DBS-C01 Practice Exam 54 — 20 Questions

Question 1

A company is migrating a 500 GB MongoDB database to Amazon DocumentDB. The migration is done using AWS DMS with full load and ongoing replication. The full load completes successfully, but during CDC, the DMS task logs show 'Memory limit exceeded' errors and the task fails repeatedly. The DMS replication instance is a dms.r5.large. The source MongoDB has a write-heavy workload with many small updates. The DBA needs to fix the migration without restarting from scratch. Which action should the DBA take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the DMS replication instance size to a larger instance class with more memory.. The 'Memory limit exceeded' error during CDC with a write-heavy workload indicates the replication instance lacks sufficient memory to buffer the changes. Increasing the instance size (e.g., to dms.r5.xlarge) provides more memory. Option B is wrong because reducing BatchApplyEnabled may slow down apply but does not increase memory; it could even worsen the backlog. Option C is wrong because restarting just clears cache temporarily; the error will recur. Option D is wrong because Multi-AZ provides high availability, not additional memory.

Answer

Reduce the DMS task's 'BatchApplyEnabled' setting to apply transactions individually.

Answer

Stop and restart the DMS task to clear the cache.

Answer

Enable Multi-AZ on the DMS replication instance to distribute the load.

Question 2

Which TWO AWS services can be used to migrate a MongoDB database to Amazon DocumentDB? (Choose 2.)

Accepted Answer

AWS Database Migration Service (AWS DMS). Option B (AWS Database Migration Service (AWS DMS)) is correct because AWS DMS natively supports MongoDB as a source and Amazon DocumentDB as a target, allowing both one-time full-load migrations and ongoing change data capture (CDC) replication with minimal downtime. Option D (MongoDB native tools (mongodump and mongorestore)) is correct because DocumentDB is MongoDB-compatible, so you can dump the source MongoDB database with mongodump and restore the BSON/JSON output into DocumentDB using mongorestore, which is a documented migration approach. Option A (AWS DataSync) is not appropriate because it is an agent-based file/object transfer service for data stores like NFS, SMB, and Amazon S3, not a database migration tool. Option C (Amazon S3) is only a storage intermediary and cannot by itself migrate a MongoDB database into DocumentDB. Option E (Amazon Kinesis Data Streams) is a real-time streaming ingestion service and does not perform database migration.

Answer

AWS DataSync

Answer

Amazon S3

Answer

Amazon Kinesis Data Streams

Question 3

A company needs to securely store and manage the master password for their Amazon RDS for PostgreSQL instance. Which AWS service is purpose-built for managing secrets with automatic rotation?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is purpose-built for storing, managing, and automatically rotating secrets such as database credentials. It natively integrates with Amazon RDS for PostgreSQL to rotate master passwords on a schedule using a Lambda rotation function, eliminating hardcoded credentials. KMS encrypts the secret at rest, but Secrets Manager provides the rotation and lifecycle management.

Answer

AWS Key Management Service (KMS)

Answer

AWS Identity and Access Management (IAM)

Answer

AWS CloudHSM

Question 4

A company wants to migrate an on-premises Oracle database to Amazon Aurora PostgreSQL. They need to convert the schema and code. Which AWS service should they use?

Accepted Answer

AWS Schema Conversion Tool (SCT). AWS Schema Conversion Tool (SCT) is the correct choice because it is specifically designed to convert database schemas and code objects (such as stored procedures, functions, and triggers) from one database engine to another. For an Oracle-to-Aurora PostgreSQL migration, SCT analyzes the source schema, identifies incompatible data types and syntax, and generates equivalent PostgreSQL DDL and PL/pgSQL code, handling complex conversions like Oracle sequences to PostgreSQL sequences and Oracle packages to PostgreSQL schemas.

Answer

AWS Lambda

Answer

Amazon S3

Answer

AWS Database Migration Service (DMS)

Question 5

A database specialist is troubleshooting an Amazon RDS for SQL Server instance that is running out of storage. The instance has 500 GB of provisioned storage and is using General Purpose SSD (gp2). The specialist wants to set up an alarm to notify when free storage space drops below 50 GB. Which CloudWatch metric and threshold should be used?

Accepted Answer

Monitor the 'FreeStorageSpace' metric in bytes and set a threshold of 53687091200.. The correct CloudWatch metric for free storage space on an RDS instance is 'FreeStorageSpace', which is reported in bytes. To set an alarm for when free space drops below 50 GB, you must convert 50 GB to bytes: 50 * 1024^3 = 53,687,091,200 bytes. Therefore, the threshold should be 53687091200.

Answer

Monitor the 'FreeStorageSpace' metric in percent and set a threshold of 10.

Answer

Monitor the 'DiskSpaceUtilization' metric and set a threshold of 90.

Answer

Monitor the 'FreeStorageSpace' metric in gigabytes and set a threshold of 50.

Question 6

A developer needs to allow an application running on an EC2 instance to connect to an Amazon RDS for MySQL DB instance securely. Which combination of steps should the developer take?

Accepted Answer

Attach an IAM role to the EC2 instance with permissions to use RDS IAM authentication, and configure the database to use an authentication token.. The most secure method to allow an EC2 instance to connect to an RDS for MySQL DB instance is to use IAM roles for EC2 combined with IAM database authentication. By attaching an IAM role to the EC2 instance that has permissions to generate RDS authentication tokens, and configuring the DB instance to accept authentication tokens instead of passwords, the application can obtain temporary credentials without hardcoding or storing any secrets. Option A is insecure because storing credentials in application code exposes them to anyone with access to the code. Option B is insecure because opening the security group to all traffic (0.0.0.0/0) exposes the database to the internet. Option C is insecure because storing credentials in S3 and downloading them at runtime still involves storing static credentials and adds potential risk from S3 access misconfiguration.

Answer

Store the database password in the application code.

Answer

Open the RDS security group to allow traffic from 0.0.0.0/0.

Answer

Store the credentials in an S3 bucket and download them at runtime.

Question 7

A company runs a MySQL-compatible database on Amazon RDS with a 3 TB dataset. They need to run complex analytical queries that involve joins and aggregations on millions of rows. The current RDS instance is a db.r5.8xlarge with 32 vCPUs and 256 GB RAM, but complex queries take over an hour. Which design change would most improve query performance for this workload?

Accepted Answer

Use Amazon Redshift for the analytical workload. Amazon Redshift is a fully managed, petabyte-scale data warehouse service optimized for complex analytical queries involving joins and aggregations on large datasets. Unlike RDS, which is designed for OLTP workloads, Redshift uses columnar storage, massively parallel processing (MPP), and automatic compression to dramatically reduce query times for analytical workloads. Migrating the analytical workload to Redshift offloads the heavy processing from the RDS instance, allowing it to continue serving transactional queries efficiently.

Answer

Migrate to Amazon Aurora with parallel query

Answer

Add an Amazon ElastiCache cluster to cache query results

Answer

Enable DynamoDB Accelerator (DAX) on the RDS instance

Question 8

A company is using Amazon RDS for PostgreSQL and needs to monitor the database for performance issues. Which TWO metrics in Amazon CloudWatch are most useful for identifying I/O bottlenecks?

Accepted Answer

ReadIOPS. ReadIOPS (A) is correct because it reports the average number of disk read I/O operations per second, so a sustained high or spiking ReadIOPS value directly signals heavy read activity that can saturate the underlying EBS storage and reveal an I/O bottleneck. DiskQueueDepth (C) is correct because it measures the number of outstanding I/O requests waiting to be serviced; a growing queue indicates the storage subsystem cannot keep up with demand, which is a classic indicator of an I/O bottleneck. FreeStorageSpace (B) is not marked correct because it only shows remaining allocated storage and relates to capacity exhaustion, not I/O throughput or latency. DatabaseConnections (D) is not marked correct because it reflects the number of active client sessions, which points to connection or concurrency issues rather than disk I/O pressure. CPUUtilization (E) is not marked correct because it measures compute load on the DB instance, which can be high for reasons unrelated to storage I/O and does not directly identify an I/O bottleneck.

Answer

FreeStorageSpace

Answer

DatabaseConnections

Answer

CPUUtilization

Question 9

A company is using Amazon DynamoDB Accelerator (DAX) for caching. The security team is concerned about data in transit between the application and DAX. What should the team do to ensure that all traffic to DAX is encrypted?

Accepted Answer

Enable encryption in transit when creating the DAX cluster.. To ensure all traffic to DAX is encrypted in transit, you must enable encryption in transit when creating the DAX cluster. This setting enforces TLS for all connections between the application and the DAX cluster, protecting data as it travels over the network. It is a cluster-level configuration that cannot be changed after creation, so it must be set at launch.

Answer

Launch the DAX cluster in a private subnet with a VPC endpoint.

Answer

Use AWS Certificate Manager to issue a certificate for the DAX cluster.

Answer

Use client-side encryption to encrypt data before sending it to DAX.

Question 10

A company is planning to migrate a 3 TB PostgreSQL database from an on-premises data center to Amazon Aurora PostgreSQL. The migration must have near-zero downtime. The on-premises database is using a custom pg_hba.conf that restricts access to specific IP ranges. Which combination of steps will meet the requirements?

Accepted Answer

Use AWS DMS with ongoing replication to an Aurora DB cluster. Configure the source endpoint with the appropriate connection settings.. AWS DMS with ongoing replication (CDC) enables near-zero downtime migration by continuously synchronizing changes from the source PostgreSQL database to the target Aurora PostgreSQL cluster after an initial full load. Configuring the source endpoint with the correct connection settings, including the custom pg_hba.conf IP ranges, allows DMS to connect securely. This approach meets the requirement for minimal downtime, unlike batch export/import methods.

Answer

Create an Aurora Replica of the on-premises database using cross-Region replication.

Answer

Use pg_dump and pg_restore to export and import the database during a maintenance window.

Answer

Use AWS SCT to convert the schema and then perform a full data load using AWS DMS.

Question 11

A developer accidentally exposed an Amazon RDS snapshot to the public. What is the quickest way to remediate this issue?

Accepted Answer

Modify the snapshot permissions to set it to private.. The quickest remediation is to modify the snapshot permissions to make it private. This immediately revokes public access. Option A is incorrect because deleting the snapshot would remove the backup entirely, which is unnecessary and could risk data loss if no other backup exists. Option B is incorrect because copying the snapshot does not change the original's permissions; the original remains public. Option C is incorrect because sharing with a specific account does not revoke public access; it only adds an additional permission. Therefore, modifying the snapshot to private is the direct and fastest fix.

Answer

Delete the snapshot and create a new one from the source DB instance.

Answer

Copy the snapshot to a new snapshot and delete the original.

Answer

Share the snapshot with only the required AWS account.

Question 12

Which TWO actions should a company take to secure an Amazon RDS for MySQL database that is accessible from the internet? (Choose two.)

Accepted Answer

Use a security group that restricts inbound traffic to only the required IP addresses.. Option A is correct because an RDS security group acts as a virtual firewall controlling inbound traffic to the DB instance, so restricting it to only the required source IP addresses (or CIDR ranges) on the MySQL port (3306) prevents arbitrary internet access. Option E is correct because placing the DB instance in a private subnet with no public IP address removes the route to the internet entirely, so the database can only be reached from within the VPC or via controlled paths such as a bastion host, VPN, or Direct Connect. Option B is wrong because disabling encryption at rest weakens security and does not meaningfully reduce latency; encryption at rest should remain enabled. Option C is wrong because a default VPC public subnet with a network ACL allowing all traffic is permissive and exposes the database. Option D is wrong because launching the instance in a public subnet with a public IP address directly exposes it to the internet, which is the opposite of the desired hardening.

Answer

Disable encryption at rest to reduce latency.

Answer

Use the default VPC with a public subnet and a network ACL that allows all traffic.

Answer

Launch the DB instance in a public subnet with a public IP address.

Question 13

Which THREE of the following are best practices for managing Amazon DynamoDB tables with provisioned throughput?

Accepted Answer

Use a composite key design with a sort key to enable efficient querying.. Option C is correct because a composite primary key (partition key plus sort key) lets related items share a partition while enabling efficient Query operations on the sort key, avoiding costly Scan operations and reducing consumed read capacity. Option D is correct because DynamoDB Auto Scaling uses CloudWatch metrics to automatically adjust provisioned read/write capacity units within defined minimum and maximum ranges, matching capacity to traffic and preventing throttling or over-provisioning. Option E is correct because DAX is an in-memory cache for DynamoDB that serves eventually consistent reads in microseconds, dramatically reducing read load on the table for frequently accessed items and lowering consumed read capacity. Option A is not a best practice because creating a global secondary index on every attribute multiplies storage and write costs, since each GSI is maintained synchronously on every write, and indexes should be created only for known access patterns. Option B is not a best practice because DynamoDB manages partitions automatically; manually splitting hot partitions is not possible in the same way as with self-managed databases, and hot partitions should instead be addressed through good key design or write sharding.

Answer

Create a global secondary index on every attribute to support any query pattern.

Answer

Split hot partitions manually to distribute write traffic.

Question 14

An Amazon RDS for MySQL instance is running out of storage. Which TWO actions can be taken to resolve this issue without downtime?

Accepted Answer

Enable storage auto scaling to automatically add storage.. Option A is correct because RDS storage auto scaling monitors the DB instance's free storage and automatically increases allocated storage when it falls below a defined threshold, applying the change without downtime. Option C is correct because modifying the DB instance's AllocatedStorage parameter increases the storage size, and RDS performs this scaling operation online without taking the database offline. Option B is not a reliable resolution because deleting data is a manual, potentially destructive workaround rather than an RDS storage-management action, and it may not be feasible or sufficient. Option D is incorrect because taking a snapshot and restoring creates a new DB instance, which involves downtime and endpoint changes rather than resolving the issue in place. Option E is incorrect because converting to Amazon Aurora is a migration to a different engine, not a no-downtime fix for the existing MySQL instance's storage shortage.

Answer

Delete unnecessary data from the instance.

Answer

Take a snapshot and restore to a larger instance.

Answer

Convert the instance to Amazon Aurora.

Question 15

An e-commerce application uses Amazon Aurora MySQL with a Multi-AZ DB cluster. During a recent load test, the application experienced increased read latency. The database cluster consists of one writer and two reader instances. Which THREE actions should be taken to improve read performance?

Accepted Answer

Add more reader instances to the cluster.. Option C is correct because adding more Aurora reader instances to the cluster distributes read traffic across additional endpoints, directly reducing the load and read latency on existing readers. Option D is correct because Aurora Auto Scaling automatically adds or removes Aurora Replicas based on metrics like CPU utilization or connections, ensuring read capacity scales with demand during load tests. Option E is correct because ElastiCache (Redis or Memcached) offloads frequent, repetitive read queries from Aurora, reducing database read pressure and improving response times. Option A is not appropriate because cross-Region read replicas address disaster recovery and geographic read locality, not intra-cluster read latency. Option B is not appropriate because increasing the writer instance class scales write capacity and does not relieve read latency on the reader instances.

Answer

Configure cross-Region read replicas.

Answer

Increase the instance class of the writer instance.

Question 16

Which THREE of the following are best practices for securing an Amazon Aurora MySQL database? (Select THREE.)

Accepted Answer

Enable encryption at rest using AWS KMS.. Option A is correct because enabling encryption at rest with AWS KMS protects Aurora MySQL storage volumes, snapshots, and automated backups using customer-managed or AWS-managed keys, ensuring data cannot be read if the underlying storage is compromised. Option B is correct because Aurora MySQL advanced auditing (via the server_audit_plugins or Database Activity Streams) logs connections, queries, and DDL/DML events to CloudWatch Logs, enabling detection of suspicious activity and supporting compliance requirements. Option D is correct because IAM database authentication lets Aurora MySQL use short-lived authentication tokens instead of long-lived passwords, eliminating stored credentials and integrating access control with IAM policies and roles. Option C is not recommended because hardcoding credentials in application code exposes secrets in source control and build artifacts; AWS Secrets Manager or IAM auth should be used instead. Option E is not recommended because disabling automated backups removes point-in-time recovery and increases risk from accidental deletion or ransomware, which does not meaningfully reduce attack surface.

Answer

Store database credentials in application code for simplicity.

Answer

Disable automated backups to reduce attack surface.

Question 17

A company uses Amazon Aurora MySQL for its e-commerce platform. The DB cluster has one writer and two readers. Recently, the application started showing occasional deadlock errors during order processing. The error logs show: 'Transaction (Process ID 123) was deadlocked on lock resources with another process and has been chosen as the deadlock victim. Rerun the transaction.' The application retries three times before failing. The development team wants to reduce the likelihood of deadlocks. Which three actions should the team take? (Choose three.)

Accepted Answer

Shorten the duration of transactions by committing frequently.. Reduces the time locks are held, decreasing contention. Option C uses a weaker isolation level (READ COMMITTED) that reduces locking overhead compared to REPEATABLE READ. Option E ensures transactions request locks in a consistent order, preventing cycle dependencies. Option B is incorrect because READ UNCOMMITTED can cause dirty reads and is not suitable for e-commerce order processing. Option D is incorrect because increasing retry attempts does not reduce the likelihood of deadlocks; it only allows more retries after a deadlock occurs.

Answer

Switch to READ UNCOMMITTED isolation level to reduce locking.

Answer

Increase the number of retry attempts to 10.

Question 18

A company is migrating an on-premises Oracle OLTP workload to AWS. The database has complex stored procedures and requires minimal code changes. Which AWS database service is the most suitable target?

Accepted Answer

Amazon RDS for Oracle. Amazon RDS for Oracle is the most suitable target because it provides native Oracle compatibility, allowing the existing complex stored procedures and PL/SQL code to run with minimal or no changes. This minimizes migration risk and effort, which is the primary requirement for an OLTP workload with complex stored procedures.

Answer

Amazon Redshift

Answer

Amazon DynamoDB

Answer

Amazon Aurora PostgreSQL

Question 19

A financial services company runs a critical PostgreSQL database on Amazon RDS. The database stores transaction records and requires point-in-time recovery (PITR) with a recovery window of 35 days. The database size is 500 GB and grows at 10 GB per day. The team wants to minimize storage costs while meeting the recovery SLA. Which backup strategy should they use?

Accepted Answer

Enable automated backups with a retention period of 35 days. Amazon RDS automated backups provide point-in-time recovery within the retention period (up to 35 days) by storing daily snapshots and transaction logs, allowing recovery to any second. Option A is incorrect because manual snapshots every hour would be costly and provide less granular recovery compared to automated backups with transaction logs. Option C is incorrect because pg_dump to S3 only provides daily full backups, not point-in-time recovery to an arbitrary second. Option D is incorrect because AWS Backup cross-region copies are for disaster recovery, not for local PITR, and would incur additional costs.

Answer

Take manual snapshots every hour and retain for 35 days

Answer

Disable automated backups and use pg_dump to S3 daily

Answer

Use AWS Backup to copy snapshots to another region daily

Question 20

A company is designing a database for an IoT application that ingests millions of small sensor readings per second. The data is append-only and queries are primarily time-based aggregations with low latency requirements (under 10 ms). Which AWS database service is most suitable for this workload?

Accepted Answer

Amazon Timestream. Amazon Timestream is a purpose-built time-series database designed for IoT and operational applications that ingest high volumes of append-only data. It automatically manages storage tiers (in-memory and magnetic) and provides built-in time-based aggregation functions, enabling queries with sub-10 ms latency for recent data. This makes it the most suitable choice for the described workload of millions of sensor readings per second with low-latency aggregation queries.

Answer

Amazon DynamoDB

Answer

Amazon ElastiCache

Answer

Amazon Aurora