DBS-C01 Management and Operations Practice Test 4 — 15 Questions

Question 1

Which TWO methods can be used to encrypt an existing unencrypted Amazon RDS for Oracle DB instance? (Choose 2.)

Accepted Answer

Create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the DB instance from the encrypted snapshot.. You can encrypt an existing unencrypted RDS for Oracle DB instance by taking a snapshot, copying it with encryption enabled, and then restoring the instance from the encrypted snapshot. This process creates a new encrypted DB instance from the snapshot copy, effectively encrypting the data at rest using AWS KMS. Option D is correct because AWS DMS can migrate data from an unencrypted source DB instance to a new target DB instance that has encryption enabled, allowing you to move the data while applying encryption during the migration process.

Answer

Use the AWS Management Console to toggle encryption on the DB instance.

Answer

Modify the DB instance and enable encryption in the configuration.

Answer

Create a read replica with encryption enabled.

Question 2

A DBA runs the above AWS CLI command. The DB instance is an Amazon RDS for MySQL instance. The DBA needs to connect to the database from an EC2 instance in the same VPC but cannot connect. Which action should be taken first?

Accepted Answer

Check the inbound rules of the security group for port 3306.. The most common cause of connectivity failure from an EC2 instance to an RDS for MySQL instance in the same VPC is that the security group associated with the RDS instance does not allow inbound traffic on port 3306 from the EC2 instance's security group or IP address. Checking the inbound rules of the security group for port 3306 is the first logical troubleshooting step because it directly addresses the network access control that governs whether the EC2 instance can initiate a TCP connection to the database.

Answer

Verify that the DB instance endpoint resolves correctly from the EC2 instance.

Answer

Enable encryption on the DB instance.

Answer

Check the DB instance status in the output.

Question 3

A DBA runs the IAM policy simulation above. The DBA can describe the DB instance but cannot modify it. What is the most likely cause?

Accepted Answer

An IAM policy explicitly denies the rds:ModifyDBInstance action.. The simulation shows that the DBA can describe the DB instance but cannot modify it. Since the simulation evaluates all applicable IAM policies, an explicit deny for rds:ModifyDBInstance in any attached policy will override any allow and cause the modify action to fail. This is the most likely cause because explicit denies are evaluated first and cannot be overridden by other policies.

Answer

The resource ARN in the simulation is incorrect.

Answer

The DBA's IAM policy does not include an allow for rds:ModifyDBInstance.

Answer

The DBA is not within the VPC where the DB instance resides.

Question 4

A DBA sees the above error log entries for an Amazon RDS for PostgreSQL DB instance. What is the most likely cause?

Accepted Answer

The user 'myuser@mycompany.com' is using an incorrect password.. The error log entry shows authentication failure for user 'myuser@mycompany.com' with message 'password authentication failed for user'. In PostgreSQL, this specific error indicates the client provided an incorrect password for an existing user. The log does not show any connection limit exceeded or network timeout messages, and the user is referenced by name, confirming the user exists.

Answer

There is a network connectivity issue between the client and the database.

Answer

The database has reached its maximum number of connections.

Answer

The user 'myuser@mycompany.com' does not exist in the database.

Question 5

A company is using Amazon DynamoDB with on-demand capacity. The application performs many small writes that are throttled frequently. The company wants to minimize costs while reducing throttling. What should the company do?

Accepted Answer

Switch to provisioned capacity with auto scaling.. DynamoDB on-demand capacity can throttle small writes if the traffic pattern exceeds the table's previous peak traffic, as on-demand capacity scales based on traffic volume but has a per-second burst limit. Switching to provisioned capacity with auto scaling allows you to set a baseline capacity that matches the application's average write throughput, while auto scaling adjusts capacity based on actual usage, reducing throttling without the premium cost of on-demand capacity for predictable workloads.

Answer

Increase the write capacity units manually.

Answer

Use DynamoDB Accelerator (DAX) to cache writes.

Answer

Use batch writes to combine small writes.

Question 6

A database administrator needs to monitor the number of database connections to an Amazon RDS for PostgreSQL instance. Which Amazon CloudWatch metric should the administrator use?

Accepted Answer

DatabaseConnections. The correct metric is `DatabaseConnections`, which is published by Amazon RDS for PostgreSQL to CloudWatch. It reports the number of client network connections to the database instance, corresponding to the `numbackends` value from the `pg_stat_database` view. This metric directly reflects the current connection count and is the standard way to monitor connection usage for RDS PostgreSQL.

Answer

ActiveConnections

Answer

ConnectionsCount

Answer

DBInstanceIdentifier

Question 7

A team is migrating an on-premises Oracle database to Amazon Aurora PostgreSQL. The database is 2 TB and has a 6-hour maintenance window. Which AWS service should the team use to minimize downtime?

Accepted Answer

AWS Database Migration Service (AWS DMS). AWS DMS is the correct choice because it can perform a live migration from Oracle to Aurora PostgreSQL with minimal downtime using ongoing replication (change data capture). It supports heterogeneous migrations, automatically converting the source schema and data types, and can handle a 2 TB database within the 6-hour maintenance window by using multiple parallel tasks and large instance types.

Answer

Amazon S3 Transfer Acceleration

Answer

AWS Snowball Edge

Answer

Amazon EC2 with Oracle installed

Question 8

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The primary instance fails and the database administrator notices that the failover did not happen automatically. What is the MOST likely cause?

Accepted Answer

The DB instance is configured as a read replica.. A read replica in Amazon RDS for MySQL is a separate DB instance that asynchronously replicates from a source instance. It does not support automatic failover; if the source instance fails, the read replica remains a standalone read-only instance and does not become the primary. Multi-AZ failover only occurs between a primary and its standby in the same region, not to a read replica.

Answer

The DB instance is in a public subnet.

Answer

Enhanced Monitoring is disabled.

Answer

The standby instance is in a different VPC.

Question 9

A company wants to encrypt an existing unencrypted Amazon RDS for SQL Server instance. What is the MOST efficient way to achieve this?

Accepted Answer

Create a snapshot of the DB instance and copy it with encryption enabled. Restore the snapshot to a new encrypted instance.. You cannot directly enable encryption on an existing unencrypted RDS instance. The most efficient method is to take a snapshot of the instance, copy it with encryption enabled (which re-encrypts the data using AWS KMS), and then restore that snapshot to a new encrypted DB instance. This approach minimizes downtime and leverages native RDS snapshot capabilities without requiring external tools.

Answer

Create a read replica with encryption enabled.

Answer

Modify the DB instance to enable encryption.

Answer

Use AWS DMS to migrate data to a new encrypted instance.

Question 10

A company is using Amazon DynamoDB with global tables. The company wants to monitor replication latency between regions. Which CloudWatch metric should the company use?

Accepted Answer

ReplicationLatency. The correct metric is ReplicationLatency, which measures the time elapsed between an update in the source region and its appearance in the replica region for DynamoDB global tables. This metric directly reflects the replication lag between regions, making it the appropriate choice for monitoring cross-region replication performance.

Answer

GlobalTableReplicationLag

Answer

ReplicaLag

Answer

WriteThrottleEvents

Question 11

A company is running Amazon Redshift and notices that queries are slow. The administrator runs the STL_ALERT_EVENT_LOG and sees many 'Nested Loop Join' alerts. What is the MOST likely cause?

Accepted Answer

Incorrect distribution keys on the tables.. Nested loop joins in Amazon Redshift occur when the query optimizer cannot use a hash join or merge join, often because the data required for the join is not co-located on the same compute nodes. Incorrect distribution keys cause data to be distributed unevenly or in a way that forces large amounts of data to be redistributed across the network, leading to nested loop joins as a fallback. This is the most likely cause because the STL_ALERT_EVENT_LOG specifically flags nested loop joins as a performance issue related to data distribution.

Answer

Insufficient concurrency scaling.

Answer

Incorrect sort keys on the tables.

Answer

Insufficient compression on the tables.

Question 12

A company needs to audit all SQL queries executed on an Amazon RDS for PostgreSQL instance. Which feature should the company enable?

Accepted Answer

pgAudit extension. PgAudit (PostgreSQL Audit Extension) is the native, supported way to log all SQL queries on Amazon RDS for PostgreSQL. It provides detailed session and object audit logging via the shared_preload_libraries parameter, capturing every executed statement without requiring external tools or additional infrastructure.

Answer

Advanced Audit

Answer

Database Activity Streams

Answer

Fine-Grained Auditing

Question 13

A company is designing a disaster recovery strategy for Amazon DynamoDB. The strategy must have an RPO of 5 minutes and RTO of 1 hour. Which TWO options meet these requirements? (Choose 2.)

Accepted Answer

Point-in-time recovery (PITR). Point-in-time recovery (PITR) enables continuous backups of DynamoDB tables with 1-second granularity over a 35-day window, allowing restoration to any point within that window. This supports an RPO of 5 minutes because you can restore to a specific timestamp within seconds of the failure, and the RTO of 1 hour is achievable as table restoration typically completes within that timeframe for most table sizes.

Answer

On-demand backups

Answer

Cross-Region Replication (CRR) to S3

Answer

Scheduled backups using AWS Backup

Question 14

A company is migrating an on-premises Oracle database to Amazon Aurora PostgreSQL. The migration must have minimal downtime and support ongoing replication. Which THREE services should the company use? (Choose 3.)

Accepted Answer

Amazon Aurora PostgreSQL. Amazon Aurora PostgreSQL (Option B) is the target database for the migration. The company is migrating from Oracle to Aurora PostgreSQL, so Aurora PostgreSQL is the required destination. AWS DMS (Option D) handles the ongoing replication with minimal downtime by using change data capture (CDC) to continuously replicate changes from the source Oracle database to the target Aurora PostgreSQL. AWS SCT (Option E) is necessary to convert the Oracle database schema and any stored procedures, functions, and other code objects to be compatible with PostgreSQL, as the two databases have different SQL dialects and data types.

Answer

AWS Snowball Edge

Answer

AWS DataSync

Question 15

A company attaches the above IAM policy to a user. The user tries to modify the DB instance 'prod-db' in us-east-1. What is the result?

Accepted Answer

The user cannot modify any DB instance.. The IAM policy includes an explicit Deny statement that denies the `rds:ModifyDBInstance` action on all resources (`Resource: "*"`). In AWS IAM, an explicit Deny overrides any Allow. Therefore, the user cannot modify any DB instance, including `prod-db`. Options A and B are incorrect because the user can describe DB instances (unless denied) and the Allow does not override the Deny. Option C is incorrect because the Deny applies to all instances, not just `prod-db`.

Answer

The user cannot describe DB instances.

Answer

The user can modify prod-db because the Allow statement covers it.

Answer

The user cannot modify prod-db.