DBS-C01 Practice Test 46 — 15 Questions

Question 1

Which TWO actions can help reduce Amazon RDS for MySQL replication lag between a primary instance and a read replica? (Choose two.)

Accepted Answer

Reduce the number of write-heavy DML statements on the primary.. Reducing write-heavy DML on the primary (Option B) decreases the volume of changes to be replicated, directly reducing lag. Increasing the instance size of the read replica (Option D) provides more CPU and memory resources for applying changes from the binary log. Option A is incorrect because increasing allocated storage does not improve the replica's ability to apply changes; it only increases storage capacity. Option C is incorrect because enabling Multi-AZ on the primary provides high availability but does not reduce replication lag. Option E is incorrect because binary logging is required for replication; disabling it would break replication.

Answer

Increase the allocated storage for the read replica.

Answer

Enable Multi-AZ on the primary instance.

Answer

Disable binary logging on the primary instance.

Question 2

A database specialist needs to monitor the number of deadlocks occurring in an Amazon RDS for SQL Server DB instance. Which CloudWatch metric should be used?

Accepted Answer

Deadlocks. The 'Deadlocks' metric in Amazon RDS for SQL Server specifically counts the number of deadlocks that occur on the DB instance. Option A is incorrect because 'BlockedTransactions' tracks transactions that are blocked, not deadlocks. Option C is incorrect because 'DatabaseConnections' is a count of active connections, not related to deadlocks. Option D is incorrect because 'LockWaits' measures the number of lock waits, which is a different contention event.

Answer

BlockedTransactions

Answer

DatabaseConnections

Answer

LockWaits

Question 3

Refer to the exhibit. A developer runs the AWS CLI command and receives the output shown. What is this output?

Accepted Answer

The DNS endpoint of the DB instance. The output shown is the DNS endpoint of the RDS instance. This is the standard endpoint used to connect to the DB instance. Option A is correct because it matches this output. Option B is incorrect because the output is a DNS name, not a private IP address. Option C is incorrect because a reader endpoint includes a '-ro' suffix and applies only to Multi-AZ clusters. Option D is incorrect because the resource ID is a different identifier, not a DNS endpoint.

Answer

The private IP address of the DB instance

Answer

The reader endpoint of a Multi-AZ cluster

Answer

The resource ID of the DB instance

Question 4

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. After migration, the application team reports that queries are slower than before. Which metric in CloudWatch should the DBA review first to check if the instance is resource-constrained?

Accepted Answer

CPUUtilization. (CPUUtilization). When migrating an on-premises Oracle database to Amazon RDS for Oracle, slower queries can indicate resource constraints. CPUUtilization is the primary metric to review first because high CPU usage directly impacts query performance. Option A (SwapUsage) is more relevant for memory pressure but not the first indicator. Option C (FreeableMemory) is important but CPU is typically the first bottleneck. Option D (DatabaseConnections) shows concurrent connections but does not directly measure resource saturation.

Answer

SwapUsage

Answer

FreeableMemory

Answer

DatabaseConnections

Question 5

A company is deploying a new application on Amazon RDS for PostgreSQL. The security policy requires that all data be encrypted at rest and in transit. Which TWO actions should the company take to meet these requirements?

Accepted Answer

Enable encryption at rest by specifying a KMS key when creating the DB instance.. To encrypt data at rest, you must enable encryption when creating the DB instance by specifying a KMS key (Option C). RDS automatically encrypts automated backups for encrypted instances, so Option B is unnecessary. To encrypt data in transit, you must enforce SSL/TLS connections by setting the parameter rds.force_ssl to 1 in the DB parameter group (Option E). Option A is incorrect because client-side encryption is not required when using RDS encryption and SSL; the requirement is to use RDS features. Option D is incorrect because creating an encrypted read replica does not encrypt the original master instance; you need to enable encryption on the master from the start.

Answer

Use a client-side encryption library to encrypt data before sending to the database.

Answer

Enable encryption for automated backups separately.

Answer

Create an encrypted read replica and promote it to master.

Question 6

Which TWO of the following are valid methods to control network access to an Amazon RDS DB instance? (Select TWO.)

Accepted Answer

VPC security groups. A and B are correct. VPC security groups (A) act as a virtual firewall to control inbound and outbound traffic to the RDS instance at the network level. DB subnet groups (B) determine which subnets the RDS instance can be deployed in, effectively controlling network access by restricting the IP ranges that can reach the instance. AWS WAF (C) is a web application firewall for HTTP/HTTPS traffic, not for network-level RDS access. IAM policies (D) control API-level permissions, not network traffic. DB parameter groups (E) manage database engine configuration settings and do not affect network access.

Answer

AWS WAF

Answer

IAM policies

Answer

DB parameter groups

Question 7

A company uses Amazon Aurora MySQL-Compatible Edition. The security team wants to implement database activity streams to monitor database activity. Which THREE statements are true about Aurora database activity streams?

Accepted Answer

Activity streams can be started and stopped without restarting the database.. Options A, B, and E are correct. Activity streams can be started and stopped without a database restart (A). They are encrypted using a KMS key (B). They publish database activity to Amazon CloudWatch Logs and Amazon Kinesis Firehose (E). Option C is incorrect because activity streams do not automatically mask sensitive data; they capture the actual queries. Option D is incorrect because activity streams capture all SQL statements, including DDL, DML, and SELECT.

Answer

Activity streams automatically mask sensitive data in the logs.

Answer

Activity streams only capture DDL statements, not DML or SELECT.

Question 8

A company uses Amazon DynamoDB with a table that has a partition key of 'user_id' (string) and sort key of 'timestamp' (number). The application queries for recent items for a specific user using the query API with KeyConditionExpression. The query returns items in descending order. Occasionally, the query returns items that are not the most recent. What is the most likely cause?

Accepted Answer

The query is using eventually consistent reads, which may not reflect the latest writes.. DynamoDB queries by default use eventually consistent reads, which may not reflect the latest writes. In this scenario, the query is likely using eventually consistent reads, causing it to return stale data. Option A is correct. Option B is incorrect because ScanIndexForward set to false returns items in descending order, which is what the application expects. Option C is incorrect because pagination would result in missing items, not stale data. Option D is incorrect because the query is on the base table, not a GSI.

Answer

The query is not using the ScanIndexForward parameter set to false.

Answer

The query results are paginated and the application is not iterating through all pages.

Answer

The query is using a global secondary index (GSI) that has a different sort key.

Question 9

A company is using Amazon RDS for MySQL to host a web application. The security team has identified that the application is vulnerable to SQL injection attacks. The team wants to implement a defense-in-depth strategy to protect the database. Which THREE measures should be taken to mitigate SQL injection risks?

Accepted Answer

Grant the minimum required permissions to the database user used by the application.. Options A, C, and E are correct. Parameterized queries (C) prevent SQL injection by separating SQL logic from data. Least privilege (A) reduces the impact if injection occurs. AWS WAF (E) provides a web application firewall to filter malicious input before it reaches the database. Option B is incorrect because stored procedures alone do not prevent SQL injection unless they use parameterized queries. Option D is incorrect because encryption at rest protects data at rest but does not prevent SQL injection.

Answer

Move all SQL logic into stored procedures.

Answer

Enable encryption at rest for the RDS instance.

Question 10

A database administrator notices that an Amazon RDS for Oracle instance has a high number of connections, causing performance degradation. Which tool can be used to identify the active sessions and their queries?

Accepted Answer

Performance Insights. Performance Insights provides a dashboard to monitor active sessions and the queries they are running. Option A is incorrect because Amazon Inspector is a security assessment tool, not a monitoring tool for database sessions. Option C is incorrect because RDS Enhanced Monitoring provides OS-level metrics like CPU and memory, not database session details. Option D is incorrect because AWS CloudTrail logs API calls, not database sessions or queries.

Answer

Amazon Inspector

Answer

RDS Enhanced Monitoring

Answer

AWS CloudTrail

Question 11

A developer reports that an application is unable to connect to an Amazon RDS for Oracle database. The security group for the database allows inbound traffic on port 1521 from the application's security group. The database is publicly accessible. What should be checked next?

Accepted Answer

Verify that the DB subnet group includes a public subnet with an internet gateway.. The database is publicly accessible, meaning it must be in a public subnet that has an internet gateway attached. Even if the security group allows traffic, the subnet must be configured correctly for public access. Option A is incorrect because the 'remote_listener' parameter affects Oracle listener registration, not basic network connectivity. Option B is incorrect because backup retention is unrelated to connection issues. Option D is incorrect because CloudWatch Logs may not capture failed connection attempts at the network level.

Answer

Check the DB parameter group for the 'remote_listener' parameter.

Answer

Check the automated backup retention period.

Answer

Review the CloudWatch Logs for error logs.

Question 12

A company uses Amazon DynamoDB with auto scaling enabled. During a sales event, the write capacity consumption increases, but the table does not scale up as expected, resulting in throttled requests. The table has read/write capacity mode set to 'Provisioned' with auto scaling configured. What should the team check first to troubleshoot the issue?

Accepted Answer

Check the target utilization percentage in the auto scaling policy. The target utilization percentage in the auto scaling policy determines when scaling triggers. If set too high (e.g., 90%), the table may not scale until near full consumption, causing throttling during spikes. Option B is incorrect: IAM permissions for the auto scaling role are typically preconfigured and less likely to cause scaling failures—permission issues would appear in CloudTrail, not as a gradual throttling problem. Option C is incorrect: table class (Standard vs. Standard-IA) affects storage costs, not write capacity scaling behavior. Option D is incorrect: while a GSI can throttle if its write capacity is insufficient, the primary table's auto scaling is independent; the question states the table itself does not scale, so the GSI is not the first check.

Answer

Verify that the auto scaling role has the necessary IAM permissions

Answer

Check whether the table class is DynamoDB Standard-IA

Answer

Check if a global secondary index (GSI) has its own write capacity that is throttling

Question 13

A company is using Amazon Redshift for analytics. The database administrator notices that some queries are slow and the system is running out of memory. Which THREE steps should the administrator take to improve performance?

Accepted Answer

Optimize the table design by choosing appropriate distkeys and sortkeys. Scaling up increases memory per node but may not be sufficient; scaling out (adding nodes) is often more effective. Option B is correct because proper distribution and sort keys minimize data shuffling and improve query performance. Option C is correct because adding more nodes increases the cluster's total memory and compute capacity. Option D is incorrect because VACUUM reclaims disk space, not memory. Option E is correct because configuring WLM limits concurrent queries, reducing memory contention.

Answer

Increase the node size (scale up) to get more memory per node

Answer

Run the VACUUM command to reclaim space from deleted rows

Question 14

A DevOps engineer notices that an Amazon RDS for PostgreSQL instance has been in 'storage-full' state for the past 30 minutes. The instance has 500 GB of General Purpose SSD (gp2) storage, and the free storage space is 0 bytes. The database is critical and cannot tolerate downtime. What is the MOST efficient way to resolve this issue while minimizing downtime?

Accepted Answer

Modify the DB instance to increase allocated storage to 1,000 GB. Modifying the storage allocation for an RDS instance can be done without downtime; the instance remains available during the modification. Increasing storage from 500 GB to 1,000 GB immediately resolves the 'storage-full' state. Option A is wrong because taking a snapshot and restoring to a new instance incurs downtime. Option C is wrong because enabling storage auto-scaling does not address the current full state; it only prevents future issues. Option D is wrong because deleting data may not free enough space and requires time-consuming intervention, risking downtime.

Answer

Take a snapshot of the DB instance and restore it to a new instance with larger storage

Answer

Enable storage auto-scaling on the DB instance

Answer

Delete unnecessary data, such as old logs or temporary tables

Question 15

A DBA is investigating a sudden increase in database connections to an Amazon RDS for SQL Server instance. The application is running on Amazon EC2 instances behind an Application Load Balancer. Which tool can provide real-time information about active connections?

Accepted Answer

Amazon RDS Performance Insights. Amazon RDS Performance Insights provides real-time information about active database connections and sessions. Option A (AWS Trusted Advisor) is incorrect because it offers best practice recommendations, not connection monitoring. Option B (VPC Flow Logs) is incorrect because they capture network traffic metadata, not database-level connection details. Option D (AWS CloudTrail) is incorrect because it records API calls for auditing, not real-time database connections.

Answer

AWS Trusted Advisor

Answer

VPC Flow Logs

Answer

AWS CloudTrail