DBS-C01 Practice Exam 66 — 20 Questions

Question 1

A database specialist manages an Amazon Aurora PostgreSQL cluster. The company requires point-in-time recovery capability for up to 30 days. The specialist needs to configure the backup retention period. Which action should be taken?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify the DB cluster and set the backup retention period to 30 days.. Aurora PostgreSQL supports automated backups with a retention period of up to 35 days. To achieve point-in-time recovery for 30 days, the backup retention period on the DB cluster must be set to 30. This enables continuous backup of the cluster and allows restoration to any point within the retention window. Other methods like manual snapshots or AWS Backup do not provide the same continuous recovery capability.

Answer

Enable automated backups and set the retention period to 30 days on each read replica.

Answer

Use AWS Backup to create a backup plan with a 30-day retention and assign the Aurora cluster as a resource.

Answer

Create a manual snapshot and configure a lifecycle policy to retain it for 30 days.

Question 2

A healthcare company stores sensitive patient records in Amazon DynamoDB. The table uses a partition key of patientID and a sort key of recordDate. Compliance requires that all data be encrypted at rest with a customer-managed AWS KMS key, and that the key be rotated annually. The security team also needs to audit all decryption operations. Which combination of actions should the database specialty engineer take to meet these requirements with the LEAST operational overhead?

Accepted Answer

Create a customer-managed KMS key with automatic annual rotation, configure the DynamoDB table to use that key, and enable AWS CloudTrail logging for KMS API calls.. The requirement for a customer-managed KMS key with annual rotation points to using a customer-managed key with automatic rotation enabled. DynamoDB supports selecting a customer-managed KMS key for encryption at rest. To audit decryption operations, CloudTrail must log KMS API calls, which include Decrypt events. AWS owned and AWS managed keys do not provide the same customer control or audit granularity. ACM is unrelated to DynamoDB encryption.

Answer

Use AWS Certificate Manager (ACM) to issue a certificate, attach it to the DynamoDB table, and enable KMS key rotation.

Answer

Enable DynamoDB encryption at rest with an AWS managed key, and use AWS CloudTrail to log all DynamoDB PutItem and GetItem calls.

Answer

Enable DynamoDB encryption at rest using the default AWS owned key, and enable AWS CloudTrail data events for the table.

Question 3

A healthcare company stores sensitive patient data in an Amazon RDS for Oracle DB instance. The security team requires that all data at rest be encrypted using a customer-managed AWS KMS key (CMK) that they control, and that the key be rotated annually. They also need to ensure that if the CMK is disabled, the database becomes inaccessible. Which configuration should the database specialist implement?

Accepted Answer

Create a customer-managed CMK in AWS KMS, enable automatic key rotation, and specify that CMK when creating or modifying the RDS instance to enable encryption.. To meet the requirements, the database must be encrypted with a customer-managed CMK that the customer controls. Enabling automatic key rotation on that CMK satisfies the annual rotation requirement. Disabling the CMK prevents RDS from accessing the encryption key, making the database inaccessible, which is the desired security behavior. The other options either use AWS managed keys or Oracle TDE, which do not provide the same level of customer control and integration with AWS KMS.

Answer

Use Oracle Transparent Data Encryption (TDE) with a master key stored in Oracle Wallet on the DB instance.

Answer

Enable encryption at rest using an AWS managed key, and then use AWS KMS grants to allow the customer to rotate the key manually.

Answer

Enable encryption at rest on the RDS instance using the default AWS managed key for RDS.

Question 4

A database specialist is troubleshooting an Amazon Aurora PostgreSQL cluster where the application reports intermittent connection timeouts during peak hours. The specialist suspects a connection storm and wants to identify the source. Which metric should be monitored in Amazon CloudWatch to determine the number of current connections to the DB instance?

Accepted Answer

DatabaseConnections. The DatabaseConnections metric in Amazon CloudWatch reports the number of client connections to the DB instance. In an Aurora PostgreSQL cluster, monitoring this metric is essential to detect connection storms that can lead to timeouts. By tracking DatabaseConnections, the specialist can determine if the application is exceeding connection limits or if there is a sudden surge in connections, enabling appropriate mitigation such as using connection pooling or increasing max_connections.

Answer

DBLoad

Answer

LoginFailures

Answer

NetworkReceiveThroughput

Question 5

A company stores sensitive data in an Amazon DynamoDB table. The security team requires that all data be encrypted at rest using a customer managed AWS KMS key (CMK) and that they can audit all decryption attempts. Which combination of actions should be taken to meet these requirements?

Accepted Answer

Create a customer managed CMK in AWS KMS, configure the DynamoDB table to use this CMK for encryption at rest, and enable AWS CloudTrail logging for KMS.. Using a customer managed CMK in AWS KMS for DynamoDB encryption at rest gives the customer control over the key and enables auditing of key usage. Enabling CloudTrail for KMS logs all decryption attempts, providing the required audit trail. This combination meets both the encryption and auditability requirements.

Answer

Use DynamoDB Accelerator (DAX) with encryption at rest enabled and configure DAX to use a customer managed CMK.

Answer

Enable DynamoDB encryption at rest with the default AWS owned CMK and enable AWS CloudTrail logging for DynamoDB.

Answer

Enable DynamoDB Streams and use AWS Lambda to encrypt the data with a customer managed CMK before writing to the table.

Question 6

A media analytics company ingests 50,000 JSON clickstream events per second into Amazon Kinesis Data Streams. A consumer written in Python using the AWS SDK for Python (Boto3) reads the stream and must persist every raw event into a durable, queryable store with sub-second eventual visibility. The team wants the lowest operational overhead and does not need joins, transactions, or a fixed schema. Which AWS database service should the team choose?

Accepted Answer

Amazon DynamoDB with on-demand capacity mode. The workload is a high-velocity, schemaless event stream with no relational requirements, so a key-value store with elastic write capacity is the natural fit. Amazon DynamoDB in on-demand mode handles unpredictable throughput without capacity planning and delivers consistent single-digit millisecond writes, giving the consumer a simple PutItem target that scales with the stream.

Answer

Amazon Redshift with RA3 nodes and concurrency scaling

Answer

Amazon ElastiCache for Redis with AOF persistence enabled

Answer

Amazon Aurora MySQL with a writer and two reader instances

Question 7

A company uses Amazon RDS for SQL Server with Transparent Data Encryption (TDE) enabled. The security team wants to ensure that the TDE certificates and private keys are managed by the company and not by AWS. What should the team do to meet this requirement?

Accepted Answer

Import a TDE certificate into the RDS instance using the rdsadmin stored procedure and then enable TDE with that certificate.. To use customer-managed TDE certificates with RDS for SQL Server, you must import the certificate and private key into the DB instance using the rdsadmin stored procedure. This allows the company to retain control over the certificate and keys. After import, you can enable TDE with that certificate. The other options incorrectly involve AWS KMS or do not provide the necessary control over the TDE certificate.

Answer

Use the RDS option group to configure TDE with a customer managed key stored in AWS KMS.

Answer

Enable TDE using the default RDS service-managed certificate, and then rotate the certificate using AWS KMS.

Answer

Create a symmetric key in the master database and use it to encrypt the TDE certificate, then store the key in AWS Secrets Manager.

Question 8

A healthcare company runs an Amazon Aurora MySQL cluster that stores patient records. A new compliance rule requires that all data at rest and in transit be encrypted, and that the company control and rotate the encryption keys independently of AWS. The application connects over TLS. Which combination of actions should a database specialist take to meet these requirements with the least operational effort?

Accepted Answer

Create a customer managed key in AWS KMS, enable Aurora encryption at rest with that key, and enforce TLS using the require_secure_transport parameter.. Meeting the rule requires controlling the encryption key and enforcing TLS. A customer managed key in AWS KMS lets the company define the key policy and rotation, while enabling encryption at rest on the Aurora cluster protects stored data. Setting the require_secure_transport parameter to ON forces TLS for all connections, covering data in transit with far less effort than custom key infrastructure.

Answer

Enable Aurora encryption at rest with a customer managed key, and rely on the default Aurora endpoint configuration to encrypt connections in transit.

Answer

Enable Aurora encryption at rest using an AWS managed key, and enforce TLS by setting the require_secure_transport parameter.

Answer

Use AWS CloudHSM to store the Aurora master key, enable encryption at rest, and terminate TLS at an Application Load Balancer.

Question 9

A company runs an Amazon RDS for MySQL DB instance in a private subnet. A database specialist must ensure that automated backups are retained for 35 days and that point-in-time recovery is available for the maximum supported window. What should the specialist do?

Accepted Answer

Set the backup retention period to 35 days on the DB instance and enable automated backups.. For Amazon RDS for MySQL, the automated backup retention period can be set from 0 to 35 days, and point-in-time recovery is available for the entire retention window. Setting it to 35 days satisfies both the 35-day retention and the maximum PITR requirement. Manual snapshots, Multi-AZ, and S3 export do not extend the PITR window.

Answer

Enable automated backups with a 35-day retention period and also enable Multi-AZ deployment.

Answer

Set the backup retention period to 7 days and create manual snapshots every day for 35 days.

Answer

Set the backup retention period to 35 days and copy the automated backups to an Amazon S3 bucket for long-term storage.

Question 10

A company is migrating an on-premises MongoDB cluster to Amazon DocumentDB (with MongoDB compatibility). The source cluster uses MongoDB 4.0 and contains 2 TB of data. The company requires minimal downtime during the migration. Which AWS service should be used to perform the migration?

Accepted Answer

AWS Database Migration Service (AWS DMS) with change data capture (CDC). AWS DMS with change data capture (CDC) is the correct choice because it supports MongoDB as a source and Amazon DocumentDB as a target, allowing an initial full load and ongoing replication to keep the target synchronized until cutover. This minimizes downtime and is the standard approach for such migrations. Other methods either lack continuous replication or are not designed for database migration.

Answer

AWS Snowball Edge with AWS DMS

Answer

AWS DataSync

Answer

mongodump and mongorestore utilities

Question 11

A company is deploying an Amazon RDS for MySQL Multi-AZ DB cluster. The company wants to ensure that the cluster can survive an Availability Zone failure with minimal downtime and that the data is durably stored. Which statement describes the replication and failover behavior of this deployment?

Accepted Answer

The cluster uses synchronous replication to two standby instances in different Availability Zones, and failover is automatic.. Amazon RDS for MySQL Multi-AZ DB clusters provide a writer and two readers across three AZs. Data is synchronously replicated to both readers, ensuring durability and zero data loss on failover. Failover is automatic and typically completes within 60 seconds, providing minimal downtime. This architecture is designed for high availability and fault tolerance.

Answer

The cluster uses asynchronous replication to a standby replica in another Availability Zone, and failover is automatic.

Answer

The cluster uses asynchronous replication to two standby instances in different Availability Zones, and failover is automatic.

Answer

The cluster uses synchronous replication to one standby instance in another Availability Zone, and failover is manual.

Question 12

A startup is building a new application that requires a fully managed, serverless relational database with automatic scaling and high availability. The application has unpredictable traffic patterns and the team wants to minimize operational overhead. Which AWS service should they choose?

Accepted Answer

Amazon Aurora Serverless v2 with PostgreSQL compatibility.. The startup needs a fully managed, serverless relational database with automatic scaling and high availability. Aurora Serverless v2 fits all these criteria: it is relational, serverless, scales automatically, and provides Multi-AZ high availability. It eliminates the need to manage instances, reducing operational overhead. Other options either are not relational, not serverless, or not designed for transactional workloads.

Answer

Amazon DynamoDB with on-demand capacity mode and global tables.

Answer

Amazon Redshift Serverless with concurrency scaling.

Answer

Amazon RDS for MySQL with Multi-AZ and auto scaling enabled.

Question 13

A database specialist is managing an Amazon Aurora PostgreSQL cluster with a writer and a reader instance. The application uses the writer endpoint for writes and the reader endpoint for reads. During a recent incident, the writer instance failed over to the reader, causing a brief outage. The specialist needs to ensure that the application automatically reconnects to the new writer after a failover with minimal disruption. What should the specialist do?

Accepted Answer

Configure the application to use the Aurora writer endpoint and implement retry logic with exponential backoff.. The Aurora writer endpoint is designed to always point to the current writer instance, and after a failover, the DNS record is updated. By using this endpoint and implementing retry logic, the application can automatically reconnect to the new writer. Direct IP connections, custom DNS, or using the reader endpoint for writes are not suitable and would cause failures.

Answer

Modify the application to connect directly to the writer instance's IP address to avoid DNS resolution delays.

Answer

Enable Aurora Auto Scaling on the reader instances and configure the application to use the reader endpoint for writes.

Answer

Create an Amazon Route 53 health check for the writer instance and update the application to use a custom DNS name that points to the healthy instance.

Question 14

A company stores sensitive data in an Amazon DynamoDB table. The security team wants to ensure that all data at rest is encrypted using a customer managed key in AWS KMS, and that the key is automatically rotated every year. They also need to monitor who uses the key. Which combination of actions should a database specialist take to meet these requirements?

Accepted Answer

Create a customer managed key in AWS KMS with automatic rotation enabled, and configure the DynamoDB table to use that key for encryption at rest.. To use a customer managed key with automatic rotation for DynamoDB encryption at rest, you create the key in AWS KMS, enable automatic rotation (which rotates yearly), and then configure the DynamoDB table to use that key. This provides control over the key and allows monitoring of key usage via CloudTrail. AWS owned and AWS managed keys do not offer the same customization and rotation control.

Answer

Use an AWS managed key for DynamoDB, and enable rotation on that key through the KMS console.

Answer

Enable DynamoDB encryption at rest with the default AWS owned key, and enable automatic key rotation on that key.

Answer

Enable DynamoDB encryption at rest with a customer managed key, and use AWS Certificate Manager to rotate the key annually.

Question 15

A logistics company uses Amazon Redshift for analytics on shipment data. The cluster currently has a single ra3.4xlarge node. The company wants to improve query performance for complex joins and aggregations on large tables. The data is loaded daily and does not change during the day. Which design approach should a database specialist recommend to optimize query performance?

Accepted Answer

Choose distribution keys on frequently joined columns and sort keys on commonly filtered columns. For complex joins and aggregations on large tables, Redshift performance depends heavily on data distribution and sorting. Distribution keys on join columns ensure that matching rows are on the same node, minimizing network traffic. Sort keys on filter columns allow zone maps to skip blocks. Other options either do not address join performance or apply distribution styles that cause data movement.

Answer

Enable concurrency scaling to automatically add transient clusters for read queries

Answer

Convert all tables to use DISTSTYLE EVEN and rely on Redshift's automatic vacuum and analyze

Answer

Use DISTSTYLE ALL for all large dimension tables and DISTSTYLE EVEN for fact tables

Question 16

A company uses Amazon ElastiCache for Redis with cluster mode enabled. The database specialist needs to add a new shard to the cluster to increase capacity. The cluster currently has three shards, each with one primary and one replica. What is the correct procedure to add a shard without downtime?

Accepted Answer

Modify the cluster to increase the number of shards, and ElastiCache will automatically rebalance the slots and migrate data.. To add a shard to an ElastiCache for Redis cluster with cluster mode enabled, you modify the cluster to increase the number of shards. ElastiCache automatically rebalances hash slots and migrates data to the new shard. This operation is performed online without downtime, ensuring continuous availability. The other options either involve downtime, manual intervention, or vertical scaling, which do not meet the requirement.

Answer

Create a new cluster with four shards and migrate the application to use the new cluster's endpoint.

Answer

Increase the node type of the existing shards to a larger instance size to add capacity.

Answer

Manually add a new node to the cluster and assign hash slots using the Redis CLI.

Question 17

A database specialist is monitoring an Amazon RDS for MySQL DB instance. The instance is experiencing high CPU utilization. The specialist wants to identify the top SQL statements contributing to the load using Performance Insights. (Choose two.)

Accepted Answer

Use the Performance Insights dashboard to view the Top SQL tab.. To identify top SQL statements using Performance Insights, the specialist must first enable Performance Insights on the DB instance. Then, they can use the Performance Insights dashboard and navigate to the Top SQL tab, which displays the SQL statements contributing most to database load. This combination provides the required insight into high CPU usage caused by SQL queries.

Answer

Query the MySQL performance_schema for statement digests.

Answer

Configure slow query logs and analyze them with CloudWatch Logs Insights.

Answer

Enable Enhanced Monitoring to capture OS-level metrics.

Question 18

A fintech company stores transaction records in Amazon Aurora PostgreSQL. Auditors require that no row can ever be deleted or updated once written, and that any attempt to do so fails at the database level rather than being caught by application code. The team wants to enforce this with minimal application changes. Which approach should the database specialist implement?

Accepted Answer

Create a BEFORE UPDATE OR DELETE trigger on the transaction table that raises an exception, and grant the application role only INSERT and SELECT privileges.. True immutability at the database layer requires a control that fires for every role, and a BEFORE UPDATE OR DELETE trigger that raises an exception does exactly that while least-privilege grants reduce the attack surface. Privilege revocation alone is bypassable, backtrack is restorative rather than preventive, and row-level security is bypassed by owners and superusers.

Answer

Revoke UPDATE and DELETE privileges from the application role and rely on that revocation alone for enforcement.

Answer

Configure the table with a PostgreSQL row-level security policy that denies UPDATE and DELETE to all roles.

Answer

Enable Aurora backtrack on the cluster and configure it to restore the table automatically if a delete or update is detected.

Question 19

A database specialist is monitoring an Amazon RDS for SQL Server DB instance. The specialist needs to receive an alert when the free storage space falls below 10% of the allocated storage. Which CloudWatch metric should be used to create an alarm for this condition?

Accepted Answer

FreeStorageSpace. The FreeStorageSpace metric provides the amount of available storage in bytes. By creating a CloudWatch alarm with a threshold set to 10% of the allocated storage, the specialist can be alerted when free space drops below that level. Other metrics like DiskQueueDepth, ReadIOPS, and WriteIOPS measure performance, not storage capacity, and thus are not appropriate for this requirement.

Answer

WriteIOPS

Answer

ReadIOPS

Answer

DiskQueueDepth

Question 20

A digital media company stores metadata for millions of video assets in an Amazon DynamoDB table. The table has a partition key of assetId (string) and no sort key. The company needs to efficiently query all assets uploaded on a specific date, and the query pattern must scale as the table grows to hundreds of terabytes. Which design change should a database specialist implement to meet these requirements?

Accepted Answer

Add a global secondary index (GSI) with a partition key of uploadDate and a sort key of assetId.. A global secondary index with uploadDate as partition key and assetId as sort key enables efficient, scalable queries for assets by date. GSIs are fully managed by DynamoDB, automatically maintained, and can be added to an existing table without downtime. This design supports the required query pattern while preserving the base table's primary key for direct asset lookups.

Answer

Create a local secondary index (LSI) with a sort key of uploadDate.

Answer

Change the table's partition key to uploadDate and use assetId as a sort key.

Answer

Enable DynamoDB Streams and use an AWS Lambda function to write a separate table keyed by uploadDate.