DBS-C01 Practice Test 39 — 15 Questions

Question 1

Which TWO actions will help protect an Amazon RDS for MySQL database from a SQL injection attack? (Select TWO.)

Accepted Answer

Use parameterized queries in the application code.. Using parameterized queries (prepared statements) prevents SQL injection. Also, restricting database user permissions to only necessary operations limits damage. Enabling encryption at rest does not prevent injection. Using a VPC does not prevent injection. Enabling auto minor version upgrade does not prevent injection.

Answer

Enable encryption at rest for the RDS instance.

Answer

Place the RDS instance in a private VPC subnet.

Answer

Enable auto minor version upgrade on the RDS instance.

Question 2

A company is using Amazon Redshift for data warehousing. The security team requires column-level access control so that certain users cannot view specific columns containing PII. Which approach should the data engineer implement?

Accepted Answer

Create views that exclude the sensitive columns and grant SELECT on the views to the users.. The correct approach is to create views that exclude sensitive columns and grant SELECT on those views to the users (Option A). Amazon Redshift supports column-level security via views; you grant access to the view rather than the underlying table. Option B is incorrect because row-level security policies (e.g., in PostgreSQL) are not available in Redshift. Option C is incorrect because although Redshift does support column-level GRANT (e.g., GRANT SELECT ON table (col1) TO user), creating views is the more standard and manageable approach for column-level access control. Option D is incorrect because column-level encryption with AWS KMS does not provide fine-grained access control; it only protects data at rest and requires application changes for decryption.

Answer

Implement row-level security policies using CREATE ROW LEVEL SECURITY POLICY.

Answer

Use GRANT SELECT ON table (col1, col2) TO user.

Answer

Encrypt the sensitive columns using AWS KMS and decrypt in the application.

Question 3

A developer needs to monitor the number of throttled read requests for a DynamoDB table. Which CloudWatch metric should be used?

Accepted Answer

ReadThrottleEvents. The CloudWatch metric ReadThrottleEvents specifically counts the number of read requests that were throttled because they exceeded the provisioned read capacity or the maximum throughput for the table or index. It is the direct metric to monitor for throttled read requests. By tracking this metric, developers can identify when read capacity is insufficient and take action, such as increasing provisioned capacity or switching to on-demand mode.

Answer

ThrottledWriteEvents

Answer

SuccessfulRequestLatency

Answer

ConsumedReadCapacityUnits

Question 4

Which TWO CloudWatch Logs features can be used to monitor and troubleshoot Amazon RDS for SQL Server error logs? (Choose TWO.)

Accepted Answer

Setting metric filters to count error occurrences. The correct answers are B and E. CloudWatch Logs allows real-time monitoring of log streams (E) and setting metric filters to count specific error occurrences (B). Option A (AWS X-Ray) is for distributed tracing, not log monitoring. Option C (exporting to S3) is for archival, not real-time monitoring. Option D (CloudTrail) captures API activity, not database error logs.

Answer

Integrating with AWS X-Ray for trace analysis

Answer

Exporting logs to Amazon S3

Answer

Using AWS CloudTrail to capture log events

Question 5

A database administrator notices that an Amazon RDS for Oracle DB instance's CPU utilization is consistently above 90% during peak hours. The application is read-heavy. Which action can reduce CPU load?

Accepted Answer

Create a read replica and direct read traffic to it. For a read-heavy workload on RDS for Oracle, offloading read traffic to a read replica is the most direct way to reduce CPU load on the primary instance. Read replicas receive asynchronous replication from the primary and serve read-only queries, freeing the primary's CPU for writes and other operations. This is a standard horizontal scaling pattern for read-heavy RDS workloads.

Answer

Disable Multi-AZ to free up resources

Answer

Increase the allocated storage

Answer

Enable Performance Insights to optimize queries

Question 6

A company is migrating an on-premises Oracle database to Amazon Aurora PostgreSQL. The database has several stored procedures that use Oracle-specific PL/SQL. The team needs to minimize manual code changes. Which AWS service or tool should be used to automate the conversion of the stored procedures?

Accepted Answer

AWS Schema Conversion Tool (AWS SCT). AWS Schema Conversion Tool (AWS SCT) is designed to automate the conversion of database schemas and stored procedures from one database engine to another, including Oracle PL/SQL to PostgreSQL PL/pgSQL. It analyzes the source code, identifies incompatibilities, and generates equivalent code for the target engine, significantly reducing manual effort.

Answer

Amazon Aurora PostgreSQL native compatibility

Answer

AWS Database Migration Service (AWS DMS)

Answer

Manual rewrite using PostgreSQL PL/pgSQL

Question 7

Which TWO methods can be used to encrypt an existing unencrypted Amazon RDS for Oracle DB instance? (Choose 2.)

Accepted Answer

Create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the DB instance from the encrypted snapshot.. You can encrypt an existing unencrypted RDS for Oracle DB instance by taking a snapshot, copying it with encryption enabled, and then restoring the instance from the encrypted snapshot. This process creates a new encrypted DB instance from the snapshot copy, effectively encrypting the data at rest using AWS KMS. Option D is correct because AWS DMS can migrate data from an unencrypted source DB instance to a new target DB instance that has encryption enabled, allowing you to move the data while applying encryption during the migration process.

Answer

Use the AWS Management Console to toggle encryption on the DB instance.

Answer

Modify the DB instance and enable encryption in the configuration.

Answer

Create a read replica with encryption enabled.

Question 8

A company is migrating a large on-premises Oracle database to Amazon Aurora PostgreSQL using AWS Schema Conversion Tool (AWS SCT) and AWS Database Migration Service (AWS DMS). During the migration, they encounter issues with stored procedures and functions. The company needs to ensure that the converted code is functionally equivalent and performs well. Which action should they take to validate and optimize the converted code?

Accepted Answer

Use AWS SCT to convert the code, then use the AWS SCT assessment report and action items to manually refactor problematic objects. AWS SCT converts procedural code and provides an assessment report that identifies objects needing manual intervention. By using the report and action items, you can refactor problematic code to ensure functional equivalence and performance. This is the standard approach for migrating stored procedures and functions. Other options either do not address validation or are not supported.

Answer

Manually rewrite all stored procedures and functions from scratch in PL/pgSQL to ensure optimal performance

Answer

Use AWS DMS to replicate the stored procedures and functions directly, as DMS supports procedural code replication

Answer

Use AWS SCT to automatically convert the code and then run the application against Aurora PostgreSQL to identify issues

Question 9

A developer deploys the CloudFormation stack. After testing, they delete the stack. What happens to the RDS instance?

Accepted Answer

The RDS instance is deleted without a final snapshot.. By default, when a CloudFormation stack containing an RDS DB instance is deleted, the instance is deleted without a final snapshot. CloudFormation's default DeletionPolicy is Delete; a final snapshot is only taken if DeletionPolicy is explicitly set to Snapshot. The stem does not mention any custom DeletionPolicy, so the default behavior applies. Option C correctly describes this outcome.

Answer

The RDS instance is retained and the stack deletion fails.

Answer

The RDS instance is deleted after a final snapshot is taken.

Answer

The RDS instance is retained and a final snapshot is taken automatically.

Question 10

A company is experiencing slow query performance on an Amazon RDS for PostgreSQL DB instance. The DB instance is a db.r5.large with 16 GB RAM and 500 GB gp2 storage. Which metric in Amazon CloudWatch would most directly help identify if the performance issue is due to memory pressure?

Accepted Answer

Monitor FreeableMemory to see if available memory is low.. FreeableMemory shows the amount of available RAM. Low FreeableMemory indicates memory pressure, which can cause swapping and slow queries. Option B is wrong because ReadIOPS measures I/O operations, not memory. Option C is wrong because DatabaseConnections tracks connections, not memory. Option D is wrong because CPUUtilization measures CPU, not memory.

Answer

Monitor ReadIOPS to see if there is a high I/O rate due to swapping.

Answer

Monitor DatabaseConnections to check for a high number of connections consuming memory.

Answer

Monitor CPUUtilization to check for high CPU usage.

Question 11

A financial services company uses Amazon Aurora MySQL-Compatible Edition for transaction processing. They need to run complex analytical queries on the same data without impacting transactional performance. Which solution meets these requirements?

Accepted Answer

Use Aurora Zero-ETL integration with Amazon Redshift. Aurora Zero-ETL integration with Amazon Redshift allows you to run complex analytical queries on transactional data without impacting Aurora's performance. It eliminates the need for extract, transform, and load (ETL) pipelines by automatically replicating data from Aurora to Redshift in near real-time, ensuring that analytical workloads are offloaded to a separate, optimized analytics engine.

Answer

Enable Performance Insights and use RDS Proxy

Answer

Export data to Amazon S3 and query with Athena

Answer

Create an Aurora Replica and run analytical queries against it

Question 12

A company is troubleshooting an Amazon RDS for MySQL DB instance that is experiencing high CPU utilization. The DB instance is a db.t3.medium. Which TWO actions should the database administrator take to investigate the cause?

Accepted Answer

Enable Performance Insights to identify the top SQL queries consuming CPU.. Option A is correct because Performance Insights provides a database load view that breaks down CPU consumption by SQL statement, wait event, and user, letting the DBA pinpoint the exact top SQL queries driving high CPU on the db.t3.medium instance. Option E is correct because the MySQL slow query log records statements whose execution time exceeds long_query_time, so reviewing it (after setting slow_query_log=1 and an appropriate long_query_time) reveals long-running queries that are likely culprits. Option B is not appropriate because Multi-AZ is a high-availability feature and disabling it does not reduce CPU load on the primary; it only removes the standby. Option C is wrong because the MySQL query cache is deprecated in MySQL 5.7 and removed in 8.0, and increasing it would not diagnose the cause. Option D is wrong because resizing the instance class is a remediation action, not an investigation step, and it does not identify the root cause.

Answer

Disable Multi-AZ to reduce overhead.

Answer

Modify the DB parameter group to increase the query cache size.

Answer

Increase the DB instance class to a larger size.

Question 13

A healthcare application stores patient records in Amazon DynamoDB. Each record has a unique patient ID and contains sensitive health information. The application must encrypt data at rest and ensure that only authorized services can access the data. Which combination of design choices meets these requirements?

Accepted Answer

Enable DynamoDB encryption at rest using AWS KMS and use IAM policies to restrict access.. DynamoDB encryption at rest using AWS KMS provides server-side encryption for sensitive patient data, while IAM policies allow fine-grained access control to ensure only authorized services can access the table. This combination directly meets both the encryption and access control requirements without unnecessary complexity or service mismatches.

Answer

Implement client-side encryption and use Lambda to validate access.

Answer

Enable S3 server-side encryption with AWS KMS and use bucket policies.

Answer

Use AWS CloudHSM for key storage and VPC endpoints for access control.

Question 14

Which TWO actions are recommended when deploying an Amazon RDS for MySQL instance in a production environment to ensure high availability and durability? (Choose two.)

Accepted Answer

Enable automated backups with a retention period of at least 7 days. Automated backups with a retention period of at least 7 days enable point-in-time recovery (PITR) within that window, which is critical for restoring a database to a specific second in the event of a failure or data corruption. This ensures durability by allowing you to recover from logical errors or accidental deletions, not just hardware failures. Option E is correct because Multi-AZ deployment automatically provisions and maintains a synchronous standby replica in a different Availability Zone, providing automatic failover for high availability without manual intervention.

Answer

Enable Enhanced Monitoring

Answer

Enable Performance Insights

Answer

Enable deletion protection

Question 15

A company is using Amazon RDS for MySQL and needs to comply with PCI DSS requirements. Which TWO actions should the company take to secure the database? (Choose TWO.)

Accepted Answer

Enable encryption at rest using AWS KMS.. Options A and C are correct. Enabling encryption at rest using AWS KMS protects data on disk, which is a PCI DSS requirement. Enabling audit logging helps track database activities for compliance. Options B and D are incorrect: writing audit logs directly to an S3 bucket is not supported; RDS audit logs are sent to CloudWatch Logs. Enabling public accessibility would violate security requirements. Option E is incorrect because changing the default port is not a PCI DSS requirement and may complicate management without adding meaningful security.

Answer

Configure the database to write audit logs directly to an S3 bucket.

Answer

Enable public accessibility on the RDS instance to allow access from anywhere.

Answer

Change the default database port to a non-standard port.