DBS-C01 Practice Exam 70 — 20 Questions

Question 1

A media analytics company ingests clickstream events into Amazon Kinesis Data Streams and needs to store the raw events for 14 months for reprocessing, then delete them automatically. The events are queried only by event ID for audit purposes. Which storage design meets these requirements with the LEAST operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Write each event to an Amazon S3 bucket with an S3 Lifecycle policy that transitions objects to S3 Glacier Deep Archive after 30 days and expires them after 420 days.. Amazon S3 with a lifecycle policy is the lowest-overhead choice because it is serverless, scales automatically, and enforces retention declaratively. Transitioning to S3 Glacier Deep Archive reduces cost for data accessed only for audits, and expiration after 420 days delivers the required 14-month deletion without custom jobs or capacity planning.

Answer

Store events in an Amazon DynamoDB table with a TTL attribute set to 420 days and a partition key of event ID.

Answer

Load events into an Amazon Redshift cluster with a scheduled job that runs DELETE statements for rows older than 420 days.

Answer

Write events to an Amazon RDS for MySQL table partitioned by date and drop old partitions after 420 days.

Question 2

A company is deploying a new Amazon Aurora PostgreSQL database cluster. They require that the database be encrypted at rest using a customer managed key (CMK) in AWS KMS. They also need to ensure that snapshots of the database are encrypted with the same CMK. Which configuration should be used?

Accepted Answer

Enable encryption at rest when creating the Aurora cluster and select the CMK.. To encrypt an Aurora cluster with a CMK, you must specify the CMK during cluster creation. Encryption cannot be enabled after creation. Snapshots of the encrypted cluster will automatically use the same CMK. This ensures both the database and snapshots are encrypted with the desired key.

Answer

Enable encryption at rest on the Aurora cluster using the default AWS managed key, and then use AWS KMS grants to allow access to the CMK for snapshots.

Answer

Enable encryption on the Aurora cluster using the default AWS managed key, then create a copy of the cluster with the CMK.

Answer

Create the Aurora cluster without encryption, then modify it to enable encryption using the CMK.

Question 3

A company uses Amazon RDS for SQL Server with Transparent Data Encryption (TDE) enabled using a customer-managed AWS KMS key. The security team wants to ensure that the TDE certificate and private key are protected and that access is audited. Which additional configuration should they implement?

Accepted Answer

Enable AWS CloudTrail logging for the KMS key and restrict key usage to the RDS service principal via the KMS key policy.. For RDS SQL Server TDE, the TDE certificate is protected by a customer-managed KMS key. To audit access to that key, CloudTrail must be enabled (which logs KMS API calls by default for customer-managed keys). Additionally, the KMS key policy should restrict usage to the RDS service principal to enforce least privilege. This ensures both visibility and control over the key protecting the TDE certificate.

Answer

Use AWS Certificate Manager (ACM) to issue a certificate for TDE and configure RDS to use it.

Answer

Store the TDE certificate and private key in AWS Secrets Manager and rotate them every 90 days.

Answer

Enable RDS Enhanced Monitoring to capture TDE certificate access events.

Question 4

A database specialist is troubleshooting an Amazon RDS for SQL Server DB instance that is experiencing slow query performance during peak hours. The specialist has enabled Enhanced Monitoring and Performance Insights. Which two actions should the specialist take to identify the most resource-intensive queries and their wait events? (Choose two.)

Accepted Answer

Query the sys.dm_exec_query_stats dynamic management view to retrieve execution statistics for cached query plans.. Performance Insights offers a top SQL view with wait events, and SQL Server DMVs like sys.dm_exec_query_stats provide execution statistics for cached plans. Together they identify the most resource-intensive queries and the waits they experience. The other options either generate excessive logs, track the wrong activity type, or disable the needed analysis.

Answer

Enable and review the general query log to capture every SQL statement executed on the instance.

Answer

Use AWS CloudTrail to analyze the API calls made to the RDS instance and identify slow queries.

Answer

Configure RDS Performance Insights to capture only OS-level metrics and disable database load analysis.

Question 5

A company uses an Amazon Aurora MySQL cluster with a writer and a reader. They notice that the reader's replica lag is increasing, and the application is reading stale data. The database specialist needs to identify the cause of the replica lag. Which action should the specialist take first?

Accepted Answer

Check the 'AuroraReplicaLag' metric in Amazon CloudWatch for the reader instance.. AuroraReplicaLag is the primary CloudWatch metric for monitoring lag between the writer and a reader in Aurora. It directly shows the lag in milliseconds. Other metrics like VolumeReadIOPs or CPUUtilization can indicate causes but are not direct measures. Using 'SHOW REPLICA STATUS' is invalid for Aurora. Therefore, checking AuroraReplicaLag is the correct first step.

Answer

Query the 'SHOW REPLICA STATUS' command on the reader instance.

Answer

Review the 'VolumeReadIOPs' metric for the reader instance.

Answer

Inspect the 'CPUUtilization' metric for the reader instance.

Question 6

A company is deploying a new Amazon Aurora PostgreSQL cluster. The security team requires that all data in transit is encrypted and that the cluster is only accessible from within a specific VPC. Which combination of steps should be taken to meet these requirements?

Accepted Answer

Enable SSL/TLS encryption for connections and configure the Aurora cluster in a private subnet with a security group that allows only the application's security group.. To encrypt data in transit, SSL/TLS must be enabled for client connections. To restrict access to within a VPC, the Aurora cluster should reside in a private subnet and use security groups to limit inbound traffic to the application's security group. This ensures the cluster is not publicly accessible and only reachable from authorized resources within the VPC.

Answer

Configure the Aurora cluster with a public endpoint and use a network ACL to allow only the corporate IP range, and enable SSL/TLS.

Answer

Use AWS PrivateLink to create an interface VPC endpoint for Aurora and enable IAM database authentication.

Answer

Enable encryption at rest using AWS KMS and configure the cluster in a public subnet with a security group that allows the corporate CIDR range.

Question 7

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database is 2 TB and the company requires a maximum downtime of 15 minutes during cutover. Which combination of AWS services should be used to achieve this?

Accepted Answer

AWS Database Migration Service (AWS DMS) with ongoing replication and AWS Schema Conversion Tool (AWS SCT). AWS DMS with ongoing replication keeps the target synchronized with the source, enabling a cutover with minimal downtime. AWS SCT handles schema and code conversion. Together they provide a reliable migration path for a 2 TB Oracle database with a 15-minute downtime requirement, unlike full-load-only or offline methods.

Answer

Amazon RDS for Oracle native replication using Oracle Data Guard

Answer

AWS DMS with full load only and AWS SCT

Answer

Oracle Data Pump export/import with AWS Snowball Edge

Question 8

A database specialist needs to audit all login attempts and failed authentication events on an Amazon Aurora MySQL DB cluster. The events must be retained for one year and searchable for security investigations. Which approach meets these requirements?

Accepted Answer

Enable Aurora MySQL advanced auditing, publish the audit logs to Amazon CloudWatch Logs, and set a one-year retention period on the log group.. Aurora MySQL advanced auditing records connection and failed-login events, and publishing those logs to CloudWatch Logs makes them centrally searchable while a one-year retention setting preserves them for investigations. General logs, Performance Insights, and error-log exports do not capture authentication events or provide the required retention and search capability.

Answer

Enable Performance Insights with a one-year retention period and query the authentication events from its dashboard.

Answer

Enable the MySQL general_log parameter on the DB cluster and query the log tables directly in the database.

Answer

Configure the DB cluster to export error logs to Amazon S3 and enable S3 server access logging for auditing.

Question 9

A company is planning to migrate an on-premises Oracle database to Amazon RDS for Oracle. They want to use AWS Database Migration Service (AWS DMS) for the migration. Which two tasks must be performed to ensure that AWS DMS can replicate ongoing changes from the source to the target? (Choose two.)

Accepted Answer

Enable supplemental logging on the source Oracle database.. To enable AWS DMS to replicate ongoing changes from an Oracle source, you must enable supplemental logging on the source database and grant the DMS user the necessary privileges to read the redo logs. These two tasks are critical for CDC. Other tasks like character set matching, automatic backups, and VPN setup are not directly required for CDC functionality.

Answer

Configure the target RDS for Oracle instance with the same character set as the source.

Answer

Enable automatic backups on the target RDS for Oracle instance.

Answer

Set up a VPN connection between the source and AWS.

Question 10

A production Amazon RDS for Oracle DB instance is encrypted with an AWS managed key (aws/rds). The security team now requires that all data at rest be encrypted with a customer managed AWS KMS key so that key rotation and access can be controlled. What is the MOST operationally efficient way to meet this requirement?

Accepted Answer

Take a snapshot of the DB instance, copy the snapshot with encryption using the customer managed key, and restore a new DB instance from the encrypted snapshot.. Because RDS storage encryption cannot be modified after creation, the supported path is to copy a snapshot with a new KMS key and restore from it. Copying the snapshot allows you to specify the customer managed key, and the restored instance is then encrypted with that key. This avoids data export and keeps the operation within native RDS tooling.

Answer

Create an encrypted read replica of the DB instance using the customer managed key, then promote the replica.

Answer

Modify the DB instance to enable encryption with the customer managed key.

Answer

Use AWS Database Migration Service to migrate the data to a new DB instance that is configured with the customer managed key.

Question 11

A company is designing a new Amazon DynamoDB table to store order data for a high-traffic e-commerce application. The table will have a partition key of orderId and a sort key of orderDate. The application needs to efficiently query orders by customerId and by status (e.g., PENDING, SHIPPED) across all customers. The company wants to minimize read latency and avoid full table scans. Which TWO design actions should a database specialist take to meet these requirements? (Choose two.)

Accepted Answer

Create a global secondary index with partition key status and sort key orderDate.. The application needs to query by customerId and by status. Creating GSIs with partition keys customerId and status, each with orderDate as sort key, enables efficient Query operations for both access patterns. DAX does not fix missing indexes, an LSI cannot support queries by customerId alone, and replicating to OpenSearch adds unnecessary complexity. The two GSIs are the correct design choices.

Answer

Add a local secondary index with partition key orderId and sort key customerId.

Answer

Use DynamoDB Streams to replicate data to an Amazon OpenSearch Service cluster for querying.

Answer

Enable DynamoDB Accelerator (DAX) for the table to cache query results.

Question 12

A company runs a critical Amazon DynamoDB table with a partition key of 'orderId' and a sort key of 'orderDate'. The table is used for an order processing system that experiences sudden spikes in write traffic. The operations team notices that write requests are occasionally throttled, and they want to ensure the table can handle unpredictable spikes without manual intervention. Which change should a database specialist make?

Accepted Answer

Switch the table to on-demand capacity mode.. On-demand capacity mode is designed for unpredictable workloads. It instantly accommodates spikes in read and write traffic without capacity planning, and you pay per request. This eliminates throttling due to insufficient provisioned capacity and removes the need for manual intervention, making it the best fit for sudden spikes.

Answer

Increase the provisioned write capacity units (WCUs) to the maximum allowed.

Answer

Implement a write sharding strategy by adding a random suffix to the partition key.

Answer

Enable DynamoDB Accelerator (DAX) for the table.

Question 13

A healthcare company needs to store patient records in a relational database. The data must be encrypted at rest and in transit, and the company must retain full control over the encryption keys, including the ability to rotate them on demand and audit their usage. The database must be highly available across multiple Availability Zones. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Amazon RDS for PostgreSQL with encryption using AWS Key Management Service (AWS KMS) customer managed keys. RDS for PostgreSQL with AWS KMS customer managed keys provides the necessary encryption controls, including customer-managed rotation and auditing, while Multi-AZ deployment ensures high availability. It is a managed service, reducing operational overhead compared to self-managed options. The other choices either lack full key control or are not relational databases.

Answer

Amazon DynamoDB with encryption using AWS owned keys

Answer

Amazon EC2 instances running a self-managed PostgreSQL database with encrypted EBS volumes

Answer

Amazon Aurora PostgreSQL with encryption using AWS KMS AWS managed keys

Question 14

A company is deploying a new Amazon Aurora MySQL cluster. The security team requires that all data in the cluster's storage volume be encrypted at rest with a customer-managed AWS KMS key, and that the key be rotated annually. Which deployment approach meets these requirements?

Accepted Answer

Enable encryption at rest on the Aurora cluster and select the customer-managed KMS key during cluster creation.. Aurora encryption must be enabled when the cluster is created, and you can choose a customer-managed KMS key. That key supports automatic annual rotation and custom key policies, satisfying both the encryption and rotation requirements. Other approaches either cannot encrypt Aurora storage or use a key that cannot be rotated by the customer.

Answer

Create the Aurora cluster unencrypted, then use AWS KMS to encrypt the underlying EBS volumes after deployment.

Answer

Use an encrypted Amazon S3 bucket as the Aurora storage backend and enable default encryption on the bucket.

Answer

Enable encryption at rest using the default AWS managed key aws/aurora and enable annual rotation on that key.

Question 15

A company runs an Amazon RDS for SQL Server DB instance. The database specialist needs to ensure that automated backups are retained for 30 days. What should the specialist do?

Accepted Answer

Modify the DB instance to set the backup retention period to 30 days.. Amazon RDS allows you to configure the automated backup retention period from 0 to 35 days. Setting it to 30 days directly fulfills the requirement. Manual snapshots, AWS Backup, or setting a longer period are either unnecessary or do not meet the exact retention need. The native configuration is the simplest and most appropriate solution.

Answer

Enable automated backups and set the retention period to 35 days.

Answer

Use AWS Backup to create a backup plan with a 30-day retention rule.

Answer

Create a manual snapshot and configure a lifecycle policy to retain it for 30 days.

Question 16

A database specialist is designing disaster recovery for an Amazon RDS for MySQL production instance. The business requires a recovery point objective of 5 minutes and a recovery time objective of 30 minutes in a different AWS Region. The team has already configured automated backups with a 7-day retention period and a read replica in the same Region. Which configuration change will meet BOTH objectives?

Accepted Answer

Create a cross-Region read replica of the RDS for MySQL instance and promote it during a regional failure.. A cross-Region read replica continuously replicates changes asynchronously to the DR Region, providing a very low recovery point, and can be promoted to a standalone instance in minutes to satisfy the recovery time. Automated snapshot copies are periodic and restore-based, so they cannot guarantee the 5-minute RPO and 30-minute RTO.

Answer

Enable Multi-AZ deployment with a standby in a second Availability Zone and fail over during a regional event.

Answer

Increase the automated backup retention period to 35 days and copy the snapshots to the DR Region on a schedule.

Answer

Configure AWS Database Migration Service with change data capture to keep an EC2-hosted MySQL instance in the DR Region in sync.

Question 17

A company is migrating a small on-premises Microsoft SQL Server database to AWS. The database is used for a departmental application with fewer than 50 concurrent users and does not require high availability across multiple Availability Zones. The company wants a fully managed service with minimal administrative effort and the ability to use existing SQL Server licenses. Which AWS service should the company choose?

Accepted Answer

Amazon RDS for SQL Server with Bring Your Own License (BYOL). Amazon RDS for SQL Server with Bring Your Own License (BYOL) allows the company to use existing SQL Server licenses while benefiting from a fully managed service. It supports Single-AZ deployments for small workloads, reducing cost and administrative overhead. Other options either require new licenses, add management overhead, or use an incompatible database engine.

Answer

Amazon RDS for SQL Server with License Included

Answer

Amazon Aurora MySQL with a reader instance

Answer

Amazon EC2 running SQL Server on Windows Server

Question 18

A database specialist is managing an Amazon Redshift cluster. The cluster has a leader node and two compute nodes. The specialist needs to add a new column to a large fact table that is used in complex analytical queries. The table has a distribution key and sort key defined. The specialist wants to minimize the impact on query performance and avoid unnecessary data movement. Which approach should be taken?

Accepted Answer

Use the ALTER TABLE ADD COLUMN command to add the new column.. Adding a column to an Amazon Redshift table using ALTER TABLE ADD COLUMN is a metadata-only operation that does not rewrite existing data. It is fast and does not affect the table's distribution or sort keys, so query performance remains stable. This method is ideal for large fact tables where minimizing impact is critical. Other methods like recreating the table would cause significant overhead.

Answer

Create a new table with the additional column, copy the data, and then rename the tables.

Answer

Use the ALTER TABLE ADD COLUMN command with the DISTKEY and SORTKEY options to redefine the distribution and sort keys.

Answer

Use the ALTER TABLE APPEND command to add the new column and redistribute data.

Question 19

A database specialist is responsible for an Amazon Aurora MySQL cluster that supports a high-traffic e-commerce application. The cluster has one writer and three reader instances. The specialist needs to implement a monitoring solution that provides real-time metrics on the number of active connections, CPU utilization, and replica lag for each instance, and must trigger an alarm if replica lag exceeds 100 milliseconds. Which AWS service should the specialist use to meet these requirements with the LEAST operational overhead?

Accepted Answer

Amazon CloudWatch with the native Aurora metrics, setting alarms on AuroraReplicaLag and CPUUtilization.. Amazon CloudWatch provides native metrics for Aurora clusters, including CPUUtilization, DatabaseConnections, and AuroraReplicaLag. These metrics are available without any additional setup. The specialist can create CloudWatch alarms on these metrics to trigger notifications when thresholds are breached. This solution requires minimal operational effort because it leverages built-in monitoring and alarm capabilities.

Answer

Amazon CloudWatch with custom metrics published by the application using the AWS CLI.

Answer

AWS CloudTrail to log API calls and analyze connection counts and CPU usage.

Answer

Amazon RDS Performance Insights with detailed monitoring enabled.

Question 20

A company is deploying a new application that uses Amazon DynamoDB. The application needs to store items with a primary key composed of a partition key (user_id) and a sort key (timestamp). The company wants to query all items for a given user_id within a specific date range, and also retrieve individual items by both keys. The table will have a large number of users, and read latency must be consistently low. Which DynamoDB feature should be used to support the date-range queries efficiently?

Accepted Answer

Use the base table's primary key to query items by user_id and a timestamp range condition on the sort key.. The base table's key schema already matches the required access pattern: partition key user_id and sort key timestamp. DynamoDB Query can efficiently retrieve items for a user_id within a timestamp range using the sort key condition. No additional index is needed, and this provides the lowest latency and simplest design.

Answer

Enable DynamoDB Streams and use AWS Lambda to maintain a separate table indexed by date.

Answer

Create a global secondary index (GSI) with a partition key on timestamp and a sort key on user_id.

Answer

Create a local secondary index (LSI) with the same partition key (user_id) and a different sort key on a date attribute.