DBS-C01 Mock Exam 71 — 25 Questions

Question 1

A company wants to encrypt an existing unencrypted Amazon RDS for SQL Server instance. What is the MOST efficient way to achieve this?

Accepted Answer

Create a snapshot of the DB instance and copy it with encryption enabled. Restore the snapshot to a new encrypted instance.. You cannot directly enable encryption on an existing unencrypted RDS instance. The most efficient method is to take a snapshot of the instance, copy it with encryption enabled (which re-encrypts the data using AWS KMS), and then restore that snapshot to a new encrypted DB instance. This approach minimizes downtime and leverages native RDS snapshot capabilities without requiring external tools.

Answer

Create a read replica with encryption enabled.

Answer

Modify the DB instance to enable encryption.

Answer

Use AWS DMS to migrate data to a new encrypted instance.

Question 2

A company uses Amazon ElastiCache for Redis as a caching layer for a web application. They notice increased latency and cache miss rates. The cache cluster has 5 nodes with replication. Which metric should be monitored to identify if the cache is under-provisioned?

Accepted Answer

CPUUtilization. High CPUUtilization indicates the cache nodes are overloaded, suggesting the cache is under-provisioned and cannot handle the request volume. Option A is incorrect because ReplicationLag measures replication delays, not overall capacity. Option B is incorrect because CacheHits measure cache effectiveness, but a high miss rate could be due to capacity or other factors; CPU is more direct for throughput. Option D is incorrect because Evictions occur when memory is full, but CPU utilization is a better indicator of processing capacity constraints.

Answer

ReplicationLag

Answer

CacheHits

Answer

Evictions

Question 3

A database administrator runs the above CLI command. The output shows that 'mydb' is a read replica of 'mydb-source'. The administrator wants to promote 'mydb' to a standalone instance with no downtime. Which action should be taken?

Accepted Answer

Use the promote-read-replica CLI command.. The `promote-read-replica` CLI command is the correct action because it transitions the read replica from a replication slave to a standalone primary DB instance without requiring any downtime. During promotion, RDS stops replication and makes the replica writable, but the instance remains available throughout the process. This is the only method that achieves zero downtime promotion directly.

Answer

Modify the DB instance to enable Multi-AZ, which automatically promotes it.

Answer

Create a snapshot of the read replica and restore it as a new DB instance.

Answer

Modify the DB instance class to a larger size to force promotion.

Question 4

A company needs to migrate a 1 TB Oracle database to Amazon RDS for Oracle. The migration must have minimal downtime and the source database is running on-premises. Which TWO AWS services should be used together to achieve this?

Accepted Answer

AWS Database Migration Service (DMS). To migrate a 1 TB Oracle database to Amazon RDS for Oracle with minimal downtime, two services are required. AWS Database Migration Service (DMS) performs the initial full load and then uses Change Data Capture (CDC) to continuously replicate ongoing changes, minimizing downtime. AWS Direct Connect establishes a dedicated network connection between the on-premises environment and AWS, ensuring stable and high-bandwidth data transfer necessary for the large database migration. Without Direct Connect, the replication could be impacted by internet latency or outages.

Answer

AWS Schema Conversion Tool (SCT)

Answer

AWS CloudEndure Migration

Answer

AWS Direct Connect

Question 5

A company runs an Amazon RDS for PostgreSQL DB instance with Multi-AZ enabled. The primary instance is in us-east-1a and the standby is in us-east-1b. During a routine audit, the security team discovers that database connections are being terminated unexpectedly. The database administrator reviews the RDS events and sees an event: 'A Multi-AZ failover has been completed.' What step should be taken to determine the cause of this failover?

Accepted Answer

Review RDS events and AWS CloudTrail logs for API calls related to the failover. Reviewing RDS events and AWS CloudTrail logs is the correct step because these services record detailed information about the failover, including any API calls that may have triggered the failover or underlying issues. Option A is incorrect because CloudWatch metrics show resource utilization (CPU, memory) but do not directly indicate the cause of a failover. Option B is incorrect because maintenance windows are scheduled events; although they may cause failovers, simply checking the console for maintenance windows does not provide a definitive cause for an unexpected failover. Option D is incorrect because the describe-db-instances CLI command shows the current status of instances (e.g., whether the standby is available) but does not provide historical information about why the failover occurred.

Answer

Examine Amazon CloudWatch metrics for increased CPU or memory usage

Answer

Check the RDS console for maintenance windows

Answer

Run the describe-db-instances CLI command to check the status of the standby

Question 6

A company is migrating a 2 TB on-premises PostgreSQL database to Amazon RDS for PostgreSQL. The migration must have minimal downtime and support ongoing replication. Which AWS service should be used?

Accepted Answer

AWS DMS. AWS DMS (Database Migration Service) is the correct choice because it supports both full-load migration and ongoing change data capture (CDC) replication from an on-premises PostgreSQL source to Amazon RDS for PostgreSQL, enabling minimal downtime. DMS uses logical replication slots to capture incremental changes, allowing the target database to stay synchronized during the cutover window.

Answer

AWS Snowball Edge

Answer

AWS S3

Answer

RDS native PostgreSQL logical replication

Question 7

Refer to the exhibit. An IAM policy is attached to an IAM user that performs database migrations. When the user tries to start an AWS DMS replication task that writes to the RDS instance 'targetdb', the task fails with an access denied error. Which additional permission is required?

Accepted Answer

dms:DescribeReplicationInstances. The DMS replication task requires permission to describe the replication instance that is being used to run the task. The `dms:DescribeReplicationInstances` action allows the IAM user to retrieve metadata about the replication instance, which DMS needs to validate the instance state and configuration before starting the task. Without this permission, the start task operation fails with an access denied error even if the user has permissions to start the task itself.

Answer

dms:CreateEndpoint

Answer

dms:CreateReplicationInstance

Answer

rds:ModifyDBInstance on the source database

Question 8

A company is using Amazon DynamoDB with auto scaling enabled. The table's read capacity is set to a minimum of 100 and maximum of 1000 read capacity units (RCUs). The actual consumed read capacity is consistently at 200 RCUs. What should the database specialist do to optimize costs without impacting performance?

Accepted Answer

Lower the minimum read capacity to 200 RCUs.. Lowering the minimum to 200 RCUs ensures auto scaling does not scale below the actual usage, reducing provisioned capacity costs. Option B is wrong because decreasing the maximum could cause throttling during spikes. Option C is wrong because disabling auto scaling would require manual management and may lead to over-provisioning or under-provisioning. Option D is wrong because increasing the minimum would increase costs unnecessarily.

Answer

Decrease the maximum read capacity to 500 RCUs.

Answer

Disable auto scaling and set the read capacity to 200 RCUs.

Answer

Increase the minimum read capacity to 500 RCUs.

Question 9

A company is using an Amazon DynamoDB table with a global table configuration across two AWS regions. The security team wants to ensure that all data is encrypted in transit between the regions. What should the team do?

Accepted Answer

No additional action is required; DynamoDB global tables encrypt all replication traffic in transit by default.. DynamoDB global tables automatically encrypt all replication traffic in transit using TLS, so no additional configuration is required. Option A is incorrect because internet gateways are not involved in inter-region replication; DynamoDB global tables use the AWS backbone network. Option B is incorrect because CloudFront is a content delivery network and does not handle DynamoDB replication traffic. Option C is incorrect because VPC peering is not required; global tables operate outside of VPCs and do not traverse VPC peering connections.

Answer

Configure an Internet gateway in each region and enforce HTTPS for all traffic.

Answer

Use AWS CloudFront to route traffic between the regions with SSL/TLS termination.

Answer

Set up a VPC peering connection between the two regions and route DynamoDB traffic through it.

Question 10

A database administrator is troubleshooting an Amazon RDS for SQL Server instance that is experiencing high 'ReadIOPS' and 'ReadLatency'. The instance uses General Purpose SSD (gp2) storage. The 'BurstBalance' metric is 0%. What should the administrator do to improve performance?

Accepted Answer

Increase the allocated storage or switch to Provisioned IOPS. When BurstBalance is 0%, the gp2 volume has exhausted its burst credits and is operating at baseline IOPS. To improve performance, you can increase the volume size (which increases baseline IOPS) or switch to Provisioned IOPS (io1/io2) for consistent performance. Option A is wrong because enabling Multi-AZ does not increase I/O performance; it provides high availability. Option C is wrong because creating a read replica offloads read traffic but does not improve write performance or reduce latency on the primary instance. Option D is wrong because disabling automatic backups reduces storage I/O but does not directly improve ReadIOPS or ReadLatency; the primary issue is exhausted burst credits.

Answer

Enable Multi-AZ to distribute the load

Answer

Create a read replica to offload read traffic

Answer

Disable automatic backups to reduce I/O

Question 11

A company is deploying a new web application on AWS. The application uses Amazon RDS for MySQL with a Multi-AZ deployment. The application team wants to reduce latency for read-heavy workloads. Which action should be taken?

Accepted Answer

Add a read replica in the same Region. Adding a read replica in the same Region offloads read-heavy workloads from the primary RDS instance, reducing latency for read queries because replicas serve read traffic directly. Amazon RDS for MySQL read replicas use asynchronous replication and can be promoted to a primary instance if needed, making this the most effective and cost-efficient solution for read scaling.

Answer

Enable Multi-AZ on the existing RDS instance

Answer

Increase the instance size of the primary RDS instance

Answer

Switch from RDS to Amazon DynamoDB with DAX

Question 12

Which THREE considerations are important when deploying Amazon Aurora Global Database? (Choose 3.)

Accepted Answer

Each secondary region can have up to 16 read replicas. Amazon Aurora Global Database allows each secondary region to have up to 16 read replicas, enabling low-latency global reads. Option C is correct because a secondary region gets its own Aurora cluster that functions as a cross-region read replica. Option E is correct because replication between the primary and secondary regions typically completes in less than one second, ensuring near-real-time data consistency. Options A and D are incorrect: AWS DMS is not required for Aurora Global Database replication (it uses built-in storage-based replication), and transaction logs are stored in Aurora's storage layer, not in Amazon S3.

Answer

AWS DMS must be used to set up replication

Answer

Amazon S3 is used to store transaction logs

Question 13

A healthcare company runs a critical application on Amazon RDS for PostgreSQL with a Multi-AZ deployment. The database stores patient records and must comply with HIPAA regulations. Recently, a security audit revealed that the database is using the default port 5432 and that SSL connections are not enforced. The security team requires that all connections to the database use SSL and that the default port be changed to 5439 to reduce the risk of automated attacks. The database administrator needs to implement these changes with minimal downtime. What should the administrator do?

Accepted Answer

Modify the DB parameter group associated with the instance to set 'ssl' to '1' and 'port' to 5439. Reboot the instance to apply the changes.. Modifying the DB parameter group to require SSL (set 'ssl' to '1') and change the port to 5439, then rebooting the instance, applies the changes with minimal downtime (a few minutes). Option A is wrong because creating a new RDS instance and migrating with pg_dump involves significant downtime and complexity. Option B is wrong because updating security group inbound rules only controls network access, not database-level SSL enforcement; SSL must be enabled on the database itself. Option C is wrong because you cannot modify the default DB parameter group; you must use a custom parameter group, and changing the port requires a reboot.

Answer

Create a new RDS instance with the desired settings, migrate the data using pg_dump, and update the application connection string.

Answer

Update the security group inbound rules to only allow traffic on port 5439 and enforce SSL at the network level.

Answer

Modify the default DB parameter group to change the port and enable SSL, then apply it to the instance without a reboot.

Question 14

A company wants to audit all SQL queries made to their Amazon RDS for MySQL database. Which AWS service should they use?

Accepted Answer

Database Activity Streams. Database Activity Streams (D) is the correct choice because it provides a near-real-time stream of database activity, including all SQL queries, directly from the RDS for MySQL engine. This service integrates with AWS services like Amazon Kinesis and third-party monitoring tools to capture and audit every SQL statement, user login, and schema change at the database engine level, which is essential for comprehensive auditing.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

AWS CloudTrail

Question 15

Refer to the exhibit. An IAM policy is attached to a user. The user tries to delete a database instance named 'prod-mydb' in us-east-1. What will happen?

Accepted Answer

The delete will be denied because the Deny statement explicitly matches the resource.. D is correct because IAM policy evaluation follows an explicit deny priority rule. Even though the Allow statement grants 'rds:DeleteDBInstance' on 'arn:aws:rds:us-east-1:*:db:*', the Deny statement explicitly matches the resource 'arn:aws:rds:us-east-1:123456789012:db:prod-mydb' and specifies 'rds:DeleteDBInstance'. Since an explicit deny overrides any allow, the delete operation will be denied.

Answer

The delete will be allowed because the Allow statement is broader.

Answer

The delete will fail with an error because the policy is invalid.

Answer

The delete will succeed only if the instance is tagged with 'Environment: prod'.

Question 16

A company is migrating a 2 TB Oracle database to Amazon Aurora PostgreSQL. They need to minimize downtime and ensure data consistency. Which migration strategy should they use?

Accepted Answer

Use AWS DMS with ongoing replication (change data capture) from Oracle to Aurora.. AWS DMS with ongoing replication (change data capture) is the correct strategy because it allows continuous synchronization of changes from the source Oracle database to the target Aurora PostgreSQL, minimizing downtime to just the final cutover window. This approach ensures data consistency by applying transactional changes in near real-time, which is essential for a 2 TB database where a full load alone would require a lengthy maintenance window and risk data divergence.

Answer

Use AWS DMS with full load only, then cut over during a maintenance window.

Answer

Export the database to Amazon S3 using Oracle Data Pump, then import into Aurora.

Answer

Use pg_dump to export the database and pg_restore to import into Aurora.

Question 17

A gaming company uses Amazon DynamoDB to store player profiles and game state. The access patterns include: (1) lookup by player ID, (2) query by game ID for recent games, and (3) leaderboard queries sorted by score. The current single-table design is causing hot partitions on the leaderboard queries. What design change should the company implement to resolve hot partitions?

Accepted Answer

Create a GSI with the game ID as the partition key and a composite sort key of score and timestamp.. Creating a Global Secondary Index (GSI) with game ID as the partition key and a composite sort key of score and timestamp allows efficient leaderboard queries without hot partitions. This design distributes write activity across multiple partitions by game ID, while the composite sort key enables sorted queries by score and timestamp within each game, avoiding the hot partition issue caused by the original single-table design.

Answer

Increase the read capacity units (RCUs) on the base table to handle the load.

Answer

Enable DynamoDB Accelerator (DAX) to cache frequent leaderboard queries.

Answer

Shard the table by player ID and use application-level aggregation for leaderboards.

Question 18

A company is using Amazon DynamoDB for a gaming application. During a new game launch, write traffic spikes and some users receive 'ProvisionedThroughputExceededException' errors. The company wants to handle these spikes automatically and cost-effectively. What should be done?

Accepted Answer

Enable DynamoDB auto scaling with a target utilization of 70%.. DynamoDB auto scaling with a target utilization of 70% allows the table to automatically adjust provisioned write capacity in response to traffic spikes, handling the increased load without manual intervention. This approach is cost-effective as it scales down during low traffic periods, avoiding over-provisioning. The target utilization of 70% provides a buffer to absorb sudden spikes while maintaining performance.

Answer

Implement application-level retries with exponential backoff and a queue.

Answer

Switch the table to on-demand capacity mode.

Answer

Increase the provisioned write capacity to the expected peak.

Question 19

A company is using Amazon DynamoDB with provisioned capacity and Auto Scaling. They notice that during a marketing campaign, write traffic exceeded the provisioned WCU and caused throttling. Auto Scaling increased the WCU, but the throttling persisted for several minutes. Which additional measure can prevent throttling during such predictable spikes?

Accepted Answer

Configure a scheduled scaling action in Application Auto Scaling to increase WCU before the campaign.. Using Application Auto Scaling scheduled scaling allows pre-scaling capacity before the predictable spike, preventing throttling. Option A is incorrect because on-demand mode is for unpredictable traffic and may be costlier; for predictable spikes, scheduled scaling is more cost-effective. Option B is wrong because DAX is a caching layer for reads, not writes. Option C is wrong because simply increasing the maximum WCU does not pre-scale capacity; it only raises the upper limit that Auto Scaling can reach after throttling occurs.

Answer

Switch the table to on-demand capacity mode.

Answer

Enable DynamoDB Accelerator (DAX) to cache write requests.

Answer

Increase the maximum provisioned WCU in the Auto Scaling policy.

Question 20

A company is using Amazon RDS for PostgreSQL and needs to monitor the database for performance issues. Which TWO metrics in Amazon CloudWatch are most useful for identifying I/O bottlenecks?

Accepted Answer

ReadIOPS. Options A and C are correct. ReadIOPS (Option A) shows the actual number of read I/O operations per second, which is a direct indicator of I/O load. DiskQueueDepth (Option C) measures the number of pending I/O requests, indicating I/O contention or bottlenecks when the queue depth is high. Option B (FreeStorageSpace) is about storage capacity, not performance. Option D (DatabaseConnections) reflects connection count, not I/O. Option E (CPUUtilization) relates to compute, not I/O.

Answer

FreeStorageSpace

Answer

DatabaseConnections

Answer

CPUUtilization