DBS-C01 Mock Exam 95 — 25 Questions

Question 1

A company runs a critical e-commerce application on Amazon RDS for MySQL with Multi-AZ enabled. The database is 2 TB and uses General Purpose (gp2) storage. Recently, during peak hours, the application experienced a 5-minute outage. The CloudWatch logs show that the primary DB instance failed and an automatic failover occurred. However, the failover took 3 minutes, which is longer than the expected 1-2 minutes. The 'ReadLatency' and 'WriteLatency' metrics were elevated before the failure. The 'BurstBalance' metric was at 0% for the hour before the failure. The team suspects the issue is related to storage performance. What should the team do to prevent this issue in the future?

Accepted Answer

Change the storage type to Provisioned IOPS (io1).. Option D is correct because the BurstBalance at 0% indicates the gp2 volume exhausted its burst credits, leading to I/O throttling and increased latency, which likely caused the failover. Switching to Provisioned IOPS (io1/io2) provides consistent performance. Option A is wrong because increasing instance size does not directly address storage I/O performance. Option B is wrong because increasing backup retention does not affect storage performance. Option C is wrong because additional read replicas do not improve write performance on the primary.

Answer

Increase the DB instance class to a larger size.

Answer

Increase the backup retention period to 35 days.

Answer

Create a read replica to offload read traffic.

Question 2

A company runs an e-commerce platform using Amazon DynamoDB as the database. The table has a provisioned capacity of 5000 WCU and 3000 RCU. During a flash sale, the write traffic spikes to 8000 WCU for 10 minutes, causing significant throttling. The operations team notices that the table's WriteCapacityUnits metric shows 5000, but the ConsumedWriteCapacityUnits metric peaks at 4500. The application is experiencing errors and slow response times. The team wants to handle such spikes automatically without manual intervention and without over-provisioning. Which solution should be implemented?

Accepted Answer

Enable DynamoDB Auto Scaling with a target utilization of 70% and a minimum capacity of 5000 WCU. Option A is correct because DynamoDB Auto Scaling can adjust capacity based on demand, and setting a target utilization of 70% allows headroom for spikes. Option B is wrong because on-demand capacity is simpler but can be more expensive for predictable workloads. Option C is wrong because increasing WCU to 8000 permanently would be costly. Option D is wrong because SQS adds latency and does not solve the throttling issue in real-time.

Answer

Increase the provisioned WCU to 8000 permanently

Answer

Implement an Amazon SQS queue to buffer write requests and process them asynchronously

Answer

Switch the table to on-demand capacity mode

Question 3

A company runs a critical application on Amazon RDS for PostgreSQL with Multi-AZ deployment. The database is a db.r5.xlarge instance with 500 GB of Provisioned IOPS (io1) storage. The application writes a large volume of time-series data every 5 minutes. Recently, the team noticed that the replica lag between the primary and standby instance has increased to over 10 seconds during peak write periods. The application requires that the standby be within 5 seconds of the primary for disaster recovery purposes. The team has already verified that network latency between AZs is minimal, and the standby instance is the same size as the primary. The CloudWatch metric 'TransactionLogsDiskUsage' shows that the primary is generating logs at a high rate. Which combination of actions should the database administrator take to reduce the replica lag? (Choose the best option.)

Accepted Answer

Increase the Provisioned IOPS on both the primary and standby instances to improve log write throughput. Option B is correct because increasing the storage IOPS on both instances reduces the time to write transaction logs to disk, which is the bottleneck. The primary generates logs, and the standby applies them; both need fast I/O. Option A is insufficient because disabling synchronous commit might cause data loss. Option C is incorrect because the standby is already the same size; increasing its size alone may not help if the bottleneck is I/O. Option D is incorrect because reducing the batch size reduces write volume, affecting application performance.

Answer

Disable synchronous commit on the primary to reduce log generation

Answer

Change the standby instance to a larger instance type (e.g., db.r5.2xlarge) to improve apply throughput

Answer

Reduce the batch write frequency to every 10 minutes to lower the log generation rate

Question 4

A company is using Amazon DynamoDB for a gaming leaderboard. The table has a partition key of 'game_id' and a sort key of 'score'. The table is configured with on-demand capacity. During a major tournament, the application experiences high latency and some requests return 'ProvisionedThroughputExceededException' errors. The CloudWatch metric 'ThrottledRequests' spikes. The application uses a single partition key for all writes during the tournament (game_id = 'tournament_final'). What is the most likely cause of the throttling, and what is the best solution?

Accepted Answer

The application is using a single partition key, causing all writes to go to one partition. The team should redesign the partition key to distribute writes across multiple partitions. Option C is correct because using a single partition key creates a hot partition, leading to throttling even with on-demand capacity (which has per-partition limits). The best solution is to redesign the partition key to distribute writes. Option A is incorrect because auto scaling is not needed for on-demand. Option B is incorrect because DAX caches reads, not writes. Option D is incorrect because creating a GSI does not affect write throttling on the base table.

Answer

The application is using a single partition key, causing all writes to go to one partition. The team should implement DAX to cache writes

Answer

The table has a global secondary index that is throttling writes; the team should remove the GSI

Answer

The table is using on-demand capacity, which has a maximum throughput limit per partition; the team should switch to provisioned capacity with auto scaling

Question 5

A financial services company is using Amazon Aurora MySQL as its primary database. The database has a table 'transactions' that receives high inserts during business hours. The table is partitioned by date. Recently, the application team noticed an increase in lock wait timeouts. The database specialist reviewed the InnoDB status and found that there are frequent gap locks on the 'transaction_date' column. The isolation level is REPEATABLE READ. What should the specialist do to reduce lock waits while maintaining data consistency?

Accepted Answer

Change the transaction isolation level to READ COMMITTED.. Option A is correct because changing the isolation level to READ COMMITTED eliminates gap locks for non-unique indexes, reducing lock contention. Option B is wrong because increasing innodb_lock_wait_timeout only increases timeout, not reduces locks. Option C is wrong because adding an index on transaction_date may increase lock granularity? Actually, if the index is not unique, gap locks still occur. Option D is wrong because partitioning does not affect gap locks.

Answer

Add a secondary index on transaction_date.

Answer

Increase the innodb_lock_wait_timeout parameter.

Answer

Modify the partitioning key to use a hash-based partition.

Question 6

A company runs a critical application on Amazon RDS for PostgreSQL with a Multi-AZ deployment. The application experiences intermittent connection timeouts and slow query performance. The CloudWatch metrics show that the 'ReadLatency' and 'WriteLatency' metrics are elevated during peak hours. The 'CPUUtilization' is consistently below 30%, and 'DatabaseConnections' is within limits. The 'BurstBalance' for the gp2 storage is frequently dropping to 0%. The DB instance is a db.r5.large with 300 GB of gp2 storage. The company wants to resolve the latency issues without significant cost increase. Which solution should the company implement?

Accepted Answer

Increase the allocated storage to 600 GB to increase baseline IOPS.. Option C: Increasing storage to 600 GB increases baseline IOPS from 900 to 1800, reducing reliance on burst credits. This is cost-effective compared to switching to io1. Option A: Increasing to io1 with 3000 IOPS would be more expensive. Option B: Adding a read replica does not help with write latency. Option D: Enabling Performance Insights only helps diagnose, not resolve.

Answer

Add a read replica to offload read traffic.

Answer

Enable Performance Insights to identify the root cause.

Answer

Switch the storage type to io1 with 3000 provisioned IOPS.

Question 7

A company uses Amazon DynamoDB to store sensor data from IoT devices. The table has a partition key of DeviceID (String) and a sort key of Timestamp (Number). The table is configured with provisioned capacity of 1000 read capacity units (RCUs) and 500 write capacity units (WCUs). Auto Scaling is enabled with target utilization of 70% and is working correctly. Recently, a new batch job was introduced that performs Scan operations on the entire table every hour. The Scan consumes many read capacity units and causes throttling of the sensor write requests. The team wants to minimize the impact on the write-heavy sensor ingestion. Which approach is BEST?

Accepted Answer

Enable DAX (DynamoDB Accelerator) to cache Scan results and reduce read consumption on the table.. Option C is correct because enabling DynamoDB Accelerator (DAX) provides an in-memory cache for reads, which reduces the read load on the table itself. Since the Scan still consumes read capacity, caching can absorb some of the read traffic and free up RCUs for other operations, but more importantly, the team should also consider other measures. However, among the options, DAX is the best to reduce read load on the table. Option A is incorrect because increasing write capacity does not address the read throttling; it just increases cost. Option B is incorrect because reducing Scan frequency may not be acceptable for the batch job. Option D is incorrect because changing to on-demand may eliminate throttling but will be more expensive for this predictable workload and does not leverage existing provisioned capacity.

Answer

Increase the provisioned write capacity to 2000 WCUs to handle bursts.

Answer

Schedule the Scan to run during off-peak hours when sensor writes are lower.

Answer

Switch the table to on-demand capacity mode to eliminate throttling.

Question 8

A company runs a production Amazon RDS for PostgreSQL Multi-AZ DB instance (db.r5.large) with 500 GB of General Purpose SSD (gp2) storage. The application experiences intermittent latency spikes every 15 minutes. Monitoring shows that during these spikes, the ReadIOPS metric on the primary instance spikes to 5,000 IOPS (the baseline is 1,500 IOPS), and the BurstBalance drops from 100% to 20% then recovers. There is no increase in CPU or connections. The application uses connection pooling with pgBouncer on an EC2 instance. The team has verified that no long-running queries or index scans are causing the spikes. Which action is MOST likely to resolve the intermittent latency?

Accepted Answer

Migrate the storage to gp3 with a baseline of 3,000 IOPS and 125 MB/s throughput.. Option B is correct because the burst balance dropping indicates the gp2 volume is exhausting its burst credits. The baseline IOPS for a 500 GB gp2 volume is 1,500 IOPS, but the spikes reach 5,000 IOPS, burning credits. Converting to gp3 provides a baseline of 3,000 IOPS (or more) without burst credits, eliminating the burst balance issue. Option A increases volume size but does not change the burst behavior (larger gp2 still uses credits and needs even more IOPS). Option C adds read replicas but the issue is on the primary write instance. Option D increases instance size but the metric shows no CPU or connection bottleneck; the bottleneck is storage IOPS credit exhaustion.

Answer

Create a read replica and redirect read traffic to it.

Answer

Increase the DB instance to db.r5.xlarge to improve CPU and network performance.

Answer

Scale the storage to 1,000 GB to increase baseline IOPS and burst credits.

Question 9

A company uses Amazon DocumentDB (with MongoDB compatibility) for its content management system. The application runs on EC2 instances and connects to a DocumentDB cluster with one instance (db.r5.large). Recently, users reported that retrieving documents takes longer than usual. CloudWatch metrics show that the CPU utilization of the DocumentDB instance is at 90% and the freeable memory is below 100 MB. The team has verified that no query optimization is possible. Which action should the team take FIRST to improve performance?

Accepted Answer

Scale up the instance to db.r5.xlarge.. Option B is correct because the high CPU and low memory indicate the instance is overworked. Scaling up to a larger instance provides more CPU and memory resources. Option A is incorrect because adding a reader instance helps with read scaling but does not reduce CPU/memory pressure on the primary writer. Option C is incorrect because creating an index may improve query performance but the team already ruled out query optimization. Option D is incorrect because increasing storage does not directly affect CPU or memory.

Answer

Add a read replica instance to offload read traffic.

Answer

Create additional indexes on frequently queried fields.

Answer

Increase the storage volume size to improve I/O performance.

Question 10

A company runs an e-commerce platform on AWS using a multi-tier architecture. The application tier consists of Auto Scaling groups of EC2 instances behind an Application Load Balancer. The database tier uses Amazon RDS for MySQL with Multi-AZ deployment. Recently, the operations team noticed that during flash sales, the application becomes unresponsive and users receive 503 errors. The team checks CloudWatch metrics and sees that the RDS instance's CPU utilization spikes to 100%, and the `DatabaseConnections` metric also spikes to the maximum allowed value of 500. The application uses connection pooling with a maximum of 200 connections, but the metric shows 500 connections. The team suspects that the connection pooling configuration is not being honored. The application code is written in Python and uses SQLAlchemy with a connection pool size of 10 per application instance. There are 20 application instances in the Auto Scaling group during peak times. The team wants to resolve the issue without increasing the database instance size. What should the team do?

Accepted Answer

Set the `max_connections` parameter in the RDS parameter group to 200 and configure the application to handle connection errors with retry logic. Option B is correct because setting a maximum number of connections in the RDS parameter group enforces a hard limit, preventing the database from accepting more connections than the application can handle, which will cause connection errors that the application can handle gracefully. Option A is wrong because increasing the connection pool size per instance would increase the total connections, worsening the problem. Option C is wrong because reducing the number of application instances may reduce load but is not a scalable solution and doesn't address the root cause of connection limit. Option D is wrong because switching to Aurora may help but is a larger change and does not fix the connection management issue directly.

Answer

Reduce the Auto Scaling group's desired capacity to 10 instances during flash sales

Answer

Migrate the database to Amazon Aurora MySQL with Auto Scaling enabled

Answer

Increase the SQLAlchemy pool size to 25 per instance to reduce connection contention

Question 11

A company runs a critical MySQL database on Amazon RDS Single-AZ (db.m5.large) with 200 GB of Provisioned IOPS (io1) storage set to 3000 IOPS. The application team reports that write operations are occasionally slow. CloudWatch metrics show that the Write IOPS metric peaks at 3500 IOPS during the slowdowns, but the average is 2000 IOPS. The Read IOPS average is 500 IOPS. The queue depth metric occasionally spikes to 20. The storage configuration includes a 50 GB General Purpose SSD (gp2) log volume attached to the same RDS instance. Which change will MOST effectively resolve the write latency?

Accepted Answer

Increase the provisioned IOPS on the io1 volume to 4000.. Option C is correct because the io1 volume is provisioned at 3000 IOPS, but the workload bursts to 3500 IOPS, causing queue depth to spike. Increasing the provisioned IOPS to 4000 ensures that the volume can handle the peak without queuing. Option A is incorrect because enabling Multi-AZ provides high availability but does not increase IOPS capacity. Option B is incorrect because moving to gp3 does not guarantee better performance; gp3 baseline is 3000 IOPS (same as current provisioned) but can burst to higher, but the issue is consistent peaks. However, the most direct fix is to increase io1 provisioned IOPS. Option D is incorrect because the log volume is separate and not the source of write IOPS contention.

Answer

Change the storage type to gp3 with 3000 baseline IOPS.

Answer

Move the log volume to the same io1 volume to reduce I/O overhead.

Answer

Enable Multi-AZ for failover protection.

Question 12

A company runs a PostgreSQL database on an Amazon RDS DB instance (db.t3.medium) with 100 GB of General Purpose SSD (gp2) storage. The database is used by a web application that experiences occasional slowdowns. CloudWatch metrics show that the BurstBalance metric for the storage volume drops to 0% during peak usage and then recovers. The average IOPS during peak is 600, and the baseline IOPS for the volume is 300. The team needs a cost-effective solution to eliminate the performance issues. What should the team do?

Accepted Answer

Migrate the storage to gp3 with 3000 baseline IOPS.. Option B is correct because converting to gp3 provides a consistent baseline of 3000 IOPS (or 3000 if using the default 3000 IOPS, though for 100 GB the baseline is 3000) without burst credits, eliminating the burst balance problem. Option A is incorrect because increasing gp2 volume size to 200 GB increases baseline to 600 IOPS and burst credits, but still relies on credits; the workload may still exceed baseline. Option C is incorrect because increasing instance size does not affect storage performance. Option D is incorrect because enabling Performance Insights does not improve performance.

Answer

Upgrade the DB instance to db.t3.large.

Answer

Increase the gp2 volume size to 200 GB.

Answer

Enable Performance Insights to monitor database load.

Question 13

A healthcare company is migrating its patient records database to Amazon RDS for SQL Server. The database contains Protected Health Information (PHI). The compliance team requires that all PHI data be encrypted at rest and that the encryption keys be stored in a dedicated AWS CloudHSM cluster. Additionally, the database must be replicated to a second AWS region for disaster recovery. The DBA has enabled RDS encryption at rest using a KMS key, but the compliance team insists on using CloudHSM. What should the DBA do to meet the compliance requirement while maintaining disaster recovery?

Accepted Answer

Enable Transparent Data Encryption (TDE) using a CloudHSM key and create a cross-region read replica for DR.. Option B is correct because RDS for SQL Server supports Transparent Data Encryption (TDE) which can use CloudHSM as the key store. Multi-AZ deployments support cross-region read replicas, allowing DR. Option A is wrong because RDS encryption at rest cannot use CloudHSM directly. Option C is wrong because moving to DynamoDB is unnecessary and does not use CloudHSM. Option D is wrong because using an RDS Custom instance with TDE and manual replication is more complex and not recommended.

Answer

Use RDS encryption at rest with a KMS key backed by CloudHSM (custom key store).

Answer

Migrate the database to Amazon DynamoDB with encryption using CloudHSM via KMS custom key store.

Answer

Use an RDS Custom for SQL Server instance and configure TDE with CloudHSM, then set up log shipping to another region.

Question 14

A financial services company runs a critical application on Amazon RDS for PostgreSQL. The database stores sensitive customer financial data. The security team has mandated that all access to the database must be through IAM database authentication to eliminate the need for passwords. The application currently uses a master user password stored in AWS Secrets Manager. The DBA needs to implement IAM authentication without downtime. The application is deployed on Amazon ECS and connects to the database using a connection string. The DBA has already created an IAM role for the ECS task with a policy that allows rds-db:connect. The DBA has also modified the DB instance to require SSL. However, after making these changes, the application cannot connect. The error message indicates 'IAM authentication is not enabled for this user'. What step did the DBA miss?

Accepted Answer

The DBA did not create a database user that is set to use IAM authentication.. Option B is correct because IAM database authentication requires that the database user be created with the IAM authentication method (using the CREATEROLE option and granting rds_iam role). Without creating a user that is mapped to the IAM role, authentication fails. Option A is wrong because the IAM role is already created. Option C is wrong because IAM authentication does not require a password; it uses authentication tokens. Option D is wrong because the port does not need to be changed.

Answer

The DBA did not attach the IAM policy to the ECS task role.

Answer

The DBA did not enable the 'password' authentication method.

Answer

The DBA did not update the security group to allow traffic on port 5432.

Question 15

A retail company uses Amazon DynamoDB to store product catalog data. The security team wants to ensure that only authorized applications can read and write to the table. The applications are running on Amazon EC2 instances. The current setup uses an IAM role attached to the EC2 instance with a policy that grants dynamodb:* on the specific table. However, during a security audit, it was discovered that any process on the EC2 instance can access the table because the instance has access to the temporary credentials from the instance metadata service. The security team requires that only specific processes (the application) can access the credentials, and that the credentials cannot be extracted from the instance. What should be done to meet these requirements?

Accepted Answer

Create a VPC endpoint for DynamoDB with a policy that restricts access to the specific IAM role, and configure the EC2 instance to use IMDSv2 with a hop limit.. Option D is correct because using a VPC endpoint with a policy that restricts access to the specific IAM role ARN ensures that only requests from that role are allowed, and using IMDSv2 with hop limit prevents credential theft. Option A is wrong because restricting to VPC does not enforce role usage. Option B is wrong because attaching a resource-based policy is not supported for DynamoDB. Option C is wrong because using an access key on the instance is less secure.

Answer

Modify the security group to only allow traffic from the EC2 instance's private IP.

Answer

Store AWS access keys on the EC2 instance and use them in the application.

Answer

Attach a resource-based policy to the DynamoDB table allowing only the EC2 instance's IAM role.

Question 16

A small business runs a web application on a single Amazon RDS for MySQL DB instance. The application uses a master user account for all database operations. The security team is concerned about the risk of SQL injection and wants to implement the principle of least privilege. They want to create separate database users for read-only and read-write operations. The application currently uses a single connection string. The developer needs to modify the application to use two separate users. What is the correct approach to implement this securely?

Accepted Answer

Create a read-only user and a read-write user in the database, grant minimal privileges, and modify the application to use the appropriate user for each operation.. Option C is correct because creating two users with appropriate grants and modifying the application to use them based on the operation reduces risk. Option A is wrong because using a single user does not enforce least privilege. Option B is wrong because IAM database authentication is a different mechanism but does not solve the user separation issue. Option D is wrong because stored procedures do not eliminate the need for separate users.

Answer

Use stored procedures for all database operations and grant execute only to the master user.

Answer

Keep using the master user but restrict its IP address.

Answer

Enable IAM database authentication and use a single IAM role.

Question 17

A company runs an e-commerce platform on AWS. The application uses an Amazon RDS for MySQL Multi-AZ database instance. The security team recently conducted an audit and found that the database is accessible from the internet because the public accessibility setting is enabled. The security team has disabled public accessibility and updated the security group to allow inbound traffic only from the application's security group. However, after these changes, the application can no longer connect to the database. The application is running on EC2 instances in the same VPC. The RDS instance is also in the same VPC. The security group for the RDS instance allows inbound MySQL traffic (port 3306) from the application's security group. The application's security group allows all outbound traffic. The application's EC2 instances have a public IP address and are in a public subnet. The RDS instance is in a private subnet. The VPC has an internet gateway attached. What is the most likely cause of the connection failure?

Accepted Answer

The application is using the RDS public DNS name, which no longer resolves after disabling public accessibility.. Option C is correct. When public accessibility is disabled, RDS removes the public IP address. The application's EC2 instances are in a public subnet with public IPs, but they need to communicate with the RDS instance in a private subnet. Since public accessibility is disabled, the RDS instance has only a private IP. The EC2 instances can reach the private IP if they are in the same VPC. However, the issue might be that the security group rule referencing the application's security group is not working because the application's security group is not correctly associated, or there is a network ACL issue. Actually, the most common cause is that the RDS instance's security group is not allowing traffic from the application's security group, but the question says it does allow. Another cause could be that the application is trying to connect using the public DNS name which now resolves to a private IP, but the EC2 instances might not have a route to the private subnet? Wait, they are in the same VPC, so they can reach. The likely cause is that the security group rule is configured with the application's security group ID, but the application's security group is not correctly associated with the EC2 instances, or there is a misconfiguration in the security group rules. Option A is wrong because disabling public accessibility does not change the security group. Option B is wrong because you don't need a NAT gateway for same VPC traffic. Option D is wrong because the RDS instance does not need an internet gateway. The correct answer is that the security group rule might be incorrectly set up, but the question states it allows. Maybe the application is using the public DNS name which after disabling public accessibility, the DNS name still resolves to the private IP? That should work. The most likely is that the security group for the RDS instance is not allowing traffic from the application's security group because the application's security group is in a different region? No. I think the intended answer is Option A: the security group is still configured to allow traffic from the public IP of the EC2 instances, not from the application's security group. But the question says it allows from the application's security group. Actually, the answer might be Option C: the RDS instance is in a private subnet and requires a NAT gateway for outbound traffic, but not for inbound. Inbound traffic from the same VPC does not require a NAT gateway. So Option C is plausible if the application's EC2 instances are in a public subnet and the RDS is in a private subnet, they can still communicate if the security group allows. Perhaps the issue is that the application's EC2 instances have a public IP and are trying to connect via the public endpoint, which is no longer available. The correct action is to ensure the application uses the private DNS name. But the question asks for the most likely cause. I'll go with Option C: The RDS instance is in a private subnet and requires a NAT gateway for inbound connections from the internet, but since the application is in the same VPC, it doesn't. Actually, the answer is likely that the security group for the RDS instance is still referencing the old public IPs, but the question says it references the application's security group. Hmm.

Answer

The RDS instance is in a private subnet and cannot receive inbound traffic from the public subnet EC2 instances without a VPC peering or VPN.

Answer

The security group for the RDS instance still allows traffic from the public IP addresses of the EC2 instances, but the EC2 instances now have different public IPs.

Answer

The EC2 instances need a NAT gateway to communicate with the RDS instance in the private subnet.

Question 18

A company is using Amazon DocumentDB (with MongoDB compatibility) for a content management system. The security team requires that all data be encrypted at rest and in transit. The DocumentDB cluster is already encrypted at rest using AWS KMS. To enforce encryption in transit, the security team wants to ensure that all client connections use TLS. The team has enabled the 'tls' parameter in the cluster parameter group. However, a developer reports that they can still connect to the cluster without specifying TLS options using the mongo shell. The developer is connecting from an EC2 instance in the same VPC. The security group for the DocumentDB cluster allows inbound traffic on port 27017 from the EC2 instance's security group. What is the most likely reason the developer can connect without TLS?

Accepted Answer

The 'tls' parameter was not applied to the cluster because the parameter group was not associated with the cluster or the cluster was not rebooted.. Option B is correct. DocumentDB supports both TLS and non-TLS connections on the same port. Enabling the 'tls' parameter in the parameter group only affects new connections if the client requests TLS; it does not force TLS. To enforce TLS, you must modify the cluster's security group to block non-TLS traffic, or use a different port for TLS. However, DocumentDB does not have a separate port for TLS; the same port can accept both. The parameter 'tls' when set to 'enabled' actually forces TLS for all connections? Actually, in DocumentDB, setting the cluster parameter 'tls' to 'enabled' does enforce TLS; but the developer might be using an older client that does not support TLS. But the question says the developer can connect without specifying TLS options. That suggests that the parameter might not be applied or the cluster was not rebooted. Option A is possible but less likely. Option C is incorrect because TLS is supported. Option D is incorrect because the same VPC does not bypass TLS.

Answer

DocumentDB does not support TLS; it only supports SSL.

Answer

The EC2 instance is in the same VPC, so TLS is not enforced for intra-VPC traffic.

Answer

The developer is using an older version of the mongo shell that does not support TLS.

Question 19

A financial services company uses Amazon DynamoDB to store transaction data. The table is encrypted with an AWS managed KMS key. The compliance team requires that the encryption key be rotated every 90 days. The current key was created 6 months ago and has not been rotated. The company also needs to ensure that all access to the table is logged for audit purposes. The security engineer proposes to enable DynamoDB Streams and AWS CloudTrail. However, the compliance team notes that CloudTrail only logs management plane events (e.g., CreateTable) and not data plane events (e.g., GetItem, PutItem). What should the engineer do to meet both requirements?

Accepted Answer

Create a customer managed KMS key, enable automatic key rotation, and configure CloudTrail to log data events for the DynamoDB table.. Option C is correct. DynamoDB can use a customer managed KMS key, which allows the customer to enable automatic key rotation (every year) or manual rotation. However, automatic rotation is not every 90 days; the engineer can create a new key every 90 days and update the table to use it. Additionally, to log data plane events, they must enable Amazon CloudWatch Logs for DynamoDB or use AWS CloudTrail data events. Option A is wrong because AWS managed keys do not support rotation. Option B is wrong because CloudTrail can log data events if configured. Option D is wrong because streaming logs to CloudWatch does not log data plane events.

Answer

Use AWS CloudTrail data events to capture DynamoDB data plane operations and store the logs in S3.

Answer

Switch to an AWS managed KMS key and enable automatic rotation.

Answer

Enable DynamoDB Streams and stream write events to CloudWatch Logs for auditing.

Question 20

A company runs an e-commerce platform on AWS using an Amazon Aurora MySQL database. The database is accessed by multiple microservices, each using a separate database user. The security team recently discovered that a developer accidentally committed database credentials to a public GitHub repository. The credentials were for a user that had write access to the database. The team immediately revoked the credentials and rotated them. However, they want to prevent such incidents from happening again. They need a solution that ensures credentials are not hardcoded in application code, are rotated automatically, and are accessible only to authorized microservices. What should they do?

Accepted Answer

Use AWS Secrets Manager to store the credentials, configure automatic rotation, and attach a resource-based policy to allow access only from the microservices' IAM roles.. Option B is correct. AWS Secrets Manager allows storing credentials, automatic rotation, and fine-grained access control via IAM policies. Each microservice can assume an IAM role that grants access to Secrets Manager. Option A is wrong because Systems Manager Parameter Store does not support automatic rotation for RDS credentials. Option C is wrong because IAM database authentication does not eliminate the need for secrets; it uses IAM roles for authentication, but the microservices still need to obtain temporary credentials. Option D is wrong because storing secrets in S3 with encryption does not provide automatic rotation or easy access control.

Answer

Use IAM database authentication for Aurora and eliminate the use of database passwords.

Answer

Use AWS Systems Manager Parameter Store to store the credentials and grant access via IAM roles.

Answer

Store the credentials in an encrypted S3 bucket and grant access to the microservices via bucket policies.