DBS-C01 Mock Exam 85 — 25 Questions

Question 1

A company is using Amazon Aurora MySQL. The database performance has degraded, and the DBA wants to identify the queries that are waiting for locks. Which system table should be queried to find information about locking conflicts?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

information_schema.INNODB_LOCKS. Information_schema.INNODB_LOCKS. This table shows current locks held by InnoDB transactions, including lock type, mode, and which transactions are waiting for locks. Option A (information_schema.TABLES) provides metadata about tables, not locks. Option B (information_schema.PROCESSLIST) shows current running processes but not lock details. Option C (performance_schema.events_waits_current) shows current wait events but is not specific to InnoDB lock conflicts; INNODB_LOCKS is the correct source for identifying locking conflicts in Aurora MySQL.

Answer

information_schema.TABLES

Answer

information_schema.PROCESSLIST

Answer

performance_schema.events_waits_current

Question 2

A developer is troubleshooting an application that uses Amazon DynamoDB. The application sometimes receives ProvisionedThroughputExceededException errors. The table has on-demand capacity mode. The errors occur in short bursts. What is the most likely cause?

Accepted Answer

The request rate exceeds the partition's throughput capacity in a short burst.. On-demand capacity mode can handle up to the table's previous peak traffic. However, if traffic spikes suddenly, DynamoDB might throttle. Option D is correct because on-demand has a limit on the maximum throughput per partition. Option A is wrong because indexes share the table's capacity. Option B is wrong because on-demand does not have provisioned limits. Option C is wrong because the table is on-demand, not provisioned.

Answer

The table has a low read/write capacity mode limit that needs to be increased.

Answer

The global secondary index (GSI) has a different throughput limit.

Answer

The table has reached the maximum provisioned throughput.

Question 3

A company is running an Amazon RDS for SQL Server Multi-AZ DB instance. During a recent failover test, the application experienced a timeout of 60 seconds. The application uses a connection string that points to the CNAME of the DB instance. Which configuration change would reduce the failover time?

Accepted Answer

Enable TDS Keep-Alive on the client side to detect and recover from connection drops faster.. Enable TDS Keep-Alive on the client side. This allows the client to detect connection drops faster and reconnect to the new primary during failover, reducing the timeout experienced. Option A (Create a read replica and promote it) is a manual process and does not reduce failover time; it is used for read scaling or disaster recovery. Option B (Using the IP address) is not recommended because the IP changes after failover; the CNAME automatically updates to point to the new primary, so using IP would cause longer outages. Option D (Disable Multi-AZ) would eliminate automatic failover, increasing downtime during failures.

Answer

Create a read replica and promote it to a standalone instance during failover.

Answer

Modify the application to use the IP address of the DB instance instead of the CNAME.

Answer

Disable Multi-AZ and use a single-AZ instance to avoid failover overhead.

Question 4

A company has an Amazon DynamoDB table with a global secondary index (GSI). The security team wants to ensure that the table and the GSI are encrypted at rest. How can this be achieved?

Accepted Answer

Nothing; DynamoDB encrypts all data at rest by default.. DynamoDB encrypts all tables and GSIs at rest by default. Option B is wrong because encryption is always on. Option C is wrong because encryption cannot be disabled. Option D is wrong because GSIs are automatically encrypted with the table.

Answer

Create the table with encryption disabled to avoid performance impact.

Answer

Enable encryption at rest on the table and the GSI separately.

Answer

Enable encryption on the GSI using a KMS key.

Question 5

A developer retrieved a database secret using the AWS CLI as shown. What is the MOST secure way to store and rotate this secret?

Accepted Answer

Store the secret in AWS Secrets Manager and enable automatic rotation with a Lambda function.. Secrets Manager can automatically rotate secrets, and the secret should be retrieved using IAM permissions. Option B is insecure. Option C is not best practice. Option D is not needed.

Answer

Store the secret in AWS Systems Manager Parameter Store as a SecureString.

Answer

Store the secret in a configuration file on the EC2 instance.

Answer

Use the secret as-is and change it manually every 90 days.

Question 6

Which THREE considerations are important when designing a database for a global, multi-Region application using Amazon DynamoDB Global Tables? (Select THREE.)

Accepted Answer

Application tolerance for eventually consistent reads. Amazon DynamoDB Global Tables use an eventually consistent model for cross-region replication. Applications must tolerate eventual consistency, as updates made in one region are propagated to other regions asynchronously, typically within one second or less. This design trade-off enables high availability and low-latency writes across multiple regions.

Answer

Using a single write region to avoid conflicts

Answer

Strongly consistent reads across regions

Question 7

A company is running a production Amazon DynamoDB table with on-demand capacity. The table experiences occasional throttling during traffic spikes. The table's partition key is a timestamp, and the workload is write-heavy. The operations team needs to reduce throttling. Which THREE actions should the team take? (Choose three.)

Accepted Answer

Add a random suffix to the partition key to distribute writes evenly.. Adding a random suffix to the timestamp partition key breaks the sequential write pattern, distributing writes evenly across all partitions. This prevents hot partitions, which are the root cause of throttling in a write-heavy workload with a monotonically increasing partition key.

Answer

Increase the read capacity units for the table.

Answer

Enable DynamoDB global tables to distribute write traffic.

Question 8

Which THREE practices should be implemented to secure an Amazon DynamoDB table that stores personally identifiable information (PII)? (Select THREE.)

Accepted Answer

Enable encryption at rest using an AWS KMS customer-managed key.. Using IAM policies to restrict access is a security best practice. Encrypting the table at rest with a KMS key protects data. Monitoring with CloudTrail provides audit trail. VPC endpoints help but are not a security practice for the table itself. Encryption in transit is done by DynamoDB automatically via HTTPS. Fine-grained access control can be achieved with IAM conditions, not attribute-based access control on the table itself.

Answer

Use a VPC endpoint to access the table.

Answer

Enable encryption in transit using SSL/TLS.

Question 9

A company wants to encrypt data at rest for an existing Amazon RDS for MySQL DB instance. The database is currently unencrypted. What is the most efficient way to enable encryption?

Accepted Answer

Create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the DB instance from the encrypted snapshot.. RDS does not support enabling encryption on an existing unencrypted DB instance directly. You must create a snapshot, copy it with encryption enabled, and restore from that encrypted snapshot. Option A is incorrect because you cannot modify the DB instance to enable encryption. Option C is incorrect because AWS KMS does not automatically encrypt the DB instance. Option D is incorrect because you cannot directly configure encryption on the existing instance.

Answer

Enable encryption on the existing DB instance by modifying the parameter group.

Answer

Use AWS KMS to automatically encrypt the DB instance.

Answer

Modify the DB instance and enable encryption from the RDS console.

Question 10

Which TWO methods can be used to securely connect to an Amazon RDS for PostgreSQL DB instance from an EC2 instance in the same VPC? (Select TWO.)

Accepted Answer

Use IAM database authentication.. Using SSL/TLS encrypts the connection. Using IAM database authentication provides a secure authentication mechanism. A security group allows traffic but does not encrypt. A VPC peering connection does not encrypt. A bastion host may add encryption but is not a method itself.

Answer

Configure a security group that allows all traffic from the EC2 instance.

Answer

Use a bastion host to proxy the connection.

Answer

Set up a VPC peering connection between the EC2 VPC and the RDS VPC.

Question 11

A company is migrating an on-premises MySQL database to Amazon RDS. The database is used for a critical e-commerce application that requires high availability with automatic failover. Which RDS deployment option should the company choose to meet these requirements?

Accepted Answer

Multi-AZ deployment with a standby in a different AZ. A Multi-AZ deployment for Amazon RDS MySQL automatically provisions and maintains a synchronous standby replica in a different Availability Zone (AZ). In the event of an AZ failure or primary instance failure, Amazon RDS automatically fails over to the standby, providing high availability with minimal downtime. This meets the requirement for automatic failover without manual intervention.

Answer

Multi-Region deployment with Read Replicas

Answer

Single-AZ instance with a standby in the same AZ

Answer

Single-AZ instance with a Read Replica

Question 12

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all connections to the database be encrypted in transit. Which TWO steps should be taken to enforce this requirement?

Accepted Answer

Set the rds.force_ssl parameter to 1 in the DB parameter group.. The correct steps are A and B. Setting the rds.force_ssl parameter to 1 in the DB parameter group forces all connections to use SSL/TLS on the server side. Additionally, configuring the database to require a client-side SSL/TLS certificate provides mutual authentication and ensures that only clients with valid certificates can connect, thereby enforcing encryption in transit from both ends.

Answer

Enable Oracle native network encryption (NNE) in the sqlnet.ora file.

Answer

Use AWS Secrets Manager to store database credentials and enable Kerberos authentication.

Answer

Use AWS Direct Connect or a VPN to connect to the VPC.

Question 13

A financial company uses Amazon DynamoDB to store customer transaction data. The compliance team requires that all data be encrypted at rest using a customer-managed AWS KMS key. Additionally, they need to ensure that the key is used only for DynamoDB and no other AWS service. How can the company meet these requirements?

Accepted Answer

Create a KMS key with a key policy that includes a condition such as "kms:ViaService": "dynamodb.amazonaws.com" to restrict usage to DynamoDB.. A KMS key policy can use the 'kms:ViaService' condition key to restrict usage of the key to requests that originate from DynamoDB (dynamodb.amazonaws.com). This ensures the key is used only for DynamoDB and no other AWS service. Option A is incorrect because IAM policies alone cannot restrict key usage if the key policy allows all principals; the key policy must explicitly enforce the restriction. Option B is incorrect because AWS Organizations SCPs do not control KMS key permissions; they control permissions for IAM entities. Option D is incorrect because IAM policies cannot prevent other services from using the key if the key policy allows them; the key policy itself must include the restriction.

Answer

Use a KMS key with no key policy, and rely on IAM policies to restrict access to only DynamoDB.

Answer

Use an AWS Organizations service control policy (SCP) to deny all AWS services except DynamoDB from using the KMS key.

Answer

Create a KMS key with a key policy that allows DynamoDB to use the key, and attach an IAM policy to deny all other services.

Question 14

A company is deploying a new web application on Amazon RDS for MySQL and expects read-heavy traffic. The database must be highly available. Which deployment approach meets these requirements?

Accepted Answer

Deploy a Multi-AZ instance and create read replicas.. Deploying a Multi-AZ RDS for MySQL instance provides automatic failover for high availability, while adding read replicas offloads read-heavy traffic from the primary instance, improving read scalability. Read replicas can be placed in different Availability Zones to further enhance resilience and read performance.

Answer

Deploy a Multi-AZ instance without read replicas.

Answer

Deploy a Single-AZ instance with a Multi-AZ read replica.

Answer

Deploy a Single-AZ instance and use ElastiCache for caching.

Question 15

A company is designing a new application that requires a relational database with strong consistency and support for transactions. The application will be accessed by users worldwide, and the database must provide low-latency reads in multiple regions. The company expects the workload to be unpredictable, with periods of very low activity followed by sudden spikes. They want to minimize operational overhead and only pay for the resources they use. Which AWS database solution should they choose?

Accepted Answer

Amazon Aurora Serverless v2 with Aurora Global Database.. Amazon Aurora Serverless v2 is a good choice for unpredictable workloads because it auto-scales capacity based on demand and you pay only for what you use. It also supports Aurora Global Database for low-latency reads in multiple regions. RDS does not have serverless capability. DynamoDB is serverless but not relational. Redshift is for analytics. So the best is Aurora Serverless v2 with Global Database.

Answer

Amazon Redshift with cross-Region snapshots.

Answer

Amazon RDS for PostgreSQL with read replicas in multiple regions.

Answer

Amazon DynamoDB with Global Tables.

Question 16

An IAM policy is attached to a user to restrict access to a DynamoDB table. What does this policy allow the user to do?

Accepted Answer

Read and write items only where the partition key equals 'customer_123'. The IAM policy uses a condition key `dynamodb:LeadingKeys` with a condition operator `ForAllValues:StringEquals` to restrict access to items where the partition key equals 'customer_123'. This allows the user to perform read and write operations only on items matching that specific partition key value, enforcing fine-grained access control at the item level.

Answer

Read and write any item in the Orders table

Answer

Scan the entire Orders table

Answer

Perform all DynamoDB actions on the Orders table

Question 17

A company is troubleshooting an Amazon DynamoDB table that is experiencing high latency. The table uses on-demand capacity. Which TWO steps should be taken to diagnose the issue?

Accepted Answer

Examine CloudWatch metrics for throttling and latency patterns. CloudWatch metrics for DynamoDB can show throttling events, latency patterns, and consumed throughput, which help diagnose high latency issues. Option C is correct because DynamoDB Accelerator (DAX) provides an in-memory cache that can significantly reduce read latency for frequently accessed items. Option A is incorrect because the table uses on-demand capacity, so adjusting provisioned capacity is not applicable. Option D is incorrect because disabling TTL does not directly reduce write overhead or latency. Option E is incorrect because DynamoDB handles partitions automatically and manual splitting is not supported.

Answer

Increase the provisioned read capacity

Answer

Disable TTL to reduce write overhead

Answer

Split the table into multiple partitions manually

Question 18

A company has an Amazon RDS for MySQL DB instance with automated backups enabled. The database is 500 GB in size. The company wants to create a new test database from the current state with minimal impact on production. Which approach meets these requirements?

Accepted Answer

Take a snapshot of the DB instance and restore it to a new instance.. Taking a snapshot of the RDS DB instance and restoring it to a new instance creates an independent copy of the database with minimal performance impact on the source. Snapshots are asynchronous and capture a consistent state without blocking writes, making this the most efficient method for creating a test database from the current production state.

Answer

Create a read replica and promote it to a standalone instance.

Answer

Use mysqldump to export the database and import into a new instance.

Answer

Create a manual DB snapshot from the automated backup and restore.

Question 19

A gaming company uses Amazon DynamoDB as the primary database for their player sessions. The player sessions table has a partition key of 'player_id' and a sort key of 'session_start_time'. The application frequently queries for recent sessions of a specific player, using the query API with 'player_id' and a filter on 'session_start_time' for the last 24 hours. The average item size is 5 KB. The company notices high latency on these queries during peak hours. The table has 10 Read Capacity Units (RCUs) provisioned. There are no indexes. Which design change would MOST improve query performance?

Accepted Answer

Create a Local Secondary Index (LSI) with the same partition key and a sort key of 'session_start_time', and query the index instead of the table.. Creating a Local Secondary Index (LSI) with the same partition key (player_id) and sort key (session_start_time) allows DynamoDB to efficiently retrieve items for a specific player sorted by session_start_time without scanning and filtering. The current query uses a filter on session_start_time after retrieving all sessions for the player, which wastes read capacity and increases latency. Querying the LSI directly uses the sort key to limit the data read to only the last 24 hours, reducing the read footprint and improving performance.

Answer

Increase the RCUs to 100.

Answer

Add a random suffix to the partition key values to distribute writes across partitions.

Answer

Create a Global Secondary Index (GSI) with partition key 'event_type' and sort key 'session_start_time' and query the GSI.

Question 20

A security audit reveals that an Amazon RDS for MySQL DB instance is accessible from the internet. The security team requires that the database be accessible only from a specific set of application servers within the same VPC. Which solution should be implemented?

Accepted Answer

Modify the DB instance's security group to allow inbound traffic only from the application servers' security group.. Modifying the DB instance's security group to allow inbound traffic only from the application servers' security group restricts access to only those instances, using the security group as a source for a more dynamic and manageable solution. Option B is incorrect because network ACLs are stateless and apply at the subnet level, not the instance level, and allowing from the application servers' IP range is less flexible and secure than using security group references. Option C is incorrect because enabling encryption at rest protects data at rest but does not control network access. Option D is incorrect because moving to a private subnet and using a bastion host is unnecessary when the application servers are in the same VPC; a security group rule is simpler and more appropriate.

Answer

Apply a network ACL that denies inbound traffic from 0.0.0.0/0 and allows from the application servers' IP range.

Answer

Enable encryption at rest on the DB instance to prevent unauthorized access.

Answer

Move the DB instance to a private subnet and configure a bastion host for access.