DBS-C01 Practice Exam 63 — 20 Questions

Question 1

A security engineer needs to restrict access to an Amazon DynamoDB table so that only users from a specific AWS account can read and write data. Which of the following can be used to achieve this? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a VPC endpoint policy for DynamoDB.. To restrict access to a DynamoDB table from a specific AWS account, you can use a VPC endpoint policy for DynamoDB (Option A) to control access through VPC endpoints, and an IAM policy with a condition key such as 'aws:SourceAccount' (Option C) to restrict API calls to those originating from the specified account. Option B is incorrect because DynamoDB does not support resource-based policies. Option D is incorrect because security groups are used for network-level access to EC2 instances, not DynamoDB. Option E is incorrect because S3 bucket policies apply only to S3 resources, not DynamoDB.

Answer

Use a resource-based policy on the DynamoDB table.

Answer

Use a security group to restrict access to the DynamoDB table.

Answer

Use an S3 bucket policy to allow access to the DynamoDB table.

Question 2

A company is deploying a new application that uses Amazon RDS for PostgreSQL. The application must be highly available with automatic failover in the event of a database failure. Which configuration should be used?

Accepted Answer

Deploy a Multi-AZ RDS instance with a standby in a different Availability Zone. Multi-AZ RDS for PostgreSQL provides synchronous replication to a standby instance in a different Availability Zone, ensuring automatic failover with minimal data loss. This configuration meets the requirement for high availability and automatic failover without manual intervention, as the RDS service handles the DNS change and standby promotion.

Answer

Use a read replica in a different Availability Zone

Answer

Deploy the RDS instance in a single Availability Zone with automated backups

Answer

Deploy the RDS instance in a Cross-Region replication configuration

Question 3

A company is migrating a large on-premises Oracle database to Amazon RDS for Oracle. The database is 5 TB in size, and the migration must be completed within a week. The company has a dedicated 10 Gbps AWS Direct Connect connection. Which TWO AWS services should the company use to minimize downtime during the migration?

Accepted Answer

AWS Schema Conversion Tool (AWS SCT). AWS DMS can handle ongoing replication to minimize downtime. AWS SCT can convert the schema if needed, and AWS DMS can migrate data. AWS Snowball is for offline data transfer, which may not be needed with Direct Connect. RDS is the target, not a migration service. AWS DataSync is for file data, not databases. The correct options are A and D.

Answer

AWS DataSync

Answer

AWS Snowball

Answer

Amazon RDS for Oracle

Question 4

A security engineer is troubleshooting an issue where an application using IAM role 'app-role' with a trust policy to assume the 'app-user' user is unable to decrypt an RDS database that uses a customer-managed KMS key. The above key policy is attached to the KMS key. What is the likely cause of the failure?

Accepted Answer

The principal in the policy is 'app-user', but the application uses an IAM role that does not have the necessary permissions.. The KMS key policy specifies the principal as 'app-user', which is an IAM user. However, the application uses an IAM role 'app-role' to make the decryption requests. Since the principal in the key policy does not include the role or its associated permissions, the KMS key policy denies access to the role, causing the decryption failure. The trust policy on the role allows the user to assume it, but that does not grant the role any KMS permissions unless explicitly added.

Answer

The 'kms:ViaService' condition requires the request to come from RDS, but the application is making KMS API calls directly.

Answer

The policy has a missing 'Effect': 'Deny' statement that is blocking access.

Answer

The condition 'kms:ViaService' restricts the key to be used only with RDS, but the application is using a different service.

Question 5

A company needs to migrate an on-premises PostgreSQL database to Amazon Aurora PostgreSQL with minimal downtime. Which AWS service should be used for the ongoing replication?

Accepted Answer

AWS Database Migration Service (DMS).. AWS Database Migration Service (DMS) supports ongoing replication (change data capture, CDC) from an on-premises PostgreSQL source to an Amazon Aurora PostgreSQL target using logical replication slots. This allows you to keep the target database synchronized with minimal downtime after the initial full load, making it the correct choice for a migration with minimal downtime.

Answer

AWS Glue.

Answer

AWS Backup.

Answer

AWS Schema Conversion Tool (SCT).

Question 6

A company is deploying a new application on Amazon RDS for PostgreSQL. The application requires a database with a specific parameter group that sets 'max_connections' to 500 and 'shared_buffers' to 25% of the instance memory. The company uses CloudFormation to deploy the RDS instance. The CloudFormation template creates a DBInstance with a DBParameterGroup. The deployment fails because the parameter group cannot be associated with the DB instance. What is the most likely cause?

Accepted Answer

The parameter group uses an invalid value for 'shared_buffers' because it must be an integer, not a percentage.. In Amazon RDS for PostgreSQL, the 'shared_buffers' parameter must be specified as an integer value (in 8 KB blocks) or a string ending with 'kB', 'MB', or 'GB', not as a percentage of instance memory. Using a percentage like '25%' is invalid and causes the parameter group association to fail. Option B is incorrect because 'max_connections' can be set to 500 as long as it does not exceed the instance class limits, but that is not the issue here. Option C is incorrect because CloudFormation automatically handles dependencies when resources are referenced; explicit DependsOn is not required. Option D is incorrect because CloudFormation templates can reference resources across regions only if explicitly designed, but the region mismatch would cause a different error, not parameter group association failure.

Answer

The 'max_connections' value of 500 exceeds the allowed maximum for the instance class.

Answer

The CloudFormation template does not include a DependsOn clause linking the DBParameterGroup to the DBInstance.

Answer

The DBParameterGroup is not in the same region as the DBInstance.

Question 7

A security engineer created the IAM policy above for an application that reads from a DynamoDB table named UserSessions. The application reports that it cannot query the table using a Global Secondary Index (GSI). The table's GSI is named GSI_UserSessions. Why is the application unable to query the index?

Accepted Answer

The Query action is not allowed on the index because the Allow statement only applies to the table, not the index.. The IAM policy's Allow statement grants the Query action only on the table resource (arn:aws:dynamodb:...:table/UserSessions) but not on the index resource (arn:aws:dynamodb:...:table/UserSessions/index/GSI_UserSessions). In DynamoDB, a Global Secondary Index is a separate subresource, and IAM policies must explicitly include the index ARN to allow operations like Query on that index. Without an explicit Allow on the index, the default implicit deny prevents the query. Option B is incorrect because while a Deny statement would override any Allow, the primary reason the application fails is the lack of an Allow on the index; the Deny statement, if present, is an additional but not necessary condition.

Answer

The Deny statement explicitly denies all DynamoDB actions on the index resource, overriding the Allow statement.

Answer

The application is using GetItem instead of Query to access the index.

Answer

The policy allows Query on the table, which automatically includes the index.

Question 8

A company is using Amazon DynamoDB to store user session data. The security team requires that all access to the table be authenticated and authorized using AWS IAM. Which mechanism should the developer use to achieve this?

Accepted Answer

Use IAM policies to grant permissions to the DynamoDB table.. DynamoDB is integrated with AWS IAM for authentication and authorization. IAM policies can be attached to users, groups, or roles to grant specific permissions to DynamoDB tables. Option A is wrong because VPC endpoints provide network isolation but do not authenticate or authorize access. Option B is wrong because Amazon Cognito identity pools are used for federated user authentication, not for direct IAM-based access to DynamoDB. Option D is wrong because DynamoDB does not support resource-based policies; access control is managed through IAM policies.

Answer

Create a VPC endpoint for DynamoDB and allow only traffic from the VPC.

Answer

Use Amazon Cognito identity pools to grant access to the DynamoDB table.

Answer

Use a DynamoDB resource-based policy to restrict access.

Question 9

A company is migrating a MySQL database from on-premises to Amazon RDS for MySQL. The current database has several stored procedures and triggers that use user-defined functions (UDFs) compiled as shared libraries. What is the best practice for handling these UDFs in RDS?

Accepted Answer

Refactor the stored procedures to avoid using the custom UDFs.. Amazon RDS for MySQL does not allow access to the underlying file system, so you cannot upload custom UDF shared libraries (.so files). The best practice is to refactor the stored procedures and triggers to remove dependencies on these UDFs, replacing their logic with native MySQL functions or application-level code. This ensures compatibility with the managed RDS environment without requiring custom binaries.

Answer

Use Amazon RDS Custom for MySQL to upload the UDF libraries.

Answer

Use AWS Lambda to replace the UDFs.

Answer

Migrate to Amazon Aurora MySQL, which supports custom UDFs.

Question 10

A company is running a production PostgreSQL database on an EC2 instance (db.m5.xlarge) with 500 GB of gp2 EBS storage. The database is used by a customer-facing application that requires low latency. The company plans to migrate this database to Amazon RDS for PostgreSQL with minimal downtime. The current database has a high write load with frequent updates and deletes, and the table sizes are growing. The company also wants to enable Multi-AZ for high availability and use read replicas for reporting workloads. During migration planning, they discover that the source database has several large unlogged tables and uses custom PostgreSQL extensions that are not available in RDS. Which migration strategy should the company use to minimize downtime and meet all requirements?

Accepted Answer

Use AWS DMS with ongoing replication, convert unlogged tables to logged tables, and migrate custom extensions using AWS SCT.. AWS DMS with ongoing replication allows near-zero downtime by continuously replicating changes from the source to the target RDS instance. DMS can handle unlogged tables by converting them to logged tables during migration, as DMS requires logical replication which relies on write-ahead logs. AWS SCT can help assess and convert custom PostgreSQL extensions to RDS-compatible equivalents or suggest alternatives. Option B (pg_dump/pg_restore) is an offline approach that would cause significant downtime, which does not meet the minimal downtime requirement. Option C (copy to S3 then restore) is not a supported migration method for PostgreSQL to RDS. Option D (streaming replication) is not feasible because RDS does not accept direct streaming replication from an external source, and unlogged tables cannot be replicated via streaming. Therefore, A is the best strategy.

Answer

Use pg_dump to export the database and pg_restore to import into RDS, then set up read replicas.

Answer

Copy the database files to Amazon S3, then use the rdsadmin.rdsadmin_restore_from_s3 procedure to restore to RDS.

Answer

Set up PostgreSQL streaming replication from the EC2 instance to an RDS read replica, then promote the replica.

Question 11

A financial services company runs an Amazon Aurora MySQL database cluster with a single writer and two readers. The cluster handles critical transactional workloads. Over the past month, the database experienced intermittent read replica lag spikes that caused stale reads in application queries. The database administrator needs to identify the root cause and reduce replica lag. Which THREE steps should the administrator take to diagnose and mitigate the issue?

Accepted Answer

Use Performance Insights on the reader instances to identify high-load queries causing resource contention.. Using Performance Insights on reader instances helps identify high-load queries causing resource contention, which can lead to replica lag. Option D is correct because a high binlog retention hours parameter can cause the replica to spend more time replaying binary logs; reducing it can mitigate lag. Option E is correct because enabling slow query logging on the writer instance helps identify long-running transactions that may lock rows or generate excessive binlog data, thereby causing replication delays. Option A is incorrect because switching from an Aurora cluster to a Multi-AZ DB instance does not address replica lag; Multi-AZ is for failover redundancy, not replication performance. Option B is incorrect because upgrading reader instances to match the writer's class may help if readers are underpowered, but this is not a direct diagnostic step and may not resolve the root cause if the issue stems from the writer side.

Answer

Switch from a single-writer cluster to Multi-AZ DB instance to reduce replication lag.

Answer

Upgrade the reader instances to a larger instance class to match the writer.

Question 12

A user is unable to list the contents of the S3 bucket 'my-db-backups' using the AWS CLI. The IAM policy attached to the user is shown in the exhibit. What is the likely cause?

Accepted Answer

The policy does not grant 's3:ListBucket' permission.. The IAM policy must include the 's3:ListBucket' action to allow listing the contents of an S3 bucket. The given policy lacks this action, so the user cannot list the bucket's objects. Option A is incorrect because there is no indication the bucket name is wrong. Option C is incorrect because the resource ARN in the policy includes the bucket-level ARN (e.g., 'arn:aws:s3:::my-db-backups'), which is sufficient for listing. Option D is incorrect because the policy syntax is valid JSON.

Answer

The user is using the wrong bucket name.

Answer

The resource ARN is missing the bucket-level ARN needed for listing.

Answer

The policy has a syntax error.

Question 13

A company runs a production Amazon RDS for PostgreSQL instance with Multi-AZ deployment. The DB instance has a large number of connections from application servers. The operations team wants to monitor the number of database connections and receive an alert when it exceeds 80% of the maximum connections. Which combination of steps should be taken to set up this monitoring? (Choose two.)

Accepted Answer

Set the alarm threshold to (0.8 * max_connections) and the evaluation period to 1 minute. Correct answers are C and D. C: Set the alarm threshold to (0.8 * max_connections) and the evaluation period to 1 minute ensures the alarm triggers when connections reach 80% of the maximum. D: Create a CloudWatch alarm on the 'DatabaseConnections' metric for the RDS instance to monitor the actual number of connections. A is wrong because the threshold should be based on max_connections, not a fixed value of 80. B is wrong because Enhanced Monitoring provides OS-level metrics, not database connection counts. E is wrong because Performance Insights provides DBLoad, not connection counts.

Answer

Set the alarm threshold to 80 and the evaluation period to 5 minutes

Answer

Enable Enhanced Monitoring and create a CloudWatch alarm on the 'database_connections' metric

Answer

Enable Performance Insights and create a CloudWatch alarm using the 'DBLoad' metric

Question 14

An e-commerce company uses Amazon ElastiCache for Redis as a session store for its web application. The application experiences occasional latency spikes during flash sales. The operations team notices that the Redis cluster's CPU utilization reaches 90% during these events. The current cluster is a single shard with a cache.r5.large node. The team wants to reduce CPU utilization and improve performance. What should the database administrator do?

Accepted Answer

Add read replicas to offload read traffic from the primary node.. Adding read replicas to an ElastiCache for Redis cluster allows read traffic to be offloaded from the primary node, reducing its CPU utilization. During flash sales, the high read load from session retrieval causes the primary's CPU to spike. Read replicas handle read queries, lowering the primary's CPU usage. Option B is incorrect because increasing replicas for data durability (e.g., for failover) does not directly reduce CPU load; replicas also serve reads but the primary still handles writes. Option C is incorrect because disabling AOF persistence reduces write overhead only marginally; the main CPU load during flash sales is from read traffic, not persistence. Option D is incorrect because enabling encryption at rest adds CPU overhead for encryption operations, which would increase CPU utilization, not reduce it.

Answer

Increase the number of replicas for data durability.

Answer

Disable AOF persistence to reduce write overhead.

Answer

Enable encryption at rest to secure data.

Question 15

A company is migrating an on-premises PostgreSQL database to Amazon RDS for PostgreSQL. The database is 2 TB in size and has a high write workload. The company needs to minimize downtime during the migration. Which AWS service or feature should the company use to achieve this?

Accepted Answer

Use AWS Database Migration Service (AWS DMS) with ongoing replication.. AWS DMS with ongoing replication (change data capture, CDC) is the correct choice because it allows continuous synchronization of the source PostgreSQL database with the target RDS for PostgreSQL instance after an initial full load. This minimizes downtime by enabling the target to stay up-to-date with changes until the cutover, which is critical for a 2 TB database with a high write workload.

Answer

Use pg_dump and pg_restore to export and import the database.

Answer

Use the AWS Schema Conversion Tool (AWS SCT) to convert the schema and migrate data.

Answer

Use AWS DataSync to replicate the database files.

Question 16

A database administrator needs to monitor Amazon RDS for PostgreSQL connections and terminate idle connections that have been open for more than 1 hour. Which combination of steps should be taken?

Accepted Answer

Enable audit logging and stream to Amazon CloudWatch Logs. Create a metric filter for connection events. Use CloudWatch Alarm to trigger a Lambda function that runs a SQL query to terminate idle connections.. The correct approach is Option C. Enable audit logging (e.g., using the pgaudit extension) and stream logs to CloudWatch Logs. Create a metric filter to identify connections idle for over 1 hour based on log patterns. Set a CloudWatch Alarm to invoke an AWS Lambda function, which executes a SQL query like pg_terminate_backend(pid) to terminate idle connections. Option A: Performance Insights provides metrics but no automated termination. Option B: RDS event subscriptions do not include idle connection details. Option D: Enhanced Monitoring provides OS-level metrics, not connection idle time.

Answer

Use Amazon RDS Performance Insights to view active connections and manually terminate idle connections via the AWS Management Console.

Answer

Configure an RDS event subscription for 'connection' events and send to Amazon SNS. Use SNS to notify an EC2 instance that runs a script to terminate idle connections.

Answer

Enable RDS Enhanced Monitoring and configure a CloudWatch alarm to invoke an AWS Lambda function that terminates idle connections.

Question 17

A company is migrating a 500 GB MySQL database from an on-premises server to Amazon RDS for MySQL. The company uses AWS DMS with ongoing replication. The initial full load completes successfully, and the target RDS instance is in sync. However, after a few hours, the replication task fails with an error: 'Last Error: Error executing source loop; The table 'orders' has a row size larger than the maximum payload size of the target endpoint.' The target RDS instance is configured with db.r5.large and the default parameter group. The company has already verified that the table does not have any BLOB or TEXT columns. What is the MOST likely cause of this error?

Accepted Answer

The source table has a row that exceeds the MySQL row size limit.. RDS for MySQL has a maximum row size limit (65,535 bytes). DMS attempts to insert a row that exceeds this limit. Increasing the instance size does not change the row size limit. Using a different storage engine might help, but InnoDB is default. Enabling compression reduces row size but is not a direct solution for the DMS error.

Answer

The DMS task is using a low-memory instance.

Answer

The target RDS instance's max_allowed_packet parameter is set too low.

Answer

The target RDS instance does not have enough storage allocated.

Question 18

Which TWO CloudWatch metrics should be monitored to determine if an Amazon Aurora MySQL DB cluster has sufficient I/O capacity?

Accepted Answer

ReadIOPS. The correct metrics to monitor for sufficient I/O capacity are ReadIOPS (Option A) and WriteIOPS (Option B). These metrics represent the actual number of read and write I/O operations per second. If the cluster is approaching the maximum IOPS limit of the underlying storage, increasing I/O capacity may be needed. Option C (FreeableMemory) is related to memory, not I/O. Option D (CPUUtilization) measures CPU usage, not I/O. Option E (DatabaseConnections) tracks connections, not I/O capacity.

Answer

FreeableMemory

Answer

CPUUtilization

Answer

DatabaseConnections

Question 19

A company is migrating an on-premises MySQL database to Amazon RDS for MySQL. The database uses InnoDB tables and is 500 GB in size. The migration must be completed within a 2-hour maintenance window. Which approach is MOST likely to meet the requirement?

Accepted Answer

Use mysqldump to export the database and then import it into RDS.. B is correct because mysqldump creates a logical backup that can be imported into Amazon RDS for MySQL within the 2-hour window for a 500 GB database, assuming sufficient network bandwidth and parallel import optimizations. The migration must complete within a fixed maintenance window, and mysqldump allows direct control over the export and import process, making it predictable for a single-shot migration.

Answer

Create a read replica of the on-premises database and promote it to RDS.

Answer

Use AWS DMS with a full load task.

Answer

Take a physical backup of the data directory and copy it to RDS.

Question 20

A developer is troubleshooting an application that is unable to write to a DynamoDB table. The above IAM policy is attached to the IAM role used by the application. What is the likely cause?

Accepted Answer

The Deny statement overrides the Allow statement, blocking all DynamoDB actions.. The Deny statement for all DynamoDB actions overrides the Allow for PutItem. Deny statements always take precedence over Allow statements. Option B is incorrect because the table name in the Resource ARN is correct. Option C is incorrect because the IAM user does exist. Option D is incorrect because the role is assumed correctly.

Answer

The table name in the Resource ARN is incorrect.

Answer

The IAM user does not exist.

Answer

The role is not correctly assumed by the application.