption at rest when creating the RDS instance and select the customer-managed KMS key.. Encryption at rest for RDS must be enabled at instance creation, and you can select a customer-managed KMS key at that time. Once enabled, the key cannot be changed. The other options are either impossible or do not meet the requirement of using a customer-managed KMS key.

Answer

Enable encryption at rest using the default AWS managed key for RDS, then change the key to a customer-managed key after creation.

Answer

Create the RDS instance without encryption, then modify the instance to enable encryption using the AWS Management Console.

Answer

Use Transparent Data Encryption (TDE) at the database level with a customer-managed key stored in AWS KMS.

Question 2

A company uses Amazon DynamoDB with global tables. They notice that changes made in one region are not appearing in another region after several minutes. Which CloudWatch metric should be monitored to check the replication lag?

Accepted Answer

ReplicationLatency. ReplicationLatency measures the time between the last update on the source table and the last update on the replica table. Option A (ConsumedWriteCapacityUnits) is wrong because it measures write capacity usage, not replication lag. Option B (SuccessfulRequestLatency) is wrong because it measures request latency, not replication lag. Option D (ThrottledRequests) is wrong because it indicates throttling, not replication lag.

Answer

ConsumedWriteCapacityUnits

Answer

SuccessfulRequestLatency

Answer

ThrottledRequests

Question 3

A company is designing a relational database for an e-commerce application that requires high availability and automated failover across AWS Regions. Which AWS database service should they use?

Accepted Answer

Amazon Aurora Global Database. Amazon Aurora Global Database is the correct choice because it is designed for cross-Region disaster recovery and high availability, replicating data with a typical latency of under one second across multiple AWS Regions. It supports automated failover from the primary Region to one of the secondary Regions, meeting the requirement for automated cross-Region failover without manual intervention.

Answer

Amazon DynamoDB Global Tables

Answer

Amazon RDS with Multi-AZ deployment

Answer

Amazon Redshift with cross-Region snapshot copy

Question 4

A financial services company is using Amazon DynamoDB to store customer transaction data. The compliance team requires that all data be encrypted at rest using a customer-managed AWS KMS key, and that access to the key be auditable via AWS CloudTrail. Additionally, the security team wants to ensure that DynamoDB can only be accessed from within the VPC using a VPC endpoint. Which combination of steps should the company take to meet these requirements?

Accepted Answer

Enable server-side encryption with a customer-managed KMS key and create an interface VPC endpoint for DynamoDB.. Option C. To meet the encryption requirement, the company must use a customer-managed KMS key, not an AWS managed key. For VPC-only access, DynamoDB supports interface VPC endpoints (via AWS PrivateLink), which provide private connectivity. Option C correctly uses a customer-managed KMS key and an interface VPC endpoint. Option D is incorrect because it uses an AWS managed KMS key. Option A is incorrect because CloudHSM is unnecessary and VPC peering is not the correct method. Option B is incorrect because a NAT gateway still routes traffic over the internet.

Answer

Use a CloudHSM key for encryption and create a VPC peering connection to DynamoDB.

Answer

Enable server-side encryption with a customer-managed KMS key and route all traffic through a NAT gateway.

Answer

Use AWS managed KMS key and a gateway VPC endpoint for DynamoDB.

Question 5

A database administrator needs to audit all SQL statements executed on an Amazon RDS for PostgreSQL DB instance. Which service should be used to capture and log the SQL statements?

Accepted Answer

Amazon RDS for PostgreSQL database activity streams. Amazon RDS for PostgreSQL supports database activity streams, which can be integrated with services like Amazon CloudWatch and AWS CloudTrail to provide a near real-time stream of database activities. The other options do not capture SQL statements: CloudTrail records API calls to RDS, Config records resource configuration changes, and Inspector is for vulnerability assessment.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon Inspector

Question 6

A company is deploying a new application that requires a MySQL-compatible database with automatic scaling of compute and storage resources. Which AWS service should be used?

Accepted Answer

Amazon Aurora MySQL. Amazon Aurora MySQL is the correct choice because it is a MySQL-compatible relational database that automatically scales compute (up to 128 vCPUs and 244 GiB of memory) and storage (up to 128 TiB in 10 GiB increments) without downtime. Aurora's storage subsystem is distributed and self-healing, scaling as data grows, and its compute can be scaled via Auto Scaling policies or by modifying the instance class with minimal disruption.

Answer

Amazon RDS for MySQL

Answer

Amazon DynamoDB

Answer

Amazon Redshift

Question 7

A company wants to restrict access to an Amazon RDS for MySQL DB instance so that only applications running in a specific VPC can connect. Which solution should be implemented?

Accepted Answer

Configure the DB instance's security group to allow inbound traffic only from the application's security group.. RDS security groups control inbound traffic at the instance/ENI level, and referencing the application's security group as the source is the canonical way to allow only that application tier to connect. This creates a dynamic, identity-based rule that follows the application instances regardless of their IP addresses. It is the standard AWS pattern for tiered VPC architectures and satisfies the requirement to restrict access to a specific VPC's applications.

Answer

Use an IAM policy to restrict database connections based on source IP.

Answer

Configure the subnet's network ACL to allow inbound traffic only from the application's IP range.

Answer

Attach a security group to the subnet that allows inbound traffic from the application's VPC.

Question 8

A team is migrating an on-premises Oracle database to Amazon Aurora PostgreSQL. The database is 2 TB and has a 6-hour maintenance window. Which AWS service should the team use to minimize downtime?

Accepted Answer

AWS Database Migration Service (AWS DMS). AWS DMS is the correct choice because it can perform a live migration from Oracle to Aurora PostgreSQL with minimal downtime using ongoing replication (change data capture). It supports heterogeneous migrations, automatically converting the source schema and data types, and can handle a 2 TB database within the 6-hour maintenance window by using multiple parallel tasks and large instance types.

Answer

Amazon S3 Transfer Acceleration

Answer

AWS Snowball Edge

Answer

Amazon EC2 with Oracle installed

Question 9

A database specialist is troubleshooting an Amazon RDS for MySQL DB instance that is running out of storage. The instance has automated backups enabled. The specialist needs to free up storage space immediately without losing backup capability. Which action should the specialist take?

Accepted Answer

Delete older automated backups that are no longer needed.. None of the provided options will free up DB instance storage. Automated backups are stored in Amazon S3, not in the instance's allocated storage. To free up instance storage, you would need to increase the allocated storage or delete actual data from the database. Reducing backup retention deletes backups from S3, not instance storage. Manual snapshots are also in S3. Disabling backups stops future backups but does not free existing storage.

Answer

Modify the DB instance to reduce the backup retention period to 0 days.

Answer

Delete manual snapshots from the RDS console.

Answer

Disable automated backups to stop storage consumption.

Question 10

A company runs a production Amazon DynamoDB table with on-demand capacity. The table stores session data for a web application. Recently, users have reported occasional slow response times. The operations team notices that the table's ConsumedWriteCapacityUnits metric shows occasional spikes that exceed the provisioned throughput (though on-demand auto-scales), and ThrottledWriteEvents metrics show occasional throttling. The application uses the AWS SDK with default retry logic. The database specialist is asked to investigate. Upon reviewing the table configuration, the specialist finds that the table has a simple primary key (partition key only) and the data access pattern is heavily skewed toward a small number of partition keys. The application writes in batches of 25 items using the BatchWriteItem API. What should the specialist recommend to reduce throttling and improve performance?

Accepted Answer

Implement write sharding by adding a random suffix to the partition key to distribute writes more evenly.. The throttling is caused by a hot partition: the table uses a single partition key, and writes are heavily skewed toward a few keys. By adding a random suffix to the partition key (write sharding), the writes are distributed evenly across all partitions, eliminating hot spots and reducing throttling. The on-demand capacity mode already handles overall throughput, but it cannot prevent throttling on individual partitions when access is skewed.

Answer

Increase the provisioned read capacity units to handle the load.

Answer

Switch the table to provisioned capacity mode and increase write capacity.

Answer

Enable DynamoDB Accelerator (DAX) to cache write operations.

Question 11

A company has an Amazon RDS for PostgreSQL DB instance that needs to be accessed by an application running on an Amazon EC2 instance. Both resources are in the same VPC. The security team insists that all traffic between the application and the database be encrypted in transit. Which configuration ensures this?

Accepted Answer

Enable SSL/TLS on the RDS instance and configure the application to connect using SSL.. Encryption in transit between an EC2 application and an RDS PostgreSQL instance is achieved by enabling SSL/TLS on the RDS instance and configuring the application's connection string to use SSL (e.g., sslmode=require or verify-full with the RDS CA). Being in the same VPC does not encrypt traffic — VPC networking is isolated but not encrypted at the application layer.

Answer

Add a security group rule that allows traffic only from the EC2 instance's private IP.

Answer

Create an AWS Site-to-Site VPN connection between the EC2 instance and the RDS instance.

Answer

Set up VPC peering between the EC2 instance's VPC and the RDS instance's VPC.

Question 12

A social media application stores user posts in an Amazon RDS for PostgreSQL instance. The application experiences a sudden spike in read traffic during peak hours, causing database bottlenecks. The team needs to improve read scalability without changing the application code. Which solution is MOST cost-effective?

Accepted Answer

Use Amazon RDS for PostgreSQL Read Replicas. Amazon RDS for PostgreSQL Read Replicas allow you to offload read traffic from the primary DB instance to one or more read-only replicas, improving read scalability without any application code changes. This is the most cost-effective solution as it leverages the existing PostgreSQL engine and requires only minimal additional compute and storage costs for the replicas.

Answer

Migrate to Amazon DynamoDB with DAX

Answer

Enable Multi-AZ on the RDS instance

Answer

Use Amazon ElastiCache to cache query results

Question 13

Refer to the exhibit. A developer created an IAM policy with the above command and attached it to a user. What is the security implication of this policy?

Accepted Answer

The policy grants full administrative access to all RDS resources in the account.. The policy allows all RDS actions on all resources, granting full administrative access to all RDS resources in the account. This is overly permissive and violates the principle of least privilege. Option A is wrong because the policy does not restrict to a specific region. Option B is wrong because it does not restrict to a specific region. Option D is wrong because it does not restrict to read-only access.

Answer

The policy restricts access to only one specific DB instance.

Answer

The policy allows only actions in the us-east-1 region.

Answer

The policy only allows read-only access to RDS.

Question 14

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. During the migration, the database administrator notices that the CPU utilization on the RDS instance is consistently above 90% during peak hours, even though the on-premises server had similar specifications. The application queries are mostly SELECT statements with occasional DML. The RDS instance is db.r5.large with 500 GB of General Purpose SSD (gp2) storage. Which change would most likely reduce CPU utilization?

Accepted Answer

Upgrade to a larger instance type, such as db.r5.xlarge.. The db.r5.large instance type has 2 vCPUs and 16 GiB of memory. Sustained CPU utilization above 90% during peak hours indicates that the instance is compute-bound for the workload. Upgrading to db.r5.xlarge (4 vCPUs, 32 GiB memory) doubles the available CPU capacity, directly reducing CPU utilization for the same query load. The on-premises server had similar specifications, but RDS instances may have different CPU architectures or hypervisor overhead, making the larger instance the most direct fix.

Answer

Create a read replica and redirect all SELECT queries to the replica.

Answer

Enable Multi-AZ to offload CPU to the standby instance.

Answer

Increase the allocated storage to 1 TB to improve I/O performance.

Question 15

A company uses Amazon DynamoDB for a time-series IoT workload. Each device sends a data point every minute. The primary key consists of device_id (partition key) and timestamp (sort key). The company wants to efficiently retrieve the latest 10 data points for a specific device. Which query design is most efficient?

Accepted Answer

Query the table with ScanIndexForward=false and Limit=10.. Query with ScanIndexForward=false retrieves items in descending order by the sort key (timestamp), and Limit=10 stops after the first 10 items, which are the most recent 10 data points for the given device_id. This is the most efficient design as it reads only the 10 items needed, leveraging the DynamoDB local secondary index or table's sort key order without any post-processing.

Answer

Use GetItem on the device_id partition key with the maximum timestamp.

Answer

Query the table with ScanIndexForward=true and Limit=10, then reverse the result set.

Answer

Scan the entire table and filter by device_id, then sort by timestamp.

Question 16

An administrator runs the CLI command shown in the exhibit and sees the output. The DB instance 'mydb' is currently running MySQL 5.7.22. What does the output indicate?

Accepted Answer

The DB instance has a pending minor version upgrade to 5.7.23. The output shows 'Pending maintenance: Yes' with 'Minor version upgrade to 5.7.23' listed. This indicates that the DB instance has a pending minor version upgrade that will be applied during the next maintenance window. The CLI command 'aws rds describe-db-instances --db-instance-identifier mydb' returns this information when a minor version upgrade is scheduled but not yet applied.

Answer

The master user password has been changed

Answer

The DB instance has failed to apply modifications

Answer

The DB instance is using a custom DB parameter group

Question 17

A company is deploying a new microservices application on Amazon ECS. Each microservice needs its own database. Which AWS database service should be used to minimize operational overhead?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a fully managed NoSQL database that provides single-digit millisecond latency at any scale, making it ideal for microservices that each require their own isolated database. It eliminates operational overhead by handling hardware provisioning, setup, configuration, replication, and patching automatically, with no servers to manage. DynamoDB also supports on-demand capacity mode, which scales automatically based on traffic, perfectly aligning with the dynamic nature of microservices on Amazon ECS.

Answer

Amazon Aurora

Answer

Amazon Redshift

Answer

Amazon RDS for MySQL

Question 18

A company needs to store JSON documents that are up to 10 KB in size. The documents are accessed by a primary key, and the company requires single-digit millisecond latency. Which database service should be used?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is the correct choice because it is a fully managed NoSQL key-value and document database that delivers single-digit millisecond latency at any scale. It natively supports JSON documents up to 400 KB in size (well above the 10 KB requirement) and provides primary key access with consistent low-latency performance, making it ideal for this workload.

Answer

Amazon Neptune

Answer

Amazon S3

Answer

Amazon RDS for MySQL with JSON data type

Question 19

A company has an Amazon Redshift cluster that contains sensitive data. The security team requires that data be encrypted at rest using a customer-managed AWS KMS key. The cluster was initially launched without encryption. How can the company enable encryption with minimal downtime?

Accepted Answer

Take a snapshot of the cluster and restore it to a new cluster with encryption enabled.. Amazon Redshift does not allow enabling encryption in place on an existing unencrypted cluster. The supported path is to take a snapshot of the unencrypted cluster and restore it to a new cluster with encryption enabled using a customer-managed KMS key. This preserves data and requires only the cutover downtime.

Answer

Unload the data to Amazon S3, create a new encrypted cluster, and reload the data from S3.

Answer

Use the AWS CLI to update the cluster encryption setting.

Answer

Modify the cluster and enable encryption using the AWS Management Console.

Question 20

A startup is building a real-time leaderboard for a mobile game using Amazon DynamoDB. The leaderboard must update frequently and support global access with low latency. Which database design approach is most suitable?

Accepted Answer

Use Amazon DynamoDB global tables with appropriate partition key design.. Amazon DynamoDB global tables provide multi-Region, fully managed, multi-master replication, which is ideal for a real-time leaderboard requiring frequent updates and low-latency global access. By designing an appropriate partition key (e.g., game ID or time-based composite key), you can distribute write traffic evenly and avoid hot partitions, ensuring consistent performance under high update frequency.

Answer

Use Amazon ElastiCache for Redis with replication across Regions.

Answer

Use Amazon Aurora Global Database with a single writer and multiple readers.

Answer

Use Amazon S3 with event notifications to update a leaderboard file.