DBS-C01 Mock Exam 82 — 25 Questions

Question 1

A company is designing a database for an e-commerce platform that requires ACID transactions for order processing, complex joins for inventory reporting, and the ability to scale read replicas across multiple AWS regions. Which database service best meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon Aurora. Amazon Aurora is the correct choice because it provides full ACID compliance for transactional workloads, supports complex joins via its MySQL/PostgreSQL-compatible relational engine, and offers up to 15 low-latency read replicas that can be placed in multiple AWS Regions using Aurora Global Database. This combination of strong consistency, relational query capabilities, and cross-region read scaling directly matches the e-commerce platform's requirements.

Answer

Amazon DynamoDB

Answer

Amazon RDS for SQL Server

Answer

Amazon Redshift

Question 2

A company is migrating an on-premises MongoDB database to Amazon DocumentDB. The migration must be online with minimal downtime. The source MongoDB is version 4.0 and uses replica sets. Which tool should the company use?

Accepted Answer

Use AWS DMS with MongoDB as source and DocumentDB as target.. AWS DMS (Database Migration Service) supports continuous replication from MongoDB (including replica sets) to Amazon DocumentDB, enabling an online migration with minimal downtime. DMS uses the MongoDB oplog to capture ongoing changes, ensuring data consistency during the cutover. This is the only option that meets the requirement for an online migration with minimal downtime.

Answer

Use MongoDB Compass to export data and import into DocumentDB.

Answer

Use mongodump and mongorestore.

Answer

Create a read replica of the MongoDB replica set and promote to DocumentDB.

Question 3

A security engineer is investigating an Amazon RDS for MySQL database that was compromised. The engineer finds that the compromise was due to a SQL injection vulnerability in a web application. The web application uses a database user with full administrative privileges. What is the BEST practice to prevent such incidents in the future?

Accepted Answer

Create dedicated database users with minimal privileges required for each application function.. The best practice is to use dedicated database users with minimal privileges for each application function (Option A). This principle of least privilege limits the damage a SQL injection attack can cause because the compromised user cannot perform unauthorized actions beyond its specific scope. Option B is incorrect because the 'sql_mode' parameter can reject certain dangerous queries but does not address the root cause of excessive privileges and may not prevent all injection attacks. Option C is incorrect because audit logs only help detect incidents after they occur, not prevent them. Option D is incorrect because while placing the RDS instance in a private subnet and restricting inbound traffic reduces the network attack surface, it does not prevent SQL injection attacks that originate from the application itself; the vulnerability lies in how the application interacts with the database.

Answer

Configure the DB parameter group to use the 'sql_mode' option to reject dangerous queries.

Answer

Enable RDS audit logs to capture all SQL queries.

Answer

Place the RDS instance in a private subnet with a security group that restricts inbound traffic.

Question 4

A company uses Amazon DynamoDB with AWS KMS-managed encryption at rest. The security team requires that all access to a particular DynamoDB table be logged for audit purposes. Which solution meets this requirement?

Accepted Answer

Enable CloudTrail data events for the DynamoDB table.. AWS CloudTrail logs all DynamoDB API calls, including data plane operations, when data events are enabled. Option A is wrong because VPC Flow Logs capture network traffic, not API calls. Option B is wrong because AWS Config records resource configuration changes, not API calls. Option D is wrong because Amazon GuardDuty is a threat detection service, not a logging service.

Answer

Enable VPC Flow Logs for the VPC where the DynamoDB endpoint is accessed.

Answer

Enable AWS Config rules for DynamoDB.

Answer

Enable Amazon GuardDuty with DynamoDB protection.

Question 5

A company is migrating a 10 TB Oracle data warehouse to Amazon Redshift. They want to use AWS DMS for continuous replication. However, the migration is taking longer than expected due to LOB columns. What optimization should be applied?

Accepted Answer

Set MaxLobSize to a value like 64 KB to limit inline LOB transfer.. Setting MaxLobSize to a value like 64 KB instructs AWS DMS to treat LOBs smaller than that threshold as inline data, which is transferred more efficiently in the batch stream. This avoids the performance penalty of using FullLobMode, which transfers each LOB individually and can dramatically slow down continuous replication for large tables with many LOB columns.

Answer

Use AWS SCT to compress LOBs.

Answer

Enable FullLobMode to transfer all LOBs.

Answer

Increase the number of DMS tasks.

Question 6

Refer to the exhibit. A database specialist is troubleshooting an automation script that fails when trying to create a snapshot of the RDS DB instance 'mydb' using an IAM role with the attached policy. The error message indicates that the user is not authorized to perform the operation. Which statement best explains the failure?

Accepted Answer

The policy does not grant the rds:CreateDBSnapshot permission on the DB instance resource.. The rds:CreateDBSnapshot action requires permission on the DB instance resource (arn:aws:rds:region:account:db:instance-name). The IAM policy in the exhibit only grants this action on the snapshot resource (arn:aws:rds:region:account:snapshot:*), not on the DB instance, causing the authorization failure. Options A and B are incorrect because they either mention an irrelevant action or misidentify the resource. Option C is incorrect because the policy does allow rds:CreateDBSnapshot on the snapshot resource, but the missing permission on the DB instance is the actual issue.

Answer

The resource ARN for the snapshot is incorrect; it should specify the DB instance ID.

Answer

The policy does not allow the rds:DescribeDBInstances action on the snapshot resource.

Answer

The policy does not allow the rds:CreateDBSnapshot action on the specific snapshot name.

Question 7

A company stores sensitive data in an Amazon RDS for PostgreSQL DB instance. The security team requires that all data at rest be encrypted. The instance is currently unencrypted. What is the simplest way to enable encryption with minimal downtime?

Accepted Answer

Create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the snapshot to a new encrypted DB instance.. An existing unencrypted Amazon RDS instance cannot be directly encrypted. The standard approach to enable encryption with minimal downtime is to create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the snapshot to a new encrypted DB instance. This process typically involves a brief outage during the restore but is simpler than other methods. Option B is incorrect because the AWS CLI does not support enabling encryption on an existing instance. Option C is incorrect because migrating to RDS Custom adds unnecessary complexity and does not directly enable encryption on the current instance. Option D is incorrect because the AWS Management Console also does not allow enabling encryption on an existing instance.

Answer

Use the AWS CLI to modify the DB instance and enable encryption.

Answer

Migrate the data to an Amazon RDS for PostgreSQL DB instance using RDS Custom.

Answer

Modify the DB instance and enable encryption in the console.

Question 8

A financial services company needs a relational database with high availability and automatic failover across three Availability Zones in us-east-1. The workload consists of OLTP transactions with occasional analytic queries. Which database solution meets these requirements?

Accepted Answer

Amazon Aurora MySQL with Multi-AZ deployment across 3 AZs. Amazon Aurora MySQL with Multi-AZ deployment across 3 AZs meets the requirements because Aurora automatically replicates your data six ways across three Availability Zones, with a primary DB instance in one AZ and two read replicas in the other two AZs. In the event of a failure, Aurora automatically fails over to a read replica in under 30 seconds without data loss, providing high availability and automatic failover across three AZs. Aurora also supports both OLTP transactions and can handle occasional analytic queries via Aurora Replicas or Aurora Global Database for read scaling.

Answer

Amazon RDS for MySQL with Multi-AZ (2 AZs)

Answer

Amazon DynamoDB global tables

Answer

Amazon Redshift with cross-region snapshots

Question 9

A company uses Amazon DynamoDB with on-demand capacity for a gaming leaderboard. During a promotional event, write traffic spikes 10x, causing occasional 'ProvisionedThroughputExceededException' errors. The application retries with exponential backoff, but latency increases. The team notices that the 'ThrottledWriteRequests' metric spikes. What is the MOST cost-effective solution to handle these unpredictable spikes?

Accepted Answer

Switch to provisioned capacity with auto scaling configured for the expected peak.. The scenario describes a DynamoDB table using on-demand capacity but experiencing 'ProvisionedThroughputExceededException', which is an error specific to provisioned capacity. This inconsistency suggests the table is actually using provisioned capacity. Therefore, the best solution is to switch to provisioned capacity with auto scaling properly configured to handle the peak traffic, ensuring cost-effectiveness by scaling only when needed. Option A is invalid because on-demand tables do not throw this error. Option B (DAX) addresses read latency, not write throttling. Option D (SQS) adds complexity and latency and is not the most cost-effective for unpredictable write spikes.

Answer

Continue using on-demand capacity but ensure the table has no throttling.

Answer

Implement DynamoDB Accelerator (DAX) to reduce read load.

Answer

Use an Amazon SQS queue to buffer write requests before DynamoDB.

Question 10

A company is migrating a 500 GB Oracle database to Amazon RDS for Oracle. They want to minimize downtime and use AWS DMS for ongoing replication. The source database is in a corporate data center behind a firewall. What is the recommended network setup for the DMS replication instance?

Accepted Answer

Deploy the DMS replication instance in a VPC that has a VPN or AWS Direct Connect connection to the corporate data center.. AWS DMS requires network connectivity between the replication instance and both the source and target databases. Since the source Oracle database is behind a corporate firewall, the DMS replication instance must be deployed in a VPC that has a VPN or AWS Direct Connect connection to the corporate data center. This establishes a private, secure, and low-latency network path for ongoing replication, minimizing downtime during migration.

Answer

Launch the DMS replication instance with a public IP address and allow inbound traffic from the corporate firewall.

Answer

Create a VPC endpoint for the DMS service and route traffic through it.

Answer

Install the DMS replication software on a server in the corporate data center to connect directly to the source.

Question 11

An IAM policy is attached to a role used by an RDS instance. The RDS instance is in VPC with a VPC endpoint to KMS. What is the effect of this policy?

Accepted Answer

Allows only the specified KMS actions on the key when the request originates from the RDS service via the specific VPC endpoint.. An IAM policy attached to a role used by an RDS instance, combined with a VPC endpoint to KMS, restricts the allowed KMS actions to only those specified and requires that the request originate from the RDS service via that specific VPC endpoint. Option A is incorrect because it suggests all KMS actions are allowed, which is not the case; only specified actions are allowed. Option B is incorrect because it mistakenly implies the policy allows actions from any source, ignoring the VPC endpoint restriction. Option C is incorrect because it states the policy applies to all KMS keys, whereas it is typically scoped to a specific key.

Answer

Allows all KMS actions on the key only when the request comes from RDS.

Answer

Allows all KMS actions on the specified key from any source.

Answer

Allows the specified KMS actions on all KMS keys in the account.

Question 12

A company is migrating an on-premises SQL Server database to Amazon RDS for SQL Server. They need to minimize downtime and have a limited network bandwidth of 50 Mbps. The database size is 1 TB. What is the MOST effective approach?

Accepted Answer

Use AWS Snowball Edge to transfer initial load, then DMS for CDC.. The 1 TB database size combined with a 50 Mbps network bandwidth would require over 46 hours for the initial load, making a full network transfer impractical. AWS Snowball Edge allows you to transfer the initial 1 TB seed data offline via a physical appliance, bypassing bandwidth constraints. After the seed is loaded into RDS, AWS DMS with Change Data Capture (CDC) can then replicate ongoing changes over the network, minimizing downtime to only the final cutover window.

Answer

Use AWS DMS with CDC over the network.

Answer

Use AWS SCT to compress data before transfer.

Answer

Use native SQL Server backup and restore to Amazon S3.

Question 13

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database is 2 TB in size. The company wants to minimize downtime during the migration. Which AWS service should be used to perform an online migration with minimal downtime?

Accepted Answer

AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) supports ongoing replication to minimize downtime. Snowball is for offline data transfer. S3 is not a migration service. Direct Connect provides a dedicated network connection but is not a migration service itself.

Answer

AWS Direct Connect

Answer

AWS Snowball

Answer

Amazon S3

Question 14

A developer is configuring an RDS for PostgreSQL instance for a new application. The application requires automatic failover to a standby instance in a different Availability Zone. Which deployment option should be selected?

Accepted Answer

Deploy a Multi-AZ instance.. Multi-AZ deployment for RDS PostgreSQL automatically provisions and maintains a synchronous standby replica in a different Availability Zone. In the event of a failure or Availability Zone outage, Amazon RDS automatically fails over to the standby, providing high availability without manual intervention. This meets the requirement for automatic failover to a standby instance in a different AZ.

Answer

Deploy a Single-AZ instance with a read replica.

Answer

Deploy a Single-AZ instance and take frequent snapshots.

Answer

Deploy a Single-AZ instance with a cross-region read replica.

Question 15

A database administrator needs to retain backups of an Amazon RDS for PostgreSQL DB instance for 7 years to meet compliance requirements. The automated backup retention period is limited to 35 days. Which solution should be used?

Accepted Answer

Create manual snapshots at regular intervals and retain them for 7 years.. Manual snapshots are retained indefinitely until deleted. Automated backups have a max retention of 35 days. Exporting to S3 is an option but not directly a backup retention method; you can export snapshots to S3, but manual snapshots are the standard way to retain backups long-term. EC2 instance backups are not applicable.

Answer

Export the automated backups to Amazon S3 and apply an S3 lifecycle policy.

Answer

Increase the automated backup retention period to 7 years.

Answer

Use an AWS Lambda function to copy automated backups to an EC2 instance.

Question 16

Refer to the exhibit. A company is creating an IAM policy for a migration engineer who needs to perform a database migration from an on-premises SQL Server to Amazon RDS for SQL Server using AWS DMS. The policy is attached to the engineer's IAM user. Which additional permission is required for the engineer to create a DMS replication instance?

Accepted Answer

ec2:CreateInstance (or equivalent). To create a DMS replication instance, AWS DMS launches an Amazon EC2 instance in the customer's VPC to run the replication engine. The IAM user must have permission to call ec2:RunInstances (or the equivalent ec2:CreateInstance action) to provision this underlying compute resource. Without this EC2 permission, the DMS service cannot spin up the replication instance, and the migration engineer will receive an authorization error.

Answer

kms:CreateKey

Answer

dms:CreateEndpoint

Answer

s3:PutObject

Question 17

A company is migrating an on-premises MySQL database to Amazon RDS for MySQL. The database has a table with 100 million rows. During the migration using AWS DMS, the full load phase is taking too long. What change can speed up the full load?

Accepted Answer

Increase the number of DMS task mappings (parallel threads). Increasing the number of DMS task mappings (parallel threads) allows DMS to partition the source table and load multiple segments concurrently, significantly reducing the full load duration. By default, DMS uses a single thread per table; adding parallel threads leverages the source database's read capacity and the target RDS instance's write throughput more efficiently.

Answer

Reduce the target RDS instance storage to minimize write latency

Answer

Increase the size of the source on-premises database instance

Answer

Disable LOB columns in the task settings

Question 18

Which THREE actions can be performed using the AWS CLI for Amazon Aurora? (Choose three.)

Accepted Answer

Create a DB cluster from a snapshot using 'aws rds restore-db-cluster-from-snapshot'. All three are valid AWS CLI actions for Aurora. RestoreDBClusterFromS3 is for MySQL, but it exists.

Answer

Change the storage type of an Aurora cluster using 'aws rds modify-db-instance'

Answer

Enable auto-scaling for Aurora Replicas using 'aws rds enable-autoscaling'

Question 19

A company is running an Amazon DynamoDB table with global secondary indexes (GSIs). Write activity increases, and the 'ThrottledWriteEvents' metric for a GSI spikes. The table itself is not throttled. What is the most likely cause?

Accepted Answer

The GSI's partition key is not sufficiently distributed.. Write sharding on the GSI partition key can cause hot partitions. Option A is wrong because read capacity on the GSI does not affect writes. Option C is wrong because write capacity on the table is separate from GSI. Option D is wrong because the issue is about throttling on GSI, not table.

Answer

The index is too large for the base table.

Answer

The table's write capacity is set too low.

Answer

The GSI's read capacity is set too low.

Question 20

A company is migrating an on-premises Oracle database to Amazon Aurora PostgreSQL. The migration must have minimal downtime and support ongoing replication. Which THREE services should the company use? (Choose 3.)

Accepted Answer

Amazon Aurora PostgreSQL. Amazon Aurora PostgreSQL (Option B) is the target database for the migration. The company is migrating from Oracle to Aurora PostgreSQL, so Aurora PostgreSQL is the required destination. AWS DMS (Option D) handles the ongoing replication with minimal downtime by using change data capture (CDC) to continuously replicate changes from the source Oracle database to the target Aurora PostgreSQL. AWS SCT (Option E) is necessary to convert the Oracle database schema and any stored procedures, functions, and other code objects to be compatible with PostgreSQL, as the two databases have different SQL dialects and data types.

Answer

AWS Snowball Edge

Answer

AWS DataSync