DBS-C01 Practice Exam 63 — 20 Questions

Question 1

A database specialist is managing an Amazon DocumentDB cluster. The application team reports that queries are slower than usual, and the specialist suspects that the cluster's cache hit ratio has dropped. Which Amazon CloudWatch metric should the specialist monitor to evaluate the buffer cache hit ratio for the DocumentDB cluster?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

BufferCacheHitRatio. BufferCacheHitRatio is the specific CloudWatch metric for Amazon DocumentDB that reports the percentage of requests served from the buffer cache. Monitoring this metric allows the specialist to confirm whether the cache hit ratio has dropped, which would explain slower queries due to increased disk reads. Other metrics like DiskQueueDepth or FreeableMemory provide related but indirect information and do not directly measure cache effectiveness.

Answer

DatabaseCursorsTimedOut

Answer

DiskQueueDepth

Answer

FreeableMemory

Question 2

A financial services company runs an Amazon Aurora PostgreSQL cluster. Compliance requires that all connections to the database use TLS with a minimum version of TLS 1.2, and that any non-encrypted connections are rejected. The security team has already enabled the cluster parameter rds.force_ssl. Which additional step must be taken to enforce TLS 1.2 or higher for all client connections?

Accepted Answer

Modify the Aurora cluster parameter group to set ssl_min_protocol_version to TLSv1.2.. Aurora PostgreSQL provides the ssl_min_protocol_version parameter to set the minimum acceptable TLS version. When rds.force_ssl is enabled, the server requires SSL, but the default minimum may be lower than TLS 1.2. Setting ssl_min_protocol_version to TLSv1.2 in the cluster parameter group ensures that only TLS 1.2 or higher connections are accepted, satisfying the compliance requirement.

Answer

Attach an IAM policy to the database users that denies connections using TLS versions lower than 1.2.

Answer

Configure the Aurora cluster to use a custom endpoint with a security group that blocks non-TLS traffic.

Answer

Enable IAM database authentication on the Aurora cluster, which automatically enforces TLS 1.2 for all connections.

Question 3

A company uses Amazon ElastiCache for Redis to cache session data for a web application. The operations team wants to monitor the cache hit rate to ensure the cache is effective. They need to set up a CloudWatch alarm that triggers when the cache hit rate falls below 80% over a 5-minute period. Which metric should they use to calculate the cache hit rate?

Accepted Answer

CacheHits and CacheMisses. To calculate the cache hit rate, the team needs the number of successful cache lookups (CacheHits) and the number of unsuccessful lookups (CacheMisses). The hit rate is CacheHits / (CacheHits + CacheMisses). ElastiCache for Redis provides these metrics in CloudWatch, and metric math can be used to create a custom metric for the hit rate. This allows setting an alarm when the hit rate drops below the threshold.

Answer

CurrConnections and NewConnections

Answer

Evictions and Reclaimed

Answer

CPUUtilization and EngineCPUUtilization

Question 4

A startup runs an Amazon Aurora MySQL cluster and wants to receive an alert when the average number of database connections exceeds a threshold for five consecutive minutes. The team already uses Amazon CloudWatch. Which combination of CloudWatch features should the database specialist configure to meet this requirement with the least effort?

Accepted Answer

A CloudWatch alarm on the `DatabaseConnections` metric with a period of 300 seconds and a threshold evaluated over one datapoint.. Aurora MySQL emits the `DatabaseConnections` metric to CloudWatch, and a CloudWatch alarm can evaluate that metric over a 300-second period to trigger when the average exceeds the threshold for five minutes. This requires only an alarm configuration and an SNS action, making it the least-effort native solution. Metric filters, EventBridge rules, and dashboard widgets do not evaluate this metric for alerting.

Answer

An Amazon EventBridge rule that matches RDS events for connection count and invokes an Amazon SNS topic.

Answer

A CloudWatch metric filter on the Aurora error log and an AWS Lambda function to evaluate the filter.

Answer

A CloudWatch dashboard widget with a custom threshold line and an SNS subscription for visual notifications.

Question 5

A company runs an Amazon Aurora MySQL cluster with a writer and two reader instances. The database specialist needs to implement a monitoring solution that captures detailed query-level performance metrics and identifies slow queries without impacting production performance. The solution must provide historical data for trend analysis. Which TWO actions should the specialist take to meet these requirements? (Choose two.)

Accepted Answer

Enable the slow query log on the Aurora cluster and publish it to Amazon CloudWatch Logs.. Performance Insights and the slow query log published to CloudWatch Logs together provide query-level monitoring and historical data. Performance Insights offers real-time and historical performance data with minimal impact, while the slow query log captures specific slow queries for deeper analysis. Enhanced Monitoring and general query logs are not suitable due to lack of query-level detail or performance overhead. CloudTrail does not capture SQL queries.

Answer

Configure Aurora to publish the general query log to Amazon CloudWatch Logs for all instances.

Answer

Enable Enhanced Monitoring on the Aurora cluster and set the granularity to 1 second.

Answer

Use AWS CloudTrail to log all database queries and analyze them with Amazon Athena.

Question 6

A company runs an Amazon Aurora PostgreSQL DB cluster. A database specialist notices that the writer instance's CPU utilization is consistently high, and Performance Insights shows a large number of active sessions waiting on the LWLock:BufferContent event. Which action should the specialist take to reduce the impact of this wait event?

Accepted Answer

Identify and optimize queries that repeatedly access the same hot pages, such as by adding appropriate indexes or partitioning.. The LWLock:BufferContent wait event signals contention on shared buffer pages, typically from concurrent queries hitting the same hot data. The most effective remediation is to identify those queries and reduce contention by adding indexes, partitioning, or rewriting queries. Increasing resources or restarting does not resolve the underlying access pattern causing the lock waits.

Answer

Increase the instance size to a larger instance class with more vCPUs.

Answer

Increase the value of the shared_buffers parameter to reduce buffer contention.

Answer

Enable the pg_stat_statements extension and restart the DB instance to reset statistics.

Question 7

A company uses Amazon Aurora PostgreSQL and wants to implement fine-grained access control for a table containing sensitive data. The security team needs to allow users in the 'analysts' role to see only rows where the 'region' column matches their assigned region, which is stored in a session variable. They also need to ensure that the filtering cannot be bypassed by users with direct table access. Which approach should a database specialist recommend?

Accepted Answer

Enable row-level security (RLS) on the table, create a policy that uses the session variable to filter rows, and grant the analysts role access to the table.. Row-level security (RLS) in Aurora PostgreSQL allows you to define policies that filter rows based on the current user or session variables. By enabling RLS and creating a policy that uses a session variable, you can ensure that users only see rows matching their region. This enforcement happens at the database engine level and cannot be bypassed by direct table access, as long as RLS is enabled and the policy is applied.

Answer

Create a separate schema for each region, copy the data into each schema, and grant the analysts role access only to the schema for their region.

Answer

Create a view that filters rows based on the session variable, and grant the analysts role SELECT on the view only.

Answer

Use column-level encryption for the 'region' column, and provide the encryption key only to users in the correct region.

Question 8

A database administrator is monitoring an Amazon RDS for MySQL DB instance. The administrator notices that the 'FreeableMemory' metric is consistently low, and the 'SwapUsage' metric is increasing. The DB instance is running a memory-intensive workload. What is the most likely impact on database performance, and what should the administrator do to resolve the issue?

Accepted Answer

Performance will degrade due to swapping; the administrator should scale up to a larger DB instance class with more memory.. Consistently low FreeableMemory and increasing SwapUsage indicate that the RDS for MySQL instance is under memory pressure and swapping to disk. Swapping causes severe performance degradation because disk access is orders of magnitude slower than memory. The correct action is to scale up to a larger DB instance class with more memory to eliminate swapping and improve performance.

Answer

Performance will improve because swapping frees up memory for the database; the administrator should take no action.

Answer

Performance will degrade due to increased disk I/O; the administrator should enable Enhanced Monitoring to diagnose further.

Answer

Performance will be unaffected because the database uses the buffer pool; the administrator should increase the buffer pool size.

Question 9

A company uses Amazon Redshift for its data warehouse. The security team wants to ensure that all data stored in the cluster is encrypted at rest using a hardware security module (HSM) to meet regulatory requirements. Which encryption option should be used?

Accepted Answer

AWS CloudHSM with a custom key.. Amazon Redshift supports encryption at rest using AWS CloudHSM, which provides dedicated HSMs. This allows the use of a custom key stored in CloudHSM and satisfies regulatory requirements for HSM-backed encryption. When creating a Redshift cluster, you can choose CloudHSM as the encryption option and specify the HSM connection details.

Answer

SSL/TLS encryption for data in transit.

Answer

Amazon S3 server-side encryption with AWS KMS.

Answer

AWS Key Management Service (KMS) with a customer managed key.

Question 10

A database specialist is monitoring an Amazon Aurora PostgreSQL cluster. The cluster has a writer and one reader. The application connects to the writer endpoint for writes and the reader endpoint for reads. During peak hours, the specialist notices that the reader instance's CPU is at 95% while the writer's CPU is at 40%. The application reports increased read latency. CloudWatch metrics show that the reader's 'SelectThroughput' is high and 'BufferCacheHitRatio' is low. What is the most likely cause of the high reader CPU?

Accepted Answer

The reader instance is under-provisioned and cannot handle the read workload, causing high CPU and low buffer cache hit ratio.. The reader instance is likely under-provisioned for the read workload. High SelectThroughput with a low BufferCacheHitRatio means many queries are reading from disk rather than memory, increasing CPU usage. Upgrading the reader instance to a larger class provides more memory for caching and more CPU to handle concurrent queries, reducing latency.

Answer

The reader endpoint is misconfigured and routing read traffic to the writer, causing the writer to handle reads and the reader to be idle.

Answer

The Aurora cluster's parameter group has 'max_connections' set too low, causing connection queuing and high CPU on the reader.

Answer

The writer instance is not sending updates to the reader, causing the reader to have stale data and perform full table scans.

Question 11

A company uses Amazon DynamoDB with a table that contains sensitive customer records. The security team wants to implement fine-grained access control so that each application user can only read and write items where the partition key matches their own user ID. The team also wants to ensure that the user cannot access items belonging to other users even if they craft their own requests. Which TWO actions should a database specialist take to meet these requirements? (Choose two.)

Accepted Answer

Attach the IAM policy to the IAM principals (users or roles) that the application uses, ensuring that the policy is evaluated for every DynamoDB request.. DynamoDB fine-grained access control is implemented through IAM policies that use the dynamodb:LeadingKeys condition key to restrict access to items where the partition key matches a value derived from the user's identity. The policy must be attached to the IAM principal (user or role) that the application assumes, so that every request is authorized accordingly. This prevents users from accessing other users' items even with crafted requests.

Answer

Use DynamoDB Accelerator (DAX) with a custom authorizer to inspect each request and allow or deny based on the partition key.

Answer

Configure a VPC endpoint for DynamoDB and use a VPC endpoint policy to restrict access to items based on the user ID.

Answer

Enable DynamoDB Streams on the table and use an AWS Lambda function to filter out unauthorized read requests based on the user ID in the request context.

Question 12

A company is using Amazon Aurora MySQL and wants to implement fine-grained access control for its database users. The security team requires that specific users can only access certain columns in a table and that all failed login attempts are logged. Which two actions should the team take to meet these requirements? (Choose two.)

Accepted Answer

Enable the audit_log plugin and configure it to log connection events, including failed logins.. For column-level access control in Aurora MySQL, use the native MySQL GRANT statement to assign privileges on specific columns. To log failed login attempts, enable the audit_log plugin and configure it to capture connection events. IAM policies, Lake Formation, and Global Database do not provide these database-level controls. Thus, the correct actions are to use column-level grants and enable audit logging.

Answer

Enable Aurora Global Database and use its write forwarding to enforce column-level security across regions.

Answer

Create an IAM policy that restricts access to specific columns in the Aurora table.

Answer

Use AWS Lake Formation to define column-level permissions on the Aurora table.

Question 13

A financial services company uses an Amazon Aurora PostgreSQL cluster to store account transaction records. A security policy mandates that all data be encrypted at rest with a customer-managed AWS KMS key, and that the company retain full control over key rotation and access policies. The database was created without encryption. What should a database specialist do to meet the encryption requirement with the LEAST operational effort?

Accepted Answer

Create a new encrypted Aurora cluster using the customer-managed KMS key, then migrate data using a logical dump and restore or snapshot copy as appropriate.. Aurora encryption at rest is selected when the cluster is created and cannot be enabled later on that same cluster. To satisfy a customer-managed KMS key requirement for an existing unencrypted cluster, you create a new encrypted cluster with that key and migrate the data. Copying an unencrypted snapshot with encryption creates an encrypted snapshot, but restoring it produces a new cluster rather than converting the original.

Answer

Enable encryption on the existing cluster by modifying the cluster and specifying the customer-managed KMS key.

Answer

Take a snapshot of the unencrypted cluster, enable encryption on the snapshot, and restore the snapshot to the existing cluster in place.

Answer

Attach an IAM policy that enforces encryption at rest and apply AWS KMS grants to the existing cluster's storage volumes.

Question 14

A company uses Amazon Aurora MySQL and wants to implement database activity monitoring for compliance. The security team must capture all SQL statements executed against the database, including who executed them and when, and store the logs in a centralized location for at least one year. The solution must minimize performance impact on the database. Which approach should a database specialist recommend?

Accepted Answer

Enable Aurora MySQL advanced auditing and publish the audit logs to Amazon CloudWatch Logs, setting the retention period to one year.. Aurora MySQL advanced auditing provides detailed audit logs that include the user, timestamp, and SQL statement, with lower performance overhead than the general log. These logs can be published to Amazon CloudWatch Logs, where you can configure a retention period of one year. This centralized approach satisfies compliance requirements for activity monitoring and long-term storage.

Answer

Use AWS CloudTrail to log all database activity by enabling data events for the Aurora cluster.

Answer

Enable the Aurora MySQL general log and error log, and configure them to be exported to Amazon CloudWatch Logs with a retention period of one year.

Answer

Install a third-party agent on the Aurora cluster to capture SQL traffic and send it to an external SIEM.

Question 15

A financial services company runs an Amazon Aurora PostgreSQL cluster. The security team must ensure that all data at rest, including automated backups and snapshots, is encrypted with a customer-managed AWS KMS key so they can control key rotation and access policies. They also need to audit all key usage. Which combination of steps should they take?

Accepted Answer

Create a customer-managed KMS key, enable encryption on the Aurora cluster at creation time specifying that key, and enable CloudTrail to log KMS API calls.. To meet the requirement for customer-managed encryption with auditability, the company must create a customer-managed KMS key and enable encryption on the Aurora cluster at creation, specifying that key. This ensures all data at rest, including backups and snapshots, uses the customer key. Enabling CloudTrail captures all KMS API calls, providing the necessary audit trail for key usage.

Answer

Create a customer-managed KMS key, enable encryption on the Aurora cluster, and use AWS Config to record KMS key changes.

Answer

Use an Amazon S3 bucket with default encryption to store Aurora backups, and enable AWS CloudTrail to log S3 API calls.

Answer

Enable encryption on the Aurora cluster using the default AWS-managed key aws/rds, and enable AWS CloudTrail to log KMS API calls.

Question 16

A company stores sensitive records in an Amazon DynamoDB table. The security team wants to ensure that all data in the table is encrypted at rest using a key that the company manages and can audit independently of AWS. What should the company do?

Accepted Answer

Configure the table to use a customer managed key in AWS KMS for encryption at rest.. DynamoDB encrypts all tables at rest by default, but the key type determines control and auditability. Selecting a customer managed key in AWS KMS gives the company ownership of the key policy, rotation, and CloudTrail visibility. This is the correct way to meet a requirement for a company-managed encryption key for the table's data at rest.

Answer

Enable DynamoDB encryption at rest with an AWS owned key.

Answer

Enable DynamoDB Streams and encrypt the stream with an AWS managed key.

Answer

Use client-side encryption with the Amazon DynamoDB Encryption Client before writing items.

Question 17

A company is using Amazon RDS for Oracle and wants to implement fine-grained access control for different application teams. They need to ensure that each team can only access specific rows and columns in a table based on their role. They also want to audit all access to sensitive columns. Which two AWS features or configurations should they use? (Choose two.)

Accepted Answer

Use Oracle Virtual Private Database (VPD) to enforce row-level security based on application context.. To enforce row-level and column-level access control in RDS for Oracle, native Oracle features such as Virtual Private Database (VPD) and Database Vault are appropriate. VPD provides row-level security by appending predicates to queries, while Database Vault restricts access to sensitive columns and provides auditing. These features are available in RDS for Oracle and meet the fine-grained access and auditing requirements.

Answer

Use Amazon RDS security groups to restrict access to specific rows and columns based on the source IP address.

Answer

Use AWS Identity and Access Management (IAM) database authentication to map IAM users to Oracle schemas.

Answer

Use AWS CloudTrail to log all SQL queries and filter for sensitive columns.

Question 18

A company uses Amazon DynamoDB to store user session data. The security team wants to implement fine-grained access control so that each user can only access items where the partition key matches their own user ID. The team also wants to ensure that all data is encrypted at rest using a customer-managed AWS KMS key. Which two actions should the team take to meet these requirements? (Choose two.)

Accepted Answer

Configure the DynamoDB table to use a customer-managed AWS KMS key for encryption at rest.. To implement fine-grained access control where users can only access items with their own user ID as partition key, use the `dynamodb:LeadingKeys` condition key in an IAM policy. To encrypt data at rest with a customer-managed KMS key, configure the DynamoDB table to use a customer-managed CMK. These two actions together meet the security requirements.

Answer

Use DynamoDB Accelerator (DAX) to encrypt data in transit and at rest with a customer-managed key.

Answer

Attach an IAM policy that uses the `dynamodb:Attributes` condition key to limit access to specific attributes based on user ID.

Answer

Enable DynamoDB encryption at rest using the default AWS-managed key, as customer-managed keys are not supported.

Question 19

A company has an Amazon Redshift cluster that contains sensitive data. The security team wants to ensure that all connections to the cluster are encrypted in transit and that only authorized users can connect. They have already configured the cluster in a private VPC subnet. Which additional step should the database specialist take to enforce encryption in transit?

Accepted Answer

Enable SSL enforcement by setting the require_ssl parameter to true in the cluster's parameter group.. For Amazon Redshift, encryption in transit is enforced by setting the require_ssl parameter to true in the parameter group associated with the cluster. This ensures that all client connections use SSL/TLS. Other options either address different security aspects or are not valid for Redshift, so setting require_ssl is the correct action.

Answer

Attach an IAM policy to the cluster that denies unencrypted connections.

Answer

Enable encryption at rest using AWS KMS, which also encrypts data in transit.

Answer

Configure the cluster to use AWS Certificate Manager (ACM) certificates for SSL/TLS.

Question 20

A financial services company runs Amazon RDS for SQL Server with Transparent Data Encryption (TDE) enabled using a customer-managed KMS key. An auditor asks how the database encryption keys are protected and rotated. The security team must explain which component actually performs the encryption and how key rotation is handled. Which statement is correct?

Accepted Answer

SQL Server TDE encrypts the database with a data encryption key protected by a certificate, and RDS manages the certificate using the KMS customer-managed key for envelope encryption.. RDS for SQL Server TDE uses a layered key model: SQL Server creates a database encryption key, protects it with a certificate, and RDS encrypts that certificate with a customer-managed KMS key. The KMS key never touches data blocks directly, and rotation affects the wrapping key rather than forcing immediate re-encryption. This envelope approach is what the auditor needs to understand.

Answer

TDE uses the KMS customer-managed key only for backup encryption, while primary data files remain unencrypted unless RDS encryption is also enabled.

Answer

RDS encrypts the database files directly with the KMS customer-managed key, and rotating that key re-encrypts all data immediately.

Answer

The KMS customer-managed key directly encrypts the SQL Server transaction log, while data files are encrypted with an IAM-generated key.