DBS-C01 Hard Questions — 25 Difficult Questions

Question 1

A company is migrating a 10 TB Amazon RDS for MySQL database to Amazon Aurora MySQL. The migration must have minimal downtime and must support point-in-time recovery for the source during migration. Which approach meets these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a read replica of the source RDS instance, use AWS DMS with CDC from the read replica to Aurora, then promote Aurora.. Creating a read replica of the source RDS for MySQL instance and using AWS DMS with Change Data Capture (CDC) from that replica allows the migration to proceed with minimal downtime. The read replica offloads the CDC overhead from the source, and CDC captures ongoing changes after the full load, enabling a near-zero-downtime cutover. Additionally, the source RDS instance remains fully available for point-in-time recovery (PITR) throughout the migration, as the read replica does not interfere with the source's backup or transaction log retention.

Answer

Use mysqldump to export the database, import into Aurora, and point DNS to Aurora.

Answer

Use AWS DMS with CDC directly from the source RDS instance to Aurora.

Answer

Take a snapshot of the source RDS instance, restore to Aurora, and point DNS to Aurora.

Question 2

A company stores financial data in an Amazon Aurora MySQL DB cluster. The security team requires that database audit logs be stored in Amazon CloudWatch Logs and encrypted at rest using a customer-managed KMS key. The database specialist enables audit log publishing to CloudWatch Logs and specifies a KMS key for log encryption. However, the audit logs are not appearing in CloudWatch Logs. What is the most likely cause?

Accepted Answer

The IAM role used for publishing logs does not have the necessary permissions to use the KMS key for CloudWatch Logs.. When publishing database audit logs to CloudWatch Logs with a customer-managed KMS key, the IAM role used by RDS must have explicit permissions for the `kms:Encrypt` and `kms:Decrypt` actions on the KMS key. Without these permissions, RDS cannot encrypt the log stream, and the logs will not appear. Option C correctly identifies this missing permission as the most likely cause.

Answer

The CloudWatch Logs log group does not exist and RDS cannot create it automatically.

Answer

The DB cluster is not configured to export error logs, only audit logs.

Answer

CloudWatch Logs does not support encryption with customer-managed KMS keys for audit logs.

Answer

The audit log parameter is static and requires a DB cluster reboot after modification.

Question 3

A company is migrating a 4 TB Oracle database to Amazon Aurora PostgreSQL using AWS DMS. The migration completes successfully but the application experiences high latency on the Aurora cluster. The DMS task used LOB mode 'full LOB mode'. What is the most likely cause of the latency?

Accepted Answer

Full LOB mode caused large LOBs to be stored in the Aurora cluster, leading to increased I/O. Full LOB mode in AWS DMS loads entire LOBs into memory before writing them to the target, which can cause large LOBs to be stored in the Aurora cluster. This increases I/O and storage overhead, leading to high latency on the Aurora cluster, especially if the LOBs are significantly larger than the default chunk size or if the cluster's I/O capacity is exceeded.

Answer

The Aurora cluster was underprovisioned for parallel load

Answer

The DMS task was configured with 'ongoing replication' causing continuous write load

Answer

The DMS task replicated data to a different region, causing network latency

Question 4

A financial services company needs to enforce row-level security on a MySQL database hosted on Amazon RDS. They want to restrict access so that each application user can only see their own data. Which approach should they take?

Accepted Answer

Use a MySQL proxy that injects session context variables and enable row-level security in the application queries. MySQL does not natively support row-level security (RLS) like PostgreSQL or SQL Server. Instead, you can implement RLS by using a MySQL proxy (e.g., ProxySQL, Amazon RDS Proxy) that injects session context variables (e.g., user_id) at connection time. Application queries then reference these variables in WHERE clauses (e.g., WHERE user_id = @@session.user_id), effectively restricting each user to their own data without modifying the underlying schema.

Answer

Place each user's data in a separate database and use VPC endpoints to isolate access

Answer

Create separate database views for each user

Answer

Use IAM database authentication and define fine-grained access policies

Question 5

A company is migrating a 3 TB SQL Server database to Amazon RDS for SQL Server. The migration must be completed with less than 15 minutes of downtime. The company has set up AWS DMS with ongoing replication. During the final cutover, the DMS task fails with a 'Target error: Cannot insert duplicate key' error. What is the most likely cause?

Accepted Answer

The target table has an identity column that is not set to allow insert of explicit values.. The error 'Cannot insert duplicate key' during DMS full load or ongoing replication indicates that the target table has an identity column that does not allow explicit value insertion. By default, SQL Server identity columns are set to NOT FOR REPLICATION = OFF, meaning DMS cannot insert rows with explicit identity values, causing duplicate key violations when the source has identity values that conflict with the target's auto-generated sequence. To resolve this, you must set the identity column to allow explicit inserts (e.g., SET IDENTITY_INSERT ON) or configure DMS to use 'Do nothing' for identity handling.

Answer

The DMS task is not set to truncate the target before loading.

Answer

The source database transaction log is full.

Answer

The source database has a primary key violation.

Question 6

A company is migrating its on-premises Oracle database to Amazon RDS for Oracle. The database specialist needs to monitor the migration process and ensure data consistency. Which TWO AWS services should be used together to continuously monitor the replication lag and data integrity?

Accepted Answer

AWS Database Migration Service (AWS DMS). AWS DMS is the correct service because it is specifically designed for database migrations and provides built-in monitoring of replication lag via the 'CDC latency' metric. Amazon CloudWatch is the correct complementary service because it collects and visualizes DMS metrics, including replication lag and task status, and can trigger alarms if data integrity or latency thresholds are breached.

Answer

Amazon RDS Performance Insights

Answer

AWS Schema Conversion Tool (AWS SCT)

Answer

AWS Glue

Question 7

A company is migrating a 5 TB Oracle database to Amazon Aurora MySQL using AWS DMS. The full load completes successfully, but the CDC phase is slow and the target Aurora cluster is consuming high CPU. The DMS instance type is dms.c4.2xlarge. Which change will most likely improve CDC performance?

Accepted Answer

Increase the number of parallel apply threads in the DMS task. Increasing the number of parallel apply threads in the DMS task allows the CDC phase to apply multiple transactions concurrently to the target Aurora cluster, reducing the backlog of changes. The high CPU on the target suggests the apply process is the bottleneck, not the source or network, and DMS's parallel apply threads directly address this by enabling multi-threaded writes, which improves throughput without requiring larger instances.

Answer

Increase the Aurora cluster's max_connections parameter

Answer

Increase the DMS task's target storage allocation

Answer

Change the Aurora cluster to a larger instance class

Question 8

A company is migrating a 10 TB PostgreSQL database from on-premises to Amazon RDS for PostgreSQL. They need to minimize downtime and have limited network bandwidth. Which approach is most appropriate?

Accepted Answer

Use AWS Snowball to transfer a physical backup to AWS, then use DMS for ongoing replication.. The 10 TB database size combined with limited network bandwidth makes a direct online migration impractical due to prolonged transfer times. AWS Snowball allows you to physically ship the database backup to AWS, bypassing bandwidth constraints. After loading the backup into Amazon RDS, AWS DMS can perform ongoing change data capture (CDC) replication to synchronize any changes made during the transfer, minimizing downtime.

Answer

Use AWS Database Migration Service (DMS) with a full load and ongoing replication to keep the target in sync.

Answer

Use pg_dump to export the database and pg_restore to import to RDS, then use DMS for replication.

Answer

Use AWS Direct Connect to increase bandwidth and then use DMS for full load and replication.

Question 9

A company is migrating a self-managed PostgreSQL database with extensions (PostGIS, pg_stat_statements) to Amazon RDS for PostgreSQL. After migration, they find that the extensions are not available. What is the most likely cause?

Accepted Answer

The required extensions are not included in the default parameter group and must be manually added to shared_preload_libraries.. Amazon RDS for PostgreSQL does not automatically load extensions that require shared library preloading, such as pg_stat_statements. These extensions must be explicitly added to the `shared_preload_libraries` parameter in the DB parameter group. PostGIS, while not requiring preloading, must be created via `CREATE EXTENSION` after the extension files are present; however, the most likely cause of extensions not being available is that the custom parameter group was not configured to include the required libraries in `shared_preload_libraries`.

Answer

The extensions are incompatible with the RDS engine version.

Answer

The RDS instance is not configured to allow extensions.

Answer

RDS does not support any PostgreSQL extensions.

Question 10

A company is migrating a 5 TB SQL Server database to Amazon RDS for SQL Server. The migration must be completed within 48 hours with minimal downtime. The network bandwidth between on-premises and AWS is 500 Mbps. What is the MOST efficient migration strategy?

Accepted Answer

Use AWS Snowball to transfer the full database to an RDS instance, then use AWS DMS for ongoing replication. A 5 TB database over 500 Mbps would take approximately 23 hours for the initial full load alone (5 TB * 8 / 500 Mbps = 80,000 seconds ≈ 22.2 hours), leaving insufficient time for ongoing replication within the 48-hour window. AWS Snowball provides a physical transfer of the full database, bypassing network constraints, and then AWS DMS can perform ongoing change data capture (CDC) replication to apply incremental changes with minimal downtime.

Answer

Upgrade network bandwidth to 10 Gbps using AWS Direct Connect

Answer

Use AWS Database Migration Service (AWS DMS) with ongoing replication

Answer

Use AWS Schema Conversion Tool (AWS SCT) to migrate the schema, then use bulk insert

Question 11

A team is deploying a new Amazon Aurora MySQL database and needs to load 5 TB of data from an existing Amazon RDS for MySQL database with minimal downtime. The data is stored in InnoDB tables. Which approach is MOST efficient?

Accepted Answer

Create an Aurora read replica from the RDS for MySQL instance using binlog replication. Creating an Aurora read replica from an RDS for MySQL instance using binlog replication allows the Aurora cluster to synchronize with the source database in near real-time. Once the replica lag reaches zero, you can promote the Aurora cluster to become the primary database, achieving minimal downtime. This approach leverages the native MySQL binlog replication, which is efficient for large datasets like 5 TB and avoids the overhead of exporting or snapshotting the entire database.

Answer

Take a snapshot of the RDS for MySQL instance and restore to Aurora

Answer

Use AWS DMS with full load and ongoing replication

Answer

Use mysqldump to export the database and import into Aurora

Question 12

A database team is migrating an on-premises Oracle database to Amazon Aurora PostgreSQL. The team needs to ensure minimal downtime and data consistency. Which approach should be used?

Accepted Answer

Use AWS Database Migration Service (DMS) with ongoing replication using change data capture (CDC). AWS DMS with ongoing replication using change data capture (CDC) is the correct approach because it enables a live migration with minimal downtime. DMS can perform a full load of the Oracle database and then continuously replicate ongoing changes from Oracle to Aurora PostgreSQL, ensuring data consistency at the point of cutover. This method avoids the need for a long maintenance window and supports heterogeneous migrations with automatic schema conversion.

Answer

Use the PostgreSQL foreign data wrapper (FDW) to link the Oracle database

Answer

Use AWS Server Migration Service (SMS) to replicate the database

Answer

Use pg_dump and pg_restore to migrate the data during a maintenance window

Question 13

A company is designing a database for a mobile application that requires offline synchronization. Users should be able to read and write data while offline, and changes should sync when connectivity is restored. Which AWS service supports this pattern?

Accepted Answer

AWS AppSync with Amazon DynamoDB. AWS AppSync with Amazon DynamoDB is correct because AppSync provides managed GraphQL APIs that support offline data synchronization via its client SDKs. When a mobile app is offline, mutations are queued locally and automatically replayed against DynamoDB once connectivity is restored, using a conflict resolution mechanism (e.g., last-writer-wins or custom resolvers) to merge changes.

Answer

Amazon RDS Proxy

Answer

Amazon S3 Transfer Acceleration

Answer

Amazon Cognito

Question 14

A security engineer is designing a VPC with an RDS instance. The database must not be accessible from the internet, but EC2 instances in a private subnet must connect. Which security group configuration is MOST secure?

Accepted Answer

Set the RDS security group inbound rule to allow traffic from the EC2 security group on port 3306.. The most secure because it uses a security group reference instead of a CIDR block. By referencing the EC2 security group as the source in the RDS security group inbound rule, only instances associated with that specific security group can communicate with the database on port 3306. This approach adheres to the principle of least privilege and automatically scales as instances are added or removed from the EC2 security group, without needing to update CIDR ranges.

Answer

Set the RDS security group inbound rule to allow traffic from the VPC CIDR on port 3306.

Answer

Set the RDS security group inbound rule to allow traffic from 0.0.0.0/0 on port 3306.

Answer

Set the RDS security group inbound rule to allow traffic from the private subnet CIDR on port 3306.

Question 15

A healthcare company stores patient records in Amazon DynamoDB. Each record includes patient_id (partition key), visit_date (sort key), and a large JSON attribute for medical history. The application frequently queries recent visits for a patient and scans historical data for analytics. The scans on the medical history attribute cause high RCU consumption. The company wants to reduce costs and improve query performance. Which design should be implemented?

Accepted Answer

Move the medical history attribute to a separate table with patient_id as partition key and visit_date as sort key. Use DynamoDB Streams to keep both tables in sync.. It separates the large, infrequently accessed medical history attribute from the frequently queried core record, reducing the item size for common queries and thus lowering RCU consumption. By using DynamoDB Streams to synchronize the two tables, you maintain data consistency without adding complexity to the application, and queries against the main table become faster and cheaper since they no longer read the large JSON payload.

Answer

Compress the medical history attribute using gzip before storing in DynamoDB.

Answer

Enable DynamoDB Accelerator (DAX) for the table to cache frequent queries.

Answer

Use Amazon S3 to store the medical history as a separate object and reference it from DynamoDB.

Question 16

A database administrator is troubleshooting an Amazon RDS for PostgreSQL DB instance that is experiencing high CPU utilization. The administrator runs the following query to find the current running queries:

SELECT pid, now() - pg_stat_activity.query_start AS duration, query, state
FROM pg_stat_activity
WHERE state = 'active';

The output shows a high number of queries with a state of 'active' and durations exceeding several minutes. What should the administrator do FIRST to reduce CPU utilization?

Accepted Answer

Use pg_terminate_backend to terminate the long-running queries.. The immediate cause of high CPU utilization is the long-running active queries consuming resources. Using pg_terminate_backend to terminate these queries will quickly free up CPU cycles, providing immediate relief. This is the first troubleshooting step before making configuration changes or scaling, as it directly addresses the symptom shown in the pg_stat_activity output.

Answer

Modify the max_connections parameter to limit concurrent sessions.

Answer

Scale up the DB instance to a larger instance class.

Answer

Enable pg_stat_statements to collect query performance data.

Question 17

A company uses Amazon RDS for SQL Server with Multi-AZ deployment. During a failover test, the application experienced a longer downtime than expected. Which monitoring metric should be reviewed to understand the failover duration?

Accepted Answer

DatabaseConnections. The DatabaseConnections metric in Amazon CloudWatch tracks the number of active database connections. During a Multi-AZ failover, existing connections are dropped and new connections are blocked until the standby becomes the primary. By monitoring the time period when DatabaseConnections drops to zero or a low value, you can estimate the failover duration. Options A (FailoverTime) is not a valid CloudWatch metric for RDS; the actual metric is 'Failover' which is a count, not a duration. WriteLatency may increase during failover but does not directly measure downtime. ReplicaLag applies to read replicas, not Multi-AZ failover.

Answer

FailoverTime

Answer

WriteLatency

Answer

ReplicaLag

Question 18

A financial services company is using Amazon DynamoDB to store customer transaction data. The compliance team requires that all data be encrypted at rest using a customer-managed AWS KMS key, and that access to the key be auditable via AWS CloudTrail. Additionally, the security team wants to ensure that DynamoDB can only be accessed from within the VPC using a VPC endpoint. Which combination of steps should the company take to meet these requirements?

Accepted Answer

Enable server-side encryption with a customer-managed KMS key and create an interface VPC endpoint for DynamoDB.. Option C. To meet the encryption requirement, the company must use a customer-managed KMS key, not an AWS managed key. For VPC-only access, DynamoDB supports interface VPC endpoints (via AWS PrivateLink), which provide private connectivity. Option C correctly uses a customer-managed KMS key and an interface VPC endpoint. Option D is incorrect because it uses an AWS managed KMS key. Option A is incorrect because CloudHSM is unnecessary and VPC peering is not the correct method. Option B is incorrect because a NAT gateway still routes traffic over the internet.

Answer

Use a CloudHSM key for encryption and create a VPC peering connection to DynamoDB.

Answer

Enable server-side encryption with a customer-managed KMS key and route all traffic through a NAT gateway.

Answer

Use AWS managed KMS key and a gateway VPC endpoint for DynamoDB.

Question 19

A social media application stores user posts in an Amazon RDS for PostgreSQL instance. The application experiences a sudden spike in read traffic during peak hours, causing database bottlenecks. The team needs to improve read scalability without changing the application code. Which solution is MOST cost-effective?

Accepted Answer

Use Amazon RDS for PostgreSQL Read Replicas. Amazon RDS for PostgreSQL Read Replicas allow you to offload read traffic from the primary DB instance to one or more read-only replicas, improving read scalability without any application code changes. This is the most cost-effective solution as it leverages the existing PostgreSQL engine and requires only minimal additional compute and storage costs for the replicas.

Answer

Migrate to Amazon DynamoDB with DAX

Answer

Enable Multi-AZ on the RDS instance

Answer

Use Amazon ElastiCache to cache query results

Question 20

Refer to the exhibit. A security engineer has applied this key policy to a customer managed KMS key used to encrypt a Secrets Manager secret containing database credentials. An application running on an Amazon EC2 instance in the same account and region is unable to decrypt the secret. What is the MOST likely cause?

Accepted Answer

The condition kms:ViaService restricts the decryption to requests made via Secrets Manager, but the application is calling KMS directly.. The condition `kms:ViaService` in the key policy restricts the `Decrypt` permission to requests that originate specifically from the AWS Secrets Manager service. When the application on the EC2 instance calls KMS directly (e.g., via the `Decrypt` API) to decrypt the secret, the request does not come through Secrets Manager, so the condition is not satisfied and the request is denied. This is the most likely cause of the decryption failure.

Answer

The KMS key ARN in the resource field is incorrect.

Answer

The policy is missing an encryption context that matches the secret's encryption context.

Answer

The policy only allows Decrypt, but the application needs Encrypt permission.