DBS-C01 Mock Exam 78 — 25 Questions

Question 1

A company has an Amazon Redshift cluster that stores sensitive financial data. The security team requires that all data be encrypted at rest and that the encryption keys be rotated annually. Which solution meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a new encrypted cluster with a KMS key and configure automatic key rotation.. The security requirements are to have encryption at rest and automatic annual key rotation. Amazon Redshift clusters can only be encrypted at creation time; you cannot enable encryption on an existing unencrypted cluster. Therefore, the only way to meet the requirements is to create a new encrypted cluster using a KMS key with automatic rotation enabled. The existing cluster must be replaced by restoring from an encrypted snapshot or by creating a new cluster and migrating data. Option D precisely describes this solution: 'Create a new encrypted cluster with a KMS key and configure automatic key rotation.' Automatic rotation can be enabled on the KMS key, and Redshift will use the new key material automatically for re-encryption.

Option A is ambiguous: 'Use AWS KMS with automatic key rotation to encrypt the Redshift cluster' – this could be interpreted as enabling encryption on an existing cluster, which is not possible. Option D clearly states the correct procedure. Hence D is the best answer.

Option B is wrong because CloudHSM-backed encryption does not support automatic key rotation; rotation must be done manually.

Option C is wrong because encryption cannot be enabled on an existing cluster; a new encrypted cluster must be created.

Answer

Use AWS KMS with automatic key rotation to encrypt the Redshift cluster.

Answer

Create the cluster with AWS CloudHSM-backed encryption and rotate the key annually.

Answer

Enable encryption on the existing cluster by modifying the cluster settings.

Question 2

A social media startup is designing a database for user activity feeds. Each user follows up to 5,000 other users. The feed must show the latest 100 posts from followed users with latency under 200ms. Reads are 10x writes. Which database design best meets these requirements?

Accepted Answer

Use Amazon DynamoDB with a fan-out on write pattern, storing each user's feed in a separate partition. The fan-out on write pattern with DynamoDB ensures each user's feed is pre-computed and stored in a separate partition, allowing reads to fetch the latest 100 posts with sub-200ms latency by querying a single item collection. This pattern optimizes for the 10:1 read-to-write ratio by shifting work to writes, which are less frequent, and avoids expensive joins or scans at read time.

Answer

Use Amazon RDS for PostgreSQL with read replicas and materialized views refreshed every minute

Answer

Use Amazon ElastiCache for Redis as a primary data store with sorted sets per user

Answer

Use a single DynamoDB table with a global secondary index on user_id and timestamp

Question 3

A company uses Amazon RDS for SQL Server with Multi-AZ deployment. During a failover test, the application experienced a longer downtime than expected. Which monitoring metric should be reviewed to understand the failover duration?

Accepted Answer

DatabaseConnections. The DatabaseConnections metric in Amazon CloudWatch tracks the number of active database connections. During a Multi-AZ failover, existing connections are dropped and new connections are blocked until the standby becomes the primary. By monitoring the time period when DatabaseConnections drops to zero or a low value, you can estimate the failover duration. Options A (FailoverTime) is not a valid CloudWatch metric for RDS; the actual metric is 'Failover' which is a count, not a duration. WriteLatency may increase during failover but does not directly measure downtime. ReplicaLag applies to read replicas, not Multi-AZ failover.

Answer

FailoverTime

Answer

WriteLatency

Answer

ReplicaLag

Question 4

A company is deploying a DynamoDB table for a global application that requires low-latency reads and writes in multiple AWS Regions. Which THREE features should be enabled? (Choose three.)

Accepted Answer

DynamoDB Accelerator (DAX).. DynamoDB Accelerator (DAX) is correct because it provides an in-memory cache for DynamoDB tables, delivering microsecond latency for read-heavy workloads. For a global application requiring low-latency reads across multiple AWS Regions, DAX reduces response times by offloading read traffic from the DynamoDB table to a distributed cache, which is essential for meeting strict performance SLAs.

Answer

DynamoDB Streams.

Answer

Time to Live (TTL).

Question 5

A financial company uses Amazon RDS for PostgreSQL with a custom parameter group. The security team wants to ensure that all connections to the database are encrypted in transit. Which action should the database administrator take?

Accepted Answer

Set the parameter 'rds.force_ssl' to 1 in the custom parameter group.. Setting the parameter 'rds.force_ssl' to 1 in the RDS for PostgreSQL custom parameter group forces all connections to use SSL/TLS, ensuring encryption in transit. Option A is incorrect because IAM roles provide authentication, not transport encryption. Option B is incorrect because changing the port does not encrypt data. Option C is incorrect because setting 'ssl' to off disables encryption. Option E is incorrect because modifying a security group to allow inbound traffic on port 5432 does not enforce encryption; the '--ssl' option is a client-side parameter, not enforceable via security groups.

Answer

Attach an IAM role to the RDS instance to authenticate users.

Answer

Change the database port to 8432 to use a non-standard port.

Answer

Set 'ssl' to 'off' in the parameter group.

Answer

Modify the security group to allow inbound traffic only on port 5432 with the '--ssl' option.

Question 6

A company uses Amazon RDS for PostgreSQL and wants to audit all database login attempts. Which TWO services can be used together to achieve this?

Accepted Answer

Enable AWS CloudTrail.. To audit all database login attempts in RDS for PostgreSQL, you need to capture both the configuration changes (e.g., enabling audit logging) and the actual login events. AWS CloudTrail (Option A) records management API calls, such as modifying the DB parameter group to enable logging to CloudWatch Logs. Option E enables RDS for PostgreSQL to log login attempts directly to CloudWatch Logs. Together, they provide complete auditing: CloudTrail for the administrative actions and CloudWatch Logs for the login events. The other options do not capture login attempts.

Answer

Enable VPC Flow Logs.

Answer

Enable S3 access logs to capture API calls.

Answer

Enable RDS Enhanced Monitoring.

Question 7

A company is migrating a PostgreSQL database to Amazon Aurora PostgreSQL. They have set up AWS DMS with change data capture (CDC). However, after the initial load, the CDC replication is experiencing high latency. What is the MOST likely cause?

Accepted Answer

The source database has large transactions that are not committed quickly.. Large uncommitted transactions on the source database cause DMS CDC to buffer changes until the transaction commits, leading to high latency. DMS must wait for the commit record before applying changes to the target Aurora instance, and during this time, CDC replication stalls, accumulating a backlog of changes.

Answer

The target Aurora instance has insufficient storage.

Answer

The DMS instance is using an older engine version.

Answer

The network bandwidth is too low.

Question 8

A social media company runs a multi-region application on Amazon DynamoDB with global tables. The application is deployed in us-east-1 and eu-west-1. Recently, they enabled DynamoDB Streams on the table to trigger an AWS Lambda function for real-time analytics. The Lambda function runs in us-east-1. After enabling streams, they notice that the Lambda function is triggered multiple times for the same update, and the application's write latency in eu-west-1 has increased. The company has strict latency requirements. A database specialist is asked to resolve the issue. What should the database specialist recommend?

Accepted Answer

Modify the Lambda function to check the 'awsRegion' attribute in the stream record and ignore records from other regions.. Global tables replicate writes across regions, and each write generates a stream record. The Lambda function should filter on the 'awsRegion' attribute in the stream record to avoid processing the same update from different regions. Option A is wrong because increasing Lambda concurrency doesn't prevent duplicate processing. Option B is wrong because using a dedicated stream for each region is not supported. Option D is wrong because disabling streams in eu-west-1 would break the replication.

Answer

Increase the Lambda function's reserved concurrency to handle duplicate events faster.

Answer

Create a separate Lambda function in eu-west-1 and use a local stream.

Answer

Disable DynamoDB Streams on the eu-west-1 replica table.

Question 9

A company is using Amazon DynamoDB for a gaming leaderboard that updates frequently. They need to maintain a sorted list of top 100 players by score. Which THREE design patterns can achieve this efficiently?

Accepted Answer

Use a Global Secondary Index (GSI) with score as the sort key and query with ScanIndexForward=false and Limit=100.. A Global Secondary Index (GSI) with score as the sort key allows you to query items in descending order using ScanIndexForward=false and limit the result to the top 100 players. This pattern efficiently retrieves the highest scores without scanning the entire table, leveraging DynamoDB's index query capabilities.

Answer

Use DynamoDB Accelerator (DAX) to cache query results.

Answer

Scan the entire table and sort the results in memory.

Question 10

A company needs to encrypt an existing unencrypted Amazon RDS for Oracle DB instance. Which set of steps should be followed?

Accepted Answer

Take a snapshot of the instance, copy the snapshot with encryption enabled, and restore from the encrypted snapshot.. The correct procedure. To encrypt an existing unencrypted RDS DB instance, you must create a manual snapshot of the instance, then copy that snapshot with encryption enabled (specifying a KMS key), and finally restore a new DB instance from the encrypted snapshot. Option A is wrong because the console does not provide a direct 'Enable Encryption' action on an existing instance. Option B is wrong because you cannot modify an existing unencrypted instance to enable encryption directly; there is no such modification parameter. Option C is wrong because while it mentions copying the snapshot to an encrypted one, it does not clarify that encryption is applied during the copy operation, and the correct process explicitly requires taking the initial snapshot, copying with encryption, and then restoring; Option D includes all three steps.

Answer

Enable encryption using the AWS Management Console by selecting the instance and choosing 'Enable Encryption'.

Answer

Modify the DB instance and set the KMS key ID to enable encryption.

Answer

Copy the snapshot to an encrypted snapshot and then restore.

Question 11

A company is migrating a PostgreSQL database to Amazon Aurora PostgreSQL. The current database has complex queries that join multiple tables and performs well. After migration, the same queries are slower on Aurora. What is the most likely cause?

Accepted Answer

The DB instance class does not have enough memory for the buffer cache.. After migrating to Aurora PostgreSQL, the same complex queries are slower, which often indicates that the buffer cache is too small to hold the working set of data. Aurora uses a distributed storage system where the buffer cache is managed by the DB instance's memory; if the instance class lacks sufficient memory, frequently accessed data pages must be read from storage more often, increasing I/O latency. This is a common performance bottleneck when migrating from on-premises PostgreSQL, where the buffer cache might have been larger or the working set fit entirely in memory.

Answer

Aurora PostgreSQL does not support complex joins; the queries must be rewritten.

Answer

Aurora PostgreSQL does not support indexes on joined columns.

Answer

The default DB parameter group is optimized for write-heavy workloads, not read-heavy.

Question 12

A company runs a global application using Amazon Aurora Global Database. The primary region is us-east-1, and secondary regions are eu-west-1 and ap-southeast-1. The application reports that writes to the primary are taking longer than expected. What is the most likely cause?

Accepted Answer

The primary DB instance is under-provisioned.. Amazon Aurora Global Database uses asynchronous replication from the primary region to secondary regions. Writes to the primary are committed locally and do not wait for replication to complete. Therefore, replication to secondary regions does not introduce synchronous commit latencies. The most likely cause of slower writes to the primary is an under-provisioned primary DB instance that cannot handle the write workload efficiently.

Answer

Multi-AZ failover occurred in the primary region.

Answer

The Global Database replication to secondary regions is causing synchronous commit latencies.

Answer

Read replicas in secondary regions are overloaded.

Question 13

A company uses Amazon DynamoDB for a session management store. The application writes and reads session data frequently. The team notices that write requests occasionally fail with ProvisionedThroughputExceededException. They want a cost-effective solution to handle these bursts. What should they do?

Accepted Answer

Enable DynamoDB Auto Scaling for the table. DynamoDB Auto Scaling dynamically adjusts the provisioned write capacity based on actual traffic patterns, handling bursts cost-effectively by scaling up during spikes and down during lulls. This avoids the fixed-cost overhead of a higher provisioned value (Option A) and directly addresses the ProvisionedThroughputExceededException by ensuring sufficient capacity during bursts.

Answer

Increase the provisioned write capacity to a higher fixed value

Answer

Use DynamoDB Accelerator (DAX) to cache writes

Answer

Implement an Amazon SQS queue to buffer writes

Question 14

Which THREE are valid methods to encrypt data at rest in Amazon DynamoDB? (Choose 3.)

Accepted Answer

Use a customer managed CMK.. DynamoDB encryption at rest is implemented through AWS KMS, supporting three types of customer master keys (CMKs): AWS-owned CMKs (default), AWS managed CMKs, and customer managed CMKs. Option A is correct because customer managed CMKs are fully supported, allowing you to create, manage, and control key policies and rotation. Option C (AWS-owned) and D (AWS managed) are also correct. Option E (client-side encryption with DynamoDB Encryption Client) is not an encryption-at-rest method provided by DynamoDB; it encrypts data before transmission, but data at rest is still encrypted by DynamoDB's server-side encryption. Option B is irrelevant as S3 server-side encryption does not apply to DynamoDB.

Answer

Use S3 server-side encryption.

Answer

Use client-side encryption with the DynamoDB Encryption Client.

Question 15

A company is migrating a MongoDB database to Amazon DocumentDB. They have a 200 GB database and need to minimize downtime. Which migration approach is most appropriate?

Accepted Answer

Use AWS DMS to migrate data from MongoDB to DocumentDB.. AWS DMS with ongoing replication (change data capture) is the most appropriate migration approach for minimizing downtime when migrating a 200 GB MongoDB database to Amazon DocumentDB. DMS can perform an initial load and then continuously replicate ongoing changes from the source MongoDB to the target DocumentDB until cutover, resulting in near-zero downtime. Option B is incorrect because native MongoDB replication is not supported by DocumentDB; DocumentDB cannot join a MongoDB replica set.

Answer

Take an EBS snapshot of the MongoDB volume and restore it to DocumentDB.

Answer

Set up MongoDB replication from the source to DocumentDB, then promote DocumentDB.

Answer

Export the database using mongodump and import using mongorestore into DocumentDB.

Question 16

A company runs an Amazon RDS for MySQL DB instance with Multi-AZ. The application team reports that a recent schema change caused a significant increase in replication lag. The instance has a read replica in a different AWS Region. Which THREE actions should be taken to reduce replication lag?

Accepted Answer

Identify and optimize any long-running transactions or DDL statements that may be blocking replication.. Options A, C, and D are correct actions to reduce replication lag. A: Optimizing long-running transactions or DDL statements helps prevent blocking on the primary that can cause lag. C: Monitoring the ReplicaLag metric in CloudWatch allows you to identify trends and set alarms for proactive management. D: Setting the transaction isolation level to READ COMMITTED reduces locking on the primary, which can decrease replication lag. Option B is not the best action: increasing the instance class may improve performance but does not directly address the root cause of lag from schema changes. Option E is incorrect because disabling binary logging would stop replication entirely, not reduce lag.

Answer

Increase the DB instance class for both the primary and read replica to improve performance.

Answer

Disable binary logging on the primary instance to reduce I/O overhead.

Question 17

A company is deploying a new Amazon RDS for MySQL database in a VPC. The database must be accessible only from an application server running in the same VPC. The security team also wants to ensure that the database is not accessible from the internet. Which TWO configurations are required? (Choose TWO.)

Accepted Answer

Configure the security group to allow inbound traffic only from the application server's security group.. To meet the requirements, two configurations are needed. First, the DB instance must be set to not publicly accessible (Option D) to ensure it cannot be reached from the internet. Second, the security group associated with the DB instance must allow inbound traffic only from the application server's security group (Option C), which restricts access to resources within the VPC. Option A is incorrect because placing the DB instance in a public subnet would expose it to the internet. Option B is incorrect because the DB parameter group controls database engine settings, not network access. Option E is incorrect because network ACLs are stateless and a rule denying all inbound traffic would block legitimate traffic as well; security groups are the appropriate mechanism for this scenario.

Answer

Place the DB instance in a public subnet.

Answer

Modify the DB parameter group to restrict network access.

Answer

Configure a network ACL to deny inbound traffic from 0.0.0.0/0.

Question 18

A company wants to deploy an Amazon RDS for MySQL database for a new application. The database must be highly available with automatic failover. Which configuration should they choose?

Accepted Answer

Deploy a Multi-AZ instance with a standby replica. A Multi-AZ deployment for Amazon RDS automatically provisions and maintains a synchronous standby replica in a different Availability Zone. In the event of a failure, Amazon RDS automatically fails over to the standby, providing high availability without manual intervention. This configuration meets the requirement for automatic failover and high availability.

Answer

Deploy a single-AZ instance with automated backups

Answer

Deploy a cross-region replica

Answer

Deploy a single-AZ instance with a read replica

Question 19

A security auditor notices that the DynamoDB table 'UserData' is encrypted with a KMS key (exhibit). The company policy requires that all DynamoDB tables use an AWS managed key for encryption. What must be done to comply with the policy?

Accepted Answer

Create a new DynamoDB table with SSE enabled using the AWS managed key, then export data from the existing table and import into the new table.. DynamoDB does not support changing the KMS key or SSE configuration after table creation. To use the AWS managed key instead of a customer managed key, you must create a new table with SSE-KMS enabled using the AWS managed key (alias 'aws/dynamodb'), export the existing table data (via DynamoDB export to S3 or using a scan/write process), and import it into the new table. Option B is incorrect because a customer managed KMS key cannot be converted into an AWS managed key; they are distinct key types. Option C is incorrect because you cannot modify the SSE configuration of an existing DynamoDB table; encryption settings are immutable after creation. Option D is incorrect because the UpdateTable API does not allow changing the KMS key used for encryption; it only supports updating other table settings like billing mode or provisioned throughput.

Answer

Delete the customer managed KMS key and recreate it as an AWS managed key.

Answer

Modify the table's SSE configuration to use the AWS managed key.

Answer

Use the UpdateTable API to change the KMS key to the AWS managed key.

Question 20

A company is using Amazon RDS for MariaDB. The database administrator wants to monitor the database for slow queries. Which TWO services can be used to achieve this? (Choose TWO.)

Accepted Answer

Amazon RDS Performance Insights. Amazon RDS Performance Insights (Option A) is correct because it provides a database performance tuning and monitoring feature that visualizes database load and allows you to identify and analyze slow queries by filtering on SQL statements, waits, and hosts. Amazon CloudWatch Logs (Option C) is correct because you can enable the slow query log for MariaDB and publish those logs to CloudWatch Logs, then use CloudWatch Logs Insights to query and filter for slow queries based on execution time.

Answer

AWS Config

Answer

Amazon RDS Enhanced Monitoring

Answer

AWS CloudTrail