DBS-C01 Practice Exam 55 — 20 Questions

Question 1

A company is running a MySQL database on Amazon RDS for a web application. The application experiences read-heavy traffic, and the company wants to improve read performance without changing the application code. Which design should the database specialist recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create one or more read replicas of the RDS DB instance.. Amazon RDS read replicas allow you to offload read traffic from the primary DB instance without any application code changes. The application simply connects to the read replica endpoint(s) for SELECT queries, while writes continue to the primary instance. This directly addresses the read-heavy workload by distributing read requests across multiple copies of the database.

Answer

Implement an Amazon ElastiCache Redis cluster in front of the database.

Answer

Increase the instance size of the RDS DB instance.

Answer

Enable DynamoDB Accelerator (DAX) for the RDS instance.

Question 2

A company runs an Amazon RDS for Oracle DB instance. The database administrator wants to receive an alert when the storage space is below 10% of the allocated storage. Which Amazon CloudWatch metric and alarm threshold should be used?

Accepted Answer

Metric: FreeStorageSpace, Condition: < 10% of 100 GB (10 GB). The correct metric is FreeStorageSpace, which reports the available storage in bytes. To alert when storage is below 10% of allocated, compute the threshold as 10% of the total allocated storage (e.g., 10 GB for 100 GB). Option A defines the condition correctly. Option B is wrong because BinaryLogUsage applies to MySQL, not Oracle. Option C is incorrect as FreeableMemory tracks memory, not storage. Option D is wrong because DiskQueueDepth measures I/O queue depth, not storage capacity.

Answer

Metric: BinaryLogUsage, Condition: > 10%

Answer

Metric: FreeableMemory, Condition: < 10% of total memory

Answer

Metric: DiskQueueDepth, Condition: > 10

Question 3

A company is moving a large-scale time-series application from Cassandra to a managed AWS service. The workload involves high-frequency writes (millions per second) and queries that aggregate data over time windows. Which THREE AWS services are suitable for this time-series workload?

Accepted Answer

Amazon OpenSearch Service. Amazon Timestream (D) is purpose-built for time-series data, offering a serverless architecture that automatically scales for high-frequency ingestion and includes built-in time-series functions for windowed aggregations, making it the most natural fit for this workload. Amazon DynamoDB (C) is suitable because it handles millions of writes per second at scale with predictable single-digit millisecond latency, and its time-to-live (TTL) feature plus composite partition/sort keys (e.g., device ID + timestamp) support efficient time-range queries. Amazon OpenSearch Service (A) is also appropriate since it ingests high-volume time-stamped data and provides powerful aggregation queries (date histograms, range queries) over time windows, commonly used for time-series analytics and log/metric analysis. Amazon Aurora (B) is a relational OLTP database and does not scale economically to millions of writes per second for time-series ingestion, and Amazon Redshift (E) is a columnar data warehouse optimized for batch analytics rather than high-frequency real-time writes, so neither fits this scenario.

Answer

Amazon Aurora

Answer

Amazon Redshift

Question 4

A company is using Amazon RDS for MySQL to host a web application. The security team has identified that the application is vulnerable to SQL injection attacks. The team wants to implement a defense-in-depth strategy to protect the database. Which THREE measures should be taken to mitigate SQL injection risks?

Accepted Answer

Grant the minimum required permissions to the database user used by the application.. Options A, C, and E are correct. Parameterized queries (C) prevent SQL injection by separating SQL logic from data. Least privilege (A) reduces the impact if injection occurs. AWS WAF (E) provides a web application firewall to filter malicious input before it reaches the database. Option B is incorrect because stored procedures alone do not prevent SQL injection unless they use parameterized queries. Option D is incorrect because encryption at rest protects data at rest but does not prevent SQL injection.

Answer

Move all SQL logic into stored procedures.

Answer

Enable encryption at rest for the RDS instance.

Question 5

A company is deploying a MongoDB-compatible database using Amazon DocumentDB. The application requires the ability to perform ad-hoc queries on nested fields within documents. Which DocumentDB feature should be enabled to meet this requirement?

Accepted Answer

Indexes on nested fields. Amazon DocumentDB supports indexing on nested fields, which allows efficient querying of sub-documents and arrays within documents. By creating indexes on specific nested paths (e.g., "address.city"), the query engine can perform index scans instead of full collection scans, enabling fast ad-hoc queries on nested fields. This feature directly meets the requirement for ad-hoc queries on nested fields.

Answer

TTL indexes

Answer

Transactions

Answer

Change streams

Question 6

Refer to the exhibit. An IAM policy allows creation of a DMS replication task only if the source database engine is Oracle. A user attempts to create a replication task with a MySQL source. What will happen?

Accepted Answer

The action will be denied because the condition does not match.. The IAM policy includes a condition that requires the source engine to be Oracle. When the user attempts to create a DMS replication task with a MySQL source, the condition fails, and IAM denies the action by default. The explicit deny is not needed; IAM uses an implicit deny when no policy statement allows the action under the given conditions.

Answer

The action will fail with an error because the policy is malformed.

Answer

The action will succeed but the task will fail later.

Answer

The action will be allowed because the resource is '*'.

Question 7

A company needs to migrate an on-premises PostgreSQL database to Amazon Aurora PostgreSQL. The database is 2 TB in size and has a 24/7 uptime requirement. Which AWS service should be used to perform the migration with minimal downtime?

Accepted Answer

AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) is the correct choice because it supports ongoing replication from an on-premises PostgreSQL source to Amazon Aurora PostgreSQL, enabling a migration with minimal downtime. DMS can perform a full load of the 2 TB database and then continuously replicate changes using PostgreSQL's logical replication (via the pglogical extension or native slot-based replication) until the cutover, keeping the source available throughout the process.

Answer

AWS Schema Conversion Tool (SCT)

Answer

AWS S3

Answer

pg_dump and pg_restore

Question 8

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database contains personally identifiable information (PII). The security team requires that the data be encrypted at rest using a customer-managed key stored in AWS KMS. Additionally, the team wants to ensure that the key can be rotated automatically every year. What should the company do to meet these requirements?

Accepted Answer

Create a customer-managed key in AWS KMS, enable automatic rotation, and enable encryption on the RDS instance using that key.. The correct approach is to create a customer-managed key in AWS KMS with automatic rotation enabled, then enable encryption on the RDS instance using that key. This meets the requirements for encryption at rest with a customer-managed key and automatic annual rotation. Option A is incorrect because AWS Secrets Manager is used for storing secrets, not encryption keys. Option C lacks automatic rotation. Option D uses an AWS managed key, not customer-managed, and requires a manual Lambda function, not automatic rotation.

Answer

Enable encryption on the RDS instance using the default RDS encryption and use AWS Secrets Manager to store the key.

Answer

Create a customer-managed key in AWS KMS without automatic rotation, and manually rotate the key using the RDS console.

Answer

Use an AWS managed key for RDS and create an AWS Lambda function to rotate the key manually each year.

Question 9

A company is using Amazon DynamoDB with fine-grained access control using IAM policies. The security team wants to ensure that a specific IAM role can only read the 'status' attribute from items in a table. The table is named 'Orders'. Which IAM policy statement should be used?

Accepted Answer

Condition: { 'ForAllValues:StringEquals': { 'dynamodb:Attributes': ['status'] } }. It uses the `dynamodb:Attributes` condition key with `ForAllValues:StringEquals` to restrict the request to only access the 'status' attribute. This ensures the role can only read the 'status' attribute, meeting the requirement. Option A incorrectly uses the condition to match the literal value 'active' as an attribute name. Options C and D use invalid or irrelevant condition keys.

Answer

Condition: { 'ForAllValues:StringEquals': { 'dynamodb:Attributes': ['active'] } }

Answer

Condition: { 'ForAllValues:StringEquals': { 'dynamodb:ReturnValues': 'ALL_OLD' } }

Answer

Condition: { 'StringEquals': { 'dynamodb:Select': 'SPECIFIC_ATTRIBUTES' } }

Question 10

A database administrator notices that an Amazon RDS for MySQL DB instance's CPU utilization is consistently above 90% during peak hours. Which initial troubleshooting step should the administrator take?

Accepted Answer

Use Amazon RDS Performance Insights to identify the queries consuming CPU.. Amazon RDS Performance Insights provides detailed database performance metrics and helps identify the specific queries contributing to high CPU utilization, enabling targeted optimization. Option A is incorrect because increasing instance size is a reactive scaling action rather than a diagnostic step; it does not identify the root cause. Option C is incorrect because Multi-AZ deployment is designed for high availability and failover, not for distributing load or improving performance. Option D is incorrect because disabling slow query logging removes valuable diagnostic information that could help identify problematic queries.

Answer

Increase the DB instance size to handle the load.

Answer

Enable Multi-AZ deployment to distribute the load.

Answer

Disable slow query logging to reduce CPU overhead.

Question 11

A company is migrating a MongoDB database to Amazon DocumentDB. They have a 200 GB database and need to minimize downtime. Which migration approach is most appropriate?

Accepted Answer

Use AWS DMS to migrate data from MongoDB to DocumentDB.. AWS DMS with ongoing replication (change data capture) is the most appropriate migration approach for minimizing downtime when migrating a 200 GB MongoDB database to Amazon DocumentDB. DMS can perform an initial load and then continuously replicate ongoing changes from the source MongoDB to the target DocumentDB until cutover, resulting in near-zero downtime. Option B is incorrect because native MongoDB replication is not supported by DocumentDB; DocumentDB cannot join a MongoDB replica set.

Answer

Take an EBS snapshot of the MongoDB volume and restore it to DocumentDB.

Answer

Set up MongoDB replication from the source to DocumentDB, then promote DocumentDB.

Answer

Export the database using mongodump and import using mongorestore into DocumentDB.

Question 12

A database engineer is troubleshooting slow query performance on an Amazon RDS for PostgreSQL instance. The instance is db.r5.large with 500 GB of General Purpose SSD (gp2) storage. CloudWatch metrics show high Read Latency and high Read IOPS, but low CPU utilization. Which TWO actions should the engineer take to improve performance?

Accepted Answer

Create a read replica and offload read queries to it.. A is correct because creating a read replica offloads read queries from the primary instance, reducing the read IOPS and read latency on the primary. This directly addresses the high Read Latency and high Read IOPS metrics without requiring a larger instance class or storage change, especially since CPU utilization is low, indicating the bottleneck is I/O, not compute.

Answer

Increase the DB instance class to a larger size, such as db.r5.2xlarge.

Answer

Enable Multi-AZ to use the standby for read traffic.

Answer

Optimize queries by adding appropriate indexes.

Question 13

A company is using Amazon RDS for MySQL and needs to restrict access to the database to only specific Amazon EC2 instances in the same VPC. Which security mechanism should be used?

Accepted Answer

Configure a VPC security group that allows inbound traffic from the EC2 security groups.. In a VPC, RDS instances use VPC security groups to control inbound traffic. Configuring a VPC security group that allows inbound traffic from the EC2 security groups is the correct mechanism. Option B is incorrect because IAM policies control API access, not network connectivity. Option C is incorrect because subnet groups define subnets for deployment, not security rules. Option D is incorrect because network ACLs are stateless, apply to entire subnets, and cannot reference security groups or specific instances.

Answer

Create an IAM policy that allows the EC2 instances to connect to the RDS instance.

Answer

Create a DB subnet group that includes only the subnets where the EC2 instances reside.

Answer

Modify the network ACL for the DB subnet to allow traffic from the EC2 instances' IP addresses.

Question 14

A company is using Amazon RDS for PostgreSQL and needs to implement column-level encryption for sensitive data. The application must be able to encrypt and decrypt data transparently. Which approach should be taken?

Accepted Answer

Install the pgcrypto extension on the RDS instance and use its functions to encrypt data at the column level.. Pgcrypto is a PostgreSQL extension that provides column-level encryption functions, allowing the application to encrypt and decrypt data transparently at the column level. Option A is incorrect because RDS encryption at rest encrypts the entire database storage, not individual columns. Option B is incorrect because using AWS Lambda would require application modifications and introduce additional latency. Option C is incorrect because AWS KMS is a key management service, not a direct column-level encryption solution for databases, and using its APIs would require building encryption logic in the application.

Answer

Enable RDS encryption at rest using a KMS key, which will automatically encrypt all columns.

Answer

Use AWS Lambda to encrypt data before writing to the database and decrypt after reading.

Answer

Use the AWS KMS Encrypt and Decrypt APIs directly in the application code.

Question 15

A company is designing a database for an e-commerce platform that needs to store product catalog data. The data is highly relational with many-to-many relationships between products, categories, and suppliers. The platform requires ACID transactions and complex joins. Which TWO AWS database solutions are suitable for this workload? (Choose TWO.)

Accepted Answer

Amazon Aurora MySQL. Amazon Aurora MySQL is a fully ACID-compliant relational database that supports complex joins and many-to-many relationships through foreign keys and junction tables. It is optimized for high-throughput e-commerce workloads with features like auto-scaling storage and up to 15 low-latency read replicas, making it suitable for product catalog data that requires transactional consistency.

Answer

Amazon ElastiCache for Redis

Answer

Amazon Neptune

Answer

Amazon DynamoDB

Question 16

A startup needs a fully managed relational database with automated backups and scaling. They expect unpredictable workloads. Which AWS service meets these requirements?

Accepted Answer

Amazon Aurora Serverless. Amazon Aurora Serverless is a fully managed relational database that automatically scales capacity up or down based on application demand, making it ideal for unpredictable workloads. It also provides automated backups, continuous backups to Amazon S3, and point-in-time recovery, meeting all stated requirements.

Answer

Amazon DynamoDB

Answer

Amazon Redshift

Answer

Amazon ElastiCache

Question 17

A company is using Amazon DynamoDB to store customer session data. The security team requires that all data is encrypted at rest using a customer-managed KMS key, and that access to the key is restricted to specific IAM roles. The company also wants to ensure that DynamoDB Accelerator (DAX) cluster is encrypted. Which steps should be taken to meet these requirements?

Accepted Answer

Create the DynamoDB table with encryption using a customer-managed KMS key. Create the DAX cluster and enable encryption at rest using the same KMS key.. DynamoDB tables can be encrypted at rest with a customer-managed KMS key at creation, and DAX clusters also support encryption at rest using the same or a different KMS key, meeting the requirement. Option B is wrong because DynamoDB encryption cannot be enabled after table creation; it must be specified at creation. Option C is wrong because it uses default encryption (AWS managed key) for the table, not a customer-managed key. Option D is wrong because it refers to encryption in transit (TLS) for DAX, but the requirement is for encryption at rest; DAX encryption at rest is not addressed.

Answer

Create the DynamoDB table without encryption, then use the AWS CLI to enable encryption after creation.

Answer

Create the DynamoDB table with default encryption, and create the DAX cluster with a separate customer-managed KMS key.

Answer

Create the DynamoDB table with encryption using a customer-managed key, and enable encryption in transit on the DAX cluster using TLS.

Question 18

Refer to the exhibit. A company uses this DynamoDB table to store user session data. The application frequently queries by user_id alone to get all sessions for a user. However, the query is slow. What is the most likely cause?

Accepted Answer

The table's partition key is session_id, not user_id, so querying by user_id requires a scan.. The table's primary key is session_id, not user_id. Querying by user_id without a secondary index forces DynamoDB to perform a full table scan, which reads every item and is significantly slower than a query operation. This is the most likely cause of the slow performance.

Answer

The table has no sort key on user_id.

Answer

The table has too many items, causing slow scans.

Answer

The provisioned read capacity is too low.

Question 19

A gaming company uses Amazon DynamoDB as the database for user profiles and game state. The application requires strongly consistent reads for the user's own profile, but eventually consistent reads for leaderboard queries. How should the company design the table and queries?

Accepted Answer

Use the ConsistentRead parameter set to true for profile queries and false for leaderboard queries.. DynamoDB supports both strongly consistent reads and eventually consistent reads on the same table, controlled by the `ConsistentRead` parameter in the `GetItem`, `Query`, or `Scan` API calls. Setting `ConsistentRead=true` for profile queries ensures the most up-to-date data, while `ConsistentRead=false` (the default) for leaderboard queries provides lower latency and higher throughput, which is ideal for read-heavy, non-critical data. This design avoids the cost and complexity of multiple tables or additional services.

Answer

Create two separate tables: one for strong consistency and one for eventual consistency.

Answer

Enable DynamoDB Accelerator (DAX) for strong consistency on all reads.

Answer

Configure DynamoDB Streams to replicate data to a second table for strong consistency.

Question 20

A company runs an e-commerce platform on Amazon RDS for PostgreSQL. During a flash sale, the database experiences high write load and read replicas lag significantly. The application uses read replicas for reporting queries. Which design change would most effectively reduce replica lag without compromising write performance?

Accepted Answer

Migrate to Amazon Aurora with read replicas.. Amazon Aurora's distributed storage architecture decouples compute from storage, allowing replicas to apply redo logs with minimal overhead compared to RDS for PostgreSQL's physical replication. Aurora's replicas share the same underlying storage volume, so replica lag is significantly reduced even under heavy write loads, while write performance on the primary remains unaffected due to the asynchronous, log-based replication mechanism.

Answer

Increase the instance size of the primary database.

Answer

Add more read replicas to distribute the reporting load.

Answer

Convert the RDS instance to a Multi-AZ deployment.