DBS-C01 Practice Test 47 — 15 Questions

Question 1

A company is using an Amazon RDS for PostgreSQL database to store sensitive customer data. The security team requires that all data be encrypted at rest and in transit, and that access to the database is restricted to only specific applications. Currently, the database is encrypted at rest using AWS KMS, and connections are made over SSL. However, the security team wants to ensure that even if the database credentials are compromised, an attacker cannot access the database from unauthorized IP addresses. What should be done to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify the security group associated with the RDS instance to allow inbound traffic only from the application's IP addresses.. Modifying the security group associated with the RDS instance to allow inbound traffic only from the application's IP addresses restricts network access at the instance level, preventing unauthorized IP addresses from connecting even if credentials are compromised. Option A (attaching a resource-based policy) does not restrict network access—it controls IAM permissions. Option B (creating a new RDS instance in a VPC with a network ACL) is unnecessarily complex and involves migrating data; the requirement can be met by modifying the existing security group without creating a new instance. Option D (enabling IAM database authentication) authenticates database users via IAM but does not restrict source IP addresses, so it does not meet the stated requirement.

Answer

Attach a resource-based policy to the RDS instance to allow only specific IAM roles.

Answer

Create a new RDS instance in a VPC with a network ACL that allows inbound traffic only from specific IP ranges, and migrate the data.

Answer

Enable IAM database authentication for the RDS instance.

Question 2

A gaming company uses Amazon DynamoDB with global tables across two regions. They notice increased write latency and throttling during peak hours. The access pattern is mostly writes to a small set of hot partitions. Which design change would best address this?

Accepted Answer

Implement write sharding using a random suffix on the partition key. The issue is hot partitions caused by a small set of partition keys receiving the majority of writes. By implementing write sharding with a random suffix on the partition key, you distribute writes across multiple partitions, reducing throttling and write latency. This directly addresses the root cause of uneven access patterns, unlike the other options that either cache reads, adjust capacity mode, or scale capacity without solving the partition-level bottleneck.

Answer

Enable DynamoDB Accelerator (DAX)

Answer

Switch to DynamoDB on-demand capacity mode

Answer

Increase write capacity using auto scaling

Question 3

A data engineer is troubleshooting a slow-running query on an Amazon Redshift cluster. The query involves large table joins and aggregations. Which diagnostic step should be taken FIRST to understand the query execution plan and identify bottlenecks?

Accepted Answer

Run the EXPLAIN command on the query to review the execution plan.. The EXPLAIN command is the first and most direct step to understand how Redshift plans to execute a query, including join types, data distribution, and aggregation strategies. It reveals the execution plan without running the query, allowing the engineer to identify bottlenecks like nested loop joins or missing sort key optimization before any other diagnostic step.

Answer

Monitor the WLM queue metrics for the query.

Answer

Check the SVV_TABLE_INFO view for table distribution and sort keys.

Answer

Query the STL_QUERY system table to review the query text.

Question 4

A company is migrating a 100 GB MySQL database to Amazon Aurora MySQL. The migration must have minimal downtime and the source database is currently in use. Which approach should the company take?

Accepted Answer

Use AWS DMS with ongoing replication from the source MySQL database to Aurora.. AWS DMS with ongoing replication (change data capture, CDC) is the correct approach because it allows a live migration with minimal downtime. DMS performs a full load of the 100 GB database and then continuously replicates incremental changes from the source MySQL to the target Aurora MySQL until you cut over, keeping the source fully operational throughout the process.

Answer

Create an Aurora Replica from the on-premises MySQL database and promote it.

Answer

Export the database using mysqldump and import it into Aurora during a maintenance window.

Answer

Take a physical backup of the MySQL database, upload to S3, and restore to Aurora.

Question 5

A company is using Amazon RDS for MySQL with Multi-AZ deployment. The application team reports increased latency during peak hours. Which AWS service should the database specialist use to identify the root cause?

Accepted Answer

Enable Performance Insights for the RDS instance and analyze the database load.. Performance Insights provides detailed database performance metrics and helps identify bottlenecks such as high load or slow queries. Option B is wrong because AWS Config tracks configuration changes, not performance. Option C is wrong because CloudWatch Metrics Dashboard shows aggregated metrics but lacks the granular database analysis needed for root cause identification. Option D is wrong because Amazon Inspector is a security assessment tool, not a performance monitoring service.

Answer

Enable AWS Config to track configuration changes to the RDS instance.

Answer

Use the CloudWatch Metrics Dashboard to analyze database connections.

Answer

Run an Amazon Inspector assessment on the RDS instance.

Question 6

Which TWO of the following are advantages of using Amazon DynamoDB over Amazon RDS for MySQL for a workload that requires high scalability and low maintenance? (Select TWO.)

Accepted Answer

No need to manage database servers or patches. Option C is correct because DynamoDB is a fully managed, serverless NoSQL service, so AWS handles provisioning, patching, and server maintenance, eliminating the operational overhead that RDS for MySQL requires (where you manage instances, OS patches, and engine upgrades). Option E is correct because DynamoDB supports automatic scaling of read/write capacity (or on-demand capacity mode), which adjusts throughput to match traffic without manual intervention, directly supporting high scalability with low maintenance. Option A is not correct because DynamoDB offers eventually consistent reads by default, with strongly consistent reads available only as an option (and at higher cost), so strong consistency is not the default. Option B is not correct because DynamoDB is a NoSQL key-value/document store that does not support complex SQL joins, and its transaction support (TransactWriteItems/TransactGetItems) is limited compared to RDS for MySQL. Option D is not correct because built-in read replicas are an RDS feature; DynamoDB scales reads via partitions and global tables, not via read replicas in the RDS sense.

Answer

Strong consistency by default

Answer

Support for complex joins and transactions

Answer

Built-in read replicas for scaling reads

Question 7

A company hosts a critical application on Amazon RDS for PostgreSQL. The security team requires that all database connections be encrypted in transit. Which configuration step is necessary?

Accepted Answer

Set the rds.force_ssl parameter to 1 in the DB parameter group.. Setting rds.force_ssl=1 in the DB parameter group forces all connections to use SSL/TLS, rejecting any unencrypted client connection. This is the standard RDS for PostgreSQL mechanism to enforce encryption in transit at the database engine level. After applying the parameter, a reboot or parameter group change is required for it to take effect.

Answer

Create a VPN connection between the application and the database.

Answer

Modify the security group to allow only port 5432 from the application.

Answer

Enable encryption at rest using AWS KMS.

Question 8

A company wants to migrate a 200 GB SQL Server database to Amazon RDS for SQL Server with minimal downtime. The database is used by a critical application. Which service should be used for the migration?

Accepted Answer

AWS Database Migration Service (DMS).. AWS DMS is the correct choice because it supports ongoing replication (change data capture) from a SQL Server source to an Amazon RDS for SQL Server target, enabling a migration with minimal downtime. DMS can perform a full load of the 200 GB database and then continuously replicate changes until the cutover, which is essential for a critical application that cannot tolerate extended downtime.

Answer

AWS Schema Conversion Tool (SCT).

Answer

SQL Server Import and Export Wizard.

Answer

SQL Server Management Studio (SSMS) backup and restore.

Question 9

A company is migrating a 2 TB Oracle database to Amazon Aurora PostgreSQL. They need to minimize downtime and ensure data consistency. Which migration strategy should they use?

Accepted Answer

Use AWS DMS with ongoing replication (change data capture) from Oracle to Aurora.. AWS DMS with ongoing replication (change data capture) is the correct strategy because it allows continuous synchronization of changes from the source Oracle database to the target Aurora PostgreSQL, minimizing downtime to just the final cutover window. This approach ensures data consistency by applying transactional changes in near real-time, which is essential for a 2 TB database where a full load alone would require a lengthy maintenance window and risk data divergence.

Answer

Use AWS DMS with full load only, then cut over during a maintenance window.

Answer

Export the database to Amazon S3 using Oracle Data Pump, then import into Aurora.

Answer

Use pg_dump to export the database and pg_restore to import into Aurora.

Question 10

A company wants to deploy a globally distributed application with a DynamoDB table that uses optimistic locking. Which DynamoDB feature should be used to implement this?

Accepted Answer

DynamoDB Conditional Writes. Optimistic locking in DynamoDB is implemented using conditional writes, specifically the `ConditionExpression` parameter in `PutItem`, `UpdateItem`, or `DeleteItem` operations. By checking that a version attribute (e.g., `version = :expected_version`) matches the client's known value before writing, the application can detect and reject concurrent modifications, ensuring data consistency without locking the entire table.

Answer

DynamoDB Streams

Answer

DynamoDB Global Tables

Answer

DynamoDB Transactions

Question 11

A mobile gaming application uses Amazon DynamoDB to store player profiles and game state. The write throughput is high during events, but low otherwise. The company wants to minimize costs while maintaining performance. Which capacity mode should they use?

Accepted Answer

On-Demand capacity mode. On-Demand capacity mode is ideal for this workload because it automatically scales to handle high write throughput during events and scales down to zero when idle, eliminating the need for capacity planning. This minimizes costs by charging only for actual reads and writes, without requiring any provisioning or management of throughput limits.

Answer

Reserved capacity

Answer

Provisioned capacity without auto scaling

Answer

Provisioned capacity with auto scaling

Question 12

A developer is building a serverless application that uses Amazon DynamoDB. The application needs to access the database from an AWS Lambda function. The security team mandates that the Lambda function should not use long-term AWS credentials. Which TWO steps should be taken to securely grant access? (Choose TWO.)

Accepted Answer

Create an IAM role with a policy that allows DynamoDB actions.. Option B is correct because creating an IAM role with a policy that grants the specific DynamoDB actions (such as dynamodb:GetItem, dynamodb:PutItem, dynamodb:Query) establishes the least-privilege permissions the function needs, and IAM roles provide temporary credentials rather than long-term keys. Option E is correct because the Lambda function assumes its execution role at runtime, and AWS STS automatically supplies short-lived credentials to the function, satisfying the mandate against long-term AWS credentials. Together, B and E implement the standard serverless pattern of an execution role carrying a DynamoDB permissions policy. Option A is wrong because hardcoding access keys in environment variables is exactly the long-term credential practice the security team prohibits and exposes secrets in the function configuration. Option C is wrong because internet access is irrelevant to AWS authentication; Lambda authenticates to DynamoDB through its execution role and the AWS SDK, not via public endpoints. Option D is wrong because Secrets Manager is used for storing application secrets like database passwords, not for granting AWS service permissions, and DynamoDB access is authorized through IAM, not retrieved credentials.

Answer

Hardcode the AWS access key ID and secret access key in the Lambda environment variables.

Answer

Configure the Lambda function to access the internet for authentication.

Answer

Store the database credentials in AWS Secrets Manager and retrieve them in the Lambda function.

Question 13

A company runs a time-series application that records sensor data every second. The data volume is 500 GB per month and grows continuously. They need to query the last 30 days of data frequently and older data rarely. Which database design is MOST appropriate?

Accepted Answer

Amazon Timestream. Amazon Timestream is purpose-built for time-series data, automatically storing recent data in memory for fast queries and moving older data to a cost-optimized store. This matches the workload of frequent queries on the last 30 days and rare queries on older data, with continuous growth at 500 GB/month.

Answer

Amazon RDS for PostgreSQL with partitioning

Answer

Amazon DynamoDB with TTL

Answer

Amazon S3 with Athena and partitioning

Question 14

A company is designing a new application that requires a relational database with strong consistency and support for transactions. The application will be accessed by users worldwide, and the database must provide low-latency reads in multiple regions. The company expects the workload to be unpredictable, with periods of very low activity followed by sudden spikes. They want to minimize operational overhead and only pay for the resources they use. Which AWS database solution should they choose?

Accepted Answer

Amazon Aurora Serverless v2 with Aurora Global Database.. Amazon Aurora Serverless v2 provides a relational database with strong consistency and full transaction support (MySQL/PostgreSQL compatible), and it automatically scales capacity up and down based on workload — ideal for unpredictable traffic with periods of low activity and sudden spikes. Aurora Global Database extends this by replicating to multiple regions with low-latency reads (typically under one second replication lag), satisfying the worldwide low-latency read requirement while minimizing operational overhead and paying only for consumed capacity.

Answer

Amazon Redshift with cross-Region snapshots.

Answer

Amazon RDS for PostgreSQL with read replicas in multiple regions.

Answer

Amazon DynamoDB with Global Tables.

Question 15

A company runs a critical Amazon RDS for PostgreSQL database. They notice that the 'DiskQueueDepth' metric is consistently high and the 'FreeStorageSpace' is below 10%. The database is used for OLTP workloads. What is the MOST immediate action to take?

Accepted Answer

Modify the DB instance to increase allocated storage.. FreeStorageSpace below 10% on an RDS PostgreSQL instance is the immediate cause of high DiskQueueDepth — the storage subsystem is saturated because there is little room for writes and background operations. The fastest remediation is to modify the DB instance to increase allocated storage, which RDS can do online without downtime and which directly relieves the disk pressure.

Answer

Upgrade to a larger DB instance class.

Answer

Switch the instance to Provisioned IOPS storage.

Answer

Create a read replica to offload read traffic.