DBS-C01 Practice Exam 68 — 20 Questions

Question 1

A company is using Amazon Aurora MySQL-Compatible Edition. The database administrator wants to restrict a specific user to only execute SELECT statements on a specific database. Which SQL command should the administrator use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

GRANT SELECT ON db_name.* TO 'user'@'%';. The GRANT SELECT ON db_name.* TO 'user'@'%' command grants SELECT privilege on all tables within the specified database to the user. Option A is incorrect because ALTER USER with GRANT OPTION is used to change user attributes or grant the ability to grant privileges, not to directly grant SELECT. Option B is incorrect because CREATE USER only creates a new user without assigning any privileges. Option C is incorrect because REVOKE ALL PRIVILEGES removes all privileges from the user, which is opposite of the desired action.

Answer

ALTER USER 'user'@'%' WITH GRANT OPTION;

Answer

CREATE USER 'user'@'%' IDENTIFIED BY 'password';

Answer

REVOKE ALL PRIVILEGES ON db_name.* FROM 'user'@'%';

Question 2

A company is migrating its on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all data at rest be encrypted using a customer-managed key stored in AWS KMS, and that the key be rotated automatically every year. The company also needs to ensure that only specific IAM roles can access the key. Which combination of steps should the database administrator take to meet these requirements?

Accepted Answer

Create the RDS instance with encryption enabled using a customer-managed KMS key, and configure the key policy to restrict access to the required IAM roles.. It enables encryption on the RDS instance with a customer-managed KMS key, which allows automatic yearly key rotation (configurable in KMS) and access control via KMS key policies to restrict usage to specific IAM roles. Option A is wrong because RDS does not support enabling encryption after creation; it must be enabled at launch. Option B is wrong because the default AWS managed service key does not allow customer-managed rotation or custom key policies. Option C is wrong because CloudHSM is not required; KMS customer-managed keys satisfy the requirements without CloudHSM.

Answer

Create the RDS instance without encryption, then use the AWS Console to enable encryption after creation using a customer-managed key.

Answer

Create the RDS instance with encryption using the default AWS managed service key, and set up automatic key rotation in KMS.

Answer

Use AWS CloudHSM to generate and store the encryption key, and configure RDS to use the CloudHSM key for encryption.

Question 3

A startup is building a social media analytics platform. The workload is write-heavy, with millions of events per day containing user actions (likes, shares, comments). The data model is simple: each event is a JSON document with a timestamp, user ID, and action type. Queries are primarily aggregations over time (e.g., count of likes per hour) and require low-latency responses for dashboards. The team wants to minimize operational overhead and cost. Which database service is most appropriate?

Accepted Answer

Amazon Timestream, a purpose-built time-series database.. Amazon Timestream is the most appropriate service because it is purpose-built for time-series data, supporting high write throughput and providing built-in aggregation functions for time-based queries. It is serverless, minimizing operational overhead and cost. Option A (ElastiCache) is a caching layer, not a durable database. Option B (RDS with TimescaleDB) requires manual scaling and management, increasing overhead. Option D (DynamoDB) is optimized for key-value access, not efficient for time-series aggregations without additional processing and secondary indexes.

Answer

Amazon ElastiCache for Redis to store aggregated counts.

Answer

Amazon RDS for PostgreSQL with TimescaleDB extension.

Answer

Amazon DynamoDB with global secondary indexes on timestamp and action type.

Question 4

A financial services company runs a critical application on Amazon RDS for MySQL that processes transactions. The database must maintain ACID compliance and support point-in-time recovery (PITR) with a recovery point objective (RPO) of 5 seconds and recovery time objective (RTO) of 1 minute. The current setup uses a single db.r5.large instance with automated backups enabled (retention period 7 days) and Multi-AZ deployment. During a recent failover test, the failover took 2 minutes, exceeding the RTO. What should the database specialist recommend to meet the RTO requirement?

Accepted Answer

Migrate to a Multi-AZ DB Cluster deployment for RDS for MySQL.. Amazon RDS Multi-AZ DB Cluster for MySQL provides fast failover (typically under 1 minute) because it uses synchronous replication to two standby instances in different Availability Zones, ensuring automatic failover meets the 1-minute RTO. Option A (Remove Multi-AZ and rely on automated backups) would require restoring from backup, which takes much longer than 1 minute. Option C (Configure a cross-Region read replica and promote it during failure) involves manual promotion and is not automatic, so it cannot guarantee the RTO. Option D (Increase the instance size to db.r5.xlarge) does not affect failover speed, as failover time is determined by the Multi-AZ configuration, not instance size.

Answer

Remove Multi-AZ and rely on automated backups for recovery.

Answer

Configure a cross-Region read replica and promote it during a failure.

Answer

Increase the instance size to db.r5.xlarge to improve failover speed.

Question 5

A company is migrating a 2 TB Oracle database to Amazon RDS for Oracle. The migration requires minimal downtime. They use AWS SCT to convert the schema and AWS DMS for data migration. After the full load, DMS ongoing replication is unable to capture changes because the archived redo logs are being deleted on the source before DMS can read them. The source database has a log retention setting of 2 hours. The team cannot increase the retention due to storage constraints. What should they do?

Accepted Answer

Configure DMS to use an S3 bucket to store archived redo logs.. AWS DMS supports storing archived redo logs in an S3 bucket as a staging area, which allows DMS to process the logs before they are deleted from the source. This resolves the issue without requiring increased log retention on the source. Option A (full load only) would cause downtime. Option B (disabling archiving) would prevent DMS from capturing ongoing changes. Option C (increasing DMS instance size) does not affect log reading speed from archived logs.

Answer

Switch to a full load only migration strategy.

Answer

Disable archiving on the source database.

Answer

Increase the DMS replication instance size to improve log reading speed.

Question 6

A company has a 50 GB MariaDB database on an on-premises server. They want to migrate to Amazon RDS for MariaDB. They have a 100 Mbps network connection. The migration window is 2 hours. The database can be offline for up to 30 minutes. Which migration approach is most appropriate?

Accepted Answer

Create a MariaDB dump, transfer to an EC2 instance in the same region, then import to RDS.. The most appropriate because a MariaDB dump to an EC2 instance in the same region allows for a fast transfer over the network, and the import into RDS can be completed within the 2-hour migration window. The 50 GB database at 100 Mbps can be transferred in just over an hour, well within the window. Option A (DMS with ongoing replication) is unnecessarily complex for a one-time migration and may require more setup time. Option B (Snowball) is overkill for 50 GB and would not meet the 2-hour window due to shipping and processing delays. Option D (SCT) is not needed since the source and target are both MariaDB, and schema conversion is unnecessary.

Answer

Use AWS DMS with ongoing replication.

Answer

Use AWS Snowball to transfer the database files.

Answer

Use AWS SCT to convert schema and then use DMS.

Question 7

A company is migrating a 5 TB PostgreSQL database from on-premises to Amazon RDS for PostgreSQL. The database has a 24/7 uptime requirement and must be migrated with minimal downtime. The on-premises network bandwidth is 100 Mbps. The migration must be completed within 48 hours. The team has chosen to use AWS Database Migration Service (DMS) with ongoing replication from a change data capture (CDC) source. After setting up the source endpoint, target endpoint, and replication instance, the initial full load takes 30 hours. However, during the CDC phase, the target falls behind by over 2 hours and continues to lag. The replication instance is a dms.c5.large (2 vCPUs, 4 GB memory). The source database is heavily utilized with frequent updates. What should the team do to reduce the CDC lag and meet the migration deadline?

Accepted Answer

Increase the replication instance size to dms.c5.2xlarge.. Increasing the replication instance size to dms.c5.2xlarge provides more CPU and memory, which can handle higher transaction throughput, reducing CDC lag. Option B is wrong because enabling Multi-AZ on a replication instance does not directly improve performance; it adds redundancy and can even introduce latency. Option C is wrong because splitting the migration into multiple tasks for a single source database adds overhead and may cause conflicts, and it does not necessarily reduce lag. Option D is wrong because disabling ongoing replication would result in data loss and does not meet the minimal downtime requirement.

Answer

Enable Multi-AZ on the replication instance for better performance.

Answer

Split the migration into multiple DMS tasks for parallel processing.

Answer

Disable ongoing replication and use a one-time full load migration.

Question 8

A company runs a critical application on Amazon RDS for PostgreSQL with a Multi-AZ deployment. The application experiences intermittent connection timeouts and slow query performance. The CloudWatch metrics show that the 'ReadLatency' and 'WriteLatency' metrics are elevated during peak hours. The 'CPUUtilization' is consistently below 30%, and 'DatabaseConnections' is within limits. The 'BurstBalance' for the gp2 storage is frequently dropping to 0%. The DB instance is a db.r5.large with 300 GB of gp2 storage. The company wants to resolve the latency issues without significant cost increase. Which solution should the company implement?

Accepted Answer

Increase the allocated storage to 600 GB to increase baseline IOPS.. Increasing the allocated storage to 600 GB increases the baseline IOPS of gp2 from 900 (at 300 GB) to 1800 (at 600 GB), reducing reliance on burst credits and resolving the latency issue. This is cost-effective compared to switching to io1 (Option C), which would incur higher costs for 3000 provisioned IOPS. Option A (adding a read replica) does not help with write latency, and Option B (enabling Performance Insights) only aids diagnosis, not resolution.

Answer

Add a read replica to offload read traffic.

Answer

Enable Performance Insights to identify the root cause.

Answer

Switch the storage type to io1 with 3000 provisioned IOPS.

Question 9

A company uses Amazon DocumentDB (with MongoDB compatibility) for its content management system. The application runs on EC2 instances and connects to a DocumentDB cluster with one instance (db.r5.large). Recently, users reported that retrieving documents takes longer than usual. CloudWatch metrics show that the CPU utilization of the DocumentDB instance is at 90% and the freeable memory is below 100 MB. The team has verified that no query optimization is possible. Which action should the team take FIRST to improve performance?

Accepted Answer

Scale up the instance to db.r5.xlarge.. High CPU utilization (90%) and low freeable memory (<100 MB) indicate that the current instance size (db.r5.large) is insufficient for the workload. Scaling up to db.r5.xlarge provides additional CPU and memory resources, directly addressing the performance bottleneck. Option A (adding a read replica) offloads read traffic but does not reduce CPU/memory pressure on the primary writer. Option B (creating additional indexes) could improve query performance, but the team has verified that no query optimization is possible. Option C (increasing storage volume) improves I/O performance but does not directly affect CPU or memory usage.

Answer

Add a read replica instance to offload read traffic.

Answer

Create additional indexes on frequently queried fields.

Answer

Increase the storage volume size to improve I/O performance.

Question 10

A company uses Amazon DynamoDB to store sensor data from IoT devices. The table has a partition key of DeviceID (String) and a sort key of Timestamp (Number). The table is configured with provisioned capacity of 1000 read capacity units (RCUs) and 500 write capacity units (WCUs). Auto Scaling is enabled with target utilization of 70% and is working correctly. Recently, a new batch job was introduced that performs Scan operations on the entire table every hour. The Scan consumes many read capacity units and causes throttling of the sensor write requests. The team wants to minimize the impact on the write-heavy sensor ingestion. Which approach is BEST?

Accepted Answer

Switch the table to on-demand capacity mode to eliminate throttling.. Switching to on-demand capacity mode eliminates throttling by automatically scaling read/write capacity to meet traffic demands. Since the scan operation runs hourly and consumes significant RCUs, on-demand mode will handle the burst without throttling write requests. Option C is incorrect because DAX caches individual items, not entire scan results; hourly scans would cause cache misses, providing no benefit. Option A is incorrect because increasing write capacity does not address read throttling. Option B is incorrect because off-peak scheduling may not be feasible and does not guarantee elimination of throttling.

Answer

Increase the provisioned write capacity to 2000 WCUs to handle bursts.

Answer

Schedule the Scan to run during off-peak hours when sensor writes are lower.

Answer

Enable DAX (DynamoDB Accelerator) to cache Scan results and reduce read consumption on the table.

Question 11

A company runs a PostgreSQL database on an Amazon RDS DB instance (db.t3.medium) with 100 GB of General Purpose SSD (gp2) storage. The database is used by a web application that experiences occasional slowdowns. CloudWatch metrics show that the BurstBalance metric for the storage volume drops to 0% during peak usage and then recovers. The average IOPS during peak is 600, and the baseline IOPS for the volume is 300. The team needs a cost-effective solution to eliminate the performance issues. What should the team do?

Accepted Answer

Migrate the storage to gp3 with 3000 baseline IOPS.. To migrate to gp3 storage. gp3 provides a consistent baseline of 3000 IOPS regardless of volume size, eliminating the need for burst credits. This directly addresses the BurstBalance dropping to 0% during peak usage. Option A (upgrade instance) does not affect storage performance. Option B (increase gp2 to 200 GB) would raise the baseline IOPS to 600 and add more burst credits, but the workload still depends on credits and may not be as cost-effective as gp3. Option D (Performance Insights) is a monitoring tool and does not improve performance.

Answer

Upgrade the DB instance to db.t3.large.

Answer

Increase the gp2 volume size to 200 GB.

Answer

Enable Performance Insights to monitor database load.

Question 12

A company runs a critical MySQL database on Amazon RDS Single-AZ (db.m5.large) with 200 GB of Provisioned IOPS (io1) storage set to 3000 IOPS. The application team reports that write operations are occasionally slow. CloudWatch metrics show that the Write IOPS metric peaks at 3500 IOPS during the slowdowns, but the average is 2000 IOPS. The Read IOPS average is 500 IOPS. The queue depth metric occasionally spikes to 20. The storage configuration includes a 50 GB General Purpose SSD (gp2) log volume attached to the same RDS instance. Which change will MOST effectively resolve the write latency?

Accepted Answer

Increase the provisioned IOPS on the io1 volume to 4000.. The io1 volume is provisioned at 3000 IOPS, but the workload bursts to 3500 IOPS, causing queue depth to spike. Increasing the provisioned IOPS to 4000 ensures that the volume can handle the peak without queuing. Option A is incorrect because changing to gp3 with 3000 baseline IOPS does not address the peak IOPS requirement; gp3 can burst but the consistent peak above baseline may still cause throttling. Option B is incorrect because moving the log volume to the same io1 volume would mix I/O streams and could increase contention, not reduce it. Option D is incorrect because enabling Multi-AZ provides high availability and fails over to a standby, but does not increase IOPS capacity or resolve write latency.

Answer

Change the storage type to gp3 with 3000 baseline IOPS.

Answer

Move the log volume to the same io1 volume to reduce I/O overhead.

Answer

Enable Multi-AZ for failover protection.

Question 13

A healthcare company is migrating its patient records database to Amazon RDS for SQL Server. The database contains Protected Health Information (PHI). The compliance team requires that all PHI data be encrypted at rest and that the encryption keys be stored in a dedicated AWS CloudHSM cluster. Additionally, the database must be replicated to a second AWS region for disaster recovery. The DBA has enabled RDS encryption at rest using a KMS key, but the compliance team insists on using CloudHSM. What should the DBA do to meet the compliance requirement while maintaining disaster recovery?

Accepted Answer

Enable Transparent Data Encryption (TDE) using a CloudHSM key and create a cross-region read replica for DR.. RDS for SQL Server supports Transparent Data Encryption (TDE) with CloudHSM as the key store, and RDS read replicas can be created across regions for disaster recovery. Option A is incorrect because RDS encryption at rest with a KMS key does not meet the CloudHSM requirement; KMS custom key stores (backed by CloudHSM) are not supported for RDS encryption at rest. Option B is incorrect because DynamoDB encryption with CloudHSM via KMS custom key store is possible but unnecessary and does not maintain the existing SQL Server database. Option C is incorrect because using RDS Custom with TDE and manual log shipping is more complex and not the standard approach for cross-region disaster recovery with RDS.

Answer

Use RDS encryption at rest with a KMS key backed by CloudHSM (custom key store).

Answer

Migrate the database to Amazon DynamoDB with encryption using CloudHSM via KMS custom key store.

Answer

Use an RDS Custom for SQL Server instance and configure TDE with CloudHSM, then set up log shipping to another region.

Question 14

A company is using Amazon DocumentDB (with MongoDB compatibility) for a content management system. The security team requires that all data be encrypted at rest and in transit. The DocumentDB cluster is already encrypted at rest using AWS KMS. To enforce encryption in transit, the security team wants to ensure that all client connections use TLS. The team has enabled the 'tls' parameter in the cluster parameter group. However, a developer reports that they can still connect to the cluster without specifying TLS options using the mongo shell. The developer is connecting from an EC2 instance in the same VPC. The security group for the DocumentDB cluster allows inbound traffic on port 27017 from the EC2 instance's security group. What is the most likely reason the developer can connect without TLS?

Accepted Answer

The 'tls' parameter was not applied to the cluster because the parameter group was not associated with the cluster or the cluster was not rebooted.. In Amazon DocumentDB, enabling the 'tls' parameter in the cluster parameter group requires the parameter group to be associated with the cluster and the cluster to be rebooted for the change to take effect. If the parameter group was not properly associated or the cluster was not rebooted after modifying the parameter, TLS enforcement would not be active, allowing connections without TLS. Options A, B, and C are incorrect because DocumentDB supports TLS (via SSL), intra-VPC traffic does not bypass TLS, and older mongo shell versions can still use TLS if configured.

Answer

DocumentDB does not support TLS; it only supports SSL.

Answer

The EC2 instance is in the same VPC, so TLS is not enforced for intra-VPC traffic.

Answer

The developer is using an older version of the mongo shell that does not support TLS.

Question 15

A company has a multi-account AWS environment using AWS Organizations. The security team wants to centrally manage database encryption keys for all Amazon RDS instances across accounts. They require that the keys be stored in a single account, and that each account can use the key to encrypt its RDS instances. Additionally, they want to automatically rotate the keys every year. Which solution should they implement?

Accepted Answer

Create a customer managed KMS key in the central account and grant the RDS service in each account permission to use the key.. AWS KMS allows you to create a customer managed key in a central account and grant cross-account access to the RDS service principal in each account. This enables each account to use the central key for RDS encryption while keeping the key stored centrally. Option A is incorrect because KMS key replication is for multi-Region, not cross-account. Option B is incorrect because CloudHSM is not integrated with RDS for encryption. Option C is incorrect because multi-Region keys are for cross-Region use, not cross-account; they do not solve the cross-account requirement.

Answer

Copy the KMS key from the central account to each account using the KMS key replication feature.

Answer

Use AWS CloudHSM to create a key and share the HSM partition with each account.

Answer

Create a multi-Region customer managed KMS key in the central account and replicate it to each account.

Question 16

A company uses Amazon RDS for MySQL with Multi-AZ. During a recent failover test, the database experienced a 5-minute write outage. The application can tolerate up to 1 minute of downtime. Which solution should be used to reduce the failover time?

Accepted Answer

Migrate to Amazon Aurora MySQL.. Amazon Aurora MySQL is designed to reduce failover time significantly compared to standard RDS for MySQL Multi-AZ. Aurora typically completes failover in under 60 seconds by using a shared distributed storage volume across multiple Availability Zones, eliminating the need to replay redo logs on the standby. This directly meets the application's requirement of tolerating up to 1 minute of downtime.

Answer

Use Amazon RDS Proxy between the application and the database.

Answer

Enable automatic failover on the Multi-AZ deployment.

Answer

Decrease the DNS TTL on the RDS endpoint.

Question 17

A developer notices that an Amazon ElastiCache for Redis cluster is experiencing high latency. The cluster uses a single node. Which CloudWatch metric should be reviewed first to determine if the issue is due to memory pressure?

Accepted Answer

DatabaseMemoryUsagePercentage. The correct metric to check for memory pressure is DatabaseMemoryUsagePercentage. This metric shows the percentage of the node's available memory that is in use, and when high it can lead to latency due to evictions or swap usage. NetworkBytesIn measures network traffic, not memory. ReplicationLag is relevant only for clusters with replicas, and CPUUtilization indicates CPU load, not memory pressure.

Answer

NetworkBytesIn

Answer

ReplicationLag

Answer

CPUUtilization

Question 18

A company is migrating an on-premises Oracle database to AWS. The database is 5 TB and supports a critical OLTP application with high transaction rates. The application requires stored procedures, triggers, and strong consistency. Which AWS database service is most appropriate with minimal application changes?

Accepted Answer

Amazon RDS for Oracle. Amazon RDS for Oracle is the most appropriate choice because it provides native Oracle compatibility, supporting stored procedures, triggers, and strong consistency with minimal application changes. The company can use Oracle's PL/SQL code directly, and RDS for Oracle offers full ACID compliance for OLTP workloads, avoiding the need to rewrite application logic or adapt to a different consistency model.

Answer

Amazon Aurora PostgreSQL

Answer

Amazon DynamoDB

Answer

Amazon Redshift

Question 19

A company wants to deploy a globally distributed application with a DynamoDB table that uses optimistic locking. Which DynamoDB feature should be used to implement this?

Accepted Answer

DynamoDB Conditional Writes. Optimistic locking in DynamoDB is implemented using conditional writes, specifically the `ConditionExpression` parameter in `PutItem`, `UpdateItem`, or `DeleteItem` operations. By checking that a version attribute (e.g., `version = :expected_version`) matches the client's known value before writing, the application can detect and reject concurrent modifications, ensuring data consistency without locking the entire table.

Answer

DynamoDB Streams

Answer

DynamoDB Global Tables

Answer

DynamoDB Transactions

Question 20

A company's production RDS for PostgreSQL instance experienced a failover to the standby replica. After the failover, the application team reports that writes are failing with 'ReadOnlyException: Connection is read-only'. The DB instance status in the RDS console shows 'available'. Which action should the database administrator take to resolve the issue?

Accepted Answer

Update the application connection string to use the new writer endpoint from the RDS console.. After a Multi-AZ failover, the standby becomes the primary, and the old primary becomes a read-only standby. The application must update its connection string to use the new writer endpoint (which automatically points to the new primary) to perform writes. Option B is incorrect because creating a read replica and promoting it is unnecessary; Multi-AZ already provides a standby. Option C is incorrect because rebooting would force another failover but does not change the endpoint. Option D is incorrect because Multi-AZ is already enabled; modifying it again does not resolve the issue.

Answer

Create a read replica and promote it to a new primary.

Answer

Reboot the DB instance to force a failover back to the original primary.

Answer

Modify the DB instance to enable Multi-AZ again.