DBS-C01 Practice Test 38 — 15 Questions

Question 1

A company is using Amazon DynamoDB with encryption at rest using an AWS managed key. The security team now requires that the encryption key be rotated every 90 days. What should they do?

Accepted Answer

Use a customer managed key and manually rotate it every 90 days by creating a new key and updating the DynamoDB table.. DynamoDB encryption at rest using an AWS managed key does not support customer-controlled rotation. Option D is correct because using a customer managed key allows you to manually rotate the key every 90 days by creating a new key and updating the DynamoDB table. Option A is incorrect because AWS managed keys rotate automatically every year, not on a 90-day schedule. Option B is incorrect because KMS automatic rotation for customer managed keys is also yearly and cannot be set to 90 days. Option C is incorrect because disabling encryption at rest is not a valid solution and adds security risk.

Answer

Enable automatic key rotation in AWS KMS for the default DynamoDB key.

Answer

Create a new customer managed key and enable automatic rotation every 90 days.

Answer

Disable encryption at rest and implement client-side encryption.

Question 2

A developer needs to deploy an Amazon RDS for MySQL DB instance that is accessible only from a specific EC2 instance in a VPC. Which configuration ensures this?

Accepted Answer

Place the RDS instance in the same VPC as the EC2 instance and configure a security group inbound rule referencing the EC2 security group. Placing the RDS instance in the same VPC as the EC2 instance and configuring a security group inbound rule that references the EC2 instance's security group allows traffic only from that specific EC2 instance. Security group rules are stateful and support referencing other security groups as sources, which provides a precise and secure method for controlling database access without exposing the RDS instance to the broader network.

Answer

Use an IAM role to allow the EC2 instance to connect to the RDS instance

Answer

Enable public accessibility and assign a public IP to the RDS instance

Answer

Place RDS and EC2 in different subnets and configure a network ACL

Question 3

A company wants to migrate an on-premises MongoDB database to Amazon DocumentDB. The migration should be performed with minimal application changes. Which AWS service should be used?

Accepted Answer

AWS Database Migration Service (AWS DMS). AWS DMS is the correct service because it supports homogeneous migrations from MongoDB to Amazon DocumentDB, including ongoing replication via change data capture (CDC) to minimize downtime. It handles schema conversion automatically for compatible data types, requiring minimal application changes since DocumentDB is MongoDB-compatible. AWS DMS can migrate data directly from a MongoDB source to a DocumentDB target without needing an intermediate schema transformation tool.

Answer

Amazon S3 Transfer Acceleration

Answer

AWS DataSync

Answer

AWS Schema Conversion Tool (AWS SCT)

Question 4

A company uses Amazon ElastiCache for Redis to cache session data. The security team requires that all data in transit be encrypted. The Redis cluster currently does not have encryption in transit enabled. The database specialist needs to enable encryption in transit with minimal downtime. Which action should the specialist take?

Accepted Answer

Create a new Redis cluster with encryption in transit enabled, and migrate the data from the existing cluster.. Encryption in transit for ElastiCache for Redis can only be enabled at cluster creation time; it cannot be added to an existing cluster. Therefore, the correct approach is to create a new Redis cluster with encryption in transit enabled, migrate the session data from the existing cluster (e.g., using replication or a manual export/import), and then redirect application traffic to the new cluster. This ensures minimal downtime if the migration is performed during a maintenance window or using a blue/green deployment strategy.

Answer

Update the Redis parameter group to enable the 'encryption-in-transit' parameter and reboot the cluster.

Answer

Use a security group to enforce encrypted connections by allowing only TLS traffic.

Answer

Modify the existing Redis cluster to enable encryption in transit using the AWS CLI.

Answer

Enable encryption in transit on the existing cluster by using the AWS Management Console.

Question 5

A company has a production Amazon RDS for SQL Server database that stores financial data. The database administrator wants to audit all access to sensitive columns (e.g., credit card numbers) using the SQL Server Audit feature. The database is part of a Multi-AZ deployment. The administrator has enabled audit logging to the 'DEFAULT' file audit target, but the audit files are being written to the local instance storage and are not being retained after failover. The compliance team requires that audit logs be stored in Amazon S3 for at least 7 years. The administrator has set up an event subscription to send database events to an S3 bucket using AWS DMS, but the audit logs are not being captured. What should the administrator do to meet the compliance requirements?

Accepted Answer

Create a new SQL Server Audit target using the Amazon S3 option and configure the audit to write to an S3 bucket.. Amazon RDS for SQL Server supports writing SQL Server Audit logs directly to an Amazon S3 bucket as an audit target. This is the only native method that persists audit logs beyond the instance lifecycle, ensuring they survive Multi-AZ failover and meet the 7-year retention requirement. The DEFAULT file target writes to ephemeral instance storage, which is lost on failover, and RDS event subscriptions or DMS cannot capture SQL Server Audit output.

Answer

Use RDS event subscriptions to send database audit logs to an S3 bucket.

Answer

Configure AWS DMS to continuously replicate the audit database to an S3 bucket.

Answer

Enable RDS Enhanced Monitoring and configure it to send logs to CloudWatch Logs.

Question 6

A company attaches the above IAM policy to a user. The user tries to modify the DB instance 'prod-db' in us-east-1. What is the result?

Accepted Answer

The user cannot modify any DB instance.. The IAM policy includes an explicit Deny statement that denies the `rds:ModifyDBInstance` action on all resources (`Resource: "*"`). In AWS IAM, an explicit Deny overrides any Allow. Therefore, the user cannot modify any DB instance, including `prod-db`. Options A and B are incorrect because the user can describe DB instances (unless denied) and the Allow does not override the Deny. Option C is incorrect because the Deny applies to all instances, not just `prod-db`.

Answer

The user cannot describe DB instances.

Answer

The user can modify prod-db because the Allow statement covers it.

Answer

The user cannot modify prod-db.

Question 7

A startup is using Amazon RDS for MySQL as its primary database. The database contains user profiles and payment information. The security team wants to ensure that database snapshots are encrypted and that the encryption key is managed by the company. The team also wants to enforce that all future snapshots are encrypted automatically. The current RDS instance is not encrypted. What should they do?

Accepted Answer

Create a new encrypted RDS instance, migrate the data, and point the application to the new instance.. For an unencrypted RDS instance, you cannot enable encryption directly. You have two valid options: either create a new encrypted instance and migrate the data (Option B), or take a snapshot, copy it with encryption enabled, and restore from that encrypted snapshot (Option D). Both methods result in an encrypted instance. Option D is often simpler and faster. Option A is incorrect because encryption cannot be enabled on an existing instance. Option C is incorrect because RDS encryption is not applied at the EBS volume level; it is managed at the instance level.

Answer

Enable encryption on the existing RDS instance by modifying the DB instance.

Answer

Use AWS KMS to encrypt the underlying EBS volumes of the RDS instance.

Question 8

A company runs an e-commerce platform on Amazon RDS for PostgreSQL. During a flash sale, the database experiences high write load and read replicas lag significantly. The application uses read replicas for reporting queries. Which design change would most effectively reduce replica lag without compromising write performance?

Accepted Answer

Migrate to Amazon Aurora with read replicas.. Amazon Aurora's distributed storage architecture decouples compute from storage, allowing replicas to apply redo logs with minimal overhead compared to RDS for PostgreSQL's physical replication. Aurora's replicas share the same underlying storage volume, so replica lag is significantly reduced even under heavy write loads, while write performance on the primary remains unaffected due to the asynchronous, log-based replication mechanism.

Answer

Increase the instance size of the primary database.

Answer

Add more read replicas to distribute the reporting load.

Answer

Convert the RDS instance to a Multi-AZ deployment.

Question 9

A media company stores video metadata in Amazon DynamoDB. The table has partition key 'video_id' and sort key 'upload_date'. The application frequently queries videos by 'category' and 'status'. The access pattern changes over time. Which design minimizes cost and maximizes query flexibility?

Accepted Answer

Create multiple GSIs with different partition keys to support various query patterns. Creating multiple GSIs with different partition keys allows the application to support various query patterns (e.g., by category, by status, or combined) without incurring the cost of scanning the base table. DynamoDB charges for read/write capacity and storage per GSI, so multiple GSIs are cost-effective only if each serves a distinct access pattern, and this design maximizes query flexibility by enabling efficient key-based lookups for changing workloads.

Answer

Create a single GSI with partition key 'category' and sort key 'status'

Answer

Use DynamoDB Streams to replicate data to Amazon Elasticsearch Service

Answer

Redesign to a single DynamoDB table that aggregates all attributes into the partition key

Question 10

A company is using Amazon DynamoDB with encryption at rest using an AWS managed key. The security team now requires that the encryption key be rotated every 90 days. What should they do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a new table with the customer-managed key, export the data from the old table using AWS Data Pipeline, and import into the new table.. You cannot modify the encryption key of an existing DynamoDB table. To switch to a customer-managed KMS key without downtime, you must create a new table with the desired key, export data from the old table using AWS Data Pipeline, and import into the new table. Option A is incorrect because the UpdateTable API does not support changing the KMS key after table creation. Option B is incorrect because DynamoDB Streams and Lambda are not suitable for full table migration, especially for global tables. Option C is incorrect because replicas inherit the table's encryption key and cannot have a different key.

Answer

Use the UpdateTable API to change the KMS key to the customer-managed key.

Answer

Enable DynamoDB Streams on the old table and use a Lambda function to copy data to a new table with the customer-managed key.

Answer

Create a new replica in the global table with the customer-managed key and then delete the old replica.

Question 11

A company is migrating a large Oracle database to Amazon Aurora PostgreSQL. They need to minimize downtime and validate data consistency after migration. Which THREE steps should they include in their migration plan? (Choose THREE.)

Accepted Answer

Use AWS Database Migration Service (DMS) with ongoing replication to keep the target in sync.. AWS DMS supports ongoing replication (change data capture) from Oracle to Aurora PostgreSQL, allowing the target database to stay synchronized with the source during the migration. This minimizes downtime by enabling a cutover after the initial load, rather than requiring a full outage for the entire migration.

Answer

Create multiple Aurora Replicas for read scaling during migration.

Answer

Perform a homogeneous migration directly from Oracle to Aurora.

Question 12

A database specialist is managing an Amazon RDS for Oracle DB instance. The instance has a large amount of data and the specialist needs to migrate it to a new instance in a different AWS Region. Which method would minimize downtime and be the most efficient?

Accepted Answer

Use AWS Database Migration Service (DMS) with ongoing replication to migrate to the target instance.. AWS DMS with ongoing replication (change data capture) allows you to perform a full load of the existing Oracle database to the target instance in the new region, and then continuously replicate changes from the source until you cut over. This minimizes downtime because you can keep the source database fully operational during the migration and only stop it for a brief period during the final switchover. It is the most efficient method for cross-region migrations because it handles schema conversion, data validation, and ongoing synchronization automatically.

Answer

Export the database to Amazon S3 using Oracle Data Pump, then import into the new instance.

Answer

Create a cross-region read replica and promote it.

Answer

Take a full backup using Oracle RMAN, copy the backup files to the target region, and restore.

Question 13

A company is designing a database solution for a global user base that requires single-digit millisecond read latency for user profile data. The data is eventually consistent and can tolerate a few seconds of staleness. Which TWO AWS services or features should be combined to achieve this latency?

Accepted Answer

Amazon DynamoDB Global Tables.. Amazon DynamoDB Global Tables provides a fully managed, multi-Region, multi-active database that replicates data across AWS Regions with sub-second latency, enabling single-digit millisecond reads for user profile data. Combined with Amazon CloudFront as a CDN, you can cache DynamoDB responses at edge locations, further reducing read latency for a global user base while tolerating eventual consistency and a few seconds of staleness.

Answer

Amazon ElastiCache for Redis with global datastore.

Answer

Amazon RDS for MySQL with cross-Region read replicas.

Answer

Amazon Aurora Global Database.

Question 14

A company is migrating a 2 TB MySQL database from on-premises to Amazon RDS for MySQL. They need to minimize downtime and ensure data consistency. They plan to use AWS DMS. What is the first step they should take before starting the migration task?

Accepted Answer

Enable binary logging (binlog) on the source MySQL database.. AWS DMS requires binary logging (binlog) to be enabled on the source MySQL database to capture ongoing changes during the full-load and change data capture (CDC) phase. This ensures data consistency and minimizes downtime by allowing DMS to replicate incremental changes after the initial load. Without binlog, DMS cannot perform CDC, and the migration would be limited to a one-time snapshot, risking data loss or extended downtime.

Answer

Create a read replica of the source database to reduce load.

Answer

Disable foreign key checks on the source database to speed up the load.

Answer

Enable binary logging on the target RDS for MySQL instance.

Question 15

A team manages an Amazon Aurora MySQL database. They observe that the 'Deadlocks' metric in CloudWatch is spiking. The application uses a single writer instance and multiple read replicas. Which action is most effective at reducing deadlocks?

Accepted Answer

Review application code to ensure transactions are as short as possible and access tables in a consistent order.. Deadlocks in Aurora MySQL occur when two or more transactions hold locks that the other needs, and they wait indefinitely. The most effective way to reduce deadlocks is to keep transactions short and access tables in a consistent order, which minimizes lock contention and avoids circular wait conditions. This directly addresses the root cause of deadlocks, unlike scaling or redirecting traffic, which only reduce the probability of contention without fixing the underlying locking pattern.

Answer

Increase the instance size to handle more concurrent connections.

Answer

Redirect read traffic to read replicas to reduce load on the writer.

Answer

Enable Multi-AZ to distribute the load.