DBS-C01 Practice Exam 59 — 20 Questions

Question 1

A company is launching a new application that requires an Amazon RDS for PostgreSQL database. The database will store highly sensitive data, and the security team mandates that all data at rest must be encrypted. The company also requires that the encryption keys be managed by the security team using AWS CloudHSM. What is the MOST efficient way to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS KMS with a customer-managed key (CMK) for RDS encryption.. Amazon RDS for PostgreSQL does not support Transparent Data Encryption (TDE). TDE is only available for Oracle and SQL Server. The most efficient way to meet the requirements is to use RDS encryption with a customer-managed key (CMK) in AWS KMS, which encrypts the underlying storage and automated backups. The security team can manage the CMK via CloudHSM by using a KMS custom key store, thus satisfying the key management requirement. Option A is incorrect because EBS encryption is not directly applicable to RDS instances; RDS encryption uses KMS. Option B is incorrect because TDE is not supported for PostgreSQL. Option D is incorrect because client-side encryption introduces application changes and does not ensure encryption at rest within the database.

Answer

Enable EBS encryption on the RDS instance's underlying volumes using a KMS key.

Answer

Enable Transparent Data Encryption (TDE) using a CloudHSM key in the RDS instance.

Answer

Implement client-side encryption in the application before writing data to the database.

Question 2

A company is running an Amazon RDS for MySQL DB instance with Multi-AZ. The company wants to perform a major version upgrade with minimal downtime. Which TWO actions should be taken? (Choose TWO.)

Accepted Answer

Use the AWS Management Console to modify the DB instance and apply the upgrade immediately.. The correct answers are B and D. Option B: Using the AWS Management Console to modify the DB instance and apply the upgrade immediately is a valid method to perform a major version upgrade, though it will cause some downtime. Option D: Creating a read replica, upgrading it first, and promoting it minimizes downtime because the primary remains available during the upgrade. Option A is incorrect because the --allow-major-version-upgrade flag is used with the AWS CLI, but it must be combined with a modification; however, simply using the flag is not sufficient. Option C is incorrect because automatic minor version upgrades do not affect major version upgrades. Option E is incorrect because restoring a snapshot does not upgrade the engine version.

Answer

Use the AWS CLI to modify the DB instance with the --allow-major-version-upgrade flag.

Answer

Enable automatic minor version upgrades on the DB instance.

Answer

Take a snapshot and restore to the new version.

Question 3

A company is migrating an on-premises PostgreSQL database to Amazon RDS for PostgreSQL. The database has a large table that is frequently accessed by reporting queries. The reporting queries filter on a column that has a high cardinality but low selectivity. To optimize query performance on this table, which design choice should the database specialist recommend?

Accepted Answer

Create a covering index on the filter column. A covering index includes all columns needed by the reporting queries, allowing PostgreSQL to satisfy the query entirely from the index without accessing the heap (table) pages. This eliminates the overhead of random I/O for row lookups, which is especially beneficial when filtering on a high-cardinality, low-selectivity column where many rows match but the index scan alone can return the required data. In Amazon RDS for PostgreSQL, this reduces read IOPS consumption and improves query latency.

Answer

Partition the table by the filter column

Answer

Use a read replica to offload reporting queries

Answer

Increase the provisioned read IOPS for the RDS instance

Question 4

Refer to the exhibit. A DynamoDB table has a primary key of pk (partition key) and sk (sort key). An application needs to perform GetItem and Query operations but should only be allowed to retrieve the pk and sk attributes. The IAM policy above is applied to the application's IAM role. Why does the policy fail to achieve the goal?

Accepted Answer

The Deny statement does not prevent retrieval of all attributes when no ProjectionExpression is specified.. The Deny statement only denies access when the request includes a ProjectionExpression that specifies attributes other than pk and sk. However, if the application performs a GetItem or Query without specifying any ProjectionExpression, DynamoDB returns all attributes by default, which violates the requirement to restrict retrieval to only pk and sk. The policy does not block this default behavior, so it fails to achieve the goal.

Answer

The Deny statement uses the wrong condition key; it should use 'dynamodb:Select' instead of 'dynamodb:Attributes'.

Answer

The policy should use 'dynamodb:ReturnValues' condition key.

Answer

The Allow statement should include 'dynamodb:Scan' to allow Query operations.

Question 5

Which TWO AWS services can be used to monitor database security events in real time? (Choose 2.)

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty (Option B) is a threat detection service that continuously monitors for malicious activity and unauthorized behavior, including database security events such as suspicious API calls or potential credential compromise. It uses machine learning, anomaly detection, and integrated threat intelligence to analyze AWS CloudTrail logs, VPC Flow Logs, and DNS logs in real time, making it suitable for monitoring database security events.

Answer

AWS WAF

Answer

Amazon RDS Performance Insights

Answer

AWS CloudTrail

Question 6

A company is designing a disaster recovery strategy for an Amazon RDS for PostgreSQL database. The database is 2 TB in size. The company wants to recover to a different AWS Region with minimal data loss. Which TWO options meet these requirements?

Accepted Answer

Create a read replica in the other Region.. Both A and B are valid options for achieving minimal data loss when recovering to a different AWS Region. Option A uses Amazon RDS native cross-Region read replicas with PostgreSQL streaming replication, providing near real-time synchronization. Option B uses AWS Database Migration Service (DMS) with ongoing replication (change data capture) to replicate changes continuously, achieving a low RPO. Options C, D, and E involve snapshot-based solutions that are not continuous and therefore do not meet the minimal data loss requirement.

Answer

Take a manual snapshot and copy it to the other Region. Restore from the snapshot.

Answer

Enable automatic backups and copy automated snapshots to the other Region.

Answer

Use AWS Backup to schedule cross-Region backups.

Question 7

A financial services company runs a critical application on Amazon RDS for Oracle. The workload is write-heavy with frequent small transactions. The DBA notices high latency during peak hours. Which design change would best address this?

Accepted Answer

Switch to Provisioned IOPS (io1 or io2) volume type. The workload is write-heavy with frequent small transactions, and high latency during peak hours indicates that the current storage volume is not meeting the IOPS demands. Provisioned IOPS (io1 or io2) volumes provide consistent, low-latency performance by guaranteeing a specific number of IOPS, which directly addresses the bottleneck caused by insufficient I/O capacity for write-intensive operations.

Answer

Implement ElastiCache for Redis

Answer

Enable Multi-AZ deployment

Answer

Add a read replica

Question 8

An e-commerce platform uses Amazon RDS for PostgreSQL to store order data. The database has a table "orders" with 500 million rows. The application runs a report query that aggregates daily sales for the last 30 days. The query currently scans the entire table and takes 15 minutes to complete. The team needs to reduce the query time to under 30 seconds. Which solution is MOST cost-effective?

Accepted Answer

Create a materialized view that stores daily sales aggregates and refresh it nightly.. A materialized view precomputes and stores the daily sales aggregates, allowing the application to query the precomputed result set directly instead of scanning 500 million rows. Refreshing the materialized view nightly (e.g., using pg_cron or a scheduled lambda) ensures the data is fresh enough for the report while keeping query time under 30 seconds. This approach avoids the cost of larger instances or complex partitioning and is the most cost-effective solution for a read-heavy, periodic aggregation workload.

Answer

Partition the table by month and query only the relevant partitions.

Answer

Add a composite index on the date column and the sales amount column.

Answer

Upgrade the RDS instance to a larger size with more vCPUs and memory.

Question 9

A financial services company runs a core banking application on Amazon RDS for MySQL. They need to maintain a full audit trail of all changes to customer account balances for regulatory compliance. The audit trail must be immutable and queryable for up to 7 years. Which solution meets these requirements with minimal impact on the source database?

Accepted Answer

Migrate to Amazon Aurora MySQL and enable database activity streams, streaming to Amazon Kinesis Data Streams and then to Amazon S3. Amazon Aurora MySQL Database Activity Streams provide a near-real-time, immutable audit trail of database activities at the transaction level, which can be streamed to Amazon Kinesis Data Streams and then stored in Amazon S3 for long-term queryable retention. This solution meets the 7-year compliance requirement with minimal impact on the source database because it offloads the audit processing to external services and does not require changes to the application or additional logging overhead on the database instance.

Answer

Use Amazon RDS Performance Insights to capture SQL queries and store them in Amazon S3

Answer

Use Amazon DynamoDB Streams with a Lambda function to capture changes from the MySQL database

Answer

Enable binary logging on the RDS instance and stream the binlog to Amazon S3 using AWS Database Migration Service (DMS)

Question 10

A company runs a reporting application that queries an Amazon RDS for PostgreSQL database. The queries are complex and take a long time to run, causing performance degradation on the primary instance. The team wants to improve query performance without affecting the transactional workload. Which solution should they use?

Accepted Answer

Create one or more read replicas and direct reporting queries to them. Amazon RDS read replicas allow you to offload read-heavy reporting queries from the primary PostgreSQL instance. By directing complex, long-running queries to one or more read replicas, you eliminate resource contention on the primary instance, preserving transactional workload performance. RDS for PostgreSQL supports up to 15 read replicas, which can be promoted to a primary instance if needed, and they use asynchronous replication to stay nearly current.

Answer

Increase the instance size of the primary database

Answer

Migrate to Amazon RDS for MySQL and use Multi-AZ

Answer

Use Amazon ElastiCache to cache the results of complex queries

Question 11

A company is migrating an on-premises MongoDB workload to Amazon DocumentDB. The workload includes aggregation pipelines with $lookup and $group operations. The team wants to ensure minimal performance impact. Which THREE steps should they take?

Accepted Answer

Create appropriate indexes on fields used in $lookup and $group. Creating appropriate indexes on fields used in $lookup (local and foreign fields) and $group (the _id field and any sort fields) allows Amazon DocumentDB to avoid full collection scans, significantly reducing query latency and resource consumption during aggregation pipeline execution.

Answer

Disable journaling to reduce I/O overhead

Answer

Enable TLS for all connections

Question 12

A company is migrating a 5 TB Oracle database to Amazon Aurora PostgreSQL. The migration must be completed within a weekend. The on-premises network has a 1 Gbps connection to AWS. What is the MOST efficient migration strategy?

Accepted Answer

Use AWS DMS with direct connect to export the Oracle database directly to Aurora. With a 1 Gbps connection, the theoretical maximum transfer rate is ~450 GB/hour, so transferring 5 TB would take about 11 hours, well within a weekend. AWS DMS with Direct Connect provides a dedicated, high-bandwidth path for the migration, making it the most efficient strategy. Snowball Edge (Option D) requires ordering, loading, shipping (1-2 days), and importing, which cannot complete within a weekend. Options A and C are less efficient: S3 Transfer Acceleration adds unnecessary steps, and DMS with CDC is designed for ongoing replication, not initial load.

Answer

Use AWS S3 Transfer Acceleration to upload the database dump to S3 and then load into Aurora

Answer

Use AWS DMS with change data capture over the existing network connection

Answer

Use AWS Snowball Edge to transfer the data and then load into Aurora

Question 13

A company wants to migrate a 200 GB SQL Server database to Amazon RDS for SQL Server with minimal downtime. The database is used by a critical application. Which service should be used for the migration?

Accepted Answer

AWS Database Migration Service (DMS).. AWS DMS is the correct choice because it supports ongoing replication (change data capture) from a SQL Server source to an Amazon RDS for SQL Server target, enabling a migration with minimal downtime. DMS can perform a full load of the 200 GB database and then continuously replicate changes until the cutover, which is essential for a critical application that cannot tolerate extended downtime.

Answer

AWS Schema Conversion Tool (SCT).

Answer

SQL Server Import and Export Wizard.

Answer

SQL Server Management Studio (SSMS) backup and restore.

Question 14

Refer to the exhibit. A company has attached this IAM policy to an IAM role used by an application running on Amazon EC2. The application needs to decrypt data in an S3 bucket that is encrypted with the specified KMS key. However, the application is receiving access denied errors. What is the most likely cause?

Accepted Answer

The application is decrypting the data by calling KMS directly instead of using S3's server-side decryption.. The policy condition 'kms:ViaService' restricts KMS operations to only when they are made through S3. However, the condition also includes 'kms:CallerAccount' which is redundant but not harmful. The error likely occurs because the EC2 instance does not have the correct IAM role, or the policy is missing 'kms:Decrypt' for the specific ciphertext. But the most common mistake is that the application is not using the S3 service to decrypt; if the application reads the encrypted object and then calls KMS directly to decrypt, the 'kms:ViaService' condition will fail because the call is not via S3. Option B addresses this. Option A is wrong because the condition is present. Option C is wrong because the role is not explicitly denied. Option D is wrong because the policy allows KMS actions.

Answer

The policy does not include 'kms:Decrypt' for the specific key.

Answer

The policy is missing a 'Principal' element.

Answer

The IAM role does not have a trust policy that allows EC2 to assume it.

Question 15

A company is using Amazon RDS for Oracle with Automated Backups enabled. The database size is 1 TB. The company wants to improve the backup and restore performance. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Use Provisioned IOPS storage for the database.. Using Provisioned IOPS storage improves I/O performance, which speeds up backup and restore operations. Option B is correct because enabling backup compression reduces the backup size, leading to faster transfer and restore times. Option C is wrong because using a smaller DB instance class would degrade performance, not improve it. Option D is wrong because increasing the backup retention period to 35 days does not affect backup performance; it only increases the storage used. Option E is wrong because disabling Multi-AZ would reduce availability and does not improve backup performance; in fact, Multi-AZ can improve backup performance by offloading backups to the standby instance.

Answer

Use a smaller DB instance class to reduce backup size.

Answer

Increase the backup retention period to 35 days.

Answer

Disable Multi-AZ to reduce backup time.

Question 16

A company runs a document management system using Amazon S3 and Amazon DynamoDB. The application writes document metadata to DynamoDB and stores the document in S3. Recently, users report that occasionally documents are saved in S3 but the corresponding metadata is missing in DynamoDB. The application writes to DynamoDB first, then to S3. If the S3 upload fails, the application retries. The database specialist suspects a transaction consistency issue. The application is running on multiple EC2 instances behind an Application Load Balancer. What should the specialist recommend to ensure that both the metadata and document are stored consistently?

Accepted Answer

Use DynamoDB transactions to write metadata and initiate S3 upload within the same transaction.. Using DynamoDB transactions ensures atomicity; if the S3 upload fails, the transaction can be rolled back. Option B is wrong because DynamoDB Streams with Lambda introduces eventual consistency and possible duplicates. Option C is wrong because writing to S3 first still leaves inconsistency if DynamoDB fails. Option D is wrong because idempotency tokens help with duplicates but not atomicity.

Answer

Use DynamoDB Streams to trigger an AWS Lambda function that performs the S3 upload.

Answer

Reverse the order: upload to S3 first, then write to DynamoDB.

Answer

Implement an idempotency key in the application to retry the entire operation.

Question 17

A security engineer runs the AWS CLI command shown in the exhibit. The engineer wants to ensure that all RDS DB instances in the account are encrypted at rest. What should the engineer do to remediate the unencrypted read replica?

Accepted Answer

Delete the unencrypted read replica and create a new read replica from the encrypted source, enabling encryption on the new replica.. To encrypt an unencrypted read replica that is sourced from an encrypted DB instance, you cannot directly enable encryption on an existing read replica or modify it. Instead, you must delete the unencrypted read replica and create a new read replica from the encrypted source, enabling encryption on the new replica. This is because encryption at rest can only be enabled during instance creation, and read replicas inherit encryption settings from the source at creation time. Option A is incorrect because the StorageEncrypted parameter cannot be modified on an existing instance. Option C is incorrect because enabling encryption on the source does not encrypt existing replicas; it only affects new replicas. Option D is incorrect because creating a snapshot of the unencrypted replica and restoring it as a new encrypted instance is not the standard procedure for encrypting a read replica; the correct approach is to recreate the read replica from the encrypted source with encryption enabled.

Answer

Modify the read replica by setting the StorageEncrypted parameter to true.

Answer

Enable encryption on the source DB instance and the read replica will automatically become encrypted.

Answer

Create a snapshot of the read replica, encrypt the snapshot, and restore it as a new instance.

Question 18

A company is migrating an on-premises Oracle database to Amazon Aurora PostgreSQL. The database has several large tables with frequent INSERT and UPDATE operations. Which TWO actions should be taken to optimize performance after migration?

Accepted Answer

Enable autovacuum and configure it to run more frequently on the large tables.. Options A and B are correct. Enabling autovacuum and tuning it to run more frequently on large tables is essential in PostgreSQL to reclaim storage and prevent transaction ID wraparound, which is critical after a migration with high DML. Using Aurora PostgreSQL integration with Amazon S3 for bulk data loading is efficient because it leverages parallel processing and avoids network overhead. Option C is incorrect because setting synchronous_commit to ON reduces performance for write-heavy workloads by waiting for disk writes; OFF or REMOTE_WRITE is recommended. Option D is incorrect because RDS Proxy helps with connection management but does not directly optimize DML performance for large tables. Option E is incorrect because while partitioning can help query performance, it is not a direct optimization for INSERT/UPDATE operations and may add complexity; Aurora's storage layer already handles large tables efficiently.

Answer

Set synchronous_commit to ON to ensure data durability.

Answer

Deploy an RDS Proxy in front of the Aurora cluster to reduce connection overhead.

Answer

Partition the large tables by date to improve query performance.

Question 19

Refer to the exhibit. An IAM policy statement allows creating manual snapshots for an RDS instance. A database administrator is unable to create a snapshot from the AWS Management Console. The error message indicates insufficient permissions. What is the likely cause?

Accepted Answer

The policy does not include necessary read actions (e.g., 'DescribeDBInstances', 'DescribeDBSnapshots') that the console uses.. The AWS Management Console often performs multiple API calls (such as DescribeDBInstances and DescribeDBSnapshots) to list and display resources before allowing actions. Even if the CreateDBSnapshot action is allowed, the console will fail if it cannot describe the instance or snapshots. Option A is incorrect because the condition key 'aws:RequestedRegion' is correctly spelled. Option C is incorrect because the resource ARN correctly identifies the RDS instance for snapshot creation. Option D is incorrect because StringEquals is appropriate for matching the region exactly; StringLike is not needed.

Answer

The condition key 'aws:RequestedRegion' is misspelled.

Answer

The resource ARN is incorrect; it should include the snapshot ARN.

Answer

The condition uses 'StringEquals' but should use 'StringLike' for region matching.

Question 20

A company has an Amazon RDS for PostgreSQL DB instance with automated backups enabled. The retention period is set to 7 days. A developer accidentally performed a DROP TABLE operation on a critical table 2 days ago. How can the table be recovered with minimal data loss?

Accepted Answer

Perform a point-in-time restore to a time just before the DROP TABLE operation.. The correct approach is to perform a point-in-time restore (PITR) to a time just before the DROP TABLE operation. RDS for PostgreSQL with automated backups enabled supports PITR within the backup retention period (7 days). Since the table was dropped 2 days ago, restoring the DB instance to a point in time just before the drop will recover the table with minimal data loss. Option B (pg_dump) is not a suitable recovery method because it requires a pre-existing backup; it cannot generate a backup retroactively. Option C (creating a read replica and promoting it) would create a copy of the current state, which already lacks the dropped table, so it does not help. Option D (restore from oldest automated snapshot) would revert the entire database to a 7-day-old state, losing all changes made in the last 7 days, including the table that was dropped only 2 days ago, resulting in greater data loss.

Answer

Use the pg_dump utility to create a manual backup and restore it.

Answer

Create a read replica of the DB instance and promote it to a standalone instance.

Answer

Restore the DB instance from the oldest automated snapshot.