DBS-C01 Practice Test 33 — 15 Questions

Question 1

A company is using Amazon Redshift for data warehousing. The query performance has degraded over time. The DBA suspects that the distribution style of large tables is suboptimal. Which Redshift system view should be queried to identify distribution skew?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SVV_DISKUSAGE. SVV_DISKUSAGE provides disk usage per slice, which helps identify distribution skew. Option A is wrong because STL_SCAN provides details about scan operations, not skew. Option B is wrong because PG_TABLE_DEF shows table definitions, not skew. Option D is wrong because STV_TBL_PERM shows storage usage per table but not per slice, making it less suitable for skew analysis.

Answer

STL_SCAN

Answer

PG_TABLE_DEF

Answer

STV_TBL_PERM

Question 2

A database administrator notices that the /var/log/mysql/error.log file on an Amazon RDS for MySQL DB instance is growing rapidly. The administrator wants to monitor the log file size and receive alerts when it exceeds a certain threshold. Which AWS service should be used to set up this monitoring?

Accepted Answer

Amazon CloudWatch Logs. CloudWatch Logs can monitor log file sizes and trigger alarms based on metric filters. Option A is wrong because CloudTrail does not monitor log file sizes. Option B is wrong because S3 is a storage service, not a monitoring service. Option C is wrong because RDS Enhanced Monitoring provides OS-level metrics, not log file metrics.

Answer

AWS CloudTrail

Answer

Amazon S3

Answer

Amazon RDS Enhanced Monitoring

Question 3

An application using Amazon DynamoDB is experiencing higher than expected read costs. The table uses on-demand capacity mode. The read pattern is mostly fetching small items (1 KB) using GetItem. Which of the following is the most cost-effective optimization?

Accepted Answer

Switch to eventually consistent reads for GetItem operations. The most cost-effective because eventually consistent reads consume half the read capacity units (0.5 RCU for items up to 4 KB) compared to strongly consistent reads (1 RCU). Since items are small (1 KB) and the table uses on-demand capacity, halving RCU consumption directly reduces read costs. Option A: Switching to provisioned capacity with auto scaling adds complexity and may not reduce costs if traffic is unpredictable; on-demand is already suitable for variable workloads. Option B: Application-level compression would not significantly reduce RCU consumption because items are already under the 4 KB RCU threshold. Option C: Adding DAX introduces additional cost and primarily improves latency, not read cost, as DAX still charges for reads from DynamoDB.

Answer

Change the table to provisioned capacity mode with auto scaling

Answer

Compress the items using application-level compression

Answer

Use DAX to cache the read results

Question 4

A database specialist is monitoring an Amazon DynamoDB global table with two replicas in separate regions. The specialist notices that the 'ReplicatedWriteConflictCount' metric is increasing. What is the MOST likely cause?

Accepted Answer

The same item is being written concurrently in multiple regions. Concurrent writes to the same item in different regions cause conflicts. Option A is wrong because provisioned throughput affects throttling, not conflicts. Option B is wrong because network latency does not cause conflicts. Option C is wrong because eventual consistency does not cause conflicts.

Answer

Insufficient write capacity in one of the regions

Answer

High network latency between the regions

Answer

The application is using strongly consistent reads

Question 5

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The database is experiencing increased latency and the application team reports slow queries. The DBA wants to identify the queries that consume the most resources. Which AWS service should be used to capture and analyze these queries?

Accepted Answer

Amazon RDS Performance Insights. Amazon RDS Performance Insights provides database performance tuning and monitoring with query-level metrics, enabling identification of resource-intensive queries. Option B is wrong because CloudWatch Logs collects log files but does not capture query-level performance. Option C is wrong because Enhanced Monitoring provides OS-level metrics (CPU, memory) but not query-level details. Option D is wrong because CloudTrail records AWS API activity, not database queries.

Answer

Amazon CloudWatch Logs

Answer

Amazon RDS Enhanced Monitoring

Answer

AWS CloudTrail

Question 6

A company is using Amazon Redshift and notices that queries are running slowly. Which TWO system views should be used to identify the cause of the slow queries? (Choose TWO.)

Accepted Answer

STL_QUERY. The correct answers are C and E. STL_QUERY contains detailed logs of all queries, including execution times, enabling identification of slow queries after execution. SVV_QUERY_STATE shows currently running queries, helping identify those that are running slowly. Option A (STV_TBL_PERM) is for table permissions, not performance. Option B (PG_TABLE_DEF) shows table definitions. Option D (STL_LOAD_COMMITS) shows load commit information.

Answer

STV_TBL_PERM

Answer

PG_TABLE_DEF

Answer

STL_LOAD_COMMITS

Question 7

Which TWO CloudWatch Logs features can be used to monitor and troubleshoot Amazon RDS for SQL Server error logs? (Choose TWO.)

Accepted Answer

Setting metric filters to count error occurrences. The correct answers are B and E. CloudWatch Logs allows real-time monitoring of log streams (E) and setting metric filters to count specific error occurrences (B). Option A (AWS X-Ray) is for distributed tracing, not log monitoring. Option C (exporting to S3) is for archival, not real-time monitoring. Option D (CloudTrail) captures API activity, not database error logs.

Answer

Integrating with AWS X-Ray for trace analysis

Answer

Exporting logs to Amazon S3

Answer

Using AWS CloudTrail to capture log events

Question 8

A database administrator needs to monitor the free storage space on an Amazon RDS for SQL Server instance. Which TWO CloudWatch metrics should be used? (Choose two.)

Accepted Answer

FreeStorageSpaceInPercent. (FreeStorageSpaceInPercent) and Option E (FreeStorageSpace) are correct. Option A is wrong because DatabaseConnections measures the number of connections, not storage. Option B is wrong because ReadLatency measures read latency, not storage. Option C is wrong because BinLogDiskUsage is a metric for MySQL/RDS for MySQL, not for SQL Server.

Answer

DatabaseConnections

Answer

ReadLatency

Answer

BinLogDiskUsage

Question 9

A company has an RDS for SQL Server DB instance that stores sensitive data. The database administrator needs to ensure that all connections to the database use SSL/TLS encryption. What should the administrator do?

Accepted Answer

Set the 'rds.force_ssl' parameter to 1 in the DB parameter group.. Setting 'rds.force_ssl' to 1 in the DB parameter group forces all connections to the RDS for SQL Server DB instance to use SSL/TLS encryption. Option A is incorrect because security group rules control network access, not encryption. Option C is incorrect because AWS CloudTrail logs API calls, not database connections. Option D is incorrect because deleting and recreating the instance would not, by itself, enforce SSL; encryption at rest is separate from SSL enforcement.

Answer

Configure the security group to only allow traffic from specific IP addresses.

Answer

Enable AWS CloudTrail to monitor connections.

Answer

Delete the DB instance and create a new one with encryption enabled.

Question 10

A company uses Amazon DynamoDB with AWS KMS customer managed keys for encryption at rest. The security team wants to audit who is using the KMS key to encrypt and decrypt data. Which AWS service should be used?

Accepted Answer

AWS CloudTrail. AWS CloudTrail logs all KMS API calls, including Encrypt and Decrypt, enabling auditing of who used the KMS key. Amazon S3 access logs (option A) are for S3 bucket access, not KMS. AWS Config (option B) tracks resource configuration changes, not API calls. Amazon CloudWatch Logs (option D) can store logs but does not capture KMS API calls by itself.

Answer

Amazon S3 access logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 11

A company is using Amazon Aurora MySQL-Compatible Edition. The security team wants to ensure that database credentials are not stored in application configuration files. They decide to use AWS Secrets Manager to manage credentials. The application is hosted on Amazon EC2 instances that have an IAM role attached. What is the most secure way to grant the application access to the secret?

Accepted Answer

Grant the IAM role attached to the EC2 instance permissions to read the secret, and use the Secrets Manager API to retrieve it at runtime.. The most secure approach is to grant the EC2 IAM role permission to read the secret using an IAM policy attached to the role, and then have the application call the Secrets Manager API to retrieve the secret at runtime. This avoids storing secrets in code or configuration files. Option B is wrong because storing the secret in application code is insecure. Option C is wrong because resource-based policies are not attached to EC2 instances; IAM roles are the correct mechanism. Option D is wrong because storing secrets in an S3 bucket introduces additional complexity and potential exposure; using Secrets Manager with IAM roles is more secure.

Answer

Store the secret in the application code and rotate it periodically.

Answer

Attach a resource-based policy to the EC2 instance allowing access to the secret.

Answer

Store the secret in an encrypted S3 bucket and have the application download it at startup.

Question 12

Which TWO AWS services can be used to centrally manage database credentials securely? (Choose two.)

Accepted Answer

AWS Secrets Manager. Options A and E are correct. AWS Secrets Manager is specifically designed to centrally manage secrets, including database credentials, with features like automatic rotation. AWS Systems Manager Parameter Store can also securely store secrets (e.g., using SecureString parameters). Option B (AWS CloudFormation) is incorrect because it is an infrastructure-as-code service, not a secrets manager. Option C (Amazon S3) is incorrect because it is an object storage service, not designed for secret storage. Option D (AWS IAM) is incorrect because it manages access permissions and identities, not secrets.

Answer

AWS CloudFormation

Answer

Amazon S3

Answer

AWS Identity and Access Management (IAM)

Question 13

A company stores sensitive data in an Amazon S3 bucket that is accessed by an Amazon Redshift cluster. The security team requires that the data in transit between Redshift and S3 be encrypted. Which configuration ensures this?

Accepted Answer

Ensure that the Redshift cluster has SSL enabled, which encrypts data in transit by default for COPY/UNLOAD operations to S3.. Redshift automatically uses SSL encryption for data in transit when moving data to and from S3 using COPY/UNLOAD commands. Option A is incorrect because server-side encryption (SSE-S3) encrypts data at rest, not in transit. Option C is incorrect because client-side encryption encrypts data before sending, but Redshift handles this automatically with SSL. Option D is incorrect because VPC endpoints do not encrypt data in transit; they provide private connectivity.

Answer

Enable server-side encryption (SSE-S3) on the S3 bucket.

Answer

Configure a VPC endpoint for S3.

Answer

Use client-side encryption on the data before uploading to S3.

Question 14

A company is using Amazon RDS for MySQL and needs to restrict access to the database to only specific Amazon EC2 instances in the same VPC. Which security mechanism should be used?

Accepted Answer

Configure a VPC security group that allows inbound traffic from the EC2 security groups.. In a VPC, RDS instances use VPC security groups to control inbound traffic. Configuring a VPC security group that allows inbound traffic from the EC2 security groups is the correct mechanism. Option B is incorrect because IAM policies control API access, not network connectivity. Option C is incorrect because subnet groups define subnets for deployment, not security rules. Option D is incorrect because network ACLs are stateless, apply to entire subnets, and cannot reference security groups or specific instances.

Answer

Create an IAM policy that allows the EC2 instances to connect to the RDS instance.

Answer

Create a DB subnet group that includes only the subnets where the EC2 instances reside.

Answer

Modify the network ACL for the DB subnet to allow traffic from the EC2 instances' IP addresses.

Question 15

A company uses Amazon Aurora MySQL-Compatible Edition and needs to audit all SQL statements executed by database users. Which feature should be enabled?

Accepted Answer

Enable the database engine audit logs (advanced auditing).. Aurora MySQL supports advanced auditing through database engine audit logs. Option B is wrong because CloudTrail logs API calls, not SQL queries. Option C is wrong because RDS Enhanced Monitoring provides OS metrics, not SQL audit. Option D is wrong because database activity streams capture activity in near real-time but are designed for monitoring and not primarily for SQL audit logging; however, they can be used, but the most direct answer is advanced auditing.

Answer

Enable AWS CloudTrail data events for the DB instance.

Answer

Enable database activity streams.

Answer

Enable RDS Enhanced Monitoring.