DBS-C01 Practice Test 31 — 15 Questions

Question 1

A gaming company uses Amazon DynamoDB to store player profiles with partition key player_id. The access pattern is to retrieve profiles for multiple players in a single request. The application currently makes separate GetItem calls, causing high latency. Which design pattern reduces latency and cost?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use BatchGetItem to retrieve multiple items in one request. BatchGetItem allows you to retrieve up to 100 items or 16 MB of data from multiple tables in a single API call, reducing the number of network round trips compared to individual GetItem calls. This directly addresses the high latency caused by multiple sequential requests and also reduces cost because you pay for read capacity units (RCUs) based on the total item size, not per request overhead.

Answer

Enable DynamoDB Accelerator (DAX)

Answer

Redesign to a single-table design

Answer

Create a global secondary index on player_id

Question 2

Which THREE actions should be taken to troubleshoot an Amazon RDS for PostgreSQL instance that is unresponsive? (Choose 3.)

Accepted Answer

Verify that the security group allows inbound traffic on the database port. Option C is correct because an unresponsive RDS for PostgreSQL instance is often caused by network-level blocking; verifying that the associated security group permits inbound traffic on the PostgreSQL port (5432) confirms clients can actually reach the endpoint. Option D is correct because RDS publishes PostgreSQL logs to CloudWatch Logs when the relevant log exports are enabled, and reviewing postgresql.log and upgrade logs reveals errors such as crashes, out-of-memory events, or replication failures that explain the unresponsiveness. Option E is correct because CloudWatch metrics like CPUUtilization, FreeableMemory, and DiskQueueDepth/ReadIOPS/WriteIOPS show whether resource exhaustion (CPU saturation, memory pressure, or storage I/O bottlenecks) is the root cause. Option A is not appropriate as a first troubleshooting step because rebooting is a disruptive remediation action that destroys diagnostic state and should follow, not precede, investigation. Option B is also not a troubleshooting action; resizing the instance class is a scaling change that may mask the symptom without identifying the underlying cause and can cause downtime.

Answer

Reboot the DB instance immediately

Answer

Modify the DB instance to a larger instance class

Question 3

A company wants to encrypt an existing unencrypted Amazon RDS for PostgreSQL DB instance. What is the correct procedure?

Accepted Answer

Take a snapshot of the instance, create an encrypted copy of the snapshot, and restore the encrypted snapshot to a new DB instance.. Amazon RDS does not allow enabling encryption on an existing unencrypted DB instance in place. The only supported method is to take a snapshot of the unencrypted instance, create an encrypted copy of that snapshot (specifying a KMS key), and then restore the encrypted snapshot to a new DB instance. This new instance will have encryption at rest enabled.

Answer

Take a snapshot of the instance and restore it with encryption enabled.

Answer

Modify the DB instance and enable encryption in the RDS console.

Answer

Create a read replica of the instance and enable encryption on the replica.

Question 4

Which THREE of the following are best practices for securing an Amazon DynamoDB table? (Select THREE.)

Accepted Answer

Enable point-in-time recovery (PITR) to protect against accidental writes or deletes.. Options A, B, and D are correct. Point-in-time recovery (PITR) protects against accidental writes or deletes by allowing you to restore the table to any point within the last 35 days. Encryption at rest using AWS KMS secures data at rest. IAM policies based on least privilege restrict access to only necessary actions and resources. Option C (public access) is not a best practice; DynamoDB tables are private by default and should not be exposed publicly. Option E (limiting item size) is a performance consideration, not a security best practice.

Answer

Enable public access to the table to allow easy data sharing.

Answer

Limit the maximum item size to 100 KB to reduce storage costs.

Question 5

A company has an Amazon RDS for MySQL DB instance that is publicly accessible. The security team wants to restrict access to only specific IP addresses. Which configuration should be used?

Accepted Answer

Configure a security group associated with the RDS instance to allow inbound traffic only from the specific IP addresses.. For an Amazon RDS for MySQL DB instance that is publicly accessible, the correct way to restrict access to specific IP addresses is to configure a security group associated with the RDS instance. Security groups act as virtual firewalls that control inbound and outbound traffic at the instance level. By setting inbound rules to allow only the specific IP addresses on the database port, you effectively restrict access. This is the standard and most granular method for controlling network access to RDS instances.

Answer

Create a VPC endpoint for RDS and attach a policy that allows only the specific IP addresses.

Answer

Use an IAM policy with a condition that restricts the source IP address.

Answer

Configure a network ACL to allow inbound traffic from the specific IP addresses.

Question 6

A company uses Amazon RDS for SQL Server with Multi-AZ deployment. The security team has mandated that all connections to the database must use SSL/TLS. The database is accessed by multiple applications running on EC2 instances. Which configuration ensures that all connections use SSL/TLS?

Accepted Answer

Set the parameter rds.force_ssl to 1 in the DB parameter group.. Setting the rds.force_ssl parameter to 1 in the DB parameter group enforces SSL/TLS for all connections to the RDS for SQL Server instance. No additional steps are needed; this parameter alone ensures that any connection attempt without SSL is rejected. Option B is incorrect because it includes an unnecessary step of revoking permissions from users that do not use SSL; the rds.force_ssl setting already forces SSL for all users and revoking permissions is redundant. Option A is incorrect because the 'Require SSL' option does not exist in the RDS console; SSL enforcement is controlled via parameter group settings. Option D is incorrect because configuring applications to use a trusted certificate only addresses the client side; the server must also require SSL, which is achieved through the parameter group setting.

Answer

Modify the DB instance by enabling the 'Require SSL' option in the RDS console.

Answer

Set the parameter rds.force_ssl to 1 in the DB parameter group and revoke permissions from users that do not use SSL.

Answer

Configure the applications to use a certificate from a trusted certificate authority and connect using SSL.

Question 7

A media company uses Amazon ElastiCache for Redis to cache database query results and reduce load on the primary database. The cache hit ratio is low because the cache is purged frequently. The team wants to improve the hit ratio without increasing the cache size. Which strategy should they implement?

Accepted Answer

Increase the TTL for cached entries to reduce early evictions.. Increasing the TTL (Time-To-Live) for cached entries allows them to remain in the cache longer, reducing the frequency of evictions due to expiration. Since the cache is purged frequently, a low TTL is likely causing entries to expire before they can be reused, which directly lowers the hit ratio. By extending the TTL, the team can retain popular entries longer without needing to increase the cache size, as the existing memory is used more efficiently.

Answer

Implement lazy loading to populate cache only on demand.

Answer

Use write-through caching to update cache on every database write.

Answer

Set eviction policy to allkeys-random to spread evictions evenly.

Question 8

A company is using Amazon Redshift for data warehousing. The data engineering team notices that queries are taking longer than expected. The cluster has two nodes of type dc2.large. The database specialist checks the system tables and finds that many queries are using the disk for temporary storage. Which action should the specialist take to improve query performance?

Accepted Answer

Upgrade the cluster to a node type with more memory, such as ra3.xlplus.. Queries spilling to disk for temporary storage indicate insufficient memory for the working set, causing Redshift to write intermediate results to disk and slowing performance. Upgrading to a node type with more memory per node (such as ra3.xlplus, which offers more memory and managed storage) directly addresses this bottleneck. Adding nodes or distribution keys helps with data skew and parallelism but does not fix memory pressure that forces disk spills.

Answer

Add distribution keys to the tables to improve data distribution.

Answer

Enable concurrency scaling to offload queries to additional clusters.

Answer

Increase the number of nodes to three to distribute the workload.

Question 9

Which THREE factors should be considered when choosing between a native database migration tool (e.g., pg_dump) and AWS DMS for migrating a database to Amazon RDS? (Choose three.)

Accepted Answer

Downtime tolerance during migration. Option B (Downtime tolerance) is correct because native tools like pg_dump typically require the database to be taken offline or placed in read-only mode for a consistent dump, whereas AWS DMS supports continuous replication with minimal downtime, so the acceptable outage window directly drives the tool choice. Option C (Requirement for ongoing replication) is correct because AWS DMS provides Change Data Capture (CDC) via replication instances to keep source and target synchronized continuously, while pg_dump produces a point-in-time snapshot with no built-in ongoing sync capability. Option E (Total size and network bandwidth) is correct because large databases make native dump/restore slow and bandwidth-bound, while DMS uses parallel load and compression options that can be more efficient over constrained links. Option A is not a deciding factor because both native tools and DMS work across AWS regions; region placement affects latency and data transfer cost but not the fundamental tool selection. Option D is not a primary factor because complex transformations are handled by AWS SCT or ETL tools, not by DMS or pg_dump themselves, so it does not distinguish between these two migration approaches.

Answer

Whether the target database is in a different AWS region

Answer

Need to perform complex data transformations during migration

Question 10

A company runs an Amazon Aurora MySQL-compatible database cluster. The security team requires that all database credentials be rotated automatically every 30 days. Which combination of AWS services can meet this requirement with minimal operational overhead?

Accepted Answer

Store the password in AWS Secrets Manager and enable automatic rotation with a 30-day interval.. AWS Secrets Manager provides built-in automatic rotation for RDS database credentials. Option A is incorrect because IAM database authentication does not involve password rotation. Option C is incorrect because CloudHSM does not manage password rotation. Option D is incorrect because Systems Manager Parameter Store lacks built-in rotation capabilities for RDS credentials.

Answer

Use IAM database authentication and rotate the IAM user keys every 30 days.

Answer

Use AWS CloudHSM to generate a new password and a Lambda function to update the database.

Answer

Store the password in AWS Systems Manager Parameter Store and use a scheduled Lambda function to update the password.

Question 11

A company runs a data warehouse on Amazon Redshift. The workload has frequent DELETE and UPDATE operations on a large fact table. Over time, query performance degrades. Which maintenance operation should be scheduled regularly to optimize performance?

Accepted Answer

Run VACUUM and ANALYZE commands regularly. B is correct because frequent DELETE and UPDATE operations in Redshift create ghost rows and cause table bloat, degrading query performance. Running VACUUM reclaims space and re-sorts rows, while ANALYZE updates table statistics for the query optimizer; together they restore performance without requiring a full table rebuild.

Answer

Run VACUUM FULL during maintenance windows

Answer

Alter the table to use a different DISTKEY

Answer

Drop and recreate the table periodically

Question 12

A company is designing a multi-tenant SaaS application on Amazon RDS for PostgreSQL. Tenants have vastly different data sizes and access patterns. The current design uses a separate schema per tenant, but some tenants experience slow queries while others are fine. Which approach would best isolate tenant performance and simplify management?

Accepted Answer

Use a separate database per tenant.. Using a separate database per tenant provides the strongest resource isolation at the database instance level. This design prevents noisy neighbors—tenants with large data volumes or heavy access patterns from degrading the performance of other tenants—and simplifies management tasks such as backup, restore, and point-in-time recovery on a per-tenant basis. Amazon RDS for PostgreSQL supports multiple databases within a single DB instance, and each database operates with its own catalog, tables, and connection pool, ensuring that query execution and memory allocation are not shared across tenants.

Answer

Use row-level security (RLS) policies within a single schema to restrict tenant data access.

Answer

Keep the current schema design and add a tenant_id index to all tables.

Answer

Use Amazon RDS Proxy to manage connections and improve performance.

Question 13

A company is deploying an Amazon Aurora MySQL database with read replicas. They need to ensure high availability and disaster recovery across AWS Regions. Which THREE components should be included?

Accepted Answer

Aurora Replicas in the same Region. Option A (Aurora Replicas in the same Region) is correct because Aurora Replicas provide in-Region high availability by enabling automatic failover to a replica if the primary writer instance fails, with typical failover times under 30 seconds. Option B (Aurora Global Database) is correct because it spans multiple AWS Regions with a primary Region and up to five secondary Regions, replicating data with typical latency under one second and enabling cross-Region disaster recovery via managed planned failover or unplanned failover. Option D (Amazon Route 53 with health checks and failover policy) is correct because Route 53 health checks monitor endpoint health and a failover routing policy directs client traffic to a healthy Region during a regional outage, completing the DR traffic-routing layer. Option C (Auto Scaling groups) is incorrect because Auto Scaling groups manage EC2 instance fleets, not Aurora database instances, and Aurora scaling is handled through Aurora Replicas and Aurora Auto Scaling rather than EC2 Auto Scaling groups. Option E (Amazon CloudFront) is incorrect because CloudFront is a content delivery network for caching and accelerating HTTP/HTTPS content at edge locations, and it does not provide database high availability or disaster recovery for Aurora MySQL.

Answer

Auto Scaling groups

Answer

Amazon CloudFront

Question 14

A developer is writing an AWS Lambda function that needs to access a Secrets Manager secret to retrieve database credentials. The Lambda function has an IAM role. Which action must be allowed in the IAM policy?

Accepted Answer

secretsmanager:GetSecretValue. The Lambda function needs to retrieve the secret value, which is done via the Secrets Manager API action GetSecretValue. This action returns the decrypted secret content (if the caller has permission) and is the standard way to read a secret. The IAM role attached to the Lambda function must explicitly allow secretsmanager:GetSecretValue on the secret's ARN. Without this permission, the function cannot fetch the credentials.

Answer

kms:Decrypt

Answer

secretsmanager:PutSecretValue

Answer

secretsmanager:ListSecrets

Question 15

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle using AWS DMS. The source database is 2 TB and has high transaction volume. The migration needs minimal downtime. Currently, full load completes but CDC task fails with 'ORA-1555: snapshot too old' errors. What should the DBA do to resolve this?

Accepted Answer

Increase the undo retention period and undo tablespace size on the source Oracle database.. The ORA-1555 'snapshot too old' error occurs when Oracle's undo data needed to reconstruct a consistent read image for the CDC (Change Data Capture) mining query has been overwritten. AWS DMS CDC tasks use LogMiner/DBMS_LOGMNR to read redo/undo, and long-running mining queries require the undo segment to retain data for the entire query duration. Increasing UNDO_RETENTION and enlarging the undo tablespace ensures the required undo blocks persist long enough for the CDC task to complete its consistent read, directly resolving the error without restarting the migration.

Answer

Restart the migration with a new full load and use a smaller task.

Answer

Enable supplemental logging on the source and use a larger DMS instance.

Answer

Reduce the transaction volume by pausing non-essential transactions during CDC.