DBS-C01 Practice Exam 56 — 20 Questions

Question 1

Which THREE measures can help protect an Amazon RDS database from a DDoS attack? (Choose 3.)

Accepted Answer

Place the RDS instance in a private subnet without direct internet access.. Placing the RDS instance in a private subnet without direct internet access (Option A) prevents any external traffic from reaching the database endpoint, removing the attack surface entirely. Using security groups to restrict inbound traffic to known IP addresses (Option B) limits the sources that can initiate connections, reducing the potential for volumetric attacks. AWS Shield Advanced (Option D) provides additional DDoS mitigation capabilities, including detection and automatic application-layer protections. These three measures work together to defend against different attack vectors.

Answer

Make the RDS instance publicly accessible for easy monitoring.

Answer

Disable audit logging to reduce resource usage.

Question 2

A company is deploying an Amazon DynamoDB table with on-demand capacity mode. The table will be accessed from multiple AWS Regions and requires strong consistency. Which THREE steps should be taken to meet these requirements?

Accepted Answer

Create a global secondary index. None of the options correctly meet the requirements. DynamoDB global tables provide multi-Region access but only eventual consistency, and strongly consistent reads are limited to the source Region. A global secondary index does not enable cross-Region access. Therefore, no combination of the listed steps can achieve strong consistency across multiple Regions.

Answer

Use DynamoDB Accelerator (DAX)

Answer

Configure auto scaling

Answer

Use strongly consistent reads

Question 3

A company is using Amazon RDS for SQL Server with Multi-AZ and automated backups enabled. The database administrator needs to restore the database to a specific point in time that is within the retention period. What is the correct procedure?

Accepted Answer

Use the RDS console to perform a point-in-time recovery to the desired time. The correct procedure for performing a point-in-time recovery within the retention period for an Amazon RDS for SQL Server instance with Multi-AZ and automated backups is to use the RDS console or API to specify the desired point in time. This restores the database to the specified time using the automated backup logs. Option B is incorrect because manual snapshots capture a specific point and cannot be used for arbitrary point-in-time recovery. Option C is incorrect because native SQL Server backup is not supported for RDS instances; AWS manages backups. Option D is incorrect because restoring from the latest automated snapshot does not give a specific point in time.

Answer

Restore from a manual snapshot taken at the desired time

Answer

Use the native SQL Server backup and restore functionality

Answer

Restore from the latest automated snapshot

Question 4

A company is migrating a self-managed PostgreSQL database to Amazon Aurora PostgreSQL. They want to use the pglogical extension for logical replication to minimize downtime. Which THREE prerequisites must be met before setting up pglogical?

Accepted Answer

Add pglogical to shared_preload_libraries and restart the source database. Pglogical must be loaded into the shared preload libraries on the source PostgreSQL instance so that it is available at server start. Without this, the extension cannot be installed or used. The database must be restarted after modifying shared_preload_libraries for the change to take effect.

Answer

Configure max_wal_senders to at least 10

Answer

Enable track_commit_timestamp on the source

Question 5

A company is running an Amazon RDS for MySQL DB instance with Multi-AZ deployment. The database experiences a failover due to a hardware failure. After the failover, the application team reports that a critical stored procedure is missing. What should the database administrator do to prevent this issue in the future?

Accepted Answer

Modify the DB parameter group to enable binary logging.. In Amazon RDS MySQL Multi-AZ deployments, all database objects including stored procedures are replicated via synchronous storage-level replication. Therefore, a missing stored procedure after a failover is unlikely and indicates a potential replication issue. To prevent this, enabling binary logging ensures that DDL statements (such as CREATE PROCEDURE) are captured in binary logs. This allows binary log replication to maintain consistency, reduces the risk of orphaned objects, and provides the ability to recover using point-in-time restore if needed. Thus, modifying the DB parameter group to enable binary logging is the best preventive measure.

Answer

Create the stored procedure as a function instead.

Answer

Ensure that the stored procedure is created on both the primary and standby instances by using a script or manually recreating it after failover.

Answer

Increase the binlog retention period to ensure the stored procedure is captured.

Question 6

A company uses Amazon DynamoDB with global tables. They notice that changes made in one region are not appearing in another region after several minutes. Which CloudWatch metric should be monitored to check the replication lag?

Accepted Answer

ReplicationLatency. ReplicationLatency measures the time between the last update on the source table and the last update on the replica table. Option A (ConsumedWriteCapacityUnits) is wrong because it measures write capacity usage, not replication lag. Option B (SuccessfulRequestLatency) is wrong because it measures request latency, not replication lag. Option D (ThrottledRequests) is wrong because it indicates throttling, not replication lag.

Answer

ConsumedWriteCapacityUnits

Answer

SuccessfulRequestLatency

Answer

ThrottledRequests

Question 7

A company uses Amazon DynamoDB for a gaming application. During a new game launch, the table experiences throttling on write requests. The table has a provisioned capacity of 10,000 WCU and 5,000 RCU. The write traffic pattern shows spikes up to 15,000 WCU for 5 minutes. Which action would resolve the throttling with minimal cost impact?

Accepted Answer

Enable Auto Scaling for DynamoDB with a target utilization of 70%. Auto Scaling for DynamoDB automatically adjusts provisioned write capacity based on actual traffic, handling spikes up to 15,000 WCU without manual intervention and minimizing cost by scaling down during low traffic. Option A is wrong: SQS buffers requests but does not directly resolve DynamoDB throttling; it adds latency and complexity. Option B is wrong: permanently increasing WCU to 20,000 is costly and wasteful for short spikes. Option D is wrong: DynamoDB Accelerator (DAX) is an in-memory cache for read-heavy workloads, not for write throughput.

Answer

Use Amazon SQS to buffer the write requests

Answer

Increase the provisioned WCU to 20,000 permanently

Answer

Enable DynamoDB Accelerator (DAX) for the table

Question 8

A security administrator is setting up a new Amazon RDS for SQL Server database. The company requires that all data be encrypted at rest and in transit. Additionally, the database must be accessible only from a specific CIDR range. Which TWO actions should the administrator take? (Choose TWO.)

Accepted Answer

Enable encryption at rest using AWS KMS.. Enabling encryption at rest using AWS KMS is a straightforward way to meet the encryption-at-rest requirement for RDS. Option B: Configuring a security group to allow inbound traffic from the specific CIDR range restricts network access to the database. Option C is incorrect because encryption in transit is handled by the database engine (e.g., SSL/TLS) and is not an RDS option group feature; you enable it on the client side or by modifying the DB parameter group. Option D is incorrect because DB parameter groups do not control network access; they manage database engine parameters. Option E is incorrect because AWS KMS is the default service for RDS encryption at rest; CloudHSM is an alternative for key management but not required.

Answer

Enable encryption in transit by modifying the RDS option group to include SSL.

Answer

Modify the DB parameter group to restrict network access.

Answer

Use AWS CloudHSM to manage encryption keys for the database.

Question 9

A social media startup is using Amazon ElastiCache for Redis to cache user profiles. The cache currently has a 24-hour TTL. The application experiences a sudden spike in traffic after a celebrity mentions the service, causing the cache to be flooded with requests for uncached profiles. This results in high latency and database load. Which design pattern should the company implement to prevent this in the future?

Accepted Answer

Implement a local cache in each application instance to reduce load on the centralized Redis cluster.. Implementing a local cache (e.g., using a library like Caffeine or Guava) in each application instance reduces the number of requests hitting the centralized Redis cluster during a traffic spike. This pattern, often called a multi-tier or near-cache, absorbs repeated reads for the same uncached profiles locally, preventing cache flooding and database overload without relying solely on Redis TTL adjustments.

Answer

Use a read-through cache with a longer TTL (e.g., 48 hours).

Answer

Use a write-through cache with a longer TTL (e.g., 48 hours).

Answer

Use a write-through cache with a shorter TTL (e.g., 1 hour).

Question 10

A company uses Amazon RDS for PostgreSQL to run a reporting application. The reporting queries are complex and take several minutes to complete, causing performance impact on the primary instance. The company wants to isolate the reporting workload without data staleness. Which solution should they implement?

Accepted Answer

Create a read replica and direct reporting queries to it.. Creating a read replica of the Amazon RDS for PostgreSQL primary instance allows you to offload complex reporting queries to the replica without impacting the primary. Read replicas use asynchronous replication (based on PostgreSQL streaming replication), which provides near-real-time data with minimal staleness, satisfying the requirement to isolate the reporting workload without significant data staleness.

Answer

Implement an Amazon ElastiCache cluster to cache query results.

Answer

Enable Multi-AZ and use the standby instance for reporting.

Answer

Take a manual snapshot of the database and restore it for reporting.

Question 11

A company is running a critical Oracle database on Amazon RDS. The DBA wants to set up monitoring to detect if the database is experiencing a high number of full table scans, which may indicate missing indexes. Which TWO metrics should the DBA monitor? (Choose TWO.)

Accepted Answer

TableScanRows. The DBA should monitor TableScanRows (A) and FullTableScans (B). FullTableScans directly counts the number of full table scan operations, while TableScanRows indicates the number of rows read during full scans. High values in either metric suggest missing indexes. BufferCacheHitRatio (C) measures cache efficiency, not full scans. UserCommits (D) tracks transaction commits, and RedoLogSpaceUsage (E) relates to redo log activity, neither of which indicate full table scans.

Answer

BufferCacheHitRatio

Answer

UserCommits

Answer

RedoLogSpaceUsage

Question 12

A company runs a MySQL database on Amazon RDS and wants to capture data changes to replicate to a separate reporting database. Which AWS service should be used to capture these changes with minimal impact on the source database?

Accepted Answer

Use AWS Database Migration Service (DMS) with ongoing replication enabled.. AWS DMS with ongoing replication (change data capture) is the correct choice because it reads the binary logs (binlog) from the source RDS MySQL instance to capture inserts, updates, and deletes with minimal overhead. DMS uses a dedicated replication instance and can apply changes to a separate reporting database without requiring schema changes or additional load from application-level polling. This approach is fully managed and designed for low-impact, continuous replication.

Answer

Use Amazon DynamoDB Streams to capture changes from the RDS instance.

Answer

Enable MySQL native replication from the RDS instance to the reporting database.

Answer

Use Amazon Kinesis Data Streams with a custom application to poll the binlog.

Question 13

A company needs to store session data for millions of users with sub-millisecond latency. The data is key-value in nature and can tolerate eventual consistency. Which database service is best suited?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is the best choice because it is a fully managed NoSQL key-value and document database designed for single-digit millisecond latency at any scale, making it ideal for session data storage. It supports eventual consistency, which is acceptable for this use case, and can handle millions of users with sub-millisecond read and write performance using its SSD-backed storage and distributed architecture.

Answer

Amazon Redshift

Answer

Amazon Neptune

Answer

Amazon RDS for MySQL

Question 14

A company uses the IAM policy shown in the exhibit to control access to a DynamoDB table. The table has a partition key user_id and a sort key timestamp. The application uses the AWS SDK to query items. When a user tries to query items with a filter condition, they receive an AccessDeniedException. What is the most likely cause?

Accepted Answer

The query does not specify a partition key that matches the user's LeadingKeys condition.. The IAM policy uses a `Condition` block with `ForAllValues:StringEquals` on `dynamodb:LeadingKeys` to restrict access to items where the partition key (`user_id`) matches the caller's IAM user ID (`${aws:userid}`). When a query does not specify a partition key that satisfies this condition, the request fails with an `AccessDeniedException`. The error occurs because the query must include a partition key equal to the user's ID to pass the leading keys restriction.

Answer

The aws:userid variable is not being resolved correctly.

Answer

The policy is missing a Condition element with dynamodb:Select.

Answer

The policy does not allow the Query action.

Question 15

A startup is building a social media analytics application that ingests high-velocity streaming data from multiple sources. The data consists of JSON objects with varying schemas. The application needs to store this data for real-time querying and later batch processing. Which AWS database solution is most cost-effective and scalable for this workload?

Accepted Answer

Amazon DynamoDB with on-demand capacity.. Amazon DynamoDB with on-demand capacity is the most cost-effective and scalable solution for this workload because it is a fully managed NoSQL database that can handle high-velocity streaming data with varying JSON schemas without requiring schema definition or provisioning. Its on-demand capacity mode automatically scales to accommodate unpredictable traffic spikes, making it ideal for real-time querying and batch processing via features like DynamoDB Streams and integration with AWS Glue or EMR.

Answer

Amazon ElastiCache for Redis with persistence enabled.

Answer

Amazon RDS for MySQL with multiple read replicas.

Answer

Amazon Redshift with auto-ingest from Kinesis.

Question 16

A company recently migrated their PostgreSQL database to Amazon Aurora PostgreSQL. They notice that the average query latency has increased, especially for complex read queries. The DB instance size is adequate and CPU utilization is below 50%. What is the MOST likely cause of the increased latency?

Accepted Answer

The application is sending all read queries to the primary instance instead of offloading them to Aurora Replicas.. If all read queries are sent to the primary (writer) instance, it must handle both writes and reads, leading to contention and increased latency. Aurora Replicas are designed to offload read traffic, and by not using them, the primary instance becomes a bottleneck even if CPU utilization is low. This is a common misconfiguration after migration, as applications often retain the original connection string pointing to the primary endpoint.

Answer

The Auto Scaling policy for the Aurora cluster is set to scale down too aggressively.

Answer

The Aurora cluster volume uses a smaller buffer cache than the original RDS instance.

Answer

The Aurora cluster is using the parallel query feature which adds overhead for complex queries.

Question 17

A development team is using Amazon RDS for MySQL with read replicas to offload reporting queries. They notice that the read replica is consistently lagging behind the primary by several seconds. The primary handles 5000 writes per second. Which action would most likely reduce replica lag?

Accepted Answer

Increase the instance size of the read replica.. Increasing the instance size of the read replica provides more CPU and memory resources, allowing it to apply changes from the binary log faster, thereby reducing replica lag. Option A is incorrect because increasing 'max_connections' on the primary does not affect the replica's ability to apply changes; it only allows more connections to the primary. Option C is incorrect because disabling binary logging on the primary would break replication entirely, as the replica relies on the binary log to receive changes. Option D is incorrect because converting the primary to Multi-AZ improves availability and failover but does not directly reduce replication lag on the read replica.

Answer

Increase the 'max_connections' parameter on the primary instance.

Answer

Disable binary logging on the primary instance to reduce I/O.

Answer

Convert the primary instance to a Multi-AZ deployment.

Question 18

A company is migrating a 1 TB Microsoft SQL Server database from on-premises to Amazon RDS for SQL Server. The on-premises database uses TDE for encryption. The company must ensure that the migrated database in RDS also uses TDE. Which solution meets this requirement?

Accepted Answer

Use AWS DMS with ongoing replication to an RDS instance that has TDE enabled.. AWS DMS can migrate data from an on-premises SQL Server database with TDE enabled to an Amazon RDS for SQL Server instance that has TDE enabled. DMS reads the decrypted data from the source (since TDE is transparent to applications) and writes it to the target, which can then encrypt the data at rest using RDS's built-in TDE support. This approach avoids the need to transfer TDE certificates or perform a native backup/restore, which are not supported for TDE-enabled databases in RDS.

Answer

Export the on-premises database with TDE certificates and import them into RDS.

Answer

Take a native backup of the on-premises database with TDE, upload to S3, and restore to RDS.

Answer

Use AWS SCT to convert the database to Amazon Aurora and enable encryption.

Question 19

A company is designing a global application that requires a database with multi-master writes across multiple AWS Regions with sub-second conflict resolution. Which AWS database service should they choose?

Accepted Answer

Amazon DynamoDB Global Tables. Amazon DynamoDB Global Tables is the correct choice because it provides a fully managed, multi-Region, multi-master database that replicates data across AWS Regions with sub-second conflict resolution using last-writer-wins (LWW) or application-defined conflict resolution. This meets the requirement for multi-master writes and sub-second conflict resolution, which is not achievable with the other options.

Answer

Amazon ElastiCache for Redis Global Datastore

Answer

Amazon RDS with Multi-AZ

Answer

Amazon Aurora Global Database

Question 20

A company runs an Amazon RDS for PostgreSQL instance with Multi-AZ deployment. The primary DB instance fails unexpectedly and a failover occurs. Which action should be taken to minimize downtime during future failovers?

Accepted Answer

Configure an Amazon RDS Proxy to reduce failover time.. Amazon RDS Proxy helps minimize downtime during failovers by maintaining database connections, reducing connection disruption and allowing applications to recover faster. The instance already has Multi-AZ enabled, so simply enabling it again is not a valid action. RDS Proxy provides connection pooling and seamless failover handling. Increasing instance size does not reduce failover time. Read replicas require manual promotion and are not used for automatic failover in RDS for PostgreSQL. Multi-AZ is already enabled, so there is no need to enable it again.

Answer

Increase the DB instance size to reduce failover time.

Answer

Create a read replica in the same region and promote it during failover.

Answer

Enable Multi-AZ deployment to automatically failover to the standby.