DBS-C01 Practice Exam 69 — 20 Questions

Question 1

A retail company stores product catalog data in Amazon DynamoDB. The table has a partition key of productId and a sort key of locale. A new requirement lets shoppers filter by category and price range within a single locale, and the queries must return results in under 100 milliseconds without scanning the table. Which change should the team make?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a global secondary index with category as the partition key and price as the sort key. Filtering by category and a price range is a new access pattern that the base table's productId and locale keys cannot serve without a scan. A global secondary index with category as the partition key and price as the sort key turns the filter into an efficient key condition, delivering the required low-latency response while leaving the base table schema intact.

Answer

Add a local secondary index on price with productId as the partition key

Answer

Enable DynamoDB Streams and maintain a separate category-price lookup table

Answer

Change the table's partition key to category and the sort key to price

Question 2

A company runs an Amazon RDS for SQL Server DB instance in a private subnet. A security engineer must ensure that all connections to the database are encrypted in transit and that the DB instance rejects any unencrypted client connections. The company uses a self-signed certificate for the DB instance. What should the security engineer do to meet these requirements?

Accepted Answer

Set the Force Encryption option to Yes in the DB parameter group, and restart the DB instance.. For RDS for SQL Server, encryption in transit is enforced by setting the Force Encryption option to Yes in the DB parameter group. This forces all client connections to use TLS. After changing the parameter group, the DB instance must be rebooted for the setting to take effect. Other engines like MySQL and PostgreSQL use the rds.force_ssl parameter, but that parameter is not available for SQL Server.

Answer

Attach an IAM policy that denies access to the DB instance unless the connection uses SSL, and apply it to all users.

Answer

Modify the DB instance to set the parameter rds.force_ssl to 1, and restart the DB instance.

Answer

Modify the DB parameter group to set rds.force_ssl to 1, and restart the DB instance.

Question 3

A database specialist manages an Amazon Aurora MySQL cluster that supports a read-heavy web application. The application connects to the cluster writer endpoint, and the specialist wants to distribute read-only queries to Aurora Replicas. The application uses a MySQL Connector/J driver and the specialist wants to minimize code changes. Which approach should the specialist take?

Accepted Answer

Configure the application to connect to the Aurora reader endpoint.. The Aurora reader endpoint is specifically designed to load-balance read-only connections across Aurora Replicas. It requires only a change to the connection string, minimizing code changes. Other options either add complexity or do not achieve read distribution. The reader endpoint also handles replica failures by routing to healthy replicas.

Answer

Modify the application to query the information_schema.replica_host_status table and connect to a specific replica.

Answer

Enable the Aurora parallel query feature and continue using the writer endpoint.

Answer

Create an Amazon Route 53 weighted routing policy that points to each Aurora Replica's instance endpoint.

Question 4

A financial services company is migrating a 10 TB on-premises Microsoft SQL Server database to Amazon RDS for SQL Server. The migration must be completed within a 6-hour maintenance window with minimal downtime. The company requires that the cutover be as fast as possible. Which migration strategy should be used?

Accepted Answer

Use AWS DMS with full load and change data capture (CDC) to replicate to RDS for SQL Server, then cut over during the maintenance window.. For a large SQL Server database with a tight cutover window, AWS DMS with full load and CDC is the most efficient strategy. It minimizes downtime by continuously replicating changes until cutover, allowing the target to be nearly synchronized. Native backup/restore or full load only would require longer downtime or risk data loss, and Always On adds unnecessary complexity.

Answer

Use native SQL Server backup and restore to Amazon RDS for SQL Server, then apply transaction log backups during the maintenance window.

Answer

Use SQL Server Always On availability groups to replicate to an Amazon EC2 instance, then use AWS DMS to replicate to RDS for SQL Server.

Answer

Use AWS Database Migration Service (AWS DMS) with full load only, followed by a manual data reconciliation process.

Question 5

A company uses Amazon Redshift and needs to implement row-level security so that users from the sales department can only see rows where the region column matches their assigned region. The security team wants to enforce this at the database level without modifying application queries. Which feature should they use?

Accepted Answer

Use Redshift row-level security (RLS) policies to define access based on the current user's role or group.. Amazon Redshift row-level security (RLS) allows you to define policies that filter rows based on the current user's role or group. This enforcement is transparent to applications and does not require query modifications. By creating an RLS policy that matches the region column to the user's assigned region, the sales department users will only see rows for their region.

Answer

Use Redshift Spectrum to create an external table with a filter on the region column based on the user.

Answer

Create a view that filters rows based on the current user and grant access to the view instead of the base table.

Answer

Implement column-level security by granting only the region column to sales users.

Question 6

A database specialist manages an Amazon Aurora MySQL cluster used for a reporting application. The team needs to run a nightly batch of heavy analytical queries against the cluster without affecting the production writer instance's performance or availability. The batch must read the most current committed data. Which approach should the database specialist use?

Accepted Answer

Create an Aurora Replica in the cluster, and direct the batch queries to the reader endpoint.. Aurora Replicas share the cluster's distributed storage and are designed for read scaling, so pointing the batch at the reader endpoint offloads the analytical queries from the writer instance while preserving near-real-time data freshness. The writer remains dedicated to production transactions, and availability is not impacted. Snapshot restores and cross-Region replicas introduce staleness or unnecessary complexity and latency.

Answer

Take a manual DB cluster snapshot before the batch and restore it to a new cluster for query execution.

Answer

Create a cross-Region Aurora read replica and route the batch queries there to reduce load.

Answer

Enable Aurora parallel query on the writer instance and run the batch directly against the cluster endpoint.

Question 7

A company runs an Amazon RDS for SQL Server DB instance in a private subnet. The security team wants to ensure that all administrative access to the database is audited and that only approved IP ranges can connect. Which two actions should be taken? (Choose two.)

Accepted Answer

Configure the DB instance security group to allow inbound traffic only from the approved CIDR ranges on the SQL Server port.. Auditing administrative access requires database-level logging, which SQL Server auditing exported to CloudWatch Logs provides. Restricting connections to approved networks requires security group rules limited to the approved CIDR ranges on the database port. Together these controls satisfy both the audit and the network restriction requirements for the RDS for SQL Server instance.

Answer

Use AWS CloudTrail to record all SQL statements executed against the database.

Answer

Enable Amazon RDS Enhanced Monitoring and publish metrics to Amazon CloudWatch Logs.

Answer

Enable IAM database authentication for the SQL Server instance and require all users to use tokens.

Question 8

A company is deploying a new Amazon RDS for PostgreSQL database that will store sensitive customer data. The security team requires that all data at rest be encrypted and that the company manage the encryption keys with the ability to audit key usage. The database must also support automatic key rotation. Which solution meets these requirements?

Accepted Answer

Enable encryption at rest using a customer managed key in AWS Key Management Service (AWS KMS) with key rotation enabled.. Encrypting an RDS for PostgreSQL instance with a customer managed key in AWS KMS meets all requirements: the company controls the key, can audit usage through CloudTrail, and can enable automatic annual rotation. This is the standard AWS best practice for customer-managed encryption at rest.

Answer

Enable encryption at rest using an AWS CloudHSM custom key store backed by a customer managed key.

Answer

Use application-level encryption before writing data to the database, and store the encryption keys in AWS Secrets Manager.

Answer

Enable encryption at rest using the default AWS managed key for RDS.

Question 9

A company uses Amazon ElastiCache for Redis (cluster mode disabled) with a single shard and two replicas. The application experiences occasional latency spikes when reading from the primary node. CloudWatch metrics show high CPU utilization on the primary node and increased replication lag on the replicas. The application uses the primary endpoint for both reads and writes. What is the most likely cause of the latency spikes?

Accepted Answer

The primary node is overwhelmed by read requests, causing CPU contention and increased replication lag.. The primary node is handling both reads and writes because the application uses the primary endpoint. This increases CPU utilization, leading to latency spikes. Replication lag increases because the primary is busy. Distributing read traffic to replicas would alleviate the load on the primary and improve overall performance.

Answer

The replicas are not properly configured to handle read traffic, causing the primary to handle all reads.

Answer

The replication lag is causing the primary to wait for replicas to acknowledge writes, increasing latency.

Answer

The ElastiCache cluster's parameter group has 'maxmemory-policy' set to 'noeviction', causing memory pressure and latency.

Question 10

A healthcare analytics company needs to store time-series patient vital-sign readings. The data is written continuously at high volume and queried by time range for the last 30 days; data older than 30 days is rarely accessed but must be retained for 7 years for compliance. The company wants to minimize storage cost without changing the query interface. Which Amazon Timestream for LiveAnalytics configuration should a database specialist recommend?

Accepted Answer

Create a single table with a memory store retention of 30 days and a magnetic store retention of 2555 days.. Timestream for LiveAnalytics uses a two-tier storage model: a memory store for recent, high-throughput data and a magnetic store for long-term, cost-optimized retention. Because queries only need the last 30 days at low latency, setting memory store retention to 30 days and magnetic store retention to 2555 days (7 years) meets both performance and compliance goals while minimizing cost, and it keeps a single SQL query interface.

Answer

Create two tables: one with a 30-day retention for recent data and another with a 7-year retention for historical data, and query both with UNION ALL.

Answer

Create a single table with a memory store retention of 2555 days and a magnetic store retention of 30 days.

Answer

Create a single table with a memory store retention of 7 years and enable magnetic store writes for all data.

Question 11

A financial services company runs an Amazon Aurora PostgreSQL cluster. The security team requires that all connections to the database be encrypted in transit. They have configured the cluster to use a custom parameter group. Which combination of steps should they take to enforce TLS for all client connections?

Accepted Answer

Set the rds.force_ssl parameter to 1 in the custom parameter group and reboot the cluster.. To enforce TLS for all connections to an Aurora PostgreSQL cluster, the rds.force_ssl parameter must be set to 1 in the cluster parameter group. This setting rejects non-SSL connections. Changing a parameter in a custom parameter group requires a reboot of the cluster to take effect. Other options, such as security group changes or IAM authentication, do not enforce encryption in transit.

Answer

Enable IAM database authentication on the cluster and require all users to authenticate with IAM credentials.

Answer

Modify the security group associated with the cluster to allow only port 5432 and block port 5433.

Answer

Create a new parameter group with ssl_min_protocol_version set to TLSv1.2 and apply it to the cluster.

Question 12

A logistics company stores shipment documents in Amazon S3 and metadata in an Amazon DynamoDB table. Auditors require that any modification to a shipment record be permanently retained and cryptographically verifiable for seven years, and that deleted records remain recoverable. The team must retain all historical versions of each item. Which DynamoDB capability should be used?

Accepted Answer

Enable DynamoDB Streams with a view type of NEW_AND_OLD_IMAGES and process the stream into an immutable, long-term archive.. DynamoDB Streams with the NEW_AND_OLD_IMAGES view type emits both the old and new image of every modified item, capturing prior values, updates, and deletions in order. Writing that stream to immutable, object-locked storage yields the seven-year, tamper-evident audit trail. The other options either expire data, retain only current state, or cover only a 35-day window.

Answer

Create a global secondary index that projects all attributes to serve as the audit history store.

Answer

Set the table to on-demand capacity mode and enable TTL on a lastModified attribute.

Answer

Enable point-in-time recovery on the table and rely on the 35-day restore window for audit history.

Question 13

A gaming company stores player profiles in Amazon DynamoDB. The table uses a partition key of playerId and no sort key. The team must add a new access pattern that retrieves all players belonging to a given guild, and guilds can contain hundreds of thousands of players. The team wants to support this access pattern without scanning the table. Which design change should the team make?

Accepted Answer

Add a global secondary index with guildId as the partition key and playerId as the sort key.. A global secondary index with guildId as its partition key and playerId as its sort key lets DynamoDB answer queries for all players in a guild directly, without scanning the base table. Because the index has its own key schema, it can support access patterns the base table cannot. Local secondary indexes cannot change the partition key, and Streams-based mapping tables add unnecessary complexity.

Answer

Add guildId as a sort key to the existing table and keep playerId as the partition key.

Answer

Enable DynamoDB Streams and use a Lambda function to maintain a separate guild-to-player mapping table.

Answer

Create a local secondary index with guildId as the sort key and playerId as the partition key.

Question 14

A database specialist is managing an Amazon Aurora PostgreSQL cluster. The cluster is experiencing performance degradation during peak hours. The specialist needs to identify the top SQL statements contributing to the load. Which two actions should be taken to gather this information? (Choose two.)

Accepted Answer

Enable Performance Insights on the Aurora cluster and analyze the top SQL tab.. Performance Insights offers a visual, top-down view of database load by SQL statement, making it ideal for quickly identifying heavy hitters. The pg_stat_statements extension provides detailed, query-level statistics that can be queried directly. Together, they give the specialist the necessary data to pinpoint and analyze the top SQL statements causing performance degradation during peak hours.

Answer

Use Amazon CloudWatch Logs Insights to analyze the Aurora error logs for query performance.

Answer

Enable Aurora Advanced Auditing and review the audit logs for slow queries.

Answer

Enable the Aurora parallel query feature to speed up analytical queries.

Question 15

A company runs an Amazon Aurora PostgreSQL DB cluster. The database specialist needs to perform a point-in-time restore to recover from accidental data deletion. The cluster has a backup retention period of 7 days. What is the most recent time to which the cluster can be restored?

Accepted Answer

Any point in time within the last 7 days, up to the latest restorable time.. Aurora continuous backups enable point-in-time restore to any second within the backup retention period. The latest restorable time is typically the current time minus about 5 minutes. With a 7-day retention, you can restore to any point in the last 7 days, not just to snapshot times. This allows recovery from accidental deletions with minimal data loss.

Answer

The time of the last manual snapshot.

Answer

The time of the last automated backup snapshot.

Answer

The time when the cluster was created.

Question 16

A logistics company stores shipment events in an Amazon DynamoDB table. Each event has a shipmentId partition key and an eventTimestamp sort key. The operations team needs to retrieve all events for a specific shipment within a given date range, and also needs to list all shipments that arrived late within the last week across all shipments. The table currently has only the base table. Which design change should be made to support the cross-shipment late-arrival query efficiently?

Accepted Answer

Create a global secondary index with a partition key of arrivalStatus and a sort key of eventTimestamp. The base table already supports per-shipment range queries through the shipmentId partition key and eventTimestamp sort key. The cross-shipment late-arrival query needs a different access pattern, which a global secondary index provides by organizing data under arrivalStatus and eventTimestamp. This allows a targeted Query with a sort-key condition instead of a full Scan, keeping latency and cost low.

Answer

Increase the read capacity of the base table and use a Scan with a FilterExpression on arrivalStatus

Answer

Add a local secondary index with a sort key of arrivalStatus

Answer

Enable DynamoDB Streams and process late arrivals with an AWS Lambda function into a separate table

Question 17

A database specialist is troubleshooting an Amazon RDS for SQL Server DB instance that is experiencing performance degradation. The specialist runs a query against the `sys.dm_exec_requests` dynamic management view and notices a high number of sessions with a wait type of `PAGEIOLATCH_SH`. The specialist needs to identify the cause and resolve the issue. Which action should the specialist take?

Accepted Answer

Review the instance's memory configuration and consider increasing the DB instance class to add more RAM.. PAGEIOLATCH_SH waits indicate SQL Server is waiting for data pages to be read from disk into memory. The most common cause is insufficient memory, causing frequent buffer pool evictions. Increasing the DB instance class to add RAM expands the buffer pool, reducing physical I/O and alleviating these waits.

Answer

Enable and analyze the slow query log to identify long-running queries causing page reads.

Answer

Increase the allocated storage for the DB instance to reduce I/O latency.

Answer

Modify the DB parameter group to increase the `max degree of parallelism` (MAXDOP) setting.

Question 18

A database specialist is responsible for an Amazon Aurora PostgreSQL cluster that supports a production application. The compliance policy requires that all data be encrypted at rest with a customer-managed AWS KMS key so the security team can rotate and revoke access independently. The cluster was originally created with the default AWS-managed key for encryption. Which action should the specialist take to meet the policy with the LEAST disruption?

Accepted Answer

Take a snapshot of the cluster, encrypt the snapshot with the customer-managed KMS key, then restore a new cluster from that encrypted snapshot.. To move an Aurora cluster to a customer-managed KMS key, the supported method is to copy a snapshot with the desired key and restore a new cluster from it. Aurora fixes the encryption key at cluster creation, so in-place modification is impossible, and replicas inherit the source key. Snapshot copy plus restore is the least disruptive supported path.

Answer

Create a read replica of the cluster and promote it, because the promoted replica will inherit the customer-managed key automatically.

Answer

Enable AWS KMS automatic key rotation on the AWS-managed key so the cluster begins using a customer-managed key.

Answer

Modify the existing cluster in place to switch the encryption key to the customer-managed KMS key.

Question 19

A database specialist manages an Amazon RDS for MySQL DB instance in a production environment. The instance is configured with a 7-day backup retention period. The security team requires that all database backups be encrypted with a customer-managed AWS KMS key, and that the key be rotated annually. Currently, the DB instance uses the default AWS-managed key for encryption. What should the specialist do to meet these requirements?

Accepted Answer

Take a snapshot of the DB instance, copy the snapshot with encryption using a customer-managed KMS key, and restore it to a new DB instance.. To encrypt an existing unencrypted RDS DB instance with a customer-managed KMS key, you must take a snapshot, copy it with encryption enabled, and restore to a new instance. This method allows specifying the KMS key and ensures the new instance is encrypted. The original instance cannot be modified to enable encryption directly. After restoring, you can update the application to point to the new instance.

Answer

Enable encryption on the existing DB instance by modifying the storage and specifying a customer-managed KMS key, then apply immediately.

Answer

Create an encrypted snapshot using a customer-managed KMS key, then restore the snapshot to a new DB instance.

Answer

Modify the DB instance to enable encryption using a customer-managed KMS key, then reboot the instance.

Question 20

A media company is building a recommendation engine that requires storing user interaction events with high write throughput and low-latency reads by user ID and timestamp. The data model is flexible, with new event types added frequently. The company expects millions of writes per second and needs to query recent events for a user. Which database design is most appropriate?

Accepted Answer

Amazon DynamoDB table with partition key as user ID and sort key as timestamp, and a global secondary index on event type.. The workload demands high write throughput, low-latency reads by user ID and timestamp, and a flexible schema. DynamoDB excels at these requirements with its partition key and sort key design, allowing efficient range queries. It scales horizontally to handle millions of writes per second. The global secondary index provides additional query flexibility. Relational databases and in-memory caches are less suitable for this combination of scale and flexibility.

Answer

Amazon ElastiCache for Redis with sorted sets for each user to store events.

Answer

Amazon RDS for MySQL with a table per event type and read replicas for scaling reads.

Answer

Amazon Aurora PostgreSQL with partitioning by user ID and a materialized view for recent events.