DBS-C01 Practice Test 4 — 10 Questions

Question 1

A company is deploying a new Amazon RDS for SQL Server database. They need to ensure that the database is encrypted at rest using a customer-managed AWS KMS key. Which action should be taken?

Accepted Answer

Enable encryption at rest when creating the RDS instance and select the customer-managed KMS key.. Encryption at rest for RDS must be enabled at instance creation, and you can select a customer-managed KMS key at that time. Once enabled, the key cannot be changed. The other options are either impossible or do not meet the requirement of using a customer-managed KMS key.

Answer

Enable encryption at rest using the default AWS managed key for RDS, then change the key to a customer-managed key after creation.

Answer

Create the RDS instance without encryption, then modify the instance to enable encryption using the AWS Management Console.

Answer

Use Transparent Data Encryption (TDE) at the database level with a customer-managed key stored in AWS KMS.

Question 2

A company uses Amazon DynamoDB with global tables. They notice that changes made in one region are not appearing in another region after several minutes. Which CloudWatch metric should be monitored to check the replication lag?

Accepted Answer

ReplicationLatency. ReplicationLatency measures the time between the last update on the source table and the last update on the replica table. Option A (ConsumedWriteCapacityUnits) is wrong because it measures write capacity usage, not replication lag. Option B (SuccessfulRequestLatency) is wrong because it measures request latency, not replication lag. Option D (ThrottledRequests) is wrong because it indicates throttling, not replication lag.

Answer

ConsumedWriteCapacityUnits

Answer

SuccessfulRequestLatency

Answer

ThrottledRequests

Question 3

A company is designing a relational database for an e-commerce application that requires high availability and automated failover across AWS Regions. Which AWS database service should they use?

Accepted Answer

Amazon Aurora Global Database. Amazon Aurora Global Database is the correct choice because it is designed for cross-Region disaster recovery and high availability, replicating data with a typical latency of under one second across multiple AWS Regions. It supports automated failover from the primary Region to one of the secondary Regions, meeting the requirement for automated cross-Region failover without manual intervention.

Answer

Amazon DynamoDB Global Tables

Answer

Amazon RDS with Multi-AZ deployment

Answer

Amazon Redshift with cross-Region snapshot copy

Question 4

A financial services company is using Amazon DynamoDB to store customer transaction data. The compliance team requires that all data be encrypted at rest using a customer-managed AWS KMS key, and that access to the key be auditable via AWS CloudTrail. Additionally, the security team wants to ensure that DynamoDB can only be accessed from within the VPC using a VPC endpoint. Which combination of steps should the company take to meet these requirements?

Accepted Answer

Enable server-side encryption with a customer-managed KMS key and create an interface VPC endpoint for DynamoDB.. Option C. To meet the encryption requirement, the company must use a customer-managed KMS key, not an AWS managed key. For VPC-only access, DynamoDB supports interface VPC endpoints (via AWS PrivateLink), which provide private connectivity. Option C correctly uses a customer-managed KMS key and an interface VPC endpoint. Option D is incorrect because it uses an AWS managed KMS key. Option A is incorrect because CloudHSM is unnecessary and VPC peering is not the correct method. Option B is incorrect because a NAT gateway still routes traffic over the internet.

Answer

Use a CloudHSM key for encryption and create a VPC peering connection to DynamoDB.

Answer

Enable server-side encryption with a customer-managed KMS key and route all traffic through a NAT gateway.

Answer

Use AWS managed KMS key and a gateway VPC endpoint for DynamoDB.

Question 5

A database administrator needs to audit all SQL statements executed on an Amazon RDS for PostgreSQL DB instance. Which service should be used to capture and log the SQL statements?

Accepted Answer

Amazon RDS for PostgreSQL database activity streams. Amazon RDS for PostgreSQL supports database activity streams, which can be integrated with services like Amazon CloudWatch and AWS CloudTrail to provide a near real-time stream of database activities. The other options do not capture SQL statements: CloudTrail records API calls to RDS, Config records resource configuration changes, and Inspector is for vulnerability assessment.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

Amazon Inspector

Question 6

A company is deploying a new application that requires a MySQL-compatible database with automatic scaling of compute and storage resources. Which AWS service should be used?

Accepted Answer

Amazon Aurora MySQL. Amazon Aurora MySQL is the correct choice because it is a MySQL-compatible relational database that automatically scales compute (up to 128 vCPUs and 244 GiB of memory) and storage (up to 128 TiB in 10 GiB increments) without downtime. Aurora's storage subsystem is distributed and self-healing, scaling as data grows, and its compute can be scaled via Auto Scaling policies or by modifying the instance class with minimal disruption.

Answer

Amazon RDS for MySQL

Answer

Amazon DynamoDB

Answer

Amazon Redshift

Question 7

A company wants to restrict access to an Amazon RDS for MySQL DB instance so that only applications running in a specific VPC can connect. Which solution should be implemented?

Accepted Answer

Configure the DB instance's security group to allow inbound traffic only from the application's security group.. RDS security groups control inbound traffic at the instance/ENI level, and referencing the application's security group as the source is the canonical way to allow only that application tier to connect. This creates a dynamic, identity-based rule that follows the application instances regardless of their IP addresses. It is the standard AWS pattern for tiered VPC architectures and satisfies the requirement to restrict access to a specific VPC's applications.

Answer

Use an IAM policy to restrict database connections based on source IP.

Answer

Configure the subnet's network ACL to allow inbound traffic only from the application's IP range.

Answer

Attach a security group to the subnet that allows inbound traffic from the application's VPC.

Question 8

A team is migrating an on-premises Oracle database to Amazon Aurora PostgreSQL. The database is 2 TB and has a 6-hour maintenance window. Which AWS service should the team use to minimize downtime?

Accepted Answer

AWS Database Migration Service (AWS DMS). AWS DMS is the correct choice because it can perform a live migration from Oracle to Aurora PostgreSQL with minimal downtime using ongoing replication (change data capture). It supports heterogeneous migrations, automatically converting the source schema and data types, and can handle a 2 TB database within the 6-hour maintenance window by using multiple parallel tasks and large instance types.

Answer

Amazon S3 Transfer Acceleration

Answer

AWS Snowball Edge

Answer

Amazon EC2 with Oracle installed

Question 9

A database specialist is troubleshooting an Amazon RDS for MySQL DB instance that is running out of storage. The instance has automated backups enabled. The specialist needs to free up storage space immediately without losing backup capability. Which action should the specialist take?

Accepted Answer

Delete older automated backups that are no longer needed.. None of the provided options will free up DB instance storage. Automated backups are stored in Amazon S3, not in the instance's allocated storage. To free up instance storage, you would need to increase the allocated storage or delete actual data from the database. Reducing backup retention deletes backups from S3, not instance storage. Manual snapshots are also in S3. Disabling backups stops future backups but does not free existing storage.

Answer

Modify the DB instance to reduce the backup retention period to 0 days.

Answer

Delete manual snapshots from the RDS console.

Answer

Disable automated backups to stop storage consumption.

Question 10

A company runs a production Amazon DynamoDB table with on-demand capacity. The table stores session data for a web application. Recently, users have reported occasional slow response times. The operations team notices that the table's ConsumedWriteCapacityUnits metric shows occasional spikes that exceed the provisioned throughput (though on-demand auto-scales), and ThrottledWriteEvents metrics show occasional throttling. The application uses the AWS SDK with default retry logic. The database specialist is asked to investigate. Upon reviewing the table configuration, the specialist finds that the table has a simple primary key (partition key only) and the data access pattern is heavily skewed toward a small number of partition keys. The application writes in batches of 25 items using the BatchWriteItem API. What should the specialist recommend to reduce throttling and improve performance?

Accepted Answer

Implement write sharding by adding a random suffix to the partition key to distribute writes more evenly.. The throttling is caused by a hot partition: the table uses a single partition key, and writes are heavily skewed toward a few keys. By adding a random suffix to the partition key (write sharding), the writes are distributed evenly across all partitions, eliminating hot spots and reducing throttling. The on-demand capacity mode already handles overall throughput, but it cannot prevent throttling on individual partitions when access is skewed.

Answer

Increase the provisioned read capacity units to handle the load.

Answer

Switch the table to provisioned capacity mode and increase write capacity.

Answer

Enable DynamoDB Accelerator (DAX) to cache write operations.