DBS-C01 Practice Test 3 — 30 Questions

Question 1

A company is using Amazon Redshift and has a query that is running slowly. The DBA wants to identify if the query is I/O-bound. Which TWO metrics from Amazon CloudWatch can indicate I/O-bound queries?

Accepted Answer

ReadIOPS. Options B and E are correct. ReadIOPS measures the number of read I/O operations per second, and ReadLatency measures the average time per read I/O operation. High values for these metrics indicate that the query is I/O-bound. Option A (NetworkReceiveThroughput) measures network throughput, not I/O. Option C (CPUUtilization) indicates CPU-bound workloads. Option D (WriteIOPS) measures write I/O, which is less likely to be the primary indicator for a slow query, and the question asks for the two metrics that can indicate I/O-bound queries; ReadIOPS and ReadLatency are the most direct I/O metrics.

Answer

NetworkReceiveThroughput

Answer

CPUUtilization

Answer

WriteIOPS

Question 2

A company needs to migrate a 3 TB Amazon RDS for SQL Server database to Amazon RDS for PostgreSQL. The migration must be automated and repeatable with minimal manual intervention. Which combination of services should be used?

Accepted Answer

Use AWS Schema Conversion Tool (SCT) to convert the schema, then use AWS DMS to migrate the data.. AWS Schema Conversion Tool (SCT) handles the schema conversion from SQL Server to PostgreSQL, which is necessary due to incompatible data types, stored procedures, and indexes. AWS Database Migration Service (DMS) then performs the continuous data migration with minimal downtime, supporting both full load and ongoing replication. This combination automates the migration process and makes it repeatable via AWS CloudFormation or DMS task templates.

Answer

Use AWS SCT to convert the schema and export data to PostgreSQL-compatible format, then import.

Answer

Use AWS DMS with native SQL Server CDC to migrate directly to PostgreSQL.

Answer

Use Microsoft Data Migration Assistant to assess and migrate to PostgreSQL.

Question 3

A company is migrating an Oracle database to Amazon RDS for Oracle. Security policy requires that all database connections be encrypted in transit. The security team wants to enforce that clients must use TLS 1.2 or higher. How can this be achieved?

Accepted Answer

Set the rds.force_ssl parameter to 1 in the DB parameter group.. Amazon RDS for Oracle supports SSL/TLS encryption, and setting the rds.force_ssl parameter to 1 in the DB parameter group enforces SSL connections, which ensures all connections use TLS 1.2 or higher (as per Oracle's implementation). Option A is incorrect because modifying the DB subnet group controls network-level access, not encryption requirements. Option B is incorrect because IAM policies cannot enforce encryption in transit at the database level; they can only control authentication and authorization. Option C is incorrect because require_secure_transport is a MySQL parameter, not applicable to Oracle.

Answer

Modify the DB subnet group to only allow traffic from specific IP ranges.

Answer

Create an IAM policy that denies access unless the connection uses TLS.

Answer

Set the require_secure_transport parameter to ON in the DB parameter group.

Question 4

A company is migrating a 10 GB MySQL database to Amazon RDS for MySQL. They have a 1 Gbps connection to AWS. The migration must be completed in the least amount of time with minimal manual effort. Which tool should be used?

Accepted Answer

AWS Database Migration Service (DMS).. AWS Database Migration Service (DMS) is the correct choice because it can perform a live, continuous migration of a 10 GB MySQL database to Amazon RDS for MySQL with minimal downtime and manual effort. DMS handles schema conversion (if needed), data replication, and ongoing changes via Change Data Capture (CDC), allowing the migration to complete in the least amount of time while automatically managing the full load and sync process over the 1 Gbps connection.

Answer

AWS Schema Conversion Tool (SCT).

Answer

AWS Snowball Edge.

Answer

mysqldump and mysql command-line tools.

Question 5

A financial services company is migrating a 10 TB Oracle data warehouse to Amazon Redshift. The source database uses a combination of partitioned tables, indexes, and materialized views. The migration team plans to use AWS SCT and DMS. Which approach should the team take to optimize query performance after migration?

Accepted Answer

Define appropriate distribution keys and sort keys. Amazon Redshift is a columnar data warehouse that does not support traditional indexes or the PARTITION BY clause used in Oracle. Instead, query performance in Redshift is optimized by defining appropriate distribution keys (to minimize data shuffling across nodes) and sort keys (to enable zone maps and reduce the amount of data scanned). This approach directly addresses the performance needs of the migrated 10 TB data warehouse.

Answer

Create indexes on frequently queried columns

Answer

Recreate all materialized views using standard views

Answer

Partition tables by date using the PARTITION BY clause

Question 6

A company wants to encrypt data at rest for an existing Amazon RDS for MySQL DB instance. The database is currently unencrypted. What is the most efficient way to enable encryption?

Accepted Answer

Create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the DB instance from the encrypted snapshot.. RDS encryption at rest can only be enabled at DB instance creation time — you cannot enable it on an existing unencrypted instance by modifying it. The supported migration path is to snapshot the unencrypted instance, copy the snapshot with the encryption option enabled (specifying a KMS key), and then restore a new DB instance from that encrypted snapshot. This is the standard, most efficient AWS-documented approach.

Answer

Enable encryption on the existing DB instance by modifying the parameter group.

Answer

Use AWS KMS to automatically encrypt the DB instance.

Answer

Modify the DB instance and enable encryption from the RDS console.

Question 7

A logistics company runs an Amazon ElastiCache for Redis cluster in cluster mode enabled to cache shipment tracking data. The application uses keys that include a customer ID and a shipment ID. The team notices uneven CPU utilization across shards, with some shards consistently hotter than others. They want to distribute the load more evenly without changing the application's key semantics. Which approach should they take?

Accepted Answer

Increase the number of shards in the cluster and let the service redistribute hash slots.. ElastiCache for Redis cluster mode enabled partitions the keyspace into 16,384 hash slots spread across shards. When some shards run hotter, adding shards triggers slot rebalancing that redistributes keys and evens out CPU load. This uses the service's native scaling mechanism and preserves application key semantics, unlike client-side sharding or hash tags, which either bypass the cluster or concentrate load.

Answer

Apply a consistent hashing scheme in the application to map keys to shards manually.

Answer

Enable automatic failover and increase the number of replicas per shard.

Answer

Use hash tags in the key names to force related keys onto the same shard.

Question 8

A gaming company wants to store player profiles and game state. The data is accessed via a REST API and must be highly available with single-digit millisecond latency. The schema is simple and may evolve over time. Which database should they use?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is the correct choice because it is a fully managed NoSQL key-value and document database that delivers single-digit millisecond latency at any scale, making it ideal for high-availability gaming workloads. Its schema-less design allows the player profile and game state schema to evolve over time without downtime or complex migrations, and it integrates seamlessly with REST APIs via AWS SDKs or API Gateway.

Answer

Amazon S3

Answer

Amazon RDS for PostgreSQL

Answer

Amazon Redshift

Question 9

An RDS DB instance has two security groups attached. Security group sg-12345678 allows inbound traffic on port 3306 from 0.0.0.0/0. Security group sg-87654321 allows inbound traffic on port 3306 from 10.0.0.0/16. What is the effective inbound access to the DB instance?

Accepted Answer

All IP addresses (0.0.0.0/0) are allowed to connect.. Security groups in AWS are additive and allow-only; when multiple security groups are attached to an RDS DB instance, the effective inbound rules are the union of all rules across all attached security groups. Since sg-12345678 allows 0.0.0.0/0 on port 3306, that rule is in effect regardless of the other group. Therefore, all IP addresses can connect on port 3306, making option D correct.

Answer

No IP addresses are allowed because the rules conflict.

Answer

Only the 0.0.0.0/0 range is allowed because sg-12345678 is more permissive.

Answer

Only the 10.0.0.0/16 range is allowed because sg-87654321 is more restrictive.

Question 10

A company is designing a multi-tier application that uses Amazon RDS for PostgreSQL. The application must encrypt data at rest and in transit. Which combination of steps should be taken to meet these requirements? (Choose the single best answer.)

Accepted Answer

Enable encryption at rest when launching the RDS instance, and configure the DB parameter group to require SSL connections.. Amazon RDS for PostgreSQL supports encryption at rest only when enabled at instance launch, and SSL/TLS encryption in transit is enforced by configuring the DB parameter group to require SSL connections (e.g., setting `rds.force_ssl=1`). Encryption at rest cannot be added after creation, and SSL ensures data is encrypted between the application and the database.

Answer

Use client-side encryption for data before sending to RDS, and enable encryption at rest after the instance is created.

Answer

Launch the RDS instance without encryption, then enable encryption at rest using the AWS Console.

Answer

Use AWS KMS to encrypt the connection between the application and RDS.

Question 11

What is the purpose of the 'TimeToLiveSpecification' in this template?

Accepted Answer

It enables DynamoDB to automatically delete items after the specified timestamp. The 'TimeToLiveSpecification' in an AWS DynamoDB CloudFormation template enables DynamoDB's Time to Live (TTL) feature, which automatically deletes items when the current time exceeds the epoch timestamp value stored in the specified attribute (e.g., 'expire_time'). This is a cost-effective way to manage data retention without requiring custom delete logic or additional write capacity.

Answer

It enforces that the 'expire_time' attribute must be unique

Answer

It automatically updates the 'expire_time' attribute when an item is read

Answer

It creates a backup of items that have expired

Question 12

A developer needs to grant an IAM user the ability to perform all operations on an Amazon RDS DB instance except the ability to delete it. Which IAM policy action should be explicitly denied?

Accepted Answer

rds:DeleteDBInstance. To prevent deletion, you must explicitly deny the rds:DeleteDBInstance action. Option A (rds:RebootDBInstance) is incorrect because it only reboots the instance. Option B (rds:StopDBInstance) is incorrect because it only stops the instance. Option C (rds:ModifyDBInstance) is incorrect because it only modifies the instance. Option D (rds:DeleteDBInstance) is the correct action to deny to prevent deletion.

Answer

rds:RebootDBInstance

Answer

rds:StopDBInstance

Answer

rds:ModifyDBInstance

Question 13

A company is migrating a MySQL database to Amazon RDS for MySQL. They want to use AWS DMS for continuous replication. Which TWO prerequisites must be met before starting the migration?

Accepted Answer

Enable binary logging (binlog) on the source MySQL database.. Option A is correct because AWS DMS requires binary logging (binlog) to be enabled on the source MySQL database for continuous replication (change data capture); the binlog_format must be set to ROW and the retention period long enough to cover the migration. Option B is correct because the DMS replication instance must have network connectivity to both the source and target databases, typically via VPC security groups, subnets, and routing, otherwise the endpoints cannot be reached and the task will fail. Option C is not required because DMS performs ongoing replication without forcing the source into read-only mode; writes can continue while changes are captured from the binlog. Option D is not a prerequisite because the source database can reside on-premises or outside a VPC, as long as connectivity to the replication instance is established. Option E is not required because DMS logs are written to Amazon CloudWatch Logs, not to an S3 bucket created for migration logs.

Answer

Set the source database to read-only mode during migration.

Answer

Place the source database in a VPC.

Answer

Create an S3 bucket to store the migration logs.

Question 14

A company is launching a new application that requires an Amazon RDS for PostgreSQL database. The database will store highly sensitive data, and the security team mandates that all data at rest must be encrypted. The company also requires that the encryption keys be managed by the security team using AWS CloudHSM. What is the MOST efficient way to meet these requirements?

Accepted Answer

Use AWS KMS with a customer-managed key (CMK) for RDS encryption.. RDS encryption at rest is always performed using AWS KMS keys. To have the security team manage keys via CloudHSM, you create a KMS customer-managed key (CMK) backed by a CloudHSM custom key store, then select that CMK when creating the RDS instance. This satisfies both the encryption-at-rest mandate and the CloudHSM key-management requirement without application changes.

Answer

Enable EBS encryption on the RDS instance's underlying volumes using a KMS key.

Answer

Enable Transparent Data Encryption (TDE) using a CloudHSM key in the RDS instance.

Answer

Implement client-side encryption in the application before writing data to the database.

Question 15

A company is designing a multi-region active-active application that requires low-latency reads and writes across regions. The database must support conflict resolution. Which database should be used?

Accepted Answer

Amazon DynamoDB Global Tables. Amazon DynamoDB Global Tables is the correct choice because it provides a fully managed, multi-region, multi-active database that replicates data across regions with eventual consistency, supporting low-latency reads and writes. It includes built-in conflict resolution using a last-writer-wins (LWW) mechanism based on timestamps, which meets the requirement for conflict resolution in an active-active architecture.

Answer

Amazon RDS Multi-AZ

Answer

Amazon Redshift

Answer

Amazon Aurora Global Database

Question 16

Arrange the steps to migrate an on-premises Oracle database to Amazon RDS for Oracle using AWS DMS (Database Migration Service) in the correct order.

Accepted Answer

Launch the DMS replication instance, then configure the source and target endpoints, then create the migration task, then monitor the migration task.. DMS migration requires setting up the replication instance, configuring endpoints with proper source database settings for CDC, creating a migration task, and monitoring for completion.

Answer

Configure the source and target endpoints, then launch the DMS replication instance, then create the migration task, then monitor the migration task.

Answer

Launch the DMS replication instance, then create the migration task, then configure the source and target endpoints, then monitor the migration task.

Answer

Configure the source and target endpoints, then launch the DMS replication instance, then monitor the migration task, then create the migration task.

Question 17

A company is designing a multi-tenant application using Amazon Aurora MySQL. Each tenant's data must be isolated from others. They need to encrypt data at rest with a unique AWS KMS key per tenant. How can this be achieved?

Accepted Answer

Launch separate Aurora clusters for each tenant, each with its own KMS key for encryption at rest.. To encrypt each tenant's data with a unique KMS key, you must launch separate Aurora clusters for each tenant, because encryption at rest is applied at the cluster level using a single KMS key. Each cluster can be configured with its own KMS key, providing tenant isolation. This approach ensures that data for each tenant is encrypted with a distinct key.

Answer

Create separate databases within the same Aurora cluster and assign a different KMS key to each database.

Answer

Use client-side encryption with different KMS keys per tenant before inserting data into the database.

Answer

Use a single Aurora cluster with row-level encryption using different KMS keys per tenant.

Question 18

Refer to the exhibit. A database engineer runs the query above to troubleshoot an application error. The query returns no results even though the database is generating errors. What is the most likely reason?

Accepted Answer

The log stream format uses a different field name for the error message. The most likely reason the query returns no results is that the log stream format uses a different field name for the error message than the one referenced in the query. In CloudWatch Logs Insights, the query must reference fields exactly as they appear in the log events. If the logs use a different key (e.g., 'message' vs 'errorMessage'), the filter will not match.

Answer

The regex pattern does not match because it is case-sensitive

Answer

The query does not specify a time range, so no results are returned

Answer

The log group has not been configured to export to CloudWatch Logs

Question 19

A company is migrating an on-premises Microsoft SQL Server database to Amazon RDS for SQL Server. The database supports a line-of-business application that requires high availability and automatic failover within a single AWS Region. The company wants to minimize downtime during the migration and ensure that the database can automatically recover from an Availability Zone failure. Which feature should the company implement?

Accepted Answer

Multi-AZ deployment with a standby replica in another Availability Zone. For Amazon RDS for SQL Server, Multi-AZ deployment provides a synchronous standby replica in a different Availability Zone and automatic failover in case of an AZ failure. This is the standard high availability feature offered by RDS. Read replicas are for read scaling and do not provide automatic failover. AWS DMS is for migration. Always On Availability Groups are supported but require additional configuration and are not the primary RDS high availability feature. Therefore, Multi-AZ deployment is the correct choice.

Answer

AWS Database Migration Service (AWS DMS) with ongoing replication

Answer

Amazon RDS for SQL Server with Always On Availability Groups

Answer

Read replicas in multiple Availability Zones

Question 20

A company is deploying a new web application that uses Amazon RDS for PostgreSQL. The database must be highly available with automatic failover across two Availability Zones. Which deployment option meets this requirement?

Accepted Answer

Deploy RDS PostgreSQL with Multi-AZ configuration.. Amazon RDS Multi-AZ deployment automatically provisions and maintains a synchronous standby replica in a different Availability Zone. If the primary DB instance fails, Amazon RDS automatically fails over to the standby, providing high availability with automatic failover across two AZs. This meets the requirement without manual intervention or application changes.

Answer

Deploy RDS PostgreSQL in a cross-region replication setup.

Answer

Deploy RDS PostgreSQL in a single Availability Zone.

Answer

Deploy RDS PostgreSQL with a read replica in another AZ.