DBS-C01 Hard Questions — 25 Difficult Questions

Question 1

Refer to the exhibit. A company has an S3 bucket with server-side encryption using AWS KMS. The bucket policy allows access to a user, but the user receives 'Access Denied' when trying to download an object. The IAM policy for the user is shown. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The policy has a condition that limits kms:Decrypt to when the request is made through the S3 service, but the user might be using a different service to access the object (e.g., directly via KMS API).. The IAM policy includes a condition that restricts kms:Decrypt to requests made through the S3 service (via the S3 service principal). If the user attempts to decrypt the object directly using the KMS API (e.g., using AWS CLI with `kms decrypt` command), the condition is not met, resulting in an 'Access Denied' error. Option A is incorrect because MFA is not mentioned in the policy. Option B is incorrect because the KMS key ID is assumed correct as per the scenario. Option C is incorrect because the policy does allow kms:Decrypt, but only conditionally.

Answer

The user does not have MFA enabled.

Answer

The KMS key ID in the policy is incorrect.

Answer

The policy does not allow kms:Decrypt for the S3 bucket.

Question 2

A company is using Amazon DynamoDB with on-demand capacity mode. The application experiences occasional throttling during traffic spikes. The database administrator wants to implement a solution to reduce throttling. Which THREE actions should the administrator take? (Choose THREE.)

Accepted Answer

Use DynamoDB Accelerator (DAX) to cache frequently accessed items.. Options A, D, and E are correct. Using DynamoDB Accelerator (DAX) caches frequently accessed items, offloading read capacity from the table and reducing read throttling. Implementing exponential backoff and retry logic in the application (option D) and designing the application to handle throttling by retrying with backoff (option E) both ensure that requests are retried gracefully during spikes, reducing the impact of throttling. Option B is incorrect because auto scaling is not applicable to on-demand capacity mode, which scales automatically. Option C is incorrect because switching to provisioned capacity does not inherently reduce throttling; on-demand already handles sudden spikes, but throttling may still occur if the workload exceeds table limits momentarily.

Answer

Enable auto scaling for the table.

Answer

Switch the table to provisioned capacity mode with auto scaling.

Question 3

A company is migrating a 10 TB Oracle database to Amazon Aurora PostgreSQL. The migration uses AWS DMS with CDC. After the full load, the CDC phase is falling behind by several minutes. The source Oracle database generates 500 MB of redo logs per minute. Which action will most likely improve CDC performance?

Accepted Answer

Increase the number of parallel apply threads on the DMS task. Increasing the number of parallel apply threads on the DMS task allows the target Aurora PostgreSQL database to apply changes concurrently, reducing the bottleneck caused by sequential apply. With 500 MB/min of redo logs, the single-threaded default apply cannot keep pace, so parallel apply directly addresses the lag by distributing the load across multiple threads.

Answer

Disable CDC and perform a full load only

Answer

Reduce the batch size in the DMS task settings

Answer

Increase the source Oracle redo log size

Question 4

A company stores financial data in an Amazon Aurora MySQL DB cluster. The security team requires that database audit logs be stored in Amazon CloudWatch Logs and encrypted at rest using a customer-managed KMS key. The database specialist enables audit log publishing to CloudWatch Logs and specifies a KMS key for log encryption. However, the audit logs are not appearing in CloudWatch Logs. What is the most likely cause?

Accepted Answer

The IAM role used for publishing logs does not have the necessary permissions to use the KMS key for CloudWatch Logs.. When publishing database audit logs to CloudWatch Logs with a customer-managed KMS key, the IAM role used by RDS must have explicit permissions for the `kms:Encrypt` and `kms:Decrypt` actions on the KMS key. Without these permissions, RDS cannot encrypt the log stream, and the logs will not appear. Option C correctly identifies this missing permission as the most likely cause.

Answer

The CloudWatch Logs log group does not exist and RDS cannot create it automatically.

Answer

The DB cluster is not configured to export error logs, only audit logs.

Answer

CloudWatch Logs does not support encryption with customer-managed KMS keys for audit logs.

Answer

The audit log parameter is static and requires a DB cluster reboot after modification.

Question 5

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer. The application uses Amazon RDS for MySQL. Recently, the database CPU utilization spikes to 100% during peak hours. The team observes that the spike is caused by a large number of slow queries. They need to identify and resolve the issue with minimal disruption. Which combination of steps should they take? (Choose two.)

Accepted Answer

Enable RDS Performance Insights to identify the slow queries. The correct combination is A and D. Option A: Enabling RDS Performance Insights quickly identifies slow queries and their resource consumption, pinpointing the cause of CPU spikes. Option D: Creating a read replica and directing reporting queries to it offloads read traffic from the primary instance, reducing CPU load during peak hours. Option B is not an identification step and may not address the root cause, while also incurring unnecessary cost. Option C addresses I/O bottlenecks, not CPU spikes from slow queries. Option E helps with connection management but does not identify or directly resolve the slow query issue.

Answer

Upgrade to a larger instance type

Answer

Increase the DB instance storage to improve I/O

Answer

Implement connection pooling using Amazon RDS Proxy

Question 6

Which THREE design patterns are commonly used to optimize DynamoDB performance for write-heavy workloads?

Accepted Answer

Using DynamoDB adaptive capacity to handle unbalanced access patterns.. DynamoDB adaptive capacity automatically isolates heavily accessed partitions, allowing them to consume more throughput without throttling other partitions. This is critical for write-heavy workloads with uneven access patterns, as it prevents hot partitions from degrading overall performance.

Answer

Using sparse indexes on rarely accessed attributes.

Answer

Using global tables to distribute writes across regions.

Question 7

A company uses Amazon RDS for PostgreSQL to store sensor data. Each sensor sends a row every second. The table has grown to 500 GB and queries filtering on a timestamp column are slow even with an index. The team wants to improve query performance while keeping the data online. Which approach should they take?

Accepted Answer

Partition the table by time using PostgreSQL table partitioning. PostgreSQL table partitioning by time (e.g., by day or month) allows the query planner to prune partitions that do not match the timestamp filter, drastically reducing the amount of data scanned. This is the most effective approach for time-series data because it maintains online access and improves query performance without requiring a migration or additional replicas.

Answer

Migrate to Amazon Aurora PostgreSQL and enable parallel query

Answer

Add more indexes on the timestamp column

Answer

Create a read replica and direct queries to the replica

Question 8

An e-commerce platform uses Amazon DynamoDB for a shopping cart table with partition key 'user_id' and sort key 'product_id'. The table experiences throttled write requests during flash sales. The access pattern includes reading the entire cart at checkout. Which design change would improve write performance without changing the read pattern?

Accepted Answer

Enable DynamoDB Adaptive Capacity and ensure the table uses on-demand capacity mode. Enabling DynamoDB Adaptive Capacity with on-demand capacity mode automatically scales write capacity to handle traffic spikes during flash sales without requiring manual provisioning. This eliminates throttling while preserving the existing table schema (partition key 'user_id' and sort key 'product_id'), so the read pattern of querying the entire cart by user_id remains unchanged.

Answer

Enable DynamoDB Accelerator (DAX) to cache writes

Answer

Increase the provisioned write capacity units (WCU) to a higher value

Answer

Change the table design to use only partition key 'user_id' and remove the sort key

Question 9

A company uses Amazon DynamoDB with fine-grained access control based on user identity. The IAM policy for a user includes a condition that restricts access to items where the 'department' attribute equals 'engineering'. However, the user is receiving an 'AccessDeniedException' when trying to query items. What is the most likely cause?

Accepted Answer

The 'department' attribute is not the partition key of the table.. Fine-grained access control in DynamoDB uses IAM policy conditions with the 'dynamodb:LeadingKeys' or 'dynamodb:Attributes' condition keys. The 'department' attribute must be the partition key of the table for 'LeadingKeys' to work. If 'department' is not the partition key, the condition cannot be evaluated for the query. Option A is possible but less likely if the user is using the correct role. Option C is wrong because DynamoDB does not require SSL for all operations. Option D is wrong because Condition check is exactly how it works.

Answer

The user is not using the correct IAM role.

Answer

The DynamoDB table is not configured to require SSL.

Answer

The IAM policy is missing a 'Condition' block.

Question 10

A company runs an OLTP workload on an RDS for MySQL instance. The database has a table with 50 million rows. The application frequently runs queries that join this table with a small lookup table (1000 rows) using a foreign key. The queries are slow. Which design change would most improve performance?

Accepted Answer

Add an index on the foreign key column in the large table.. The query joins a large table (50M rows) with a small lookup table (1000 rows) on a foreign key column. Without an index on the foreign key column in the large table, MySQL must perform a full table scan for each join, leading to slow performance. Adding an index on that column allows MySQL to use an index lookup (e.g., B-tree) to quickly locate matching rows, dramatically reducing query time.

Answer

Partition the large table by the foreign key column.

Answer

Scale up the RDS instance to a larger size.

Answer

Create a read replica and direct all read queries to it.

Question 11

A financial services company runs an Amazon Aurora MySQL database. The application performs complex joins and aggregations on large tables, causing high CPU utilization on the writer instance. The team wants to reduce load without changing the application code. Which solution would best address this issue?

Accepted Answer

Create one or more Aurora Replicas and route read traffic to them.. Creating one or more Aurora Replicas and routing read traffic to them offloads the complex joins and aggregations from the writer instance, reducing CPU utilization without requiring application code changes. Aurora Replicas share the same underlying storage volume as the writer, so they serve read queries with minimal replication lag while the writer focuses on write operations.

Answer

Switch to asynchronous replication to reduce load on the primary.

Answer

Enable Aurora Auto Scaling to increase storage capacity.

Answer

Migrate to Aurora Serverless v2 for automatic scaling.

Question 12

A company runs a data warehouse on Amazon Redshift. The workload has frequent DELETE and UPDATE operations on a large fact table. Over time, query performance degrades. Which maintenance operation should be scheduled regularly to optimize performance?

Accepted Answer

Run VACUUM and ANALYZE commands regularly. B is correct because frequent DELETE and UPDATE operations in Redshift create ghost rows and cause table bloat, degrading query performance. Running VACUUM reclaims space and re-sorts rows, while ANALYZE updates table statistics for the query optimizer; together they restore performance without requiring a full table rebuild.

Answer

Run VACUUM FULL during maintenance windows

Answer

Alter the table to use a different DISTKEY

Answer

Drop and recreate the table periodically

Question 13

A company's Amazon Aurora MySQL DB cluster is experiencing a failover event. Which THREE metrics in CloudWatch should be examined to understand the cause of the failover?

Accepted Answer

ACUUtilization. (ACUUtilization) is correct because high ACU utilization can indicate resource exhaustion (CPU/memory pressure) that may trigger a failover in Aurora. Option D (DatabaseConnections) is correct because a sudden spike or drop in connections could signal issues like connection exhaustion or application failures that lead to failover. Option E (FailoverCount) is correct because this metric directly tracks the number of failover events; examining the timestamp of the last increment helps correlate with the incident. Option B (ReadLatency) is wrong because while high read latency can be a symptom, it is not a direct cause of failover; Aurora uses different mechanisms for read scaling. Option C (BinLogDiskUsage) is wrong because it relates to binary log storage for replication, not a direct trigger for failover.

Answer

ReadLatency

Answer

BinLogDiskUsage

Question 14

A media company is migrating a 5 TB MongoDB database to Amazon DocumentDB. The migration must have minimal downtime. The source MongoDB uses sharding across 10 shards. Which migration strategy is MOST appropriate?

Accepted Answer

Use AWS DMS with MongoDB as source and DocumentDB as target, enabling CDC. AWS DMS with CDC (Change Data Capture) is the most appropriate strategy because it supports ongoing replication from a sharded MongoDB source to Amazon DocumentDB, enabling near-zero downtime migration. DMS can handle the 5 TB dataset and 10 shards by using the MongoDB oplog to capture changes after the initial full load, ensuring minimal interruption to the media company's operations.

Answer

Use native MongoDB replication to sync to DocumentDB

Answer

Export data to S3 and use AWS Glue to load into DocumentDB

Answer

Use mongoexport to export data and mongoimport to import into DocumentDB

Question 15

A database team is migrating an on-premises Oracle database to Amazon Aurora PostgreSQL. The team needs to ensure minimal downtime and data consistency. Which approach should be used?

Accepted Answer

Use AWS Database Migration Service (DMS) with ongoing replication using change data capture (CDC). AWS DMS with ongoing replication using change data capture (CDC) is the correct approach because it enables a live migration with minimal downtime. DMS can perform a full load of the Oracle database and then continuously replicate ongoing changes from Oracle to Aurora PostgreSQL, ensuring data consistency at the point of cutover. This method avoids the need for a long maintenance window and supports heterogeneous migrations with automatic schema conversion.

Answer

Use the PostgreSQL foreign data wrapper (FDW) to link the Oracle database

Answer

Use AWS Server Migration Service (SMS) to replicate the database

Answer

Use pg_dump and pg_restore to migrate the data during a maintenance window

Question 16

Which THREE factors should be considered when choosing between a homogeneous migration and a heterogeneous migration to Amazon RDS? (Select THREE.)

Accepted Answer

Performance requirements of the target database.. A homogeneous migration (e.g., MySQL to RDS MySQL) typically requires minimal schema changes, preserves performance characteristics, and maintains existing licensing costs. A heterogeneous migration (e.g., Oracle to RDS PostgreSQL) requires schema conversion (validating schema compatibility), may require re-architecting to meet performance requirements due to different query optimizers, and can change licensing costs (e.g., eliminating Oracle licenses). Therefore, factors B, D, and E directly influence the choice between homogeneous and heterogeneous migrations.

Answer

Network latency between source and target.

Answer

Amount of application code changes needed.

Question 17

A company is migrating an on-premises Oracle data warehouse to AWS. The warehouse contains 20 TB of data and supports complex SQL queries with joins and aggregations. The migration should minimize downtime and require minimal changes to existing SQL queries. Which database service is MOST appropriate?

Accepted Answer

Amazon Redshift. Amazon Redshift is the most appropriate choice because it is a fully managed, petabyte-scale data warehouse service designed for complex SQL queries with joins and aggregations. It supports standard SQL with minimal changes to existing queries, and its columnar storage and massively parallel processing (MPP) architecture are optimized for analytical workloads. The 20 TB data size and requirement to minimize downtime align with Redshift's ability to perform online resizing and use features like RA3 nodes with managed storage for elastic scaling.

Answer

Amazon RDS for Oracle

Answer

Amazon DynamoDB

Answer

Amazon ElastiCache for Redis

Question 18

A security engineer is designing a VPC with an RDS instance. The database must not be accessible from the internet, but EC2 instances in a private subnet must connect. Which security group configuration is MOST secure?

Accepted Answer

Set the RDS security group inbound rule to allow traffic from the EC2 security group on port 3306.. The most secure because it uses a security group reference instead of a CIDR block. By referencing the EC2 security group as the source in the RDS security group inbound rule, only instances associated with that specific security group can communicate with the database on port 3306. This approach adheres to the principle of least privilege and automatically scales as instances are added or removed from the EC2 security group, without needing to update CIDR ranges.

Answer

Set the RDS security group inbound rule to allow traffic from the VPC CIDR on port 3306.

Answer

Set the RDS security group inbound rule to allow traffic from 0.0.0.0/0 on port 3306.

Answer

Set the RDS security group inbound rule to allow traffic from the private subnet CIDR on port 3306.

Question 19

A company is migrating a 5 TB Oracle database to Amazon RDS for Oracle. The database has several large tables with LOB columns. The migration must have minimal downtime. Which approach should be taken?

Accepted Answer

Use AWS DMS with LOB support and ongoing replication from Oracle to RDS.. AWS DMS with LOB support and ongoing replication (change data capture, CDC) is the correct approach because it enables a near-zero downtime migration by continuously replicating changes from the source Oracle database to Amazon RDS for Oracle after an initial full load. DMS handles large LOB columns efficiently using its 'Full LOB mode' or 'Limited LOB mode' settings, which are critical for tables with LOB data. The combination of full load + CDC ensures minimal downtime, as the target remains synchronized until cutover.

Answer

Use Oracle GoldenGate to replicate data to RDS.

Answer

Use Oracle Data Pump to export the database and import into RDS.

Answer

Copy the database files to Amazon S3 and use the rdsadmin.rds_restore_from_s3 procedure.

Question 20

A company runs a MySQL-compatible database on Amazon RDS for a mission-critical application. The database experiences high write latency due to frequent index updates. The team wants to redesign the database to reduce write amplification and improve insert performance. Which TWO design changes could help?

Accepted Answer

Use batch INSERT statements instead of single-row inserts. Batch INSERT statements reduce the overhead of per-row index updates by combining multiple rows into a single transaction. This minimizes the number of index tree traversals and log flushes, directly lowering write amplification and improving insert throughput in InnoDB.

Answer

Switch the storage engine from InnoDB to MyISAM

Answer

Upgrade to a larger RDS instance class

Answer

Normalize the database schema to reduce data redundancy