DBS-C01 Practice Test 41 — 15 Questions

Question 1

Which TWO of the following are methods to encrypt data at rest for an Amazon RDS for Oracle DB instance? (Select TWO.)

Accepted Answer

Enable encryption at rest using AWS KMS when creating the DB instance.. Options A and B are correct. Amazon RDS for Oracle supports encryption at rest via two methods: enabling encryption using AWS KMS when creating the DB instance (Option A) or using Oracle Transparent Data Encryption (TDE) with a customer-managed Oracle wallet (Option B). Option C (SSL/TLS) encrypts data in transit, not at rest. Option D (S3 SSE) is irrelevant as S3 is not used for RDS storage. Option E (client-side encryption) is an application-level approach and not a native RDS encryption method.

Answer

Enable SSL/TLS for the DB instance.

Answer

Configure Amazon S3 server-side encryption on the DB instance's storage.

Answer

Use client-side encryption in the application before sending data to RDS.

Question 2

A company is deploying a new application on Amazon RDS for PostgreSQL. The security policy requires that all data be encrypted at rest and in transit. Which TWO actions should the company take to meet these requirements?

Accepted Answer

Enable encryption at rest by specifying a KMS key when creating the DB instance.. To encrypt data at rest, you must enable encryption when creating the DB instance by specifying a KMS key (Option C). RDS automatically encrypts automated backups for encrypted instances, so Option B is unnecessary. To encrypt data in transit, you must enforce SSL/TLS connections by setting the parameter rds.force_ssl to 1 in the DB parameter group (Option E). Option A is incorrect because client-side encryption is not required when using RDS encryption and SSL; the requirement is to use RDS features. Option D is incorrect because creating an encrypted read replica does not encrypt the original master instance; you need to enable encryption on the master from the start.

Answer

Use a client-side encryption library to encrypt data before sending to the database.

Answer

Enable encryption for automated backups separately.

Answer

Create an encrypted read replica and promote it to master.

Question 3

A company is using Amazon DynamoDB for a gaming application. The application stores player scores in a table with a partition key of player_id and a sort key of timestamp. The company wants to query the top 10 scores for a given player efficiently. Which TWO steps should the company take to optimize this query?

Accepted Answer

Use the Query API with the LSI and scan index forward set to false to get the top scores.. The correct answers are A and B. A local secondary index (LSI) on the score attribute (option B) allows efficient sorting of items within the same partition key (player_id) by score. Using the Query API on this LSI with scanIndexForward set to false (option A) retrieves the top scores in descending order. Option C (Scan with filter) is inefficient as it reads the entire table. Option D (LSI on timestamp) is redundant because the base table already has timestamp as sort key and does not sort by score. Option E (GSI on score) would not be efficient for per-player queries because you would need to query by score globally, not per player.

Answer

Use a Scan operation with a filter expression to retrieve the top scores.

Answer

Create a local secondary index on the timestamp attribute.

Answer

Create a global secondary index (GSI) on the score attribute.

Question 4

Which TWO metrics should be monitored to detect an Amazon RDS for MySQL instance that is experiencing memory pressure? (Choose 2.)

Accepted Answer

SwapUsage. SwapUsage (A) is correct because when an RDS for MySQL instance runs low on physical RAM, the OS begins paging memory to disk, so a rising or non-zero SwapUsage value is a direct indicator of memory pressure. FreeableMemory (D) is correct because it reports the amount of available RAM (in bytes) on the instance; a steadily declining or very low FreeableMemory value signals that the instance is exhausting memory and under pressure. DatabaseConnections (B) only reflects the number of client connections and does not by itself indicate memory exhaustion. ReadIOPS (C) measures read operations per second on storage and points to I/O load rather than memory pressure. CPUUtilization (E) tracks processor usage, which can be high for many reasons unrelated to memory, so it is not a reliable memory-pressure metric.

Answer

DatabaseConnections

Answer

ReadIOPS

Answer

CPUUtilization

Question 5

A company is migrating an on-premises MySQL database to Amazon Aurora MySQL. The database is 2 TB and the migration must have minimal downtime. The network bandwidth between the on-premises data center and AWS is 1 Gbps. Which migration approach is most appropriate?

Accepted Answer

Use AWS Database Migration Service (DMS) with ongoing replication to keep the target in sync. AWS DMS with ongoing replication is the most appropriate approach because it allows a full load of the 2 TB database followed by continuous change data capture (CDC) to keep the target Aurora MySQL cluster in sync with minimal downtime. At 1 Gbps, the initial load would take approximately 5–6 hours, but the CDC phase reduces the final cutover downtime to seconds or minutes, meeting the minimal downtime requirement.

Answer

Use mysqldump to export the data, upload to Amazon S3, and import into Aurora

Answer

Take a snapshot of the on-premises database and restore it to Aurora

Answer

Use AWS Snowball Edge to transfer the data physically to AWS

Question 6

A company is designing a multi-tenant SaaS application on Amazon Aurora MySQL. Each tenant has its own database, but some tenants are very large and generate high write traffic. The company wants to isolate tenant workloads to prevent a noisy neighbor from affecting other tenants. Which TWO design strategies should the database specialist recommend?

Accepted Answer

Use Aurora Serverless for tenants with variable workloads. Aurora Serverless automatically scales compute capacity based on application demand, which is ideal for tenants with variable workloads. This prevents a noisy neighbor scenario by ensuring that a tenant's burst of write traffic does not consume shared resources that would degrade performance for other tenants.

Answer

Use a single Aurora cluster with read replicas for each tenant

Answer

Migrate all tenants to Amazon DynamoDB and use DynamoDB Accelerator (DAX) for caching

Answer

Use Amazon RDS Proxy to pool connections and limit throughput per tenant

Question 7

A company is migrating an on-premises MongoDB workload to Amazon DocumentDB. The current workload uses secondary indexes heavily for reporting queries. Which design consideration should the company evaluate to ensure optimal performance on DocumentDB?

Accepted Answer

Enable Multi-AZ deployment to improve read performance.. Amazon DocumentDB supports secondary indexes, but unlike MongoDB it does not support covered queries (index-only scans). Every index lookup still requires fetching the underlying document. For a reporting workload that relies heavily on secondary indexes, the company should evaluate adding read replicas across Availability Zones (Multi-AZ) to scale read throughput and offload reporting queries from the primary. This improves read performance without relying on unsupported MongoDB-style covered queries.

Answer

Shard the collection across multiple DocumentDB clusters.

Answer

Use the MongoDB aggregation pipeline to bypass indexing.

Answer

Evaluate using covered queries instead of secondary indexes.

Question 8

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database has a large table with a BLOB column storing PDF files. Which migration approach minimizes downtime?

Accepted Answer

Use AWS Database Migration Service (DMS) with ongoing replication.. AWS DMS with ongoing replication (change data capture) allows you to perform an initial full load of the database while continuously capturing and applying changes from the source Oracle database to the target RDS for Oracle instance. This minimizes downtime because you can cut over to the new database after the initial load and replication lag is near zero, rather than taking the source offline for the entire migration.

Answer

Use Oracle Data Pump to export the table and import into RDS.

Answer

Use Oracle RMAN to back up the database and restore to RDS.

Answer

Export the table without the BLOB column, then import the BLOBs separately.

Question 9

A company wants to ensure that their Amazon RDS for PostgreSQL database is automatically backed up every day and retains backups for 30 days. Which configuration should they use?

Accepted Answer

Enable automated backups with a retention period of 30 days.. To automatically back up an Amazon RDS for PostgreSQL database daily and retain backups for 30 days, you should enable automated backups with a retention period of 30 days. RDS automated backups allow you to set a retention period from 0 to 35 days. Setting it to 30 days meets the requirement. Manual snapshots or AWS Backup are not automated daily backups by default, and Multi-AZ is for high availability, not backups.

Answer

Set the backup retention period to 0 to disable automated backups and use manual snapshots.

Answer

Create a manual snapshot daily using AWS Backup.

Answer

Enable Multi-AZ deployment for automatic failover.

Question 10

A company is running an Amazon RDS for MySQL DB instance in a VPC. The security team requires that all connections to the database use SSL/TLS. Which combination of steps should be taken to enforce this? (Choose two.)

Accepted Answer

Require database users to connect using the --ssl-ca parameter with the RDS certificate.. Option D is correct because setting the 'rds.force_ssl' parameter to 1 in the DB parameter group makes the RDS for MySQL instance reject any non-SSL connections, which directly enforces SSL/TLS for all clients. Option C is correct because clients must supply the RDS certificate authority using the --ssl-ca parameter (along with --ssl-mode=REQUIRED or equivalent) so the MySQL client can establish a verified TLS connection to the instance. Option A is not correct because placing the DB in a private subnet only restricts network reachability; it does not enforce SSL/TLS on port 3306. Option B is not correct because security groups cannot inspect whether a connection is encrypted, so they cannot deny traffic based on SSL usage. Option E is not correct because SSL/TLS enforcement for RDS for MySQL is controlled through the parameter group (rds.force_ssl), not through an option group SSL option.

Answer

Create a new DB subnet group that isolates the DB instance in a private subnet without internet access.

Answer

Update the security group for the DB instance to deny inbound traffic on port 3306 from sources that do not have SSL.

Answer

Modify the DB option group associated with the DB instance, enabling the SSL option.

Question 11

A company is using Amazon RDS for MySQL and wants to restrict access to the database based on the source IP address. Which AWS feature should be used to achieve this?

Accepted Answer

VPC Security Groups. VPC Security Groups can be used to restrict access to an Amazon RDS for MySQL database based on the source IP address. Security groups act as virtual firewalls that control inbound and outbound traffic at the instance level. You can create rules that allow traffic only from specific IP addresses or CIDR ranges to the database port.

Answer

DB Parameter Groups

Answer

IAM Database Authentication

Answer

Network ACLs

Question 12

A company runs an Amazon Aurora MySQL DB cluster with one writer and two readers. The application experiences increased read latency. The DBA wants to offload read traffic from the writer instance. Which configuration change should be made to the application?

Accepted Answer

Modify the application to use the reader endpoint for read queries.. The reader endpoint for an Aurora MySQL cluster automatically load-balances read-only connections across all available reader instances. By modifying the application to use the reader endpoint for read queries, read traffic is offloaded from the writer instance, reducing read latency on the writer. This is the standard AWS-recommended pattern for separating read and write workloads in Aurora.

Answer

Modify the application to use an individual instance endpoint for each reader.

Answer

Create a custom endpoint that includes both writer and readers.

Answer

Modify the application to use the cluster endpoint for all queries.

Question 13

A company is using Amazon RDS for PostgreSQL for its transactional database. The application generates reports that query millions of rows, causing high CPU on the primary instance. The reports are not time-sensitive. What is the MOST cost-effective way to offload the reporting queries without affecting write performance?

Accepted Answer

Create an Amazon RDS Read Replica and direct reporting queries to the replica.. Creating an Amazon RDS Read Replica offloads reporting queries to a separate read-only instance, preventing CPU contention on the primary. Since the reports are not time-sensitive, the replica can handle the large queries without impacting write performance, and it is cost-effective because you only pay for the replica's compute and storage.

Answer

Use Amazon ElastiCache to cache report results.

Answer

Enable Multi-AZ to distribute reads to the standby instance.

Answer

Migrate reporting to Amazon Redshift.

Question 14

A company is migrating an on-premises MySQL database to Amazon RDS for MySQL. Which TWO AWS services can assist in assessing the source database for compatibility issues?

Accepted Answer

AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) is correct because it provides a premigration assessment capability that analyzes the source database for issues that could affect migration, including schema and object compatibility concerns, helping identify required actions before migration. AWS Schema Conversion Tool (SCT) is correct because it is specifically designed to assess source database schemas, convert them to a target engine, and produce an assessment report highlighting incompatibilities and required manual actions. AWS Trusted Advisor is not correct because it provides best-practice checks on cost, security, fault tolerance, and service limits, not database schema compatibility analysis. Amazon CloudWatch is not correct because it monitors metrics, logs, and alarms for running resources rather than assessing database compatibility. Amazon Inspector is not correct because it is a vulnerability management service that scans EC2 instances and container images for software vulnerabilities and unintended network exposure, not database migration compatibility.

Answer

AWS Trusted Advisor

Answer

Amazon CloudWatch

Answer

Amazon Inspector

Question 15

A company is migrating a 2 TB MySQL database to Amazon Aurora MySQL. They need to minimize downtime and ensure data consistency. Which TWO actions should they take? (Choose two.)

Accepted Answer

Create an Amazon Aurora MySQL read replica from an Amazon RDS MySQL DB instance.. Option C is correct because you can create an Amazon Aurora MySQL read replica from an RDS MySQL DB instance, using native MySQL replication to continuously replicate data and allow a controlled, low-downtime cutover. Option D is correct because AWS DMS with change data capture (CDC) is a fully supported method for homogeneous MySQL-to-Aurora MySQL migration that continuously replicates ongoing changes and enables a low-downtime cutover. Option E is not a separate action: enabling binary logging and setting up replication is part of creating/operating an Aurora read replica, and as a standalone answer it overlaps with C. Option A is incorrect because mysqldump on a 2 TB database would cause significant downtime and no continuous replication. Option B is incorrect because AWS SCT is used for heterogeneous schema conversion, not MySQL-to-Aurora MySQL.

Answer

Export data using mysqldump and import into Aurora during a maintenance window.

Answer

Use AWS Schema Conversion Tool (SCT) to convert the schema to Aurora MySQL.

Answer

Enable binary logging (binlog) on the source RDS MySQL instance and set up replication to Aurora.