DBS-C01 Mock Exam 75 — 25 Questions

Question 1

A company needs to store application logs for 90 days and run periodic analytical queries. The logs are generated at 1 TB per day. Which storage solution is most cost-effective?

Accepted Answer

Store logs in Amazon S3 and use S3 Select for queries.. Amazon S3 is the most cost-effective storage solution for 90-day retention of 1 TB/day of application logs, as it offers low-cost object storage with lifecycle policies to automatically expire data after 90 days. S3 Select allows you to run analytical queries (e.g., filtering, aggregations) directly on the data stored in S3 using SQL-like statements, without needing to load data into a separate analytics engine, thus minimizing compute costs and operational overhead.

Answer

Store logs in Amazon RDS for MySQL with partitioning.

Answer

Store logs in Amazon Redshift with automatic compression.

Answer

Store logs in Amazon DynamoDB with TTL for expiration.

Question 2

A database administrator has the IAM policy shown above attached to their user. When they try to run the AWS CLI command `aws rds describe-db-instances --region us-west-2`, they receive an access denied error. Why does this fail?

Accepted Answer

The policy explicitly restricts the resource to a specific DB instance ARN in us-east-1, and the command specifies a different region.. The IAM policy includes two Allow statements. The first statement grants rds:DescribeDBInstances only on a specific DB instance ARN in us-east-1. The second statement grants the same action on any resource (*). Because IAM evaluates the effective permissions as the union of all statements, the user is only allowed to describe that specific instance in us-east-1; describing instances in any other region (such as us-west-2) is not explicitly allowed for that resource, so the request is denied. Option D is correct because it acknowledges that the resource ARN restriction from the first statement limits the allowed region. Option A is incorrect because there is no MFA condition in the policy. Option B is incorrect because the user can describe the specific instance in us-east-1. Option C is incorrect because the policy restricts access via a resource ARN, not a condition key.

Answer

The user must use multi-factor authentication (MFA) to perform the describe action.

Answer

The user does not have permission to describe DB instances in any region.

Answer

The policy includes a condition key that denies access when the region is not us-east-1.

Question 3

A company is running an Amazon RDS for MySQL DB instance in a VPC. The security team requires that all connections to the database use SSL/TLS. The DBA has enabled 'require_secure_transport' parameter in the DB parameter group. However, after applying the change and rebooting, some applications that were previously connecting successfully are now failing. What is the most likely cause?

Accepted Answer

The application is not configured to connect using SSL/TLS.. Enabling 'require_secure_transport' in the MySQL parameter group forces the server to accept only SSL/TLS connections. Applications that are not configured with SSL will be rejected, causing them to fail after this change. Option A is incorrect because the security group inbound rule missing would have prevented connections entirely, not just after this change. Option B is incorrect because the SSL option in the option group is separate from the 'require_secure_transport' parameter; the parameter group controls this setting. Option D is incorrect because the DB subnet group determines network placement, not SSL enforcement.

Answer

The security group inbound rule for the database port is missing.

Answer

The option group does not have the SSL option enabled.

Answer

The DB subnet group does not include the application's subnet.

Question 4

A company is migrating a 5 TB Microsoft SQL Server database to Amazon Aurora MySQL. The migration must be completed with minimal downtime. Which THREE steps should the company take? (Select THREE.)

Accepted Answer

Use AWS DMS to perform a full load and ongoing replication from SQL Server to Aurora.. AWS DMS (Database Migration Service) supports ongoing replication (change data capture) from Microsoft SQL Server to Amazon Aurora MySQL, enabling a full load followed by continuous sync of changes. This minimizes downtime by allowing the source database to remain operational until the final cutover, at which point the application switches to the Aurora writer endpoint.

Answer

Update the application connection string to point to the Aurora reader endpoint.

Answer

Create a read replica of the Aurora database in the same region.

Question 5

A company uses Amazon RDS for SQL Server with Multi-AZ deployment. The security team has mandated that all connections to the database must use SSL/TLS. The database is accessed by multiple applications running on EC2 instances. Which configuration ensures that all connections use SSL/TLS?

Accepted Answer

Set the parameter rds.force_ssl to 1 in the DB parameter group.. Setting the rds.force_ssl parameter to 1 in the DB parameter group enforces SSL/TLS for all connections to the RDS for SQL Server instance. No additional steps are needed; this parameter alone ensures that any connection attempt without SSL is rejected. Option B is incorrect because it includes an unnecessary step of revoking permissions from users that do not use SSL; the rds.force_ssl setting already forces SSL for all users and revoking permissions is redundant. Option A is incorrect because the 'Require SSL' option does not exist in the RDS console; SSL enforcement is controlled via parameter group settings. Option D is incorrect because configuring applications to use a trusted certificate only addresses the client side; the server must also require SSL, which is achieved through the parameter group setting.

Answer

Modify the DB instance by enabling the 'Require SSL' option in the RDS console.

Answer

Set the parameter rds.force_ssl to 1 in the DB parameter group and revoke permissions from users that do not use SSL.

Answer

Configure the applications to use a certificate from a trusted certificate authority and connect using SSL.

Question 6

A company is running a MySQL database on Amazon RDS and needs to store JSON documents that are frequently queried by fields within the JSON. The company wants to reduce development complexity and improve query performance. Which RDS MySQL feature should the database specialist recommend?

Accepted Answer

Use the JSON data type in MySQL 8.0 and utilize JSON path expressions in queries. MySQL 8.0's native JSON data type stores JSON documents in an optimized binary format, enabling efficient indexing and querying via JSON path expressions (e.g., `JSON_EXTRACT`, `->`, `->>`). This reduces development complexity by allowing direct SQL access to JSON fields without application-level parsing, and improves query performance through generated columns and virtual indexes.

Answer

Migrate the JSON data to Amazon DynamoDB and use DynamoDB's document model

Answer

Store JSON documents in a VARCHAR(MAX) column and use LIKE operations for queries

Answer

Store JSON documents as BLOBs and parse them in application code

Question 7

A company is using Amazon RDS for MySQL with Multi-AZ deployment. The primary instance recently experienced an unexpected failover due to a hardware failure. The database is 2 TB in size and has high write throughput. Which TWO actions should the database administrator take to minimize recovery time and ensure data durability?

Accepted Answer

Enable automated backups with a retention period of 1 day to allow point-in-time recovery.. Enabling automated backups with a retention period of 1 day allows for point-in-time recovery, which minimizes data loss and recovery time. Option E is correct because verifying that the failover completed successfully through the RDS event log and monitoring the new primary's status ensures data durability and confirms that the Multi-AZ deployment functioned properly. Option A is wrong because increasing the instance class does not directly reduce recovery time from a failover. Option B is wrong because disabling Multi-AZ reduces availability and does not prevent hardware failures. Option D is wrong because manual snapshots are not as immediate as automated backups for point-in-time recovery and would take longer to restore.

Answer

Increase the DB instance class to a larger size to handle the write load.

Answer

Disable Multi-AZ and use a single-AZ deployment to avoid future failovers.

Answer

Take a manual snapshot of the DB instance immediately.

Question 8

A financial services company runs a critical PostgreSQL database on Amazon RDS. The DBA needs to ensure that any database failover is detected within 30 seconds. Which monitoring approach should be used to meet this requirement?

Accepted Answer

Subscribe to RDS Event Notifications and create an SNS topic for 'failover' events.. Amazon RDS Event Notifications for 'failover' events are delivered within seconds, meeting the 30-second requirement. Subscribing to SNS topics ensures near real-time notification. Option B is wrong because the 'DatabaseConnections' metric with a 1-minute evaluation period introduces a delay of up to 1 minute, exceeding the 30-second threshold. Option C is wrong because Enhanced Monitoring provides OS-level metrics every second but does not directly indicate a failover event. Option D is wrong because CloudTrail logs API calls with a typical delay of several minutes, not suitable for sub-minute detection.

Answer

Create a CloudWatch alarm on the 'DatabaseConnections' metric with a 1-minute evaluation period.

Answer

Use Enhanced Monitoring to monitor the 'engine' process status every second.

Answer

Enable CloudTrail and monitor the 'FailoverDBCluster' API call.

Question 9

A financial services company is migrating its Oracle database to Amazon Aurora PostgreSQL. The database runs a critical batch processing job every night that updates millions of rows. The company needs the migration to minimize downtime and ensure data integrity. Which AWS service should the database specialist use to perform the migration?

Accepted Answer

AWS Database Migration Service (AWS DMS) with ongoing replication from Oracle to Aurora PostgreSQL. AWS DMS with ongoing replication (change data capture, CDC) is the correct choice because it enables a near-zero-downtime migration by continuously replicating changes from the source Oracle database to the target Aurora PostgreSQL while the source remains fully operational. After the initial full load, DMS applies ongoing transactions, allowing you to cut over with minimal interruption. This directly addresses the requirement to minimize downtime for the nightly batch job and ensures data integrity through transactional consistency.

Answer

AWS Data Pipeline to export data from Oracle and import into Aurora PostgreSQL

Answer

AWS Schema Conversion Tool (AWS SCT) to convert the schema and then use native PostgreSQL tools to migrate data

Answer

AWS Glue to extract data from Oracle and load into Aurora PostgreSQL

Question 10

A company is migrating a 500 GB MySQL database from on-premises to Amazon RDS for MySQL. The migration must have minimal downtime and support ongoing replication. Which AWS service should be used?

Accepted Answer

Use AWS Database Migration Service (DMS) with a full load and ongoing replication from a change data capture source.. AWS DMS is the correct choice because it supports both a full load of the 500 GB database and ongoing replication using change data capture (CDC) from the on-premises MySQL source. This enables minimal downtime by keeping the target RDS instance synchronized during the migration window, and it handles schema conversion automatically for MySQL-to-MySQL migrations without needing a separate tool.

Answer

Use mysqldump to export the database and import to RDS during a maintenance window.

Answer

Use AWS Schema Conversion Tool (SCT) to convert the schema and migrate data.

Answer

Take a physical backup, copy it to Amazon S3, and restore to RDS.

Question 11

A company is migrating an on-premises MongoDB database to Amazon DocumentDB. The database stores IoT sensor data with time-series characteristics. The application performs range queries on timestamp fields and updates recent documents frequently. Which THREE aspects of DocumentDB should the company consider to optimize performance for this workload? (Choose three.)

Accepted Answer

Implement sharding to distribute write load across multiple instances.. DocumentDB does not support native sharding like MongoDB; however, for workloads with high write throughput, you can distribute writes by using multiple DocumentDB instances and routing writes based on a shard key in the application layer. This helps avoid write bottlenecks on a single instance and scales write capacity horizontally.

Answer

Use global secondary indexes to speed up queries on the timestamp field.

Answer

Use a single large instance class to avoid sharding complexity.

Question 12

A gaming company uses Amazon DynamoDB for player session data. Each session has a partition key of `game_id` and a sort key of `session_id`. The table has a global secondary index (GSI) on `player_id` for leaderboard queries. Recently, the company noticed that write traffic to the GSI is causing throttling on the base table, even though the base table's write capacity is not fully utilized. What is the MOST likely cause?

Accepted Answer

The GSI is not designed with a high-cardinality partition key, causing write hot spots on the GSI.. A global secondary index (GSI) has its own provisioned read and write capacity, separate from the base table. If the GSI's partition key (player_id) has low cardinality (e.g., only a few distinct player_id values), writes to the base table will concentrate on a small number of GSI partitions, causing throttling on the GSI. This throttling on the GSI then back-pressures the base table, resulting in write throttling on the base table even if its own write capacity is underutilized.

Answer

The application is using strongly consistent reads on the GSI, which consumes double the read capacity.

Answer

Point-in-time recovery (PITR) is enabled, consuming extra write capacity.

Answer

The table's auto-scaling settings are not configured correctly for the GSI.

Question 13

A database administrator is troubleshooting why Amazon RDS Enhanced Monitoring is not displaying metrics for a DB instance. The IAM role attached to the instance has the policy shown in the exhibit. What is the likely cause?

Accepted Answer

The policy denies the 'rds:DescribeDBInstances' action.. Amazon RDS Enhanced Monitoring requires the IAM role to have permission to describe the DB instance using 'rds:DescribeDBInstances'. This action is necessary for the monitoring service to retrieve information about the instance so it can collect and publish OS metrics. If the policy explicitly denies this action, Enhanced Monitoring will fail to display metrics. Option C is incorrect because 'monitoring:ListMetrics' is not required; Enhanced Monitoring publishes to CloudWatch Logs, not CloudWatch Metrics, and the IAM role needs logs permissions (e.g., 'logs:PutLogEvents') rather than monitoring actions. Options B and D are also incorrect: 'rds:CreateDBInstance' is unrelated to monitoring, and using a resource of '*' is acceptable as long as the trust policy allows RDS to assume the role.

Answer

The policy is missing the 'rds:CreateDBInstance' action.

Answer

The policy does not include 'monitoring:ListMetrics'.

Answer

The resource is set to '*' instead of the specific DB instance ARN.

Question 14

A database administrator notices that Amazon RDS for MySQL is experiencing high CPU utilization during peak hours. The application is read-heavy with many SELECT queries. Which action is most cost-effective to improve performance?

Accepted Answer

Create one or more read replicas and direct read traffic to them.. The most cost-effective solution for a read-heavy, high-CPU workload on Amazon RDS for MySQL is to create one or more read replicas and direct read traffic to them. This offloads SELECT queries from the primary DB instance, reducing CPU utilization without incurring the high cost of upgrading the primary instance. Option B (increasing DB instance class) and Option D (vertical scaling to higher vCPU) are more expensive and not cost-effective. Option C (increasing allocated storage) improves I/O throughput but does not directly reduce CPU utilization.

Answer

Increase the DB instance class to a larger size.

Answer

Increase the allocated storage to improve I/O throughput.

Answer

Scale up the DB instance vertically to a higher vCPU count.

Question 15

A company is using Amazon Aurora MySQL-Compatible Edition. The security team wants to audit all database login attempts and store the logs in Amazon S3 for 90 days. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Enable the Aurora audit log and publish logs to Amazon CloudWatch Logs. Create a CloudWatch Logs subscription filter to stream the logs to an Amazon S3 bucket.. Amazon Aurora can publish audit logs to Amazon CloudWatch Logs. A CloudWatch Logs subscription filter can then stream those logs to an Amazon S3 bucket for long-term storage. This approach requires minimal operational overhead because it uses native AWS services without custom scripts or additional infrastructure. Option B is incorrect because Aurora does not support writing audit logs directly to S3. Option C is incorrect because installing a custom audit plugin and using a Lambda function introduces unnecessary complexity and operational overhead. Option D is incorrect because using Amazon Kinesis Data Firehose adds an extra streaming service that is not needed; a CloudWatch Logs subscription filter is simpler and more direct.

Answer

Enable the Aurora audit log and configure the DB cluster to publish logs directly to an S3 bucket.

Answer

Install a custom audit plugin on the Aurora cluster that writes logs to a file, then use an AWS Lambda function to upload the file to S3.

Answer

Enable the Aurora audit log and use Amazon Kinesis Data Firehose to stream the logs to S3.

Question 16

A company uses Amazon DynamoDB for its critical application. The security team requires that all access to DynamoDB tables be logged and monitored for suspicious activity. The company also needs to be alerted when a user deletes a table. Which combination of AWS services should be used?

Accepted Answer

AWS CloudTrail and Amazon CloudWatch Events.. AWS CloudTrail logs all DynamoDB API calls, including DeleteTable, and can send events to Amazon CloudWatch Events, which can trigger alerts via SNS or Lambda. Option A is incorrect because DynamoDB Streams captures item-level changes, not API calls. Option B is incorrect because AWS Config records resource configuration changes but not API calls directly for alerting; CloudTrail is needed. Option D is incorrect because VPC Flow Logs capture network traffic, not API calls.

Answer

AWS CloudTrail and Amazon DynamoDB Streams.

Answer

AWS Config and Amazon Simple Notification Service (SNS).

Answer

Amazon VPC Flow Logs and Amazon CloudWatch Logs.

Question 17

Refer to the exhibit. A database administrator has this IAM policy attached to their user. They are trying to authorize ingress to a DB security group named 'my-security-group' in the us-east-1 region. The operation fails. What is the most likely reason?

Accepted Answer

The user is missing the 'rds:DescribeDBSecurityGroups' permission, which is required to perform the authorize operation.. The policy grants the `rds:AuthorizeDBSecurityGroupIngress` action on a specific DB security group. However, to authorize ingress, the user must also be able to describe the security group to verify its existence and details. The policy does not include `rds:DescribeDBSecurityGroups`, which is a prerequisite for the authorization operation. Therefore, the operation fails due to missing describe permission.

Answer

The user is not allowed to create DB security groups, which is a prerequisite.

Answer

The policy does not grant 'rds:AuthorizeDBSecurityGroupIngress' on the specific security group.

Answer

The security group ARN in the policy is incorrect; it should include the security group ID instead of the name.

Question 18

A company is migrating an on-premises MySQL database to Amazon Aurora MySQL. The database is 2 TB and the migration must have minimal downtime. The network bandwidth between the on-premises data center and AWS is 1 Gbps. Which migration approach is most appropriate?

Accepted Answer

Use AWS Database Migration Service (DMS) with ongoing replication to keep the target in sync. AWS DMS with ongoing replication is the most appropriate approach because it allows a full load of the 2 TB database followed by continuous change data capture (CDC) to keep the target Aurora MySQL cluster in sync with minimal downtime. At 1 Gbps, the initial load would take approximately 5–6 hours, but the CDC phase reduces the final cutover downtime to seconds or minutes, meeting the minimal downtime requirement.

Answer

Use mysqldump to export the data, upload to Amazon S3, and import into Aurora

Answer

Take a snapshot of the on-premises database and restore it to Aurora

Answer

Use AWS Snowball Edge to transfer the data physically to AWS

Question 19

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all connections to the database use SSL/TLS encryption. Which step is necessary to enforce SSL connections?

Accepted Answer

Set the 'rds.force_ssl' parameter to 1 in the DB parameter group.. To enforce SSL/TLS connections to an Amazon RDS for Oracle instance, you must set the 'rds.force_ssl' parameter to 1 in the DB parameter group. This requires all connections to use SSL. Option A is incorrect because security groups control network-level access, not encryption. Option B is incorrect because the DB subnet group defines the subnets for the instance, not encryption. Option C is incorrect because the option group is used to enable additional features like Oracle Enterprise Manager or timezone, not SSL enforcement. Therefore, Option D is the correct step.

Answer

Configure the security group to only allow traffic on port 443.

Answer

Modify the DB subnet group to use a private subnet.

Answer

Add the SSL option to the option group.

Question 20

A company wants to audit all SQL statements executed on their RDS for PostgreSQL database. Which AWS service should they use?

Accepted Answer

CloudWatch Logs with PostgreSQL audit logs. For auditing SQL statements on Amazon RDS for PostgreSQL, you enable the PostgreSQL Audit Extension (pgaudit) and configure it to send logs to Amazon CloudWatch Logs. CloudWatch Logs can then be used to monitor, store, and access the SQL audit logs. Option A (AWS Database Migration Service) is used for migrating databases, not auditing. Option B (VPC Flow Logs) captures IP traffic metadata, not SQL statements. Option C (Amazon RDS Performance Insights) monitors database performance metrics, not individual SQL statements.

Answer

AWS Database Migration Service (DMS)

Answer

VPC Flow Logs

Answer

Amazon RDS Performance Insights