DBS-C01 Practice Test 48 — 15 Questions

Question 1

Refer to the exhibit. A database specialist is investigating performance degradation on an Amazon RDS for MySQL DB instance. The BurstBalance metric shows the values above. What does this indicate, and what action should be taken?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The instance has exhausted its I/O burst credits; scale up the allocated storage to increase baseline I/O.. The BurstBalance metric dropping to 0 indicates that the instance has exhausted its I/O burst credits, resulting in I/O throttling. Scaling up the allocated storage increases the baseline I/O performance, which in turn increases the burst credit earning rate and raises the burst balance. Option B is incorrect because adding a read replica offloads read traffic but does not increase I/O credits. Option C is incorrect because changing the instance class does not affect I/O credits; it only increases compute capacity. Option D is incorrect because enabling Performance Insights helps with diagnosis but does not resolve I/O credit exhaustion.

Answer

The instance is experiencing high read load; add a read replica to offload reads.

Answer

The instance's compute capacity is insufficient; change the instance class to a larger size.

Answer

The instance is experiencing a memory bottleneck; enable Performance Insights to analyze query performance.

Question 2

A database administrator notices that an Amazon RDS for MySQL DB instance is using more storage than expected. Which metric should be monitored to troubleshoot storage usage?

Accepted Answer

FreeStorageSpace. FreeStorageSpace directly indicates the available storage remaining on the DB instance, which is key to troubleshooting storage usage. Option B is incorrect because DatabaseConnections measures the number of client connections, not storage. Option C is incorrect because ReadIOPS measures input/output operations per second, not storage capacity. Option D is incorrect because NetworkThroughput measures data transfer rates, not storage.

Answer

DatabaseConnections

Answer

ReadIOPS

Answer

NetworkThroughput

Question 3

A company is building a real-time leaderboard for a gaming application. The leaderboard must update scores within seconds and support queries for top players and individual ranks. Which database design is most appropriate?

Accepted Answer

Amazon DynamoDB with a global secondary index on score. Amazon DynamoDB with a global secondary index (GSI) on score is the most appropriate design because it supports real-time updates and low-latency queries for both top players (via query on the GSI with ScanIndexForward=false and Limit) and individual ranks (via efficient key lookups). DynamoDB's fully managed, serverless architecture ensures sub-second response times at any scale, which is critical for a gaming leaderboard that must update scores within seconds.

Answer

Amazon S3 with Range GET requests

Answer

Amazon ElastiCache for Redis with sorted sets

Answer

Amazon RDS for PostgreSQL with ORDER BY and LIMIT

Question 4

A company runs a critical application on Amazon RDS for PostgreSQL. The application team reports that the database occasionally becomes unresponsive for a few seconds. CloudWatch metrics show 'CPUSurplusCreditsCharged' and 'CPUSurplusCredits' are not 0. The instance is a db.t3.medium. What is the likely cause and how should it be fixed?

Accepted Answer

The instance is out of CPU credits and is being throttled; switch to a larger or non-burstable instance. T3 instances are burstable and use CPU credits. When credits are exhausted, they can use surplus credits, which incur charges. If the workload is consistently high, the instance may run out of credits and become throttled, causing unresponsiveness. The fix is to switch to T3 unlimited mode (but that incurs charges) or use a non-burstable instance (e.g., M5). Option B is wrong because Enhanced Monitoring provides detailed OS-level metrics but does not prevent CPU credit exhaustion. Option C is wrong because increasing allocated storage does not affect CPU credits; it improves I/O performance. Option D is wrong because enabling Multi-AZ provides high availability and failover but does not resolve CPU credit issues.

Answer

Enable Enhanced Monitoring to diagnose the issue

Answer

Increase the allocated storage to improve I/O

Answer

The instance is experiencing a failover; enable Multi-AZ

Question 5

The exhibit shows the output of a MySQL command run on an Amazon RDS for MySQL DB instance. The database is experiencing frequent checkpointing that is causing I/O spikes. The parameter innodb_log_file_size is currently 256 MB. Which change should be made to reduce checkpoint frequency?

Accepted Answer

Increase the value of innodb_log_file_size to 1 GB.. Increasing innodb_log_file_size reduces checkpoint frequency by allowing more transactions to be logged before a checkpoint is forced. Option A is wrong because decreasing the log file size would increase checkpoint frequency. Option B is wrong because innodb_flush_log_at_trx_commit controls write-ahead logging durability, not checkpoint frequency. Option D is wrong because innodb_buffer_pool_size affects caching and memory, but does not directly reduce checkpoint frequency.

Answer

Decrease the value of innodb_log_file_size to 128 MB.

Answer

Set innodb_flush_log_at_trx_commit to 0.

Answer

Increase the value of innodb_buffer_pool_size.

Question 6

A team is troubleshooting a DynamoDB table that has high read latency. The table uses on-demand capacity and has a global secondary index (GSI). Which configuration is MOST likely causing the issue?

Accepted Answer

The GSI has provisioned capacity set too low. An under-provisioned GSI can throttle reads even if the base table uses on-demand. Option B is wrong because TTL does not affect read latency. Option C is wrong because DAX reduces latency, not increases. Option D is wrong because on-demand capacity handles bursts and does not cause high latency.

Answer

Time-to-Live (TTL) is enabled

Answer

DAX is enabled for the table

Answer

The table uses on-demand capacity

Question 7

Which TWO settings should be verified when troubleshooting an RDS for MySQL instance that has a high number of aborted connections? (Choose 2.)

Accepted Answer

connect_timeout parameter. Options A (connect_timeout) and B (max_allowed_packet) are correct because a low connect_timeout can cause connections to abort if not completed within the time limit, and a low max_allowed_packet can cause large queries to fail, resulting in aborted connections. Option C is incorrect because query_cache_type affects caching, not connection handling. Option D is incorrect because binlog_retention_hours is for binary log retention, unrelated to connections. Option E is incorrect because max_connections limits the total number of simultaneous connections but does not directly cause aborted connections; excessive connection attempts might be due to other issues.

Answer

query_cache_type parameter

Answer

binlog_retention_hours parameter

Answer

max_connections parameter

Question 8

A company has an Amazon Redshift cluster that contains sensitive data. The security team requires that data be encrypted at rest using a customer-managed AWS KMS key. The cluster was initially launched without encryption. How can the company enable encryption with minimal downtime?

Accepted Answer

Take a snapshot of the cluster and restore it to a new cluster with encryption enabled.. To enable encryption on an existing unencrypted Redshift cluster with minimal downtime, the recommended approach is to take a snapshot of the cluster and restore it to a new cluster with encryption enabled. This allows the original cluster to remain operational while the encrypted cluster is being created, minimizing downtime. Once the new cluster is ready, traffic can be redirected. Option A (unload to S3, create new encrypted cluster, reload) also achieves encryption but requires significant downtime for data transfer. Option B is incorrect because there is no direct CLI command to enable encryption on an existing cluster; a new cluster must be created. Option D is incorrect because the AWS Management Console does not allow enabling encryption on an existing cluster.

Answer

Unload the data to Amazon S3, create a new encrypted cluster, and reload the data from S3.

Answer

Use the AWS CLI to update the cluster encryption setting.

Answer

Modify the cluster and enable encryption using the AWS Management Console.

Question 9

A company is migrating its on-premises Oracle database to Amazon RDS for Oracle. As part of the migration, they need to ensure that all sensitive data is encrypted at rest using AWS Key Management Service (AWS KMS). Which configuration step is required to achieve this?

Accepted Answer

Create a new encrypted DB instance by enabling encryption and specifying a KMS key.. To encrypt an Amazon RDS for Oracle DB instance at rest using AWS KMS, you must enable encryption when creating the DB instance and specify a KMS key. Encryption cannot be added to an existing unencrypted DB instance directly; you must take a snapshot, create an encrypted copy, and restore it. Option A is incorrect because modifying an existing instance does not allow enabling encryption. Option B is incorrect because SSL/TLS encrypts data in transit, not at rest. Option C is incorrect because while CloudHSM can be used, AWS KMS is the simpler and more common approach, and the question specifically mentions AWS KMS.

Answer

Modify the existing DB instance to enable encryption.

Answer

Configure SSL/TLS on the DB instance to encrypt data at rest.

Answer

Use AWS CloudHSM to generate and store the encryption keys.

Question 10

A company is using Amazon Redshift and needs to comply with regulatory requirements that mandate encryption of all data at rest and control of the encryption keys. Which THREE steps should be taken? (Choose THREE.)

Accepted Answer

Enable automatic key rotation for the KMS key.. Enabling automatic key rotation for the KMS key ensures that encryption keys are rotated regularly, meeting key control requirements. Option B is correct because using a customer-managed KMS key allows the company to control the encryption keys themselves. Option E is correct because Amazon Redshift requires encryption to be enabled at cluster creation time, and using a KMS key accomplishes this. Option C is incorrect because AWS CloudHSM is not necessary for this requirement; KMS provides sufficient key management. Option D is incorrect because encryption cannot be enabled on an existing Redshift cluster; it must be enabled at creation.

Answer

Use AWS CloudHSM to generate and manage encryption keys.

Answer

Enable encryption on the cluster after creation by modifying the cluster.

Question 11

A company is using Amazon DynamoDB to store sensitive customer data. They need to ensure that all data is encrypted at rest using a customer-managed AWS KMS key. The company also wants to rotate the KMS key every year. What is the simplest way to achieve key rotation?

Accepted Answer

Enable automatic key rotation in AWS KMS for the customer-managed key.. The simplest way to achieve annual key rotation for a customer-managed AWS KMS key used with DynamoDB is to enable automatic key rotation on the existing key. AWS KMS supports automatic rotation of customer-managed keys once per year when enabled, which can be done through the KMS console or API without any manual intervention or table modification. Option A is incorrect because creating a new key and updating the DynamoDB table requires manual effort and is more complex than enabling automatic rotation. Option B is incorrect because deleting and recreating the key is disruptive and not simpler. Option D is incorrect because importing new key material does not provide automatic rotation and is not the simplest method.

Answer

Create a new KMS key every year and update the DynamoDB table to use the new key.

Answer

Manually rotate the key by deleting and recreating the KMS key each year.

Answer

Import new key material into the existing KMS key every year.

Question 12

The security team reports that the database 'mydb' is not encrypted. However, the CLI output shows 'StorageEncrypted' is true. What is the MOST likely reason for the security team's concern?

Accepted Answer

The KMS key specified may have been disabled or deleted, causing the database to be inaccessible or not encrypted.. The security team's concern likely stems from the possibility that the KMS key specified for encryption might have been disabled or deleted. Even though 'StorageEncrypted' is true, if the KMS key is not available, the database may become inaccessible or the encryption may not be effective. Option A is incorrect because using a default AWS managed key still provides encryption; the security team's concern is about encryption itself, not key type. Option C is incorrect because the CLI output clearly shows 'StorageEncrypted' is true, so the field is not false. Option D is incorrect because there is no indication that a CloudHSM key is involved, and using a KMS key is the standard approach for RDS encryption.

Answer

The database is using a default AWS managed key instead of a customer-managed key.

Answer

The 'StorageEncrypted' field is false, but the CLI output shows true.

Answer

The database is not using a KMS key and is instead using a CloudHSM key.

Question 13

A company has an Amazon RDS for MySQL DB instance that stores sensitive customer data. The security team requires that all data at rest be encrypted using a customer-managed AWS KMS key. The DB instance was originally launched without encryption. Which combination of steps will meet the requirement with the least downtime?

Accepted Answer

Take a snapshot of the DB instance, copy the snapshot with encryption enabled using the desired KMS key, and restore the encrypted snapshot to a new DB instance.. To enable encryption on an existing unencrypted RDS MySQL DB instance, you must take a snapshot of the instance, copy the snapshot with encryption enabled using the desired KMS key, and then restore the encrypted snapshot to a new DB instance. This process results in some downtime but is the standard method. Option A is incorrect because you cannot create an encrypted read replica from an unencrypted source instance; encryption on a read replica requires the source to be encrypted. Option B is incorrect because you cannot enable encryption on an existing unencrypted DB instance by modifying it; encryption can only be enabled at creation time or by restoring an encrypted snapshot. Option D is incorrect because you cannot restore an encrypted snapshot to the same DB instance ID; you must restore to a new instance, then update the application endpoint.

Answer

Create a read replica of the DB instance with encryption enabled, and then promote the read replica to become the primary instance.

Answer

Modify the DB instance and enable encryption using the AWS Management Console.

Answer

Take a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the encrypted snapshot to the same DB instance ID.

Question 14

A company is designing a security architecture for Amazon DynamoDB. They need to ensure that only authorized applications can access the data, and that data in transit is encrypted. Which THREE steps should be taken? (Choose THREE.)

Accepted Answer

Attach an IAM policy that grants access only to specific IAM roles or users.. The correct answers are B, C, and E. IAM policies ensure only authorized principals can access DynamoDB. AWS PrivateLink VPC endpoints keep traffic within the AWS network, enhancing security. HTTPS (TLS) encrypts data in transit, which is required for confidentiality. Option A is incorrect because KMS keys are for encryption at rest, not in transit. Option D is incorrect because security groups are associated with network interfaces, not DynamoDB tables; they can be used with VPC endpoints but not directly on the table.

Answer

Use a customer-managed KMS key to encrypt data in transit.

Answer

Configure a security group to restrict inbound traffic to the DynamoDB table.

Question 15

A company is designing a disaster recovery strategy for an Amazon RDS for SQL Server DB instance that contains sensitive financial data. The database must be encrypted at rest using a customer-managed AWS KMS key. The recovery point objective (RPO) is 5 minutes, and the recovery time objective (RTO) is 1 hour. Which THREE steps should be taken to meet these requirements?

Accepted Answer

Store the KMS key in the secondary Region by creating a cross-Region KMS key replica.. To achieve an RPO of 5 minutes and RTO of 1 hour across regions, you need automated backups with a 5-minute interval (D) so that transaction logs are backed up frequently. A cross-Region read replica (E) can be promoted quickly in the secondary region to meet the RTO. Since the database uses a customer-managed KMS key, you must create a cross-Region KMS key replica (C) in the secondary region so that the replica can be encrypted. Multi-AZ (B) only provides high availability within a single region and does not support cross-region disaster recovery, so it does not help meet these RPO/RTO requirements.

Answer

Take a manual DB snapshot every hour.

Answer

Enable Multi-AZ deployment for automatic failover.