DBS-C01 Mock Exam 74 — 25 Questions

Question 1

A company is migrating a 1 TB SQL Server database to Amazon RDS for SQL Server. They use AWS DMS with full load and ongoing replication. After the full load completes, they observe that the ongoing replication is falling behind and the target database is not consistent. The source database has high transaction volume. What is the most effective way to improve replication performance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the size of the DMS replication instance (e.g., from dms.c5.xlarge to dms.c5.2xlarge).. Increasing the DMS replication instance size (Option D) provides more CPU and memory resources, which directly addresses the bottleneck caused by high transaction volume on the source. A larger instance can process and apply changes faster, reducing the replication lag and improving consistency. This is the most effective single action because it scales the entire replication pipeline without altering the task configuration.

Answer

Disable CloudWatch logging for the DMS replication instance.

Answer

Configure multiple parallel load tasks for ongoing replication.

Answer

Enable batch apply mode in the DMS task.

Question 2

A company is designing a time-series database for IoT sensor data using Amazon DynamoDB. Each sensor sends a reading every second. The table uses 'sensor_id' as partition key and 'timestamp' as sort key. The application queries for the last hour of data for a specific sensor. The query uses 'KeyConditionExpression' with 'timestamp' between start and end time. The table has auto-scaling enabled. However, the query latency is high. What is the MOST likely cause?

Accepted Answer

The query is scanning from the beginning of time; use 'ScanIndexForward: false' and a 'Limit' parameter.. The high query latency is most likely due to the query scanning all historical data for the sensor before applying the filter on the sort key. By default, DynamoDB queries return results in ascending order of the sort key, and without `ScanIndexForward: false` and a `Limit` parameter, the query may process many irrelevant items before reaching the last hour of data. Setting `ScanIndexForward: false` returns the most recent items first, and adding a `Limit` reduces the number of items scanned, significantly improving latency.

Answer

Enable DynamoDB Accelerator (DAX) to cache the query results.

Answer

The sort key should be 'sensor_id' and partition key should be 'timestamp'.

Answer

The table does not have enough read capacity units; increase the base capacity.

Question 3

A company runs an e-commerce application on Amazon RDS for MySQL. The application experiences read-heavy traffic during flash sales. The development team wants to offload read traffic without changing the application code. Which solution should be used?

Accepted Answer

Create an RDS Read Replica and point read traffic to the replica endpoint.. Creating an RDS Read Replica allows read-heavy traffic to be offloaded from the primary RDS instance without any application code changes. The application simply needs to be configured to use the read replica's endpoint for SELECT queries, while writes continue to the primary instance. This directly addresses the requirement to offload read traffic without modifying the application code.

Answer

Implement an Amazon ElastiCache cluster and update the application to cache queries.

Answer

Configure Multi-AZ deployment for the RDS instance.

Answer

Use DynamoDB Accelerator (DAX) in front of the RDS instance.

Question 4

A company is designing a database for a ride-sharing application that requires real-time location updates and driver-passenger matching. The database must support geospatial queries to find nearby drivers within a radius. The expected throughput is 10,000 writes per second and 5,000 reads per second. The company wants a fully managed solution with low latency. The application team has experience with PostgreSQL. Which database design should they choose?

Accepted Answer

Use Amazon Aurora PostgreSQL with the PostGIS extension and use read replicas for scaling reads.. Amazon Aurora PostgreSQL supports PostGIS for geospatial queries, can scale to handle the throughput with write replicas and auto-scaling, and is fully managed. Option B (DynamoDB) is not ideal for geospatial queries; it requires complex partitioning. Option C (DynamoDB with GSI) still not good for radius queries. Option D (RDS MySQL) has geospatial support but may not scale as well as Aurora.

Answer

Use Amazon DynamoDB with a geospatial library to encode locations into a partition key.

Answer

Use Amazon DynamoDB with a global secondary index on a geohash attribute for proximity queries.

Answer

Use Amazon RDS for MySQL with spatial indexes and Multi-AZ deployment.

Question 5

A company is migrating its on-premises Oracle database to Amazon RDS for Oracle. The database contains sensitive data that must be encrypted at rest and in transit. The security team also requires that the encryption keys be rotated every year. The DBA has enabled encryption at rest using a customer-managed KMS key and SSL/TLS for in-transit encryption. What additional step is needed to meet the key rotation requirement?

Accepted Answer

Enable automatic KMS key rotation for the customer-managed key.. Enable automatic KMS key rotation for the customer-managed key. AWS KMS supports automatic annual rotation of customer-managed keys, which meets the key rotation requirement without manual intervention. Option A is incorrect because manually creating a new key and updating the RDS instance each year is an unnecessary manual process when automatic rotation is available. Option B is incorrect because RDS option groups do not control encryption key rotation; they are used for managing additional database features. Option C is incorrect because CloudHSM is not integrated with RDS for key management; KMS is the service used for RDS encryption at rest.

Answer

Manually create a new KMS key every year and update the RDS instance to use the new key.

Answer

Configure the RDS option group to rotate the encryption key.

Answer

Use an AWS CloudHSM key and configure automatic rotation.

Question 6

A company uses Amazon RDS for MySQL with encryption at rest enabled. The security team mandates that all access to the database must be authenticated using IAM database authentication. The database administrator has created a user 'app_user' and granted appropriate privileges. However, when the application tries to connect using an IAM authentication token, it receives an 'Access denied' error. Which action should be taken to resolve this issue?

Accepted Answer

Ensure the IAM role used by the application has a name that matches the database user 'app_user' and has the necessary policy attached.. IAM database authentication for RDS MySQL requires that the database user name matches the IAM role or user name used to generate the authentication token. The IAM role must have a policy that allows the `rds-db:connect` action with a resource ARN specifying the database user. Without this exact match, the authentication token is rejected, resulting in an 'Access denied' error.

Answer

Create a password for 'app_user' and use that password in the connection string.

Answer

Modify the security group to allow inbound traffic on port 3306 from the application's IP address.

Answer

Download the latest Amazon RDS CA certificate and add it to the application trust store.

Question 7

A company is building a real-time leaderboard for a mobile game using Amazon DynamoDB. The leaderboard displays the top 100 players by score. The table has 'game_id' as partition key and 'player_id' as sort key. The score is updated frequently. Which THREE design patterns should the company implement to ensure low-latency reads for the leaderboard? (Choose three.)

Accepted Answer

Enable DynamoDB Accelerator (DAX) to cache the leaderboard query.. DynamoDB Accelerator (DAX) provides an in-memory cache that can serve repeated leaderboard queries with microsecond latency, reducing the read load on the base table and avoiding throttling. For a real-time leaderboard that is read frequently, DAX ensures low-latency responses without needing to query DynamoDB directly each time.

Answer

Use 'ScanIndexForward: false' on the base table to get top players.

Answer

Use 'begins_with' operator on the sort key to filter by score range.

Question 8

Refer to the exhibit. An IAM policy is attached to a user who is attempting to run a Scan operation on the Orders table using the AWS CLI. The Scan operation fails with an AccessDeniedException. What is the most likely reason?

Accepted Answer

The 'ForAllValues:StringEquals' condition set operator prevents the Scan operation because it requires all leading keys to match a single value, which is impossible for a Scan.. The condition 'dynamodb:LeadingKeys' applies only to Query and Scan operations when the condition key is used to restrict partition key values. However, the condition 'ForAllValues:StringEquals' requires that all leading keys in the request match the specified value. For a Scan operation without a specific partition key, the condition cannot be satisfied, leading to denial. Option A is incorrect because the resource ARN includes the table name, so it is valid. Option B is incorrect because the policy allows Scan action. Option C is incorrect because the condition is on LeadingKeys, not on the table.

Answer

The resource ARN does not include the table name.

Answer

The Scan action is not allowed in the policy.

Answer

The condition requires the partition key to be 'CustomerID', but the Scan operation does not specify a partition key.

Question 9

An IAM policy is attached to a user. Which of the following actions will be allowed?

Accepted Answer

Create a new DB instance named 'prod-db'.. The question does not include the IAM policy text, so it is impossible to determine which actions are allowed. Without the policy, we cannot evaluate whether any specific action is permitted or denied. Therefore, none of the options can be confirmed as correct.

Answer

Delete a DB instance named 'prod-db'.

Answer

Delete a DB instance named 'test-db'.

Answer

Delete a DB instance named 'dev-db'.

Question 10

A company is setting up an Amazon Aurora MySQL-compatible database. The security policy requires that all traffic between the application and database be encrypted in transit. Which TWO steps should be taken?

Accepted Answer

Set the 'require_secure_transport' parameter to 'ON' in the DB cluster parameter group.. To encrypt data in transit, you need to enforce SSL on the server side and ensure the client uses SSL. Setting the 'require_secure_transport' parameter to 'ON' in the DB cluster parameter group (Option C) forces the server to require SSL connections. Configuring the application connection string to use the SSL-enabled endpoint (Option D) ensures the client connects using SSL. Option A is unnecessary because Aurora supports SSL natively without a load balancer. Option B does not encrypt traffic; a VPN only secures the network path but does not enforce encryption at the database layer. Option E encrypts data at rest, not in transit.

Answer

Use a Network Load Balancer with a TLS listener in front of the Aurora cluster.

Answer

Place the Aurora cluster in a private subnet with a VPN connection.

Answer

Enable encryption at rest using AWS KMS.

Question 11

A company needs to ensure that all changes to an Amazon RDS DB instance's security group are logged for auditing purposes. Which AWS service should be enabled?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records API calls made to the AWS environment, including actions like AuthorizeSecurityGroupIngress and RevokeSecurityGroupEgress that modify security group rules. When enabled, CloudTrail logs all changes to Amazon RDS security groups as management events, providing an immutable audit trail that can be stored in Amazon S3 for compliance and auditing purposes.

Answer

Amazon RDS Event Subscriptions

Answer

AWS Config

Answer

VPC Flow Logs

Question 12

A company runs an Amazon RDS for SQL Server DB instance in a VPC. The security group for the DB instance allows inbound traffic on port 1433 from the application servers' security group. The application servers can connect to the database, but a database administrator cannot connect from their workstation using SQL Server Management Studio (SSMS). What is the MOST likely cause?

Accepted Answer

The security group does not allow inbound traffic from the DBA workstation's IP address.. The DBA's workstation is not within the VPC, so it needs a public IP and the security group must allow inbound traffic from the workstation's IP. Option A (DBA's IP not in security group) is correct. Option B (SSMS version) is unlikely; Option C (Multi-AZ) irrelevant; Option D (encryption) does not prevent connection.

Answer

The DBA is using an incompatible version of SSMS.

Answer

The DB instance is configured as Multi-AZ, which restricts direct connections.

Answer

The DB instance has encryption enabled, which blocks non-encrypted connections.

Question 13

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all network traffic between the application servers and the database be encrypted using TLS. The application servers are in a different VPC connected via VPC Peering. What is the simplest way to enforce encryption in transit?

Accepted Answer

Enable the rds.force_ssl parameter in the DB parameter group and configure the application to use SSL connections.. Enabling the rds.force_ssl parameter in the DB parameter group forces all connections to use SSL, satisfying the encryption-in-transit requirement. The application must be configured to connect using SSL with the appropriate certificate. Option A is wrong because changing the security group to port 443 does not enforce encryption; port 443 is for HTTPS, not for Oracle database traffic, and SSL is configured at the database level. Option C is wrong because the default parameter group does not enforce SSL; the rds.force_ssl parameter must be explicitly set. Option D is wrong because a VPN adds unnecessary complexity and does not directly enforce TLS encryption for database connections.

Answer

Modify the security group for the RDS instance to only allow traffic on port 443.

Answer

Use a default DB parameter group, as it already enforces SSL.

Answer

Set up a VPN connection between the two VPCs and route all traffic through it.

Question 14

A company is running an Oracle database on Amazon RDS with the configuration shown in the exhibit. The application is experiencing high latency for write operations. The storage is consistently showing high queue depth and write latency. Which change will most improve write performance?

Accepted Answer

Migrate to io1 or io2 storage with higher provisioned IOPS.. Migrating to io1 or io2 block storage with higher provisioned IOPS directly addresses the root cause of high queue depth and write latency. Unlike gp2, which has a baseline IOPS of 3 per GB (up to 16,000 IOPS at 5,334 GB) and a burst bucket that depletes under sustained load, io1/io2 provide consistent, provisioned IOPS independent of volume size. This ensures the storage subsystem can keep up with the write workload, reducing queue depth and latency.

Answer

Increase allocated storage to 1,000 GB to get higher gp2 baseline IOPS.

Answer

Enable storage auto scaling and increase storage throughput to 500 MB/s.

Answer

Change the DB instance class to db.r5.2xlarge.

Question 15

A company wants to enforce that all new Amazon RDS DB instances are created with encryption at rest enabled. Which approach should be taken?

Accepted Answer

Use an IAM policy that denies the rds:CreateDBInstance action unless rds:StorageEncrypted is set to true.. An IAM policy with a condition key `rds:StorageEncrypted` set to `true` can deny the `rds:CreateDBInstance` action when encryption is not enabled, enforcing encryption at rest at creation time. Option B is wrong because CloudTrail is an auditing service; it logs API calls but cannot automatically delete unencrypted instances without additional services like Lambda. Option C is wrong because AWS Config detects and reports noncompliant resources but does not prevent creation; it is reactive. Option D is wrong because Amazon RDS does not offer a default encryption setting at the account level; encryption must be explicitly enabled per instance.

Answer

Use AWS CloudTrail to detect unencrypted instance creation and automatically delete them.

Answer

Use AWS Config rules to mark unencrypted instances as noncompliant.

Answer

Enable encryption by default in the RDS console.

Question 16

A database administrator needs to monitor the number of connections to an Amazon RDS for PostgreSQL DB instance. Which Amazon CloudWatch metric should be used?

Accepted Answer

DatabaseConnections. The DatabaseConnections metric in Amazon CloudWatch directly reports the number of client connections to the RDS for PostgreSQL DB instance. This metric is published by the RDS service and reflects the count of active connections as seen by the database engine, making it the correct choice for monitoring connection counts.

Answer

CPUUtilization

Answer

WriteLatency

Answer

FreeableMemory

Question 17

A company wants to migrate an on-premises MySQL database to Amazon RDS for MySQL with minimal downtime. They plan to use AWS DMS. Which source database configuration is required to enable ongoing replication (CDC)?

Accepted Answer

Enable binary logging (binlog) on the source database. AWS DMS requires binary logging (binlog) enabled on the source MySQL database to capture ongoing changes for continuous replication (CDC). The binlog records all data modifications (INSERT, UPDATE, DELETE) in a sequential log, which DMS reads to apply those changes to the target RDS instance with minimal downtime. Without binlog enabled, DMS can only perform a full load migration and cannot support ongoing replication.

Answer

Set auto_increment_increment to 1

Answer

Enable the slow query log

Answer

Enable the query cache

Question 18

A company is running a production Amazon Aurora MySQL database. The database performance has degraded over the past week. The DBA suspects an increase in lock waits. Which tool should be used to identify queries experiencing lock waits?

Accepted Answer

Amazon RDS Performance Insights. Amazon RDS Performance Insights provides a database load visualization and detailed wait event analysis, allowing you to identify queries experiencing lock waits. Option A is incorrect because CloudWatch Logs captures log streams but does not directly show lock wait events. Option B is incorrect because Enhanced Monitoring provides OS-level metrics (CPU, memory, disk I/O) but not database-specific lock waits. Option D is incorrect because AWS Trusted Advisor offers best-practice recommendations but does not monitor real-time database performance or lock waits.

Answer

Amazon CloudWatch Logs

Answer

Amazon RDS Enhanced Monitoring

Answer

AWS Trusted Advisor

Question 19

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database is 2 TB in size and has a high transaction rate. The migration must have minimal downtime. Which migration strategy should a database specialist recommend?

Accepted Answer

Use AWS DMS with ongoing replication to capture changes.. AWS DMS with ongoing replication allows for minimal downtime by continuously replicating changes from the source Oracle database to the target Amazon RDS for Oracle, allowing a cutover with only a brief pause. Option B is incorrect because copying data files to S3 and loading into RDS is not a supported migration path for RDS for Oracle and would require significant downtime. Option C is incorrect because Oracle Data Pump export and import requires the source database to be offline or in read-only mode during export, causing downtime. Option D is incorrect because RMAN backup and restore is not natively supported for RDS for Oracle and would involve complex manual steps and downtime.

Answer

Copy the data files to Amazon S3 and then load into RDS.

Answer

Use Oracle Data Pump to export and import the database.

Answer

Perform an RMAN backup and restore to RDS.

Question 20

A company uses Amazon DynamoDB with on-demand capacity for a mobile application. During a marketing campaign, write traffic spikes to 10,000 writes per second for 5 minutes. The application experiences throttling after the first minute. The DynamoDB table has a single partition key. What should be done to prevent throttling in future campaigns?

Accepted Answer

Redesign the partition key to ensure write traffic is evenly distributed across partitions.. Throttling with on-demand capacity often results from a hot partition caused by a single partition key. On-demand capacity handles total throughput but still has per-partition throughput limits. Redesigning the partition key to distribute writes evenly across partitions resolves the hotspot. Option B is wrong because DAX is an in-memory cache for reads, not writes. Option C is wrong because switching to provisioned capacity with 10,000 WCUs would still hit partition-level limits if the partition key design is poor. Option D is wrong because pre-warming does not affect per-partition throughput ceilings.

Answer

Enable DynamoDB Accelerator (DAX) to cache write requests.

Answer

Switch to provisioned capacity and increase write capacity units to 10,000.

Answer

Pre-warm the table by writing dummy data before the campaign.