DBS-C01 Practice Exam 64 — 20 Questions

Question 1

A healthcare company stores patient records in an Amazon DynamoDB table. The security team must ensure that only authenticated users from a specific Amazon Cognito identity pool can read and write items, and that each user can access only their own records. They decide to use IAM policies with fine-grained access control. Which combination of features must they use to meet these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use IAM roles for Cognito identities and a DynamoDB policy with a Condition element that uses dynamodb:LeadingKeys to match the user's identity.. DynamoDB fine-grained access control relies on IAM condition keys, specifically dynamodb:LeadingKeys, to restrict operations to items whose partition key matches the caller. When combined with Cognito identity pools and IAM roles, this lets each authenticated user access only their own records. Streams, per-user tables, and DAX do not provide the required item-level authorization.

Answer

Create a separate DynamoDB table for each user and grant each Cognito identity access only to its own table using an IAM policy.

Answer

Use DynamoDB Accelerator (DAX) with an IAM policy that limits access based on the Cognito user's email address stored in the item.

Answer

Enable DynamoDB Streams and use an AWS Lambda function to filter items based on the Cognito user ID before returning results.

Question 2

A company uses Amazon Redshift and has implemented column-level access control using Redshift's column-level privileges. The security team now wants to ensure that when a user queries a table, they can only see rows that match their department. The company already uses an IAM role for Redshift Spectrum and has a mapping of users to departments in a separate table. Which Redshift feature should be used to enforce row-level security dynamically based on the user's department?

Accepted Answer

Create a row-level security policy using the CREATE RLS POLICY statement and attach it to the table.. Amazon Redshift row-level security (RLS) allows you to define policies that filter rows based on the current user or their group. By using CREATE RLS POLICY and ATTACH RLS POLICY, you can dynamically enforce row-level access based on a mapping table. Column-level privileges, views, and Redshift Spectrum do not provide the same centralized, dynamic row-level filtering.

Answer

Use column-level privileges to restrict access to the department column.

Answer

Create a view that filters rows based on the current user and grant SELECT on the view to users.

Answer

Enable Redshift Spectrum and create an external table with row filtering.

Question 3

A company uses Amazon Redshift for a data warehouse. The security team requires that all data in the cluster be encrypted at rest using a hardware security module (HSM) to meet compliance requirements. The cluster is currently unencrypted. What should the company do to meet this requirement?

Accepted Answer

Create a new Redshift cluster with HSM encryption enabled, and migrate the data from the existing cluster.. Amazon Redshift HSM encryption must be enabled when the cluster is created; it cannot be added to an existing cluster. To meet the compliance requirement, the company must create a new Redshift cluster with HSM encryption enabled and then migrate the data from the existing unencrypted cluster. This ensures that all data at rest is encrypted using an HSM.

Answer

Enable encryption on the existing cluster using AWS KMS with a customer-managed key, and then enable HSM encryption.

Answer

Modify the existing cluster to use HSM encryption by enabling it in the cluster's parameter group.

Answer

Use AWS KMS with a customer-managed key and enable automatic key rotation to meet the HSM requirement.

Question 4

A healthcare analytics company runs a nightly ETL job that loads 2 TB of compressed CSV files into Amazon Redshift. The cluster is a 4-node ra3.4xlarge. The job currently uses a single COPY command and takes 8 hours, exceeding the maintenance window. The company wants to reduce the load time without changing the cluster size. Which approach should a database specialist recommend?

Accepted Answer

Split the data into multiple files and run parallel COPY commands from Amazon S3.. Amazon Redshift COPY achieves maximum throughput when data is split into multiple files so that all slices can load in parallel. A single large file limits parallelism to one slice per node, causing the 8-hour load. Splitting into many files and running parallel COPY commands uses the existing cluster fully, meeting the no-resize constraint.

Answer

Use AWS Glue to perform the load instead of Amazon Redshift COPY.

Answer

Enable concurrency scaling on the cluster to add transient capacity during the load.

Answer

Increase the number of slices per node by resizing the cluster to a larger node type.

Question 5

A company is planning to migrate an on-premises Microsoft SQL Server database to Amazon RDS for SQL Server. The database is 2 TB and the company wants to minimize downtime during the migration. They also need to ensure that the target database is continuously synchronized with the source until cutover. Which two steps should be included in the migration plan? (Choose two.)

Accepted Answer

Enable and configure MS-CDC on the source SQL Server database.. To minimize downtime when migrating to Amazon RDS for SQL Server, use AWS DMS with full load and change data capture (CDC) to continuously replicate changes. Additionally, MS-CDC must be enabled on the source SQL Server database for DMS to capture ongoing changes. These two steps ensure that the target remains synchronized until cutover, allowing for a quick switchover with minimal downtime.

Answer

Use AWS Database Migration Service (AWS DMS) with only a full load, and then manually apply changes after cutover.

Answer

Use native SQL Server backup and restore to transfer the database to Amazon RDS for SQL Server.

Answer

Set up a VPN connection between on-premises and AWS to facilitate data transfer.

Question 6

A company is running an Amazon RDS for SQL Server instance with Multi-AZ deployment. The security team requires that all data at rest be encrypted. The instance was originally launched without encryption. What is the most efficient way to enable encryption at rest for this existing instance?

Accepted Answer

Take a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance.. The correct option is C: take a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the encrypted snapshot to a new DB instance. For an existing unencrypted RDS for SQL Server instance, encryption at rest cannot be turned on in place; the supported approach is to snapshot the instance, encrypt the snapshot copy (which applies AWS KMS encryption), and restore that encrypted snapshot as a new encrypted DB instance. Option A is invalid because the ModifyDBInstance API does not allow enabling storage encryption on an existing unencrypted instance. Option B is unnecessary and less efficient than the native snapshot copy/restore method, and Option D does not work because an encrypted read replica cannot be created from an unencrypted source instance.

Answer

Modify the DB instance and set the encryption attribute to true.

Answer

Use AWS Database Migration Service (DMS) to migrate the data to a new encrypted RDS instance.

Answer

Create a read replica with encryption enabled and promote it to become the primary instance.

Question 7

A database specialist is investigating an Amazon Aurora MySQL DB cluster where the application reports intermittent connection timeouts. The specialist notices that the number of connections to the writer instance spikes dramatically every hour. Which metric in Amazon CloudWatch should be reviewed FIRST to determine if the DB cluster is hitting the maximum connection limit?

Accepted Answer

DatabaseConnections. The DatabaseConnections metric in Amazon CloudWatch tracks the number of active connections to an Aurora DB instance. Since the application experiences timeouts during hourly connection spikes, this metric will reveal if the cluster is reaching its maximum connection limit. Other metrics like CPU or memory might show secondary effects, but DatabaseConnections is the direct measure of connection count and is the first to check.

Answer

CPUUtilization

Answer

DiskQueueDepth

Answer

FreeableMemory

Question 8

A healthcare company is building a new patient records system on AWS. The system must store structured data with complex relationships, enforce referential integrity, and support ACID transactions across multiple tables. The company expects unpredictable read traffic with spikes during business hours and wants to minimize database administration. Which AWS database service should they use?

Accepted Answer

Amazon Aurora Serverless v2 with MySQL compatibility and multi-AZ deployment.. The requirements point to a relational database with ACID transactions, referential integrity, and minimal administration. Aurora Serverless v2 provides automatic scaling for unpredictable workloads and supports MySQL features, making it the best fit. It eliminates the need to manage instance capacity while ensuring data integrity and complex query support.

Answer

Amazon RDS for Oracle with a multi-AZ deployment and Oracle Active Data Guard.

Answer

Amazon Redshift with a multi-node cluster and concurrency scaling enabled.

Answer

Amazon DynamoDB with transactions and a global secondary index for each relationship.

Question 9

A development team is building a new microservice that needs a fully managed, key-value database with single-digit millisecond latency at any scale. The team wants to avoid managing servers and wants the database to automatically scale read and write capacity. Which AWS service should the team choose?

Accepted Answer

Amazon DynamoDB with on-demand capacity mode. DynamoDB with on-demand capacity mode is the only fully managed key-value database that provides single-digit millisecond latency at any scale and automatically scales read and write capacity without server management. The other services are either relational, caching, or graph databases that do not meet all requirements.

Answer

Amazon Neptune with read replicas

Answer

Amazon ElastiCache for Memcached with auto discovery

Answer

Amazon RDS for MySQL with Multi-AZ and auto scaling

Question 10

A database specialist is investigating intermittent connection timeouts to an Amazon Aurora MySQL cluster. The application logs show errors like 'Too many connections'. The specialist checks Amazon CloudWatch metrics and sees that the DatabaseConnections metric spikes to the maximum allowed by the DB parameter group's max_connections setting during peak traffic, but CPU and memory remain moderate. What is the MOST likely cause of the connection errors?

Accepted Answer

The application is not closing connections properly, leading to a buildup of idle connections that consume the max_connections limit.. The 'Too many connections' error occurs when the number of concurrent connections reaches the max_connections parameter limit. Since CPU and memory are moderate, the database is not overloaded; instead, connections are accumulating, likely due to improper connection handling. Implementing connection pooling or fixing connection leaks will resolve the issue by keeping the connection count below the limit.

Answer

The security group is blocking new connections after a certain threshold, causing timeouts.

Answer

The Aurora cluster's reader endpoint is not being used, causing all read traffic to hit the writer instance.

Answer

The Aurora cluster's writer instance is undersized, causing it to reject new connections when CPU is high.

Question 11

A company is designing a database for a new IoT application that ingests time-series data from millions of sensors. The data arrives continuously and must be stored for long-term analysis. The team needs to optimize for high write throughput and efficient time-range queries. Which TWO design choices should the team make? (Choose two.)

Accepted Answer

Use Amazon Timestream with memory store and magnetic store retention policies. Timestream is purpose-built for time-series data with automatic tiering and retention policies, while DynamoDB with a composite key of sensor ID and timestamp provides scalable high-throughput ingestion and efficient time-range queries. Both are valid design choices for this IoT workload.

Answer

Use Amazon Redshift with sort keys on the timestamp column and distribution keys on sensor ID

Answer

Use Amazon ElastiCache for Redis with sorted sets for time-series data

Answer

Use Amazon RDS for SQL Server with a clustered index on the timestamp column

Question 12

A company is deploying a new Amazon RDS for MySQL database. They want to ensure that the database is highly available and can automatically fail over to a standby instance in case of an Availability Zone failure. Which feature should they enable?

Accepted Answer

Multi-AZ deployment. Multi-AZ deployment is the correct feature for automatic failover in Amazon RDS for MySQL. It maintains a synchronous standby in another Availability Zone and automatically promotes it if the primary fails. Read replicas, automated backups, and RDS Proxy do not provide automatic failover on their own.

Answer

Amazon RDS Proxy

Answer

Read replicas

Answer

Automated backups

Question 13

A financial services company is deploying a new Amazon Aurora PostgreSQL database cluster. They require that the database be encrypted at rest using a customer managed AWS KMS key and that encryption cannot be changed after creation. They also need to ensure that snapshots and automated backups are encrypted. Which action should be taken to meet these requirements?

Accepted Answer

Enable encryption at rest when creating the Aurora cluster and specify the customer managed KMS key.. Aurora encryption at rest is enabled only at cluster creation. You must specify the customer managed KMS key during creation. Once set, encryption cannot be disabled or changed. Automated backups and snapshots inherit the encryption. Therefore, the correct action is to enable encryption and choose the customer managed key when creating the cluster.

Answer

Create the Aurora cluster with encryption using the default AWS managed KMS key, then later change to a customer managed key.

Answer

Create the Aurora cluster without encryption, then modify the cluster to enable encryption using the customer managed KMS key.

Answer

Create the Aurora cluster with encryption using a customer managed KMS key, and enable encryption on automated backups separately.

Question 14

A company runs an e-commerce platform on AWS using an Amazon Aurora MySQL database. The database is accessed by multiple microservices, each using a separate database user. The security team recently discovered that a developer accidentally committed database credentials to a public GitHub repository. The credentials were for a user that had write access to the database. The team immediately revoked the credentials and rotated them. However, they want to prevent such incidents from happening again. They need a solution that ensures credentials are not hardcoded in application code, are rotated automatically, and are accessible only to authorized microservices. What should they do?

Accepted Answer

Use AWS Secrets Manager to store the credentials, configure automatic rotation, and attach a resource-based policy to allow access only from the microservices' IAM roles.. AWS Secrets Manager is purpose-built for storing and automatically rotating database credentials, and its resource-based policy can restrict access to specific IAM roles used by the authorized microservices, directly addressing the hardcoding, rotation, and least-privilege requirements. Automatic rotation for Aurora MySQL is natively supported through a Lambda rotation function, so the compromised-credential scenario is mitigated going forward. Option A does not fit because IAM database authentication still requires generating and managing authentication tokens and does not by itself provide a central credential store with automatic rotation for password-based users. Option B is weaker because Parameter Store can hold secrets but lacks native automatic rotation for Aurora credentials and relies mainly on IAM policies rather than a resource-based secret policy. Option D is unsuitable because an S3 bucket is not a secrets-management service, provides no automatic rotation, and increases the risk of accidental exposure.

Answer

Use IAM database authentication for Aurora and eliminate the use of database passwords.

Answer

Use AWS Systems Manager Parameter Store to store the credentials and grant access via IAM roles.

Answer

Store the credentials in an encrypted S3 bucket and grant access to the microservices via bucket policies.

Question 15

A startup is deploying a new Amazon DynamoDB table for a web application. They need to ensure that the table can handle sudden spikes in read traffic without manual intervention. They also want to minimize costs during periods of low traffic. Which capacity mode should they choose?

Accepted Answer

On-demand capacity mode.. On-demand capacity mode automatically scales to handle sudden spikes in traffic and charges per request, so costs decrease during low traffic. Provisioned modes require capacity planning and may not respond instantly to spikes. Reserved capacity is for predictable workloads. Therefore, on-demand is the best fit for unpredictable traffic and cost minimization.

Answer

Provisioned capacity mode with auto scaling enabled.

Answer

Provisioned capacity mode with reserved capacity.

Answer

Provisioned capacity mode with global secondary indexes.

Question 16

A startup is building a new web application that requires a relational database. They want to minimize database management tasks and prefer a serverless option that automatically scales based on demand. The application has unpredictable traffic patterns. Which AWS service should they choose?

Accepted Answer

Amazon Aurora Serverless. The startup needs a relational database that is serverless and automatically scales with unpredictable traffic. Amazon Aurora Serverless fits this perfectly: it is relational, fully managed, and scales automatically. Other options are either not relational (DynamoDB), not serverless (RDS), or not designed for transactional web applications (Redshift).

Answer

Amazon RDS for MySQL

Answer

Amazon Redshift

Answer

Amazon DynamoDB

Question 17

A media company runs a video streaming platform. They need to store user watch history for the last 90 days. The data volume is very large (hundreds of terabytes) and queries are analytical, scanning large portions of data with complex aggregations. The company wants a cost-effective solution with minimal operational overhead. Which AWS database service is MOST appropriate?

Accepted Answer

Amazon Redshift. The scenario requires a cost-effective, scalable solution for analytical queries on a massive dataset. Amazon Redshift is purpose-built for this, offering columnar storage, parallel processing, and seamless scaling. Other options are either not analytical (DynamoDB, ElastiCache) or not cost-effective at this scale (RDS).

Answer

Amazon RDS for PostgreSQL with read replicas

Answer

Amazon ElastiCache for Redis

Answer

Amazon DynamoDB with on-demand capacity

Question 18

A company is designing a new Amazon DynamoDB table to store user profiles for a global application. The table will have a partition key of UserID and a sort key of LastLogin. The application needs to efficiently query users by their email address and by their country. Which two design changes should be made to meet these access patterns? (Choose two.)

Accepted Answer

Create a global secondary index (GSI) with Email as the partition key.. GSIs allow efficient queries on non-key attributes. Creating one GSI with Email as the partition key and another with Country as the partition key enables the application to query users by email and by country independently. This is the standard DynamoDB pattern for supporting multiple access patterns without table scans or custom replication.

Answer

Add a sort key to the base table that combines Country and Email.

Answer

Create a local secondary index (LSI) with Country as the sort key.

Answer

Enable DynamoDB Streams and use AWS Lambda to replicate data to a new table keyed by Email.

Question 19

A company is migrating a large on-premises MongoDB database to Amazon DocumentDB. They need to perform the migration with minimal downtime and ensure that the target database is continuously updated during the cutover. Which AWS service should they use?

Accepted Answer

AWS Database Migration Service (AWS DMS) with change data capture (CDC). For minimal downtime migrations, AWS DMS with CDC is the correct choice because it performs an initial full load and then replicates ongoing changes. This keeps the target in sync until cutover. Other options either do not support database replication or lack change capture, making them unsuitable for this scenario.

Answer

AWS Database Migration Service (AWS DMS) with full load only

Answer

AWS DataSync with a scheduled task

Answer

AWS Snowball Edge with a copy of the database files

Question 20

A company is planning to migrate a large on-premises MySQL database to Amazon Aurora MySQL. They want to minimize downtime and ensure data consistency. They will use AWS DMS. Which TWO actions should be taken to meet these requirements? (Choose two.)

Accepted Answer

Configure the AWS DMS task to perform a full load and ongoing replication (CDC).. To minimize downtime and ensure consistency, the DMS task must perform both a full load and ongoing replication (CDC). This requires binary logging on the source MySQL database with ROW format. These two actions allow DMS to copy existing data and continuously apply changes, enabling a quick cutover. The other options are either incorrect or not essential for the stated requirements.

Answer

Set the target endpoint to use the 'Drop and create tables' mode for the full load.

Answer

Configure the AWS DMS replication instance in the same AWS Region as the target Aurora cluster.

Answer

Use a single-AZ Aurora cluster to reduce replication latency.