DBS-C01 Practice Questions 2 — 50 Questions

Question 1

A startup is building a social media analytics platform that requires storing time-series data with frequent writes and queries for the last hour. Which AWS database service is BEST suited for this workload?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon Timestream. Amazon Timestream is a purpose-built time-series database that efficiently handles high-frequency writes and recent-time queries (e.g., last hour) with automatic data tiering (in-memory store for recent data, magnetic store for historical). Its serverless architecture and built-in time-series functions (e.g., interpolation, smoothing) make it ideal for social media analytics workloads requiring low-latency queries on recent data.

Answer

Amazon RDS with MySQL

Answer

Amazon Neptune

Answer

Amazon DynamoDB

Question 2

A company is running an Amazon RDS for PostgreSQL DB instance with Multi-AZ deployment. They notice that the primary DB instance is experiencing high CPU utilization. The read replica shows normal CPU. Which action should the DBA take to reduce the load on the primary instance?

Accepted Answer

Offload SELECT queries to the read replica. Offloading SELECT queries to the read replica reduces CPU utilization on the primary instance because read replicas can handle read traffic independently. Option A is incorrect: failing over to the standby instance does not reduce CPU load—the standby is only for high availability and becomes the new primary, still handling the same workload. Option B is incorrect: increasing the DB instance size would help but is not the best first step; it involves scaling costs and potential downtime, whereas using a read replica is more efficient and cost-effective for read-heavy workloads. Option C is incorrect: converting the read replica to a Multi-AZ standby would make it a synchronous replica for failover, not for offloading reads, so it would not reduce CPU on the primary.

Answer

Failover to the standby instance

Answer

Increase the DB instance size

Answer

Convert the read replica to a Multi-AZ standby

Question 3

A company is migrating an on-premises MySQL database to Amazon RDS for MySQL. They need to validate that the schema is compatible. Which AWS service should they use?

Accepted Answer

AWS Schema Conversion Tool (SCT). The AWS Schema Conversion Tool (SCT) is designed specifically to assess and convert database schemas from one engine to another, including on-premises MySQL to Amazon RDS for MySQL. It analyzes the source schema for compatibility issues, identifies unsupported features or deprecated syntax, and generates a detailed assessment report. This makes it the correct choice for validating schema compatibility before migration.

Answer

Amazon Inspector

Answer

AWS Database Migration Service (DMS)

Answer

AWS Trusted Advisor

Question 4

A company is using Amazon ElastiCache for Redis to cache database query results. The application team reports that cache hit ratio has dropped significantly. What is the first step to investigate?

Accepted Answer

Check the CacheHitRate and Evictions metrics in CloudWatch. When the cache hit ratio drops significantly, the first step is to investigate whether the cache is evicting keys due to memory pressure or if the working set no longer fits. CloudWatch metrics such as `CacheHitRate` and `Evictions` provide immediate visibility into these conditions without requiring direct Redis access. This aligns with the AWS Well-Architected Framework's principle of observability before making configuration changes.

Answer

Run the Redis INFO command to see memory usage

Answer

Review the ElastiCache event logs for node failures

Answer

Check the Redis AOF persistence logs

Question 5

A company wants to audit all SQL statements executed on their Amazon Aurora MySQL database for compliance. Which AWS feature should be enabled?

Accepted Answer

Database Activity Streams. Database Activity Streams provide a stream of database activities including SQL queries. Option B is wrong because VPC Flow Logs capture network traffic, not SQL statements. Option C is wrong because CloudWatch Logs can store logs but the source should be Database Activity Streams; CloudWatch Logs alone does not audit SQL statements. Option D is wrong because CloudTrail logs API calls, not SQL statements.

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 6

A security engineer is investigating an Amazon RDS for MySQL database that was compromised. The engineer finds that the compromise was due to a SQL injection vulnerability in a web application. The web application uses a database user with full administrative privileges. What is the BEST practice to prevent such incidents in the future?

Accepted Answer

Create dedicated database users with minimal privileges required for each application function.. The best practice is to use dedicated database users with minimal privileges for each application function (Option A). This principle of least privilege limits the damage a SQL injection attack can cause because the compromised user cannot perform unauthorized actions beyond its specific scope. Option B is incorrect because the 'sql_mode' parameter can reject certain dangerous queries but does not address the root cause of excessive privileges and may not prevent all injection attacks. Option C is incorrect because audit logs only help detect incidents after they occur, not prevent them. Option D is incorrect because while placing the RDS instance in a private subnet and restricting inbound traffic reduces the network attack surface, it does not prevent SQL injection attacks that originate from the application itself; the vulnerability lies in how the application interacts with the database.

Answer

Configure the DB parameter group to use the 'sql_mode' option to reject dangerous queries.

Answer

Enable RDS audit logs to capture all SQL queries.

Answer

Place the RDS instance in a private subnet with a security group that restricts inbound traffic.

Question 7

A financial services company runs an Amazon Aurora MySQL database. The application performs complex joins and aggregations on large tables, causing high CPU utilization on the writer instance. The team wants to reduce load without changing the application code. Which solution would best address this issue?

Accepted Answer

Create one or more Aurora Replicas and route read traffic to them.. Creating one or more Aurora Replicas and routing read traffic to them offloads the complex joins and aggregations from the writer instance, reducing CPU utilization without requiring application code changes. Aurora Replicas share the same underlying storage volume as the writer, so they serve read queries with minimal replication lag while the writer focuses on write operations.

Answer

Switch to asynchronous replication to reduce load on the primary.

Answer

Enable Aurora Auto Scaling to increase storage capacity.

Answer

Migrate to Aurora Serverless v2 for automatic scaling.

Question 8

A company wants to migrate an on-premises MySQL database to Amazon RDS for MySQL with minimal downtime. They plan to use AWS DMS. Which source database configuration is required to enable ongoing replication (CDC)?

Accepted Answer

Enable binary logging (binlog) on the source database. AWS DMS requires binary logging (binlog) enabled on the source MySQL database to capture ongoing changes for continuous replication (CDC). The binlog records all data modifications (INSERT, UPDATE, DELETE) in a sequential log, which DMS reads to apply those changes to the target RDS instance with minimal downtime. Without binlog enabled, DMS can only perform a full load migration and cannot support ongoing replication.

Answer

Set auto_increment_increment to 1

Answer

Enable the slow query log

Answer

Enable the query cache

Question 9

A company uses Amazon Aurora MySQL-Compatible Edition. The security team wants to implement database activity streams to monitor database activity. Which THREE statements are true about Aurora database activity streams?

Accepted Answer

Activity streams can be started and stopped without restarting the database.. Options A, B, and E are correct. Activity streams can be started and stopped without a database restart (A). They are encrypted using a KMS key (B). They publish database activity to Amazon CloudWatch Logs and Amazon Kinesis Firehose (E). Option C is incorrect because activity streams do not automatically mask sensitive data; they capture the actual queries. Option D is incorrect because activity streams capture all SQL statements, including DDL, DML, and SELECT.

Answer

Activity streams automatically mask sensitive data in the logs.

Answer

Activity streams only capture DDL statements, not DML or SELECT.

Question 10

A company is running an Amazon RDS for MySQL DB instance in a VPC. The security team requires that all connections to the database use SSL/TLS. The DBA has enabled 'require_secure_transport' parameter in the DB parameter group. However, after applying the change and rebooting, some applications that were previously connecting successfully are now failing. What is the most likely cause?

Accepted Answer

The application is not configured to connect using SSL/TLS.. The most likely cause is that the application is not configured to connect using SSL/TLS. When 'require_secure_transport' is enabled, the database rejects any non-SSL connections. Applications that were previously connecting without SSL will fail until they are updated to use SSL/TLS in their connection strings. The parameter change itself is correct and does not require an option group modification for RDS MySQL.

Answer

The security group inbound rule for the database port is missing.

Answer

The option group does not have the SSL option enabled.

Answer

The DB subnet group does not include the application's subnet.

Question 11

A company is using Amazon Redshift and has a query that is running slowly. The DBA wants to identify if the query is I/O-bound. Which TWO metrics from Amazon CloudWatch can indicate I/O-bound queries?

Accepted Answer

ReadIOPS. Options B and E are correct. ReadIOPS measures the number of read I/O operations per second, and ReadLatency measures the average time per read I/O operation. High values for these metrics indicate that the query is I/O-bound. Option A (NetworkReceiveThroughput) measures network throughput, not I/O. Option C (CPUUtilization) indicates CPU-bound workloads. Option D (WriteIOPS) measures write I/O, which is less likely to be the primary indicator for a slow query, and the question asks for the two metrics that can indicate I/O-bound queries; ReadIOPS and ReadLatency are the most direct I/O metrics.

Answer

NetworkReceiveThroughput

Answer

CPUUtilization

Answer

WriteIOPS

Question 12

A company needs to migrate a 3 TB Amazon RDS for SQL Server database to Amazon RDS for PostgreSQL. The migration must be automated and repeatable with minimal manual intervention. Which combination of services should be used?

Accepted Answer

Use AWS Schema Conversion Tool (SCT) to convert the schema, then use AWS DMS to migrate the data.. AWS Schema Conversion Tool (SCT) handles the schema conversion from SQL Server to PostgreSQL, which is necessary due to incompatible data types, stored procedures, and indexes. AWS Database Migration Service (DMS) then performs the continuous data migration with minimal downtime, supporting both full load and ongoing replication. This combination automates the migration process and makes it repeatable via AWS CloudFormation or DMS task templates.

Answer

Use AWS SCT to convert the schema and export data to PostgreSQL-compatible format, then import.

Answer

Use AWS DMS with native SQL Server CDC to migrate directly to PostgreSQL.

Answer

Use Microsoft Data Migration Assistant to assess and migrate to PostgreSQL.

Question 13

A company is migrating an Oracle database to Amazon RDS for Oracle. Security policy requires that all database connections be encrypted in transit. The security team wants to enforce that clients must use TLS 1.2 or higher. How can this be achieved?

Accepted Answer

Set the rds.force_ssl parameter to 1 in the DB parameter group.. Amazon RDS for Oracle supports SSL/TLS encryption, and setting the rds.force_ssl parameter to 1 in the DB parameter group enforces SSL connections, which ensures all connections use TLS 1.2 or higher (as per Oracle's implementation). Option A is incorrect because modifying the DB subnet group controls network-level access, not encryption requirements. Option B is incorrect because IAM policies cannot enforce encryption in transit at the database level; they can only control authentication and authorization. Option C is incorrect because require_secure_transport is a MySQL parameter, not applicable to Oracle.

Answer

Modify the DB subnet group to only allow traffic from specific IP ranges.

Answer

Create an IAM policy that denies access unless the connection uses TLS.

Answer

Set the require_secure_transport parameter to ON in the DB parameter group.

Question 14

A company is migrating a 10 GB MySQL database to Amazon RDS for MySQL. They have a 1 Gbps connection to AWS. The migration must be completed in the least amount of time with minimal manual effort. Which tool should be used?

Accepted Answer

AWS Database Migration Service (DMS).. AWS Database Migration Service (DMS) is the correct choice because it can perform a live, continuous migration of a 10 GB MySQL database to Amazon RDS for MySQL with minimal downtime and manual effort. DMS handles schema conversion (if needed), data replication, and ongoing changes via Change Data Capture (CDC), allowing the migration to complete in the least amount of time while automatically managing the full load and sync process over the 1 Gbps connection.

Answer

AWS Schema Conversion Tool (SCT).

Answer

AWS Snowball Edge.

Answer

mysqldump and mysql command-line tools.

Question 15

A financial services company is migrating a 10 TB Oracle data warehouse to Amazon Redshift. The source database uses a combination of partitioned tables, indexes, and materialized views. The migration team plans to use AWS SCT and DMS. Which approach should the team take to optimize query performance after migration?

Accepted Answer

Define appropriate distribution keys and sort keys. Amazon Redshift is a columnar data warehouse that does not support traditional indexes or the PARTITION BY clause used in Oracle. Instead, query performance in Redshift is optimized by defining appropriate distribution keys (to minimize data shuffling across nodes) and sort keys (to enable zone maps and reduce the amount of data scanned). This approach directly addresses the performance needs of the migrated 10 TB data warehouse.

Answer

Create indexes on frequently queried columns

Answer

Recreate all materialized views using standard views

Answer

Partition tables by date using the PARTITION BY clause

Question 16

A company wants to encrypt data at rest for an existing Amazon RDS for MySQL DB instance. The database is currently unencrypted. What is the most efficient way to enable encryption?

Accepted Answer

Create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the DB instance from the encrypted snapshot.. RDS encryption at rest can only be enabled at DB instance creation time — you cannot enable it on an existing unencrypted instance by modifying it. The supported migration path is to snapshot the unencrypted instance, copy the snapshot with the encryption option enabled (specifying a KMS key), and then restore a new DB instance from that encrypted snapshot. This is the standard, most efficient AWS-documented approach.

Answer

Enable encryption on the existing DB instance by modifying the parameter group.

Answer

Use AWS KMS to automatically encrypt the DB instance.

Answer

Modify the DB instance and enable encryption from the RDS console.

Question 17

A logistics company runs an Amazon ElastiCache for Redis cluster in cluster mode enabled to cache shipment tracking data. The application uses keys that include a customer ID and a shipment ID. The team notices uneven CPU utilization across shards, with some shards consistently hotter than others. They want to distribute the load more evenly without changing the application's key semantics. Which approach should they take?

Accepted Answer

Increase the number of shards in the cluster and let the service redistribute hash slots.. ElastiCache for Redis cluster mode enabled partitions the keyspace into 16,384 hash slots spread across shards. When some shards run hotter, adding shards triggers slot rebalancing that redistributes keys and evens out CPU load. This uses the service's native scaling mechanism and preserves application key semantics, unlike client-side sharding or hash tags, which either bypass the cluster or concentrate load.

Answer

Apply a consistent hashing scheme in the application to map keys to shards manually.

Answer

Enable automatic failover and increase the number of replicas per shard.

Answer

Use hash tags in the key names to force related keys onto the same shard.

Question 18

A gaming company wants to store player profiles and game state. The data is accessed via a REST API and must be highly available with single-digit millisecond latency. The schema is simple and may evolve over time. Which database should they use?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is the correct choice because it is a fully managed NoSQL key-value and document database that delivers single-digit millisecond latency at any scale, making it ideal for high-availability gaming workloads. Its schema-less design allows the player profile and game state schema to evolve over time without downtime or complex migrations, and it integrates seamlessly with REST APIs via AWS SDKs or API Gateway.

Answer

Amazon S3

Answer

Amazon RDS for PostgreSQL

Answer

Amazon Redshift

Question 19

An RDS DB instance has two security groups attached. Security group sg-12345678 allows inbound traffic on port 3306 from 0.0.0.0/0. Security group sg-87654321 allows inbound traffic on port 3306 from 10.0.0.0/16. What is the effective inbound access to the DB instance?

Accepted Answer

All IP addresses (0.0.0.0/0) are allowed to connect.. Security groups in AWS are additive and allow-only; when multiple security groups are attached to an RDS DB instance, the effective inbound rules are the union of all rules across all attached security groups. Since sg-12345678 allows 0.0.0.0/0 on port 3306, that rule is in effect regardless of the other group. Therefore, all IP addresses can connect on port 3306, making option D correct.

Answer

No IP addresses are allowed because the rules conflict.

Answer

Only the 0.0.0.0/0 range is allowed because sg-12345678 is more permissive.

Answer

Only the 10.0.0.0/16 range is allowed because sg-87654321 is more restrictive.

Question 20

A company is designing a multi-tier application that uses Amazon RDS for PostgreSQL. The application must encrypt data at rest and in transit. Which combination of steps should be taken to meet these requirements? (Choose the single best answer.)

Accepted Answer

Enable encryption at rest when launching the RDS instance, and configure the DB parameter group to require SSL connections.. Amazon RDS for PostgreSQL supports encryption at rest only when enabled at instance launch, and SSL/TLS encryption in transit is enforced by configuring the DB parameter group to require SSL connections (e.g., setting `rds.force_ssl=1`). Encryption at rest cannot be added after creation, and SSL ensures data is encrypted between the application and the database.

Answer

Use client-side encryption for data before sending to RDS, and enable encryption at rest after the instance is created.

Answer

Launch the RDS instance without encryption, then enable encryption at rest using the AWS Console.

Answer

Use AWS KMS to encrypt the connection between the application and RDS.