DBS-C01 Practice Test 43 — 15 Questions

Question 1

A company is migrating an on-premises MySQL database to Amazon RDS. The database is used for a critical e-commerce application that requires high availability with automatic failover. Which RDS deployment option should the company choose to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Multi-AZ deployment with a standby in a different AZ. A Multi-AZ deployment for Amazon RDS MySQL automatically provisions and maintains a synchronous standby replica in a different Availability Zone (AZ). In the event of an AZ failure or primary instance failure, Amazon RDS automatically fails over to the standby, providing high availability with minimal downtime. This meets the requirement for automatic failover without manual intervention.

Answer

Multi-Region deployment with Read Replicas

Answer

Single-AZ instance with a standby in the same AZ

Answer

Single-AZ instance with a Read Replica

Question 2

A developer retrieved a database secret using the AWS CLI as shown. What is the MOST secure way to store and rotate this secret?

Accepted Answer

Store the secret in AWS Secrets Manager and enable automatic rotation with a Lambda function.. AWS Secrets Manager is purpose-built for storing and rotating secrets, with native support for automatic rotation via a Lambda function on a schedule. This satisfies both the secure storage and rotation requirements with minimal operational effort. It also integrates with RDS, Redshift, and DocumentDB for managed rotation templates.

Answer

Store the secret in AWS Systems Manager Parameter Store as a SecureString.

Answer

Store the secret in a configuration file on the EC2 instance.

Answer

Use the secret as-is and change it manually every 90 days.

Question 3

An Amazon RDS for MySQL DB instance has a high number of connections and the application is experiencing slow response times. The database administrator wants to identify the queries that are causing the most load. Which approach is most effective?

Accepted Answer

Enable Amazon RDS Performance Insights and review the top SQL queries. Amazon RDS Performance Insights provides a dashboard that visualizes database load and identifies top SQL queries by wait events, which is exactly what the DBA needs. It shows which queries contribute most to load, making it the most effective tool for this scenario. Slow query logs are useful but require manual analysis and do not directly rank queries by load.

Answer

Enable slow query logs and analyze them in CloudWatch Logs

Answer

Monitor the DatabaseConnections metric in CloudWatch

Answer

Check RDS events for any error messages

Question 4

A developer needs to deploy an Amazon RDS for MySQL DB instance that is accessible only from a specific EC2 instance in a VPC. Which configuration ensures this?

Accepted Answer

Place the RDS instance in the same VPC as the EC2 instance and configure a security group inbound rule referencing the EC2 security group. Placing the RDS instance in the same VPC as the EC2 instance and configuring a security group inbound rule that references the EC2 instance's security group allows traffic only from that specific EC2 instance. Security group rules are stateful and support referencing other security groups as sources, which provides a precise and secure method for controlling database access without exposing the RDS instance to the broader network.

Answer

Use an IAM role to allow the EC2 instance to connect to the RDS instance

Answer

Enable public accessibility and assign a public IP to the RDS instance

Answer

Place RDS and EC2 in different subnets and configure a network ACL

Question 5

A company has an Amazon RDS for SQL Server DB instance that stores financial data. The security team requires that all database activity be monitored in real-time for suspicious queries. Which AWS service should be used to meet this requirement?

Accepted Answer

Amazon GuardDuty with RDS Protection. Amazon GuardDuty with RDS Protection provides real-time monitoring of database activity on Amazon RDS instances, analyzing SQL queries and detecting suspicious behavior such as SQL injection or unusual access patterns. Option A (AWS CloudTrail) is incorrect because it records API calls made to the AWS environment, not the database queries themselves. Option B (AWS Security Hub) is incorrect as it aggregates security findings from multiple AWS services but does not perform real-time database activity monitoring. Option D (Amazon Inspector) is incorrect because it is a vulnerability assessment service that scans for software vulnerabilities and unintended network exposure, not for database query threats.

Answer

AWS CloudTrail

Answer

AWS Security Hub

Answer

Amazon Inspector

Question 6

A company runs an Amazon Aurora MySQL database. The database experiences a sudden spike in connections and then becomes unresponsive. The DB instance has a db.r5.large class with 8 GB memory. The maximum connections parameter is set to the default. Which is the most likely cause of the unresponsiveness?

Accepted Answer

The number of connections exceeded the max_connections limit. The default max_connections for Aurora MySQL is based on memory, and with 8 GB, it is about 800. A spike exceeding that can exhaust resources. Option A is wrong because storage auto-scaling is seamless. Option B is wrong because burst balance applies to gp2 volumes, but Aurora uses cluster storage. Option D is wrong because replica lag would affect reads, not make the instance unresponsive.

Answer

The DB instance's EBS burst balance dropped to zero

Answer

The storage volume ran out of allocated space

Answer

A read replica had high replication lag

Question 7

A company is running a MongoDB workload on-premises and wants to migrate to AWS with minimal operational overhead. The application uses MongoDB-specific features like aggregation pipelines. Which service is best?

Accepted Answer

Amazon DocumentDB. Amazon DocumentDB is the correct choice because it is a fully managed, MongoDB-compatible document database that supports MongoDB-specific features like aggregation pipelines, indexes, and queries. It minimizes operational overhead by handling hardware provisioning, patching, backups, and replication, making it ideal for migrating an on-premises MongoDB workload to AWS without significant application changes.

Answer

Amazon DynamoDB

Answer

Amazon RDS for PostgreSQL

Answer

Amazon Elasticsearch Service

Question 8

Refer to the exhibit. A DBA sees the above error log entries for an Amazon RDS for MySQL DB instance. Which action should the DBA take to resolve the 'Too many connections' error?

Accepted Answer

Modify the DB parameter group to increase max_connections. Increasing the max_connections parameter in the DB parameter group allows the MySQL instance to handle more concurrent connections, directly resolving the 'Too many connections' error. Option B is incorrect because rebooting the DB instance does not change the connection limit, only temporarily clears existing connections. Option C is incorrect because modifying the DB security group adjusts network access rules, not the database's internal connection limit. Option D is incorrect because resetting the master user password addresses authentication issues, not the connection limit.

Answer

Reboot the DB instance

Answer

Modify the DB security group to allow more connections

Answer

Reset the DB instance master user password

Question 9

A company is migrating a 2 TB Oracle database from on-premises to Amazon RDS for Oracle. The network bandwidth is 100 Mbps. The migration must be completed within 3 days. Which approach is MOST efficient?

Accepted Answer

Use AWS DMS with parallel load and ongoing replication.. AWS DMS with parallel load and ongoing replication is the most efficient approach because it can handle the 2 TB migration within the 3-day window over a 100 Mbps link. At 100 Mbps, the theoretical maximum transfer is about 1.08 TB per day (100 Mbps * 86400 seconds / 8 bits per byte / 1024^4), so 2 TB would take nearly 2 days just for the full load. DMS's parallel load splits the data into multiple tasks, maximizing throughput and reducing the full-load time, while ongoing replication captures changes during the migration, allowing a seamless cutover without downtime.

Answer

Use Oracle RMAN to create a backup and restore to RDS.

Answer

Use Oracle Data Pump with a single export and import.

Answer

Use Oracle GoldenGate for real-time replication.

Question 10

A company is migrating a 10 TB Oracle database to Amazon Aurora PostgreSQL. They need to minimize downtime and ensure data consistency. Which TWO steps should be included in the migration plan? (Choose two.)

Accepted Answer

Use AWS Schema Conversion Tool (AWS SCT) to convert the Oracle schema to PostgreSQL.. For a heterogeneous migration from Oracle to Aurora PostgreSQL, AWS SCT is required to convert the schema, and AWS DMS with CDC is needed to migrate data with minimal downtime. The combination ensures that the schema is compatible and that ongoing changes are replicated until cutover. Other options do not address the core requirements of schema conversion and continuous data replication.

Answer

Use Oracle Data Pump to export the database and import it directly into Aurora PostgreSQL.

Answer

Enable Aurora Global Database to replicate data from the on-premises Oracle database.

Answer

Create an Aurora PostgreSQL read replica in the same AWS Region and promote it after migration.

Question 11

A retail company is designing a new order processing system using Amazon DynamoDB. The system must handle sudden spikes in traffic during flash sales, and the development team wants to minimize operational effort while ensuring the table can scale automatically. The access patterns include reading and writing individual orders by order ID and querying orders by customer ID and date. Which TWO design choices should the team make to meet these requirements? (Choose two.)

Accepted Answer

Create a global secondary index (GSI) with customer ID as the partition key and order date as the sort key.. On-demand capacity mode automatically handles traffic spikes without manual provisioning, and a GSI on customer ID and order date supports the query pattern efficiently. Together, these choices meet the requirements for automatic scaling and minimal operational effort. The other options either add operational overhead, use an incorrect index type, or do not address capacity scaling.

Answer

Use provisioned capacity mode with automatic scaling and a high minimum capacity.

Answer

Enable DynamoDB Streams to capture order changes and trigger AWS Lambda functions for scaling.

Answer

Store the order date as a separate attribute and create a local secondary index (LSI) on customer ID.

Question 12

Which TWO of the following are methods to control access to an Amazon RDS DB instance? (Select TWO.)

Accepted Answer

VPC security groups. Options A and B are correct. VPC security groups control network access to the RDS instance at the instance level, acting as a virtual firewall. IAM policies can control who can perform administrative actions on the RDS instance via the AWS API, such as creating, modifying, or deleting the instance. Option C is incorrect because CloudWatch alarms monitor performance metrics and trigger actions, but do not control access. Option D is incorrect because database passwords are a form of authentication for users connecting to the database, not a method to control access to the RDS instance itself. Option E is incorrect because S3 bucket policies control access to Amazon S3 resources, not RDS.

Answer

Amazon CloudWatch alarms

Answer

Database passwords

Answer

Amazon S3 bucket policies

Question 13

A company uses an Amazon RDS for PostgreSQL database with Multi-AZ deployment. The security team wants to audit all SQL queries executed against the database for compliance purposes. Which solution should be implemented to capture and store the queries?

Accepted Answer

Enable PostgreSQL query logging and publish logs to Amazon CloudWatch Logs.. To audit all SQL queries executed against an RDS for PostgreSQL database, you must enable PostgreSQL's native query logging (via the log_statement parameter, typically set to 'all') and publish those logs to Amazon CloudWatch Logs. RDS supports exporting PostgreSQL logs to CloudWatch, where they can be retained, searched with CloudWatch Logs Insights, and archived for compliance. This captures the actual SQL text executed against the database.

Answer

Use AWS CloudTrail to capture SQL queries.

Answer

Enable Performance Insights and store the data in CloudWatch Logs.

Answer

Enable RDS event notifications for database queries.

Question 14

Arrange the steps to enable encryption at rest for an existing unencrypted Amazon RDS for MariaDB DB instance in the correct order.

Accepted Answer

Create a manual snapshot, then copy the snapshot with encryption enabled, then restore the encrypted snapshot to a new DB instance, then migrate applications.. Encryption at rest for an existing instance requires creating an encrypted snapshot and restoring it, then migrating applications.

Answer

Create a manual snapshot, then restore the snapshot to a new instance, then copy the new instance with encryption, then migrate applications.

Answer

Create a manual snapshot, then copy the snapshot with encryption, then modify the original DB instance to use encryption.

Answer

Enable encryption on the original DB instance via a maintenance window, then take a snapshot, then restore.

Question 15

Which TWO actions can help protect an RDS database from SQL injection attacks? (Choose 2.)

Accepted Answer

Use parameterized SQL statements in the application.. Parameterized SQL statements (also known as prepared statements) ensure that user input is treated strictly as data, not executable code, preventing SQL injection at the application layer. Option E is correct because input validation and sanitization filter out malicious characters or patterns before they reach the database, adding an extra layer of defense. Both measures are essential; network controls (security groups) and encryption do not prevent injection attacks.

Answer

Enable Multi-AZ for the RDS instance.

Answer

Enable encryption at rest using KMS.

Answer

Restrict network access using security groups.