DBS-C01 Practice Exam 51 — 20 Questions

Question 1

A company has an Amazon RDS for Oracle DB instance that is publicly accessible. They want to restrict access to only a specific CIDR block. Which two actions must be taken together?

Accepted Answer

Modify the VPC security group to allow inbound traffic on the database port from the specific CIDR, and ensure the DB instance is publicly accessible with the correct security group.. You must modify the VPC security group to allow inbound traffic on the database port from the specific CIDR, and the DB instance must be configured as publicly accessible with that security group attached. Option B is wrong because the DB subnet group determines which subnets the instance can be deployed in, not inbound access restrictions. Option C is wrong because network ACLs operate at the subnet level and are less granular; security groups are the appropriate mechanism for RDS access control. Option D is wrong because the rds.force_ssl parameter enforces encrypted connections but does not restrict by source IP or CIDR.

Answer

Modify the DB subnet group to include only subnets from the allowed CIDR.

Answer

Add a rule to the network ACL to allow inbound traffic from the CIDR.

Answer

Set the rds.force_ssl parameter to force encrypted connections from the allowed CIDR.

Question 2

A financial services company uses Amazon RDS for MySQL to store sensitive customer data. The compliance team requires that all database administrators (DBAs) must authenticate using IAM database authentication, and no static database passwords should be used. A junior DBA has been granted the rds_iam role in the database. However, the junior DBA is unable to connect using the AWS CLI command: aws rds generate-db-auth-token --hostname mydb.xyz.us-east-1.rds.amazonaws.com --port 3306 --username jdba. The error message says 'Access denied'. What is the most likely cause?

Accepted Answer

The RDS instance does not have IAM database authentication enabled.. For IAM database authentication to work, the RDS instance must have the 'IAM DB authentication' setting enabled. If it is not enabled, the authentication token generated by `generate-db-auth-token` will be rejected with an 'Access denied' error. Option A is incorrect because RDS does not use resource-based policies; IAM policies are attached to users/roles. Option B is incorrect because SSL is required for IAM auth, but a missing SSL connection would result in a different error (e.g., 'SSL required'). Option C is incorrect because network issues would typically cause a timeout or connection refused, not an authentication error.

Answer

The RDS instance does not have a resource-based policy that grants the junior DBA access.

Answer

The junior DBA is not using an SSL connection to the database.

Answer

The security group does not allow inbound traffic on port 3306 from the junior DBA's IP address.

Question 3

A KMS key has the grant shown. An IAM role named AdminRole is the grantee. What additional permission does this grant provide to AdminRole beyond what the role's IAM policy allows?

Accepted Answer

The role can use the key to encrypt and decrypt, regardless of its IAM policy.. A KMS grant allows the grantee to perform the specified operations (in this case, Encrypt and Decrypt) on the KMS key without needing additional permissions in the IAM policy. The grant provides these permissions directly to the grantee, independent of IAM policies. Option B is incorrect because the grant's permissions are effective regardless of the IAM policy; they do not require IAM policy to also allow the operations. Option C is incorrect because the grant does not include permission to delete the key; deletion requires separate IAM permissions. Option D is incorrect because creating new grants is a separate permission (CreateGrant) that is not included in a grant that only allows Encrypt and Decrypt.

Answer

The role can use the key to encrypt and decrypt, but only if its IAM policy also allows it.

Answer

The role can delete the KMS key.

Answer

The role can create new grants for this key.

Question 4

A company is migrating a 500 GB on-premises PostgreSQL database to Amazon RDS for PostgreSQL. The migration must have minimal downtime and support ongoing replication after the initial load. The network link has limited bandwidth, and the company wants to avoid costly data transfer fees. Which approach should be used?

Accepted Answer

Use AWS DMS with ongoing replication (CDC) from the start.. AWS DMS with ongoing replication (CDC) enables a full load followed by continuous change data capture, which meets the requirements of minimal downtime and ongoing replication. DMS compresses data in transit and can throttle network usage, helping to manage limited bandwidth and avoid costly data transfer fees by using the existing network link efficiently.

Answer

Use AWS Database Migration Service (DMS) with a full load only, then cut over.

Answer

Use pg_dump to export the database and pg_restore to import into RDS.

Answer

Use AWS Snowball Edge to transfer the database files, then load into RDS.

Question 5

A company hosts a critical application on Amazon RDS for PostgreSQL. The security team requires that all database connections be encrypted in transit. Which configuration step is necessary?

Accepted Answer

Set the rds.force_ssl parameter to 1 in the DB parameter group.. Enforcing SSL/TLS for connections is required for encryption in transit. Option B is correct. Option A is wrong because a VPN encrypts network traffic but does not enforce database-level SSL. Option C is wrong because modifying security group rules to allow only port 5432 does not encrypt connections. Option D is wrong because enabling encryption at rest does not encrypt data in transit.

Answer

Create a VPN connection between the application and the database.

Answer

Modify the security group to allow only port 5432 from the application.

Answer

Enable encryption at rest using AWS KMS.

Question 6

A developer is building a serverless application that uses Amazon DynamoDB. The application needs to access the database from an AWS Lambda function. The security team mandates that the Lambda function should not use long-term AWS credentials. Which TWO steps should be taken to securely grant access? (Choose TWO.)

Accepted Answer

Create an IAM role with a policy that allows DynamoDB actions.. To securely grant an AWS Lambda function access to DynamoDB without using long-term credentials, you should create an IAM role that grants the necessary DynamoDB permissions (option B) and then attach that IAM role to the Lambda function's execution role (option E). This allows Lambda to obtain temporary credentials via the IAM role, eliminating the need for hardcoded credentials. Option A is incorrect because hardcoding credentials in environment variables is not secure and uses long-term credentials. Option C is incorrect because the function does not need internet access for authentication; IAM roles provide temporary credentials internally. Option D is incorrect because while Secrets Manager can store credentials, it still requires managing secrets and may not align with the mandate to avoid long-term credentials; IAM roles are the preferred method.

Answer

Hardcode the AWS access key ID and secret access key in the Lambda environment variables.

Answer

Configure the Lambda function to access the internet for authentication.

Answer

Store the database credentials in AWS Secrets Manager and retrieve them in the Lambda function.

Question 7

A company is using Amazon RDS for MySQL with encryption at rest enabled. The security team wants to ensure that the database backups stored in Amazon S3 are also encrypted using a customer-managed KMS key. What should be done to meet this requirement?

Accepted Answer

No additional action is required; RDS automatically uses the same KMS key for backups.. When encryption at rest is enabled for an RDS DB instance, RDS automatically encrypts automated backups, snapshots, and read replicas with the same KMS key used for the DB instance. No additional action is required. Option A is incorrect because you cannot specify a separate KMS key for backups; the key is inherited. Option C is incorrect because you cannot modify the DB instance to enable backup encryption with a different key; it is automatically encrypted with the same key. Option D is incorrect because enabling S3 default encryption does not affect RDS backups, as RDS manages the backup storage and encryption directly.

Answer

Create a new KMS key and specify it when creating the DB instance to encrypt backups differently.

Answer

Modify the DB instance to enable backup encryption using a new KMS key.

Answer

Enable default encryption on the S3 bucket where backups are stored.

Question 8

A company is using Amazon Aurora MySQL and needs to audit all database logins, including failed attempts, and store the audit logs for one year for compliance. The logs must be immutable and accessible only by the security team. Which solution should the company implement?

Accepted Answer

Enable RDS for Aurora database activity streams, stream to CloudWatch Logs, and export to S3 with S3 Object Lock enabled.. Amazon Aurora MySQL supports Database Activity Streams, which capture detailed audit information including login attempts (both successful and failed). These streams can be sent to Amazon CloudWatch Logs for monitoring and then exported to Amazon S3. To ensure immutability and restricted access, S3 Object Lock can be enabled, preventing any updates or deletions, and S3 bucket policies can limit access to only the security team. Option A is incorrect because VPC Flow Logs capture network-level traffic, not database login events. Option B is incorrect because AWS CloudTrail logs API calls made to AWS services, not database-level login attempts. Option D is incorrect because the standard MySQL audit log plugin stores logs in a table that can be modified, lacking immutability, and does not natively integrate with S3 Object Lock for long-term immutable storage.

Answer

Enable VPC Flow Logs to capture network connections to the database endpoint.

Answer

Enable AWS CloudTrail to log database login events.

Answer

Enable the standard MySQL audit log plugin and store logs in a database table with restricted access.

Question 9

A database administrator needs to audit all SQL statements executed on an Amazon RDS for Oracle DB instance. The audit logs must be stored in Amazon S3 for long-term retention and analysis with Amazon Athena. Which solution meets these requirements?

Accepted Answer

Configure Oracle's unified auditing and stream audit logs to CloudWatch Logs, then export to S3.. Oracle's unified auditing can be configured to stream audit logs to CloudWatch Logs, which can then be exported to Amazon S3 for long-term retention and analysis with Athena. Option A is incorrect because Enhanced Monitoring provides OS-level metrics, not SQL audit logs. Option C is incorrect because AWS CloudTrail captures API calls to RDS, not SQL statements executed within the database. Option D is incorrect because detailed billing reports do not include database query logs.

Answer

Enable Enhanced Monitoring on the RDS instance and publish logs to CloudWatch Logs.

Answer

Enable AWS CloudTrail to capture RDS API calls and store them in S3.

Answer

Enable detailed billing reports and configure them to include database queries.

Question 10

A company runs an Amazon Redshift cluster with 8 dc2.large nodes for its data warehouse. The data engineering team loads data daily using COPY commands from S3. Recently, the load times have increased significantly. The cluster's CloudWatch metric 'CPUUtilization' is high during the load. The administrator runs the STL_LOAD_ERRORS table and finds no errors. The SVL_S3LOG shows that the COPY command is scanning many small files. The data in S3 is stored as 10,000 small CSV files (each ~100 KB). Which action will MOST improve the COPY performance?

Accepted Answer

Consolidate the small files into fewer, larger files (e.g., 100 files of 10 MB each). Consolidating many small files into fewer, larger files reduces the overhead of opening and processing numerous small files during the COPY command. Redshift performs better with larger files (e.g., 64 MB to 1 GB) because it can parallelize the load across slices more efficiently. Option A is incorrect because the MANIFEST option helps with specifying files but does not address the root cause of many small files. Option B is incorrect because JSON format typically increases parsing overhead compared to CSV. Option D is incorrect because changing the distribution style to ALL does not improve COPY performance; it affects query performance after data is loaded.

Answer

Use the MANIFEST option to specify the files explicitly

Answer

Use the JSON format instead of CSV to reduce parsing overhead

Answer

Change the table's distribution style to ALL to avoid data redistribution

Question 11

A company has an Amazon RDS for Oracle DB instance that is publicly accessible. They want to restrict access to only a specific CIDR block. Which two actions must be taken together?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Take a snapshot of the DB instance, copy the snapshot with KMS encryption, and restore from the encrypted snapshot.. To change the encryption key from Oracle TDE to AWS KMS, you must take a snapshot of the DB instance, copy the snapshot with KMS encryption, and restore from the encrypted snapshot. This process enables encryption at rest with KMS. Option B is incorrect because you cannot directly enable KMS encryption on an existing TDE instance; this is not supported. Option C is incorrect because creating a read replica does not allow changing the encryption key; read replicas inherit the source instance's encryption. Option D is incorrect because you cannot modify the encryption key in place on an existing instance.

Answer

Enable KMS encryption directly on the existing DB instance using the AWS CLI.

Answer

Create a read replica with KMS encryption.

Answer

Modify the DB instance and select the KMS key.

Question 12

Which TWO AWS services can be used to monitor and alert on suspicious database access patterns in Amazon RDS? (Choose 2.)

Accepted Answer

Amazon CloudWatch. The correct answers are Amazon CloudWatch (B) and Amazon GuardDuty (E). Amazon CloudWatch can monitor RDS metrics and create alarms based on access patterns like failed login attempts. Amazon GuardDuty is a threat detection service that uses machine learning to identify suspicious database access activity. Option A (Amazon Inspector) is for vulnerability assessment, not monitoring access patterns. Option C (AWS Trusted Advisor) provides best practice checks and recommendations. Option D (AWS Config) is for resource configuration tracking and compliance.

Answer

Amazon Inspector

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 13

A company wants to restrict access to an Amazon DynamoDB table so that only specific IAM users can read and write data. What is the BEST way to achieve this?

Accepted Answer

Create an IAM policy that grants access to the DynamoDB table and attach it to the specific IAM users.. Using an IAM policy attached to specific IAM users is the most precise method to restrict access to a DynamoDB table. Resource-based policies are not supported for DynamoDB (Option A is wrong). VPC endpoints control network traffic but do not restrict which users can access the table (Option D is wrong). DynamoDB Accelerator (DAX) with IAM authentication handles caching and authentication, not table-level access control (Option C is wrong).

Answer

Use a resource-based policy on the DynamoDB table.

Answer

Use DynamoDB Accelerator (DAX) with IAM authentication.

Answer

Create a VPC endpoint for DynamoDB and allow only traffic from that VPC.

Question 14

A company has an Amazon RDS for MySQL DB instance that is publicly accessible. The security team wants to restrict access to only specific IP addresses. Which configuration should be used?

Accepted Answer

Configure a security group associated with the RDS instance to allow inbound traffic only from the specific IP addresses.. A security group associated with the RDS instance can be configured to restrict inbound traffic to specific IP addresses, even if the instance is publicly accessible. Option A is incorrect because a VPC endpoint is used for private connectivity from within a VPC, not for restricting public access. Option B is incorrect because IAM policies control permissions for API actions, not network-level access. Option D is incorrect because network ACLs are stateless and applied at the subnet level, and while they can filter IP traffic, security groups are the more appropriate and granular control for individual RDS instances.

Answer

Create a VPC endpoint for RDS and attach a policy that allows only the specific IP addresses.

Answer

Use an IAM policy with a condition that restricts the source IP address.

Answer

Configure a network ACL to allow inbound traffic from the specific IP addresses.

Question 15

A company is migrating its Oracle database to Amazon RDS for Oracle. The security team requires that all data be encrypted at rest using a customer-managed AWS KMS key. Which TWO steps are necessary to achieve this?

Accepted Answer

Migrate the data using Oracle Data Pump to the new encrypted instance.. To enable encryption at rest with a customer-managed KMS key in Amazon RDS for Oracle, you must create a new DB instance and specify the KMS key for encryption (Option C). Encryption cannot be enabled on an existing RDS instance without migrating to a new encrypted instance (Options B and D are incorrect). After creating the encrypted instance, you can migrate the Oracle database using Oracle Data Pump to the new encrypted instance (Option A). Using the default RDS encryption key (Option E) does not meet the requirement of a customer-managed key. Therefore, the two necessary steps are A and C.

Answer

Modify the DB instance to enable encryption using a KMS key.

Answer

Enable encryption at rest on the existing RDS instance by modifying the DB instance.

Answer

Use the default RDS encryption key (aws/rds) to encrypt the instance.

Question 16

A company is deploying a new web application that uses Amazon RDS for PostgreSQL. The database must be highly available with automatic failover across two Availability Zones. Which deployment option meets this requirement?

Accepted Answer

Deploy RDS PostgreSQL with Multi-AZ configuration.. Amazon RDS Multi-AZ deployment automatically provisions and maintains a synchronous standby replica in a different Availability Zone. If the primary DB instance fails, Amazon RDS automatically fails over to the standby, providing high availability with automatic failover across two AZs. This meets the requirement without manual intervention or application changes.

Answer

Deploy RDS PostgreSQL in a cross-region replication setup.

Answer

Deploy RDS PostgreSQL in a single Availability Zone.

Answer

Deploy RDS PostgreSQL with a read replica in another AZ.

Question 17

A company wants to restrict access to an Amazon RDS for MySQL DB instance so that only applications running in a specific VPC can connect. Which solution should be implemented?

Accepted Answer

Configure the DB instance's security group to allow inbound traffic only from the application's security group.. Security groups act as a virtual firewall for the DB instance, and by allowing inbound traffic only from the application's security group, access is restricted to resources in that VPC. Option A is incorrect because IAM policies control API-level permissions, not network-level access. Option C is incorrect because network ACLs are stateless and apply at the subnet level, not at the instance level. Option D is incorrect because security groups are not attached to subnets; they are attached to network interfaces.

Answer

Use an IAM policy to restrict database connections based on source IP.

Answer

Configure the subnet's network ACL to allow inbound traffic only from the application's IP range.

Answer

Attach a security group to the subnet that allows inbound traffic from the application's VPC.

Question 18

A company runs a production Amazon DynamoDB table with on-demand capacity. The security team requires that all access to the table be logged for compliance. What is the most cost-effective way to log every DynamoDB API call?

Accepted Answer

Enable AWS CloudTrail and create a trail that delivers logs to Amazon CloudWatch Logs.. AWS CloudTrail logs all DynamoDB API calls (e.g., GetItem, PutItem, Query) and can deliver these logs to CloudWatch Logs for monitoring and compliance. Option A is incorrect because DynamoDB Streams capture data modifications (INSERT, MODIFY, DELETE), not the API calls themselves. Option B is incorrect because CloudWatch Logs is a destination for logs, not a service that captures API calls directly; it relies on CloudTrail or other sources to send logs. Option C is incorrect because VPC Flow Logs record network traffic metadata (IP addresses, ports), not API-level calls.

Answer

Enable DynamoDB Streams on the table and process the stream with AWS Lambda.

Answer

Enable Amazon CloudWatch Logs to capture DynamoDB API calls.

Answer

Enable VPC Flow Logs and analyze them with Amazon Athena.

Question 19

A company is using Amazon RDS for Oracle with Transparent Data Encryption (TDE) enabled. They need to rotate the TDE master key. What is the correct procedure?

Accepted Answer

Use the AWS KMS RotateKey operation to rotate the customer master key (CMK) that is used for TDE.. In Amazon RDS for Oracle with TDE, the master key is stored in AWS KMS. To rotate the TDE master key, you can call the AWS KMS RotateKey operation on the customer master key (CMK) used for TDE, or use the Amazon RDS procedure rds.rds_rotate_tde_key. Option B is correct. Option A is incorrect because Oracle's ALTER SYSTEM SET ENCRYPTION KEY command rotates the Oracle-internal master key, not the KMS CMK, and RDS does not support direct Oracle TDE key rotation. Option C is incorrect because full migration is unnecessary. Option D is incorrect because modifying the DB instance to use a new KMS key changes the key, but does not rotate the existing TDE key.

Answer

Use Oracle's ALTER SYSTEM SET ENCRYPTION KEY command to rotate the key.

Answer

Create a new encrypted RDS instance and migrate the data.

Answer

Modify the DB instance to use a new KMS key.

Question 20

A company is troubleshooting an Amazon RDS for MySQL DB instance that is experiencing high CPU utilization. The DB instance is a db.t3.medium. Which TWO actions should the database administrator take to investigate the cause?

Accepted Answer

Enable Performance Insights to identify the top SQL queries consuming CPU.. Enabling Performance Insights provides visibility into which SQL queries are consuming CPU resources. Option E is correct because reviewing the slow query log helps identify queries with long execution times that may be causing high CPU. Option B is incorrect because disabling Multi-AZ does not help investigate CPU utilization; it reduces availability but not CPU. Option C is incorrect because increasing the query cache size is a tuning action, not an investigative step, and may not address the root cause. Option D is incorrect because increasing the DB instance class is a scaling fix, not an investigation method.

Answer

Disable Multi-AZ to reduce overhead.

Answer

Modify the DB parameter group to increase the query cache size.

Answer

Increase the DB instance class to a larger size.