Courseiva

AWS Certified Database Specialty DBS-C01 (DBS-C01) — Questions 175

1663 questions total · 23pages · All types, answers revealed

Page 1 of 23

Page 2
1
MCQhard

A company is using Amazon DynamoDB with on-demand capacity. The application performs many small writes that are throttled frequently. The company wants to minimize costs while reducing throttling. What should the company do?

A.Increase the write capacity units manually.
B.Use DynamoDB Accelerator (DAX) to cache writes.
C.Switch to provisioned capacity with auto scaling.
D.Use batch writes to combine small writes.
AnswerC

Provisioned with auto scaling can handle predictable patterns and reduce cost vs. on-demand.

Why this answer

DynamoDB on-demand capacity can throttle small writes if the traffic pattern exceeds the table's previous peak traffic, as on-demand capacity scales based on traffic volume but has a per-second burst limit. Switching to provisioned capacity with auto scaling allows you to set a baseline capacity that matches the application's average write throughput, while auto scaling adjusts capacity based on actual usage, reducing throttling without the premium cost of on-demand capacity for predictable workloads.

Exam trap

The trap here is that candidates assume on-demand capacity automatically handles all traffic patterns without throttling, but on-demand throttles when traffic exceeds the table's previous peak, and they may overlook that switching to provisioned capacity with auto scaling provides a cost-effective solution for predictable workloads with frequent small writes.

How to eliminate wrong answers

Option A is wrong because DynamoDB on-demand capacity does not use manual write capacity units; you cannot increase them manually as on-demand scales automatically, and manually setting provisioned capacity would require switching away from on-demand. Option B is wrong because DynamoDB Accelerator (DAX) is an in-memory cache for reads, not writes; it does not reduce write throttling as writes still go directly to DynamoDB. Option D is wrong because batch writes combine multiple write operations into a single API call, which can improve throughput efficiency but does not address the root cause of throttling under on-demand capacity, and the question states the application performs many small writes that are throttled frequently, implying the issue is capacity limits, not write batching.

2
Multi-Selectmedium

A company is migrating an on-premises Oracle database to Amazon Aurora PostgreSQL. The database contains a large table that is partitioned by date. The company wants to minimize downtime during migration and ensure compatibility. Which TWO actions should the company take?

Select 2 answers
A.Use AWS Database Migration Service (DMS) with ongoing replication to migrate the data.
B.Migrate the database using a full load only and accept downtime.
C.Use AWS Schema Conversion Tool (SCT) to convert the schema automatically without any manual adjustments.
D.Replace the Oracle database with Amazon RDS for MySQL.
E.Convert Oracle partitions to PostgreSQL table inheritance or declarative partitioning.
AnswersA, E

DMS enables minimal downtime by replicating changes continuously.

Why this answer

AWS DMS with ongoing replication (change data capture) allows continuous synchronization from the source Oracle database to the target Aurora PostgreSQL, minimizing downtime by keeping the target nearly up-to-date until the final cutover. This approach supports large partitioned tables and reduces the migration window compared to a full load only.

Exam trap

The trap here is that candidates may think a full load only is sufficient for minimizing downtime, or that SCT can automatically convert all Oracle features without manual adjustments, but the exam requires understanding that ongoing replication and proper partition conversion are both necessary for a low-downtime, compatible migration.

3
MCQeasy

A developer needs to allow an application running on an EC2 instance to connect to an Amazon RDS for MySQL DB instance securely. Which combination of steps should the developer take?

A.Store the database password in the application code.
B.Open the RDS security group to allow traffic from 0.0.0.0/0.
C.Store the credentials in an S3 bucket and download them at runtime.
D.Attach an IAM role to the EC2 instance with permissions to use RDS IAM authentication, and configure the database to use an authentication token.
AnswerD

Correct. Attaching an IAM role to the EC2 instance with permissions to use RDS IAM authentication and configuring the database to use an authentication token provides a secure, passwordless authentication method using temporary credentials.

Why this answer

The most secure method to allow an EC2 instance to connect to an RDS for MySQL DB instance is to use IAM roles for EC2 combined with IAM database authentication. By attaching an IAM role to the EC2 instance that has permissions to generate RDS authentication tokens, and configuring the DB instance to accept authentication tokens instead of passwords, the application can obtain temporary credentials without hardcoding or storing any secrets. Option A is insecure because storing credentials in application code exposes them to anyone with access to the code.

Option B is insecure because opening the security group to all traffic (0.0.0.0/0) exposes the database to the internet. Option C is insecure because storing credentials in S3 and downloading them at runtime still involves storing static credentials and adds potential risk from S3 access misconfiguration.

4
MCQhard

A company notices that its Aurora MySQL cluster has a high number of locks and deadlocks. The application uses read replicas for read scaling. What is the MOST likely cause?

A.Performance Insights is enabled
B.The writer and reader instances are of different sizes
C.Long-running transactions on the writer instance
D.Read replicas are performing write operations
AnswerC

Long transactions hold locks, increasing contention and deadlock probability.

Why this answer

Long-running transactions on the writer instance hold locks for extended periods, increasing the probability of lock contention and deadlocks. Option A is incorrect because Performance Insights is a monitoring tool and does not cause locks or deadlocks. Option B is incorrect because mismatched instance sizes may affect performance but do not directly cause locks or deadlocks.

Option D is incorrect because Aurora read replicas are read-only and cannot perform write operations.

5
MCQeasy

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. During the migration, they need to ensure minimal downtime. Which AWS service should be used for the migration?

A.AWS Database Migration Service
B.AWS DataSync
C.Amazon S3 Transfer Acceleration
D.AWS Server Migration Service
AnswerA

DMS supports homogeneous and heterogeneous migrations with minimal downtime.

Why this answer

AWS Database Migration Service (DMS) is the correct choice because it is specifically designed for migrating databases to AWS with minimal downtime. DMS supports homogeneous migrations (e.g., Oracle to Oracle) and heterogeneous migrations (e.g., Oracle to Amazon Aurora), and it can perform continuous replication using change data capture (CDC) to keep the source and target databases synchronized during the migration, allowing you to cut over with only a brief pause.

Exam trap

The trap here is that candidates may confuse AWS DMS with general-purpose data transfer services like DataSync or S3 Transfer Acceleration, not realizing that DMS is the only service that supports live database replication with transaction consistency and minimal downtime.

How to eliminate wrong answers

Option B (AWS DataSync) is wrong because it is designed for moving large amounts of file data (e.g., NFS, SMB shares) to Amazon S3, EFS, or FSx, not for live database replication with transaction consistency. Option C (Amazon S3 Transfer Acceleration) is wrong because it only speeds up uploads to S3 buckets over the internet by using AWS edge locations; it does not handle database schema, data types, or ongoing replication. Option D (AWS Server Migration Service) is wrong because it is used for migrating entire virtual machines (VMs) from on-premises to AWS as Amazon Machine Images (AMIs), not for database-level migration with minimal downtime.

6
MCQhard

A company uses Amazon DynamoDB with global tables. During a regional failure, the application in the secondary region experiences higher latency and throttling. The DynamoDB table's WriteCapacityUnits are set to 10000 in both regions. Which action should be taken to reduce throttling during failover?

A.Switch the table to on-demand capacity mode
B.Enable DynamoDB auto scaling for write capacity in both regions
C.Disable global tables and use application-level replication
D.Increase the write capacity of the secondary region to 20000
AnswerB

Enabling DynamoDB auto scaling dynamically adjusts write capacity based on actual traffic, helping reduce throttling during failover when secondary region traffic increases.

Why this answer

Enabling DynamoDB auto scaling allows the table to dynamically adjust write capacity based on actual traffic, which helps reduce throttling during failover when secondary region traffic increases. Option A is incorrect because switching to on-demand capacity mode may reduce throttling but is more expensive and not the most direct fix for capacity limits; auto scaling provides a more cost-effective solution. Option C is incorrect because disabling global tables would stop cross-region replication, defeating the purpose of multi-region disaster recovery.

Option D is incorrect because increasing write capacity of only the secondary region to 20000 may lead to over-provisioning and cost, while auto scaling provides a more efficient and automated solution to handle varying load.

7
MCQmedium

The application uses the IAM role to access the 'orders' DynamoDB table. What is the intended effect of this policy?

A.The role can perform any DynamoDB action on the 'orders' table
B.The role can only access items where the partition key matches the principal's identifier
C.The role can access all items in the table but only during specific times
D.The role is denied access to the 'orders' table
AnswerB

The condition restricts access to items with LeadingKeys equal to the aws:userid.

Why this answer

The policy uses a condition key like `dynamodb:LeadingKeys` with a value referencing the principal's identifier (e.g., `${aws:userid}`). This restricts access to only those items in the 'orders' table whose partition key matches the IAM role's unique identifier, enforcing row-level security. The intended effect is fine-grained access control, not full table access or time-based restrictions.

Exam trap

The trap here is that candidates assume a policy with `Allow` on DynamoDB actions grants full table access, overlooking the `Condition` block that restricts access to specific items based on the partition key.

How to eliminate wrong answers

Option A is wrong because the policy includes a condition that limits DynamoDB actions to items with a specific partition key, so it does not grant unrestricted access to all items. Option C is wrong because the policy does not reference any time-based conditions (e.g., `aws:CurrentTime`); it only filters by partition key. Option D is wrong because the policy grants access (via `Allow` effect) to specific actions, not an explicit deny.

8
Multi-Selecthard

A company is designing a document database for a content management system using Amazon DocumentDB. The application requires high availability and low-latency reads across multiple AWS Regions. Which TWO design choices meet these requirements?

Select 2 answers
A.Configure read replicas in each region to offload read traffic.
B.Use a single instance in each region with Multi-AZ disabled.
C.Use local secondary indexes to improve query performance in each region.
D.Deploy a global cluster with a primary region and secondary regions for read workloads.
E.Shard the data across multiple clusters in different regions.
AnswersA, D

Read replicas provide additional read capacity with low latency.

Why this answer

Amazon DocumentDB read replicas can be placed in different AWS Regions to offload read traffic and provide low-latency reads locally. Option D is correct because a global cluster in DocumentDB replicates data from a primary region to secondary regions, enabling high availability and low-latency reads across regions.

Exam trap

The trap here is that candidates may confuse Amazon DocumentDB's global cluster feature with DynamoDB global tables or assume that sharding across clusters is necessary for cross-region reads, when DocumentDB's native global cluster provides a simpler and more performant solution.

9
MCQhard

A company uses Amazon DynamoDB for its critical application. The security team requires that all access to DynamoDB tables be logged and monitored for suspicious activity. The company also needs to be alerted when a user deletes a table. Which combination of AWS services should be used?

A.AWS CloudTrail and Amazon DynamoDB Streams.
B.AWS Config and Amazon Simple Notification Service (SNS).
C.AWS CloudTrail and Amazon CloudWatch Events.
D.Amazon VPC Flow Logs and Amazon CloudWatch Logs.
AnswerC

CloudTrail logs API calls, and CloudWatch Events can create rules to match DeleteTable events and trigger alerts.

Why this answer

AWS CloudTrail logs all DynamoDB API calls, including DeleteTable, and can send events to Amazon CloudWatch Events, which can trigger alerts via SNS or Lambda. Option A is incorrect because DynamoDB Streams captures item-level changes, not API calls. Option B is incorrect because AWS Config records resource configuration changes but not API calls directly for alerting; CloudTrail is needed.

Option D is incorrect because VPC Flow Logs capture network traffic, not API calls.

10
MCQmedium

A database administrator is troubleshooting a slow-running query on an Amazon RDS for PostgreSQL DB instance. The query plan shows a sequential scan on a large table. The table has a primary key and an index on the column used in the WHERE clause. Why might the query optimizer choose a sequential scan over an index scan?

A.The query is expected to return a large percentage of rows.
B.The query is a SELECT * without a WHERE clause.
C.The table's statistics are outdated.
D.The index on the column is not being used because it is a composite index with a different column order.
AnswerA

Correct: When the query returns a large percentage of rows, a sequential scan is more efficient than random I/O from an index.

Why this answer

When a query is expected to return a large percentage of rows, a sequential scan is often more efficient than an index scan due to the overhead of random I/O from the index. Option B is wrong because the scenario includes a WHERE clause, so SELECT * without WHERE does not apply. Option C is wrong because outdated statistics could cause the optimizer to choose a sequential scan, but the question asks for a reason the planner might choose sequential scan; outdated stats are a possible cause but not the direct reason given in A.

Option D is wrong because the index order does not automatically force its use; the optimizer decides based on selectivity.

11
MCQhard

A developer receives a 'ResourceNotFoundException' when trying to describe a DynamoDB table. The developer runs the command shown in the exhibit and gets the output. What is the most likely cause?

A.The developer is using a different AWS region or the table name has incorrect case.
B.The table is not in ACTIVE state.
C.The table ARN is incorrect.
D.The developer does not have permission to describe the table.
AnswerA

Correct. The developer may be using a different AWS region or the table name has incorrect case, causing the table not to be found.

Why this answer

The 'ResourceNotFoundException' indicates the table was not found. The command output lists tables in a specific region. If the table exists in another region, it will not appear.

Additionally, DynamoDB table names are case-sensitive. Option A correctly identifies these as the most likely causes. Option B is incorrect because a table not in ACTIVE state would generate a different error.

Option C is unlikely because the describe command uses the table name, not the ARN. Option D is incorrect because the describe command succeeded (returned a list), but the specific table was not found due to region or case mismatch.

12
Multi-Selecthard

A company uses Amazon DynamoDB to store session data for a web application. The security team discovers that an IAM user has been performing unauthorized scans on the table. They need to implement controls to detect and prevent such unauthorized access in the future. Which THREE actions should the security team take? (Choose THREE.)

Select 3 answers
A.Enable AWS CloudTrail logging and create a metric filter for Scan API calls.
B.Use fine-grained access control with IAM conditions to restrict access to specific items or attributes.
C.Disable the Scan operation on the DynamoDB table.
D.Create an IAM policy that denies the 'Scan' action for unauthorized users using a condition key.
E.Enable VPC Flow Logs to monitor traffic to DynamoDB.
AnswersA, B, D

CloudTrail logs API calls, and metric filters can trigger alarms on unauthorized scans.

Why this answer

Options A, B, and D are correct. Option A: Enabling CloudTrail logging and creating a metric filter for Scan API calls allows the security team to detect unauthorized scan attempts in real time and trigger alerts. Option B: Using fine-grained access control with IAM conditions (e.g., 'dynamodb:LeadingKeys' or 'dynamodb:Attributes') restricts access to specific items or attributes, preventing unauthorized scans from retrieving sensitive data.

Option D: Creating an IAM policy that denies the 'Scan' action for unauthorized users using a condition key (e.g., 'aws:SourceIp' or custom tag) provides a preventive control to block unauthorized scans at the API level. Option C is incorrect because disabling the Scan operation on the DynamoDB table would break legitimate use cases that require scanning (e.g., admin queries, reporting) and is not a recommended control. Option E is incorrect because VPC Flow Logs capture network traffic to DynamoDB, not the DynamoDB API operations themselves, so they cannot detect scans.

13
MCQhard

A company is migrating a 10 TB Oracle Data Warehouse to Amazon Redshift. The source database runs on premises with limited bandwidth (100 Mbps). The migration must complete within 5 days. Which approach is most cost-effective and meets the timeline?

A.Use AWS DMS over the internet to migrate data.
B.Use AWS Snowball Edge to transfer the initial full load, then AWS DMS for ongoing changes.
C.Use AWS Schema Conversion Tool (SCT) to convert and then upload to S3.
D.Use AWS DMS with AWS Direct Connect at 1 Gbps.
AnswerB

Snowball is fast and cost-effective for large data transfer.

Why this answer

The 10 TB dataset over a 100 Mbps link would take approximately 10 days (10 TB * 8 / 100 Mbps / 86400 seconds/day) for a full load, exceeding the 5-day window. AWS Snowball Edge provides a physical, high-bandwidth transfer for the initial full load, bypassing network constraints, and AWS DMS then captures and applies ongoing changes (CDC) to keep the target in sync. This combination is the most cost-effective as it avoids expensive Direct Connect and meets the timeline.

Exam trap

The trap here is that candidates often overlook the bandwidth calculation and assume DMS over Direct Connect is always the fastest and most cost-effective, but the question explicitly asks for the most cost-effective solution that meets the timeline, and Snowball Edge avoids the high recurring costs of Direct Connect for a one-time migration.

How to eliminate wrong answers

Option A is wrong because AWS DMS over the internet at 100 Mbps would take over 10 days for the full 10 TB load, failing the 5-day requirement, and is not cost-effective due to potential data transfer costs and instability over the public internet. Option C is wrong because AWS Schema Conversion Tool (SCT) is used for schema conversion and can upload data to S3, but it does not handle ongoing replication (CDC) and relies on network transfer for the full load, which still faces the bandwidth bottleneck. Option D is wrong because while AWS DMS with AWS Direct Connect at 1 Gbps could theoretically transfer 10 TB in under 2 days, the cost of provisioning and maintaining a 1 Gbps Direct Connect connection for a one-time migration is significantly higher than using Snowball Edge, making it not the most cost-effective.

14
Multi-Selecteasy

A company is using Amazon ElastiCache for Redis to cache database query results. The cache cluster is a single node. The application experiences increased latency when the cache misses. Which TWO actions can improve the cache hit ratio?

Select 2 answers
A.Increase the Time-to-Live (TTL) for cached items.
B.Disable persistence to free memory.
C.Decrease the Time-to-Live (TTL) for cached items.
D.Add read replicas to the ElastiCache cluster.
E.Implement lazy loading to populate the cache on read requests.
AnswersA, E

Increasing TTL keeps data in cache longer, reducing cache misses.

Why this answer

Options A and E are correct. Option A: Increasing TTL keeps data in cache longer, reducing cache misses. Option E: Implementing lazy loading populates the cache on read requests, improving hit ratio over time.

Option B is wrong because disabling persistence does not affect cache hit ratio. Option C is wrong because decreasing TTL would increase cache misses. Option D is wrong because adding read replicas improves read throughput but does not improve cache hit ratio.

15
MCQmedium

A social media company runs a large Amazon DynamoDB table (Users) with 10 TB of data. The table uses on-demand capacity. Recently, the application started experiencing occasional ProvisionedThroughputExceeded exceptions during read-heavy periods. The table's read metrics show that consumed read capacity is consistently below 50% of provisioned capacity. The application uses eventually consistent reads. The table has a global secondary index (GSI) on the 'status' attribute. The GSI's read capacity consumption is often at 100% of its provisioned capacity. What is the most likely cause of the throttling?

A.The on-demand capacity mode is not suitable for this workload; switch to provisioned with auto scaling.
B.The base table's read capacity is insufficient despite on-demand mode.
C.The GSI is throttling because its read capacity is not set to on-demand, or the GSI's partition key is causing hot partitions.
D.The application should use strongly consistent reads to reduce throttling.
AnswerC

GSI has its own capacity; if it throttles, base table reads that use the GSI may be throttled.

Why this answer

The GSI has its own read capacity settings. If the GSI is throttled, reads on the base table that require the GSI may also be throttled. Option C is correct because the GSI is likely using provisioned capacity, not on-demand, and its read capacity is often at 100%, causing throttling.

Option A is incorrect because on-demand capacity mode for the base table is not the issue; the issue is the GSI. Option B is incorrect because the base table's read capacity is not the bottleneck (consumed read capacity is below 50%). Option D is incorrect because using strongly consistent reads would increase read consumption, not reduce throttling.

16
Multi-Selectmedium

Which TWO factors should be considered when choosing between Amazon DynamoDB and Amazon RDS for MySQL for a new e-commerce application with variable traffic patterns?

Select 2 answers
A.Ability to perform complex joins and aggregations: DynamoDB supports SQL-like queries.
B.Operational overhead: DynamoDB is serverless, RDS requires patching and provisioning.
C.Support for ACID transactions in both databases.
D.Encryption at rest is only available for RDS.
E.Automatic scaling of throughput with DynamoDB on-demand vs. manual scaling of RDS.
AnswersB, E

DynamoDB is fully managed with no server management; RDS still requires some management.

Why this answer

DynamoDB is a fully managed serverless service that eliminates the need for patching, provisioning, or managing servers, whereas Amazon RDS for MySQL requires manual patching, scaling, and instance provisioning. This operational overhead difference is critical for variable traffic patterns, as DynamoDB automatically handles infrastructure management, reducing administrative burden.

Exam trap

The trap here is that candidates may assume ACID transactions are exclusive to relational databases, but DynamoDB supports ACID transactions within a single table, leading them to incorrectly select option C as a distinguishing factor.

17
Multi-Selectmedium

A company runs a PostgreSQL database on Amazon RDS for a CRM application. The database is 500 GB and experiences high read traffic. The company wants to improve read scalability and reduce latency. Which TWO actions should the company take? (Choose two.)

Select 2 answers
A.Implement Amazon ElastiCache for Redis to cache common queries.
B.Store large objects in Amazon S3 and reference them.
C.Enable Multi-AZ for automatic failover.
D.Create one or more read replicas in the same region.
E.Migrate data to Amazon DynamoDB with Global Tables.
AnswersA, D

Caching reduces database load.

Why this answer

Amazon ElastiCache for Redis can cache the results of frequently executed read queries, offloading read traffic from the RDS PostgreSQL instance and reducing latency for repeated queries. This is especially effective for read-heavy workloads where the same data is requested many times, as Redis provides sub-millisecond response times and reduces the load on the database.

Exam trap

The trap here is that candidates often confuse Multi-AZ (which is for high availability) with read replicas (which are for read scaling), and may incorrectly think that enabling Multi-AZ also distributes read traffic, when in fact the standby instance is not accessible for reads.

18
Multi-Selectmedium

An e-commerce company uses Amazon RDS for MySQL to store order data. They need to run complex analytical queries on the data without impacting the performance of the transactional workload. Which TWO solutions should they implement? (Choose TWO.)

Select 2 answers
A.Migrate the transaction table to Amazon DynamoDB
B.Use Amazon Redshift for analytics and load data via AWS DMS
C.Store order data in Amazon S3 and query with Amazon Athena
D.Enable Multi-AZ to use the standby for queries
E.Create an Amazon RDS read replica for analytical queries
AnswersB, E

Redshift is purpose-built for analytics; DMS can replicate data from RDS.

Why this answer

Amazon Redshift is purpose-built for complex analytical queries on large datasets, and AWS DMS can continuously replicate data from RDS for MySQL into Redshift without impacting the source transactional workload. This separates OLTP and OLAP environments, ensuring performance isolation.

Exam trap

The trap here is that candidates often confuse Multi-AZ read replicas with the standby instance, mistakenly believing the standby can serve queries, when in fact only a dedicated read replica (Option E) can offload read traffic for analytics.

19
MCQmedium

A company is migrating an on-premises MongoDB database to Amazon DocumentDB. The application uses secondary indexes extensively and requires low-latency reads. Which database design consideration is MOST important for this workload?

A.Convert secondary indexes to the DocumentDB-compatible format
B.Provision EBS-optimized instances with increased IOPS
C.Use a larger instance type to avoid indexing issues
D.Enable DynamoDB Accelerator (DAX) for caching
AnswerA

DocumentDB requires indexes to be created in its own format; otherwise queries may not use them.

Why this answer

Secondary indexes in MongoDB must be converted to the Amazon DocumentDB-compatible format. DocumentDB uses a different storage engine and indexing implementation than MongoDB, so indexes created in MongoDB are not automatically compatible. Converting secondary indexes ensures that the query patterns relying on those indexes continue to perform with low-latency reads after migration.

Exam trap

The trap here is that candidates may assume secondary indexes are automatically compatible between MongoDB and DocumentDB, or they may confuse DocumentDB's storage architecture with Amazon RDS's EBS-based instances, leading them to select options about EBS IOPS or instance sizing instead of focusing on index conversion.

How to eliminate wrong answers

Option B is wrong because DocumentDB does not use EBS volumes; it uses a distributed storage architecture with automatically provisioned I/O, so provisioning EBS-optimized instances with increased IOPS is not applicable. Option C is wrong because using a larger instance type does not fix indexing issues; indexing problems are related to index design and compatibility, not instance size. Option D is wrong because DynamoDB Accelerator (DAX) is an in-memory cache for Amazon DynamoDB, not for Amazon DocumentDB; DocumentDB uses its own caching mechanisms.

20
MCQmedium

A company uses Amazon DynamoDB global tables for a multi-region application. They notice that writes in one region are not appearing in another region after several minutes. What should they check first?

A.Check the ReplicationLatency metric in Amazon CloudWatch
B.Verify that auto scaling is configured identically in both regions
C.Ensure DynamoDB Streams are enabled on the table
D.Check the table size in both regions
AnswerA

This metric shows the lag between regions.

Why this answer

The ReplicationLatency metric in CloudWatch directly measures the delay between a write in one region and its replication to another region in DynamoDB global tables. This is the most relevant metric to diagnose replication delays. Option B (auto scaling) affects capacity provisioning, not replication timing.

Option C (DynamoDB Streams) are enabled by default for global tables to facilitate replication, but checking the metric is the immediate next step if delays are observed. Option D (table size) does not directly cause replication delays; replication is asynchronous and not size-dependent.

21
MCQhard

A company runs a financial analytics platform on Amazon DynamoDB. The table stores transaction records with a partition key of account_id and a sort key of transaction_timestamp. Each account has thousands of transactions. The application frequently queries the most recent transactions for a given account_id, sorted by timestamp in descending order. Recently, as the number of accounts grew, the query latency increased significantly. The DynamoDB table has provisioned read capacity of 10,000 RCUs, and CloudWatch metrics show that consumed read capacity is at 60%. The database specialist suspects that the issue is due to the query pattern. Which action should the database specialist take to reduce query latency?

A.Migrate the table to Amazon Aurora PostgreSQL with a secondary index on account_id and transaction_timestamp.
B.Create a Global Secondary Index (GSI) with account_id as partition key and transaction_timestamp as sort key, and query the GSI with ScanIndexForward set to false.
C.Enable DynamoDB Accelerator (DAX) to cache query results.
D.Increase the provisioned read capacity to 20,000 RCUs to handle the load.
AnswerB

A GSI with the desired sort key allows efficient descending queries.

Why this answer

Creating a Global Secondary Index (GSI) with account_id as the partition key and transaction_timestamp as the sort key allows the application to query the most recent transactions for a given account_id efficiently. By setting ScanIndexForward to false in the query, DynamoDB returns items in descending order by sort key, which directly matches the query pattern. This avoids the need to scan all transactions for an account and then sort them, significantly reducing latency.

The existing table's sort key is transaction_timestamp, but the query pattern requires descending order; the GSI provides an optimized access path without changing the base table structure.

Exam trap

The trap here is that candidates may think increasing RCUs or adding caching (DAX) will solve latency issues, but the real problem is the inefficient query pattern that requires scanning and sorting all items for an account, which a properly designed GSI with ScanIndexForward=false directly addresses.

How to eliminate wrong answers

Option A is wrong because migrating to Amazon Aurora PostgreSQL would introduce unnecessary complexity and operational overhead, and it does not address the root cause of the query pattern inefficiency in DynamoDB; the issue is about optimizing the existing NoSQL access pattern, not switching database engines. Option C is wrong because enabling DynamoDB Accelerator (DAX) caches query results but does not reduce the latency of the initial query that must still scan and sort all transactions for an account; DAX helps with repeated queries but not with the underlying inefficient scan-and-sort pattern. Option D is wrong because increasing provisioned read capacity to 20,000 RCUs does not solve the latency problem caused by the query pattern; the consumed read capacity is only at 60%, indicating sufficient capacity, and the latency is due to the need to scan and sort thousands of items per account, not due to throttling.

22
MCQeasy

A company is designing a database for an e-commerce application that needs to store product catalog data. The data is highly structured with relationships between products, categories, and suppliers. The application requires ACID transactions to maintain data integrity when updating inventory. The company expects moderate read and write traffic. Which AWS database service is MOST suitable for this workload?

A.Amazon ElastiCache for Redis
B.Amazon Neptune
C.Amazon RDS for MySQL
D.Amazon DynamoDB
AnswerC

RDS for MySQL provides full ACID compliance and supports relational data structures.

Why this answer

Amazon RDS for MySQL is the most suitable choice because it provides a fully managed relational database that supports ACID transactions, which are essential for maintaining data integrity during inventory updates. The highly structured nature of product catalog data with relationships between products, categories, and suppliers maps naturally to MySQL's relational model with foreign keys and joins. RDS for MySQL handles moderate read/write traffic efficiently and offers features like Multi-AZ for high availability and read replicas for scaling reads.

Exam trap

The trap here is that candidates often pick Amazon DynamoDB for its scalability and performance, but overlook the requirement for ACID transactions and relational joins, which DynamoDB handles poorly compared to a traditional RDBMS like MySQL.

How to eliminate wrong answers

Option A is wrong because Amazon ElastiCache for Redis is an in-memory key-value store that does not support ACID transactions or relational queries; it is designed for caching and session management, not as a primary database for structured relational data. Option B is wrong because Amazon Neptune is a graph database optimized for highly connected data like social networks or recommendation engines, but it is overkill and not designed for ACID-compliant transactional workloads with structured relational schemas. Option D is wrong because Amazon DynamoDB is a NoSQL key-value and document database that does not natively support complex joins, foreign keys, or ACID transactions across multiple items without using expensive transactions API features; it is better suited for unstructured or semi-structured data at scale.

23
MCQeasy

A media company is storing large video files (up to 10 GB each) in Amazon S3 and needs to maintain metadata about each file, including title, duration, and upload timestamp. The workload involves frequent writes (1000+ per second) and occasional read queries by title. Which database is best suited for this metadata store?

A.Amazon Neptune
B.Amazon RDS for MySQL
C.Amazon DynamoDB
D.Amazon ElastiCache for Memcached
AnswerC

DynamoDB supports high write throughput and fast queries by partition key.

Why this answer

Amazon DynamoDB is the best choice because it supports single-digit millisecond latency at any scale, handles over 1000 writes per second with auto-scaling, and can efficiently serve occasional read queries by title using a global secondary index (GSI) on the title attribute. Its fully managed, serverless nature eliminates operational overhead for high-throughput metadata storage.

Exam trap

AWS often tests the misconception that a relational database (RDS) is always the default for metadata, but the high write throughput and simple query pattern here make DynamoDB the correct choice, not RDS.

How to eliminate wrong answers

Option A is wrong because Amazon Neptune is a graph database designed for highly connected data (e.g., social networks, recommendation engines), not for simple key-value or document metadata with high write throughput. Option B is wrong because Amazon RDS for MySQL, while capable of storing metadata, cannot scale to 1000+ writes per second without significant vertical scaling or complex sharding, and its relational overhead (schema, joins) is unnecessary for simple metadata lookups. Option D is wrong because Amazon ElastiCache for Memcached is an in-memory cache, not a persistent database; it would lose data on node failure and cannot serve as a durable metadata store.

24
Multi-Selectmedium

A database specialist is troubleshooting an Amazon DynamoDB table that is experiencing high throttling on write requests. The table has on-demand capacity and uses a composite primary key (partition key and sort key). Which TWO actions should the specialist take to identify and resolve the issue?

Select 2 answers
A.Examine the partition key value distribution to identify hot partitions
B.Implement DynamoDB Accelerator (DAX) to offload read traffic
C.Change the table to provisioned capacity mode
D.Increase the read capacity units on the table
E.Review Amazon CloudWatch metrics for 'WriteThrottleEvents' and 'ConsumedWriteCapacityUnits'
AnswersA, E

Correct. Uneven partition key value distribution leads to hot partitions that exceed per-partition throughput limits. Examining the distribution helps identify the bottleneck, and strategies like write sharding or adjusting the partition key design can resolve the issue.

Why this answer

High throttling on write requests often results from uneven partition key distribution, creating hot partitions. Option A is correct: examining the partition key value distribution helps identify hot partitions. Option E is correct: reviewing CloudWatch metrics for WriteThrottleEvents and ConsumedWriteCapacityUnits helps identify throttled write requests and analyze capacity usage.

Options B, C, and D are incorrect: DAX is a read cache and does not affect write throughput; changing to provisioned capacity or increasing read capacity units does not resolve write throttling caused by hot partitions.

Exam trap

The trap here is that candidates may confuse read and write capacity units or assume that on-demand capacity eliminates all throttling, when in fact hot partitions can still cause throttling regardless of the capacity mode.

25
Multi-Selecteasy

A company is using Amazon RDS for MySQL and wants to implement database activity monitoring to detect suspicious queries. Which TWO AWS services can be used together to achieve this?

Select 2 answers
A.AWS Lambda
B.AWS CloudTrail
C.AWS Systems Manager Patch Manager
D.Amazon Inspector
E.Amazon CloudWatch Logs
AnswersA, E

Can process CloudWatch Logs and detect patterns.

Why this answer

Options A and E are correct. Amazon RDS for MySQL can publish database logs (such as general logs, slow query logs, or audit logs) to Amazon CloudWatch Logs. CloudWatch Logs can then trigger an AWS Lambda function to analyze the logs in real-time and detect suspicious queries.

Option B (AWS CloudTrail) records API calls made to AWS services, not database queries. Option C (AWS Systems Manager Patch Manager) is used for patching OS and applications. Option D (Amazon Inspector) is a vulnerability assessment service, not for database activity monitoring.

26
Multi-Selecteasy

A company is using Amazon DynamoDB and wants to restrict access to a specific table so that only users in a particular IAM group can perform read and write operations. Which THREE steps should be taken to achieve this?

Select 3 answers
A.Create an IAM policy that allows dynamodb:GetItem, dynamodb:PutItem, etc. on the specific table ARN.
B.Attach the IAM policy to an IAM group.
C.Attach a resource-based policy to the DynamoDB table allowing access from the group.
D.Add the users to the IAM group.
E.Create an IAM role and assign it to the table.
AnswersA, B, D

This defines the allowed actions on the table.

Why this answer

The correct answers are A, B, and D. To restrict access to a specific DynamoDB table, you create an IAM policy that allows the required DynamoDB actions on that table's ARN (A). You then attach that policy to an IAM group (B), and add the users who need access to that group (D).

Options C and E are incorrect because DynamoDB does not support resource-based policies, and IAM roles are not directly assigned to tables for access control.

27
Multi-Selectmedium

A company is running an Amazon RDS for MySQL DB instance with Multi-AZ. The company wants to perform a major version upgrade with minimal downtime. Which TWO actions should be taken? (Choose TWO.)

Select 2 answers
A.Use the AWS CLI to modify the DB instance with the --allow-major-version-upgrade flag.
B.Use the AWS Management Console to modify the DB instance and apply the upgrade immediately.
C.Enable automatic minor version upgrades on the DB instance.
D.Create a read replica, upgrade the replica to the new version, and promote it to become the primary.
E.Take a snapshot and restore to the new version.
AnswersB, D

For Multi-AZ, this performs the upgrade on the standby first, then fails over, minimizing downtime.

Why this answer

The correct answers are B and D. Option B: Using the AWS Management Console to modify the DB instance and apply the upgrade immediately is a valid method to perform a major version upgrade, though it will cause some downtime. Option D: Creating a read replica, upgrading it first, and promoting it minimizes downtime because the primary remains available during the upgrade.

Option A is incorrect because the --allow-major-version-upgrade flag is used with the AWS CLI, but it must be combined with a modification; however, simply using the flag is not sufficient. Option C is incorrect because automatic minor version upgrades do not affect major version upgrades. Option E is incorrect because restoring a snapshot does not upgrade the engine version.

28
MCQhard

A company has a MySQL database that stores user profile data. The database is 1 TB and growing. The team wants to archive inactive user profiles that haven't been accessed in over 1 year. The archived data must be queryable but at a slower performance tier. Which approach is most cost-effective?

A.Create an RDS read replica and delete inactive records from the primary
B.Move inactive profiles to Amazon Aurora Serverless and stop the cluster when not in use
C.Export inactive profiles to Amazon S3 and use S3 Intelligent-Tiering for storage
D.Use Amazon DynamoDB with TTL to expire inactive profiles
AnswerC

S3 Intelligent-Tiering optimizes costs, and the data can be queried using Athena.

Why this answer

The most cost-effective because Amazon S3 with Intelligent-Tiering automatically moves data between access tiers (frequent, infrequent, and archive) based on usage, minimizing storage costs for rarely accessed data. Inactive profiles exported to S3 remain queryable via S3 Select or Athena, meeting the requirement for slower query performance at a fraction of the cost of maintaining a relational database instance.

Exam trap

The trap here is that candidates confuse 'archiving' with 'expiring' or 'replicating,' and assume that a database service (like Aurora Serverless or DynamoDB) is required for queryability, overlooking S3's ability to serve as a queryable data lake via Athena or S3 Select.

How to eliminate wrong answers

Option A is wrong because creating a read replica does not reduce storage costs for the primary database; the replica incurs additional compute and storage charges, and deleting inactive records from the primary does not address the need for queryable archived data. Option B is wrong because Aurora Serverless incurs costs for compute capacity when active and storage costs for the data volume; stopping the cluster does not eliminate storage charges for the 1 TB of archived data, and Aurora is not designed for long-term, low-cost archival storage. Option D is wrong because DynamoDB TTL automatically deletes expired items, not archives them; the data is permanently removed and cannot be queried after expiration, failing the requirement for queryable archived data.

29
MCQhard

A company runs a MongoDB workload on Amazon EC2 and wants to migrate to Amazon DocumentDB. The database has a total size of 2 TB and experiences 10,000 writes per second during peak. Which migration strategy minimizes downtime?

A.Export data using mongodump and import with mongorestore.
B.Use AWS Glue to stream data to DocumentDB.
C.Use AWS DMS with continuous replication.
D.Copy data files to Amazon S3 and load into DocumentDB.
AnswerC

DMS supports live migration with minimal downtime.

Why this answer

AWS DMS with continuous replication (change data capture) is the correct strategy because it allows you to keep the source MongoDB and target DocumentDB synchronized in near-real time, minimizing downtime to a brief cutover window. For a 2 TB database with 10,000 writes per second, a full export/import would take hours and require significant downtime, while DMS handles the initial full load and then continuously applies ongoing changes until you switch over.

Exam trap

The trap here is that candidates often assume a simple export/import (mongodump/mongorestore) is sufficient, but they overlook the requirement for minimal downtime with a high-write workload, where only a CDC-capable tool like DMS can keep the target synchronized during migration.

How to eliminate wrong answers

Option A is wrong because mongodump/mongorestore performs a full logical backup and restore, which for a 2 TB database would take many hours and require the source to be quiesced or read-only during the dump, causing extended downtime; it also does not support continuous replication to reduce the cutover window. Option B is wrong because AWS Glue is an ETL service designed for batch processing and data transformation, not for real-time streaming or continuous replication of database writes; it lacks the change data capture (CDC) capability needed to keep a live database synchronized with minimal downtime. Option D is wrong because copying data files to S3 and loading into DocumentDB is not a supported migration method; DocumentDB does not accept raw data files from MongoDB, and there is no native mechanism to ingest from S3 directly into a DocumentDB cluster.

30
MCQeasy

A gaming company wants to store player profiles and game state. The data is accessed via a REST API and must be highly available with single-digit millisecond latency. The schema is simple and may evolve over time. Which database should they use?

A.Amazon DynamoDB
B.Amazon S3
C.Amazon RDS for PostgreSQL
D.Amazon Redshift
AnswerA

DynamoDB provides low latency, high availability, and schema flexibility.

Why this answer

Amazon DynamoDB is the correct choice because it is a fully managed NoSQL key-value and document database that delivers single-digit millisecond latency at any scale, making it ideal for high-availability gaming workloads. Its schema-less design allows the player profile and game state schema to evolve over time without downtime or complex migrations, and it integrates seamlessly with REST APIs via AWS SDKs or API Gateway.

Exam trap

The trap here is that candidates often choose Amazon RDS for PostgreSQL because they assume relational databases are required for structured data, overlooking DynamoDB's schema-less design and its ability to handle evolving schemas with single-digit millisecond latency at scale.

How to eliminate wrong answers

Option B (Amazon S3) is wrong because S3 is an object storage service designed for blob data (e.g., files, images) and does not support single-digit millisecond query latency for structured data access; it also lacks native support for complex queries or schema evolution required for player profiles. Option C (Amazon RDS for PostgreSQL) is wrong because while it supports schema evolution, it is a relational database that requires upfront schema definition and can experience latency spikes under high concurrency; it is not optimized for the single-digit millisecond latency and massive scale required by gaming state data. Option D (Amazon Redshift) is wrong because it is a columnar data warehouse optimized for analytical queries on large datasets, not for transactional, low-latency reads/writes of player profiles and game state; its latency is typically in the hundreds of milliseconds to seconds.

31
MCQeasy

A company is designing a database for a global e-commerce application that requires low-latency reads and writes with strong consistency. The application is expected to handle millions of requests per second and requires high availability. Which AWS database service is most suitable for this workload?

A.Amazon ElastiCache for Memcached
B.Amazon S3 with S3 Select
C.Amazon RDS for MySQL with Multi-AZ deployment
D.Amazon DynamoDB with DynamoDB Accelerator (DAX)
AnswerD

DynamoDB provides scalable, low-latency, strongly consistent performance suitable for high-request-rate applications.

Why this answer

Amazon DynamoDB with DAX is the most suitable choice because DynamoDB itself provides single-digit millisecond latency at any scale, supports strong consistency for both reads and writes (via ConsistentRead=true for reads), and is designed for high availability and millions of requests per second. DAX is an in-memory cache that accelerates reads, but it only supports eventual consistency; however, reads requiring strong consistency can be served directly from DynamoDB while DAX handles the majority of eventually consistent reads, thereby meeting the low-latency and strong consistency requirements of the application.

Exam trap

The trap here is that candidates often confuse Amazon ElastiCache as a primary database solution for low-latency workloads, overlooking that it lacks durability and strong consistency, and instead choose it over DynamoDB with DAX which is purpose-built for such requirements.

How to eliminate wrong answers

Option A is wrong because Amazon ElastiCache for Memcached is an in-memory caching layer that does not provide strong consistency or durable writes; it is designed for caching, not as a primary database with ACID-like guarantees. Option B is wrong because Amazon S3 with S3 Select is an object storage service optimized for large-scale data lakes and analytics, not for transactional workloads requiring low-latency reads and writes with strong consistency; it lacks the atomicity and consistency features needed for e-commerce transactions. Option C is wrong because Amazon RDS for MySQL with Multi-AZ deployment provides high availability but cannot handle millions of requests per second due to its single-primary architecture and limited scalability; it also introduces replication lag that can compromise strong consistency under heavy write loads.

32
MCQmedium

Refer to the exhibit. An IAM policy is attached to a user who will manage AWS DMS tasks. When the user tries to start a replication task, they receive an access denied error. What is the most likely cause?

A.The policy does not allow rds:DescribeDBInstances
B.The policy does not allow the dms:StartReplicationTask action
C.The policy is missing permissions to describe endpoints and connections
D.The policy does not allow dms:CreateReplicationTask
AnswerC

To start a replication task, DMS needs to describe endpoints and connections; these actions are missing from the policy.

Why this answer

The DMS API requires that a user have permissions to describe endpoints and connections before starting a replication task. Even if the policy grants dms:StartReplicationTask, the service internally calls dms:DescribeEndpoints and dms:DescribeConnections to validate the source and target endpoints. Without those describe permissions, the API call fails with an access denied error, even though the start action itself is allowed.

Exam trap

The trap here is that candidates assume the error is due to a missing start action (Option B) when the policy actually includes it, but they overlook that DMS requires additional describe permissions for endpoints and connections as a prerequisite to starting a task.

How to eliminate wrong answers

Option A is wrong because rds:DescribeDBInstances is not required to start a DMS replication task; DMS uses its own endpoints and connections, not direct RDS instance descriptions. Option B is wrong because the policy explicitly includes dms:StartReplicationTask (as shown in the exhibit), so the error is not due to a missing start action. Option D is wrong because dms:CreateReplicationTask is only needed to create a new task, not to start an existing one; the user is attempting to start an already created task.

33
MCQhard

A company is migrating a 500 GB PostgreSQL database from on-premises to Amazon Aurora PostgreSQL. The migration must have a recovery point objective (RPO) of less than 5 minutes and a recovery time objective (RTO) of less than 30 minutes. Which migration strategy should the company use?

A.Create a read replica of the on-premises database and promote it.
B.Use AWS DMS with full load and ongoing replication.
C.Take a full backup using pg_basebackup and restore to Aurora.
D.Use pg_dump to export the database and import into Aurora.
AnswerB

Ongoing replication achieves low RPO.

Why this answer

AWS DMS with full load and ongoing replication is the correct strategy because it supports continuous change data capture (CDC) from the on-premises PostgreSQL source to Amazon Aurora PostgreSQL, enabling an RPO of less than 5 minutes. The full load phase migrates the initial 500 GB, and ongoing replication keeps the target synchronized with minimal lag, while Aurora’s automated failover and fast recovery help achieve an RTO under 30 minutes.

Exam trap

The trap here is that candidates often assume pg_basebackup or pg_dump can meet low RPO/RTO by combining with manual log shipping, but they overlook that these methods lack built-in continuous replication and automated failover, which are essential for the stated recovery objectives.

How to eliminate wrong answers

Option A is wrong because creating a read replica of the on-premises database and promoting it is not supported for cross-platform migration from on-premises to Aurora; PostgreSQL read replicas require a primary instance within the same environment or a compatible cloud service, and Aurora does not support direct replication from an external PostgreSQL instance. Option C is wrong because taking a full backup using pg_basebackup and restoring to Aurora provides only a point-in-time snapshot without ongoing replication, resulting in an RPO equal to the backup interval (often hours) and failing to meet the sub-5-minute requirement. Option D is wrong because using pg_dump to export and import into Aurora is a one-time logical dump that does not support continuous replication, leading to significant data loss between the dump and cutover, which violates the RPO requirement.

34
MCQeasy

A company is using Amazon DynamoDB and needs to export data to Amazon S3 for analysis. Which AWS service can perform this export without writing custom code?

A.AWS Data Pipeline
B.Amazon EMR
C.AWS Glue
D.DynamoDB Console
AnswerC

Glue can run ETL jobs to export DynamoDB data to S3.

Why this answer

AWS Glue provides a built-in DynamoDB-to-S3 export feature that requires no custom code. You can create a Glue job using the 'Export DynamoDB table to S3' blueprint, which automatically handles schema inference, data conversion, and partitioning. This is the only option that directly supports the export without writing any code.

Exam trap

The trap here is that candidates may choose AWS Data Pipeline because it is a traditional ETL service, but they overlook that AWS Glue now offers a simpler, code-free export blueprint specifically for DynamoDB-to-S3, making it the most direct answer.

How to eliminate wrong answers

Option A is wrong because AWS Data Pipeline requires defining a pipeline with activities and resources, which involves configuration but not custom code; however, it is not the simplest or most direct service for this task and is deprecated in favor of Glue. Option B is wrong because Amazon EMR requires you to write or run custom scripts (e.g., Spark or Hive) to export data from DynamoDB to S3, which does not meet the 'without writing custom code' requirement. Option D is wrong because the DynamoDB Console only allows manual export of table data to S3 via the 'Export to S3' feature, but this is a one-time, manual operation, not an automated service; the question asks for a 'service' that can perform the export, and the console is a UI, not a service.

35
MCQmedium

A company uses Amazon Aurora MySQL for its online transaction processing (OLTP) application. Recently, read traffic has increased significantly, causing performance issues. The company wants to offload read traffic with minimal application changes. Which solution should they implement?

A.Enable Multi-AZ deployment
B.Create one or more Aurora Replicas
C.Migrate to Amazon DynamoDB
D.Add an Amazon ElastiCache cluster in front of Aurora
AnswerB

Aurora Replicas are read-only copies that offload read traffic.

Why this answer

Aurora Replicas are designed specifically to offload read traffic from the primary Aurora instance with minimal application changes. They connect to the same shared storage volume as the primary, so replication is nearly instantaneous and requires no additional storage overhead. The application can use the Aurora reader endpoint to distribute read queries across up to 15 low-latency replicas.

Exam trap

The trap here is that candidates confuse Multi-AZ with read scaling, assuming the standby instance can serve reads, but in standard RDS Multi-AZ the standby is not active for reads unless using Aurora's Multi-AZ with reader endpoint, which is actually an Aurora Replica feature.

How to eliminate wrong answers

Option A is wrong because Multi-AZ deployment provides high availability and automatic failover, but it does not offload read traffic—the standby instance is not used for reads unless a reader endpoint is explicitly configured, and even then it is not designed for scaling read capacity. Option C is wrong because migrating to DynamoDB would require significant application changes to adapt from a relational SQL model to a NoSQL key-value and document data model, which contradicts the requirement for minimal application changes. Option D is wrong because adding an ElastiCache cluster introduces a caching layer that requires application code changes to implement cache-aside or other caching patterns, and it does not directly offload read traffic from Aurora without modifying queries.

36
MCQeasy

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database is 2 TB in size and has a 100 Mbps internet connection. The migration must be completed within 3 days with minimal downtime. Which approach is MOST suitable?

A.Export the database as a dump file, upload to S3, and restore to RDS.
B.Use AWS Database Migration Service (DMS) with a full load from an AWS Snowball device, then ongoing replication.
C.Use AWS DMS with full load over the internet, then ongoing replication.
D.Create a VPN connection to AWS and use Oracle Data Pump over the VPN.
AnswerB

Snowball handles the initial large data transfer, and DMS provides minimal downtime replication.

Why this answer

The 2 TB database cannot be fully loaded over a 100 Mbps internet connection within 3 days (theoretical max transfer ~2.6 TB in 3 days, but real-world throughput is lower due to overhead and contention). AWS Snowball provides a physical appliance to transfer the full load offline, bypassing bandwidth constraints, and then AWS DMS ongoing replication captures and applies changes with minimal downtime.

Exam trap

The trap here is that candidates underestimate the real-world throughput of a 100 Mbps link for a 2 TB transfer, assuming theoretical maximum speeds, and overlook the Snowball option as a viable offline data transfer method for large databases with tight timelines.

How to eliminate wrong answers

Option A is wrong because exporting to a dump file, uploading to S3, and restoring to RDS requires significant downtime for the export and restore, and the 100 Mbps connection makes the upload of a 2 TB dump file impractical within 3 days (estimated >50 hours at full speed, ignoring overhead). Option C is wrong because AWS DMS full load over the internet with a 100 Mbps link cannot complete the initial 2 TB transfer within 3 days due to bandwidth limitations and network overhead, risking migration failure. Option D is wrong because Oracle Data Pump over a VPN over the same 100 Mbps internet connection still faces the same bandwidth bottleneck, and the VPN adds encryption overhead, making the transfer even slower.

37
MCQhard

A database team is migrating an on-premises Oracle database to Amazon Aurora PostgreSQL. The team needs to ensure minimal downtime and data consistency. Which approach should be used?

A.Use the PostgreSQL foreign data wrapper (FDW) to link the Oracle database
B.Use AWS Server Migration Service (SMS) to replicate the database
C.Use AWS Database Migration Service (DMS) with ongoing replication using change data capture (CDC)
D.Use pg_dump and pg_restore to migrate the data during a maintenance window
AnswerC

AWS DMS with ongoing CDC replication captures incremental changes from the Oracle source redo logs, enabling near-zero downtime migration by continuously synchronising transactions to Aurora PostgreSQL until cutover. This satisfies the stem’s requirement for minimal downtime and data consistency, as CDC maintains transactional integrity without halting the source database during the bulk load phase.

Why this answer

AWS DMS with ongoing replication using change data capture (CDC) is the correct approach because it enables a live migration with minimal downtime. DMS can perform a full load of the Oracle database and then continuously replicate ongoing changes from Oracle to Aurora PostgreSQL, ensuring data consistency at the point of cutover. This method avoids the need for a long maintenance window and supports heterogeneous migrations with automatic schema conversion.

Exam trap

The trap here is that candidates often confuse AWS DMS with simpler dump-and-restore tools (pg_dump/pg_restore) or assume that a foreign data wrapper can perform a migration, when in fact DMS is the only AWS managed service designed specifically for heterogeneous database migrations with minimal downtime via CDC.

How to eliminate wrong answers

Option A is wrong because the PostgreSQL foreign data wrapper (FDW) is used for querying remote databases in real-time, not for migrating data with minimal downtime and consistency guarantees; it does not provide a managed replication or cutover mechanism. Option B is wrong because AWS Server Migration Service (SMS) is designed for migrating virtual machines (VMs) from on-premises to AWS, not for database-level replication; it cannot handle heterogeneous database migrations or CDC. Option D is wrong because pg_dump and pg_restore require taking the source database offline or using a maintenance window, which contradicts the requirement for minimal downtime; this approach also does not support ongoing replication to keep data consistent during migration.

38
MCQmedium

A company is migrating a 2 TB on-premises Oracle database to Amazon RDS for Oracle. The migration must have minimal downtime and support ongoing replication. Which AWS service should be used to accomplish this?

A.AWS Schema Conversion Tool (AWS SCT)
B.AWS DataSync
C.AWS Glue
D.AWS Database Migration Service (AWS DMS)
AnswerD

AWS DMS supports minimal-downtime migrations and ongoing replication.

Why this answer

AWS DMS is the correct choice because it supports homogeneous migrations (Oracle to Oracle) with minimal downtime through ongoing replication using change data capture (CDC). It can handle a 2 TB database by using a large enough replication instance and enabling task logging for validation, ensuring data consistency during the migration.

Exam trap

The trap here is that candidates might confuse AWS DMS with AWS SCT, assuming schema conversion is needed for an Oracle-to-Oracle migration, but DMS handles both schema and data migration natively for homogeneous migrations without requiring SCT.

How to eliminate wrong answers

Option A is wrong because AWS SCT is used for schema conversion when migrating between heterogeneous database engines (e.g., Oracle to Aurora PostgreSQL), not for ongoing replication or minimal-downtime migration within the same engine. Option B is wrong because AWS DataSync is designed for transferring large files over NFS/SMB to Amazon S3 or EFS, not for database-level replication or CDC. Option C is wrong because AWS Glue is an ETL service for data preparation and analytics, not for live database migration with ongoing replication.

39
MCQmedium

Refer to the exhibit. An IAM policy is attached to a user. The user attempts to create an RDS DB instance named 'new-prod-db' with Oracle Standard Edition Two engine. What will happen?

A.The request will fail because the Deny condition matches the engine.
B.The request will fail because there is no Allow for 'new-prod-db'.
C.The request will succeed because the Allow matches the name pattern.
D.The request will succeed because the Deny is not effective for 'new-prod-db'.
AnswerA

Explicit Deny for Oracle denies the action.

Why this answer

The IAM policy includes an explicit Deny for the `rds:CreateDBInstance` action when the engine is `oracle-se2`, which matches the Oracle Standard Edition Two engine. Since explicit Deny statements override any Allow statements, the request fails regardless of the name pattern match. AWS IAM evaluates Deny statements first, making the Deny effective and blocking the operation.

Exam trap

The trap here is that candidates assume a matching Allow on the resource name will override a Deny, but AWS IAM's explicit Deny always takes precedence, making the engine-specific Deny the decisive factor.

How to eliminate wrong answers

Option B is wrong because an explicit Deny overrides the absence of an Allow; the Deny on the engine causes failure, not the lack of an Allow for the name. Option C is wrong because while the Allow matches the name pattern 'new-prod-db', the explicit Deny on the engine takes precedence and blocks the request. Option D is wrong because the Deny is effective for 'new-prod-db' since the engine condition matches 'oracle-se2', and Deny statements are always evaluated before Allow statements.

40
MCQeasy

A database administrator needs to track changes to an Amazon RDS DB instance's configuration, such as modifications to the DB instance class or security group. Which AWS service should be used?

A.Amazon CloudWatch Logs
B.AWS Config
C.AWS CloudTrail
D.AWS Systems Manager Patch Manager
AnswerB

AWS Config tracks configuration changes and provides a history.

Why this answer

AWS Config records configuration changes to RDS instances. Option A is wrong because CloudWatch Logs are for log data, not configuration changes. Option C is wrong because CloudTrail records API calls, not configuration state.

Option D is wrong because Systems Manager Patch Manager is for patching.

41
MCQhard

The security team reports that the database 'mydb' is not encrypted. However, the CLI output shows 'StorageEncrypted' is true. What is the MOST likely reason for the security team's concern?

A.The database is using a default AWS managed key instead of a customer-managed key.
B.The KMS key specified may have been disabled or deleted, causing the database to be inaccessible or not encrypted.
C.The 'StorageEncrypted' field is false, but the CLI output shows true.
D.The database is not using a KMS key and is instead using a CloudHSM key.
AnswerB

If the KMS key is disabled or deleted, the database may not be able to encrypt/decrypt data, leading to security concerns.

Why this answer

The security team's concern likely stems from the possibility that the KMS key specified for encryption might have been disabled or deleted. Even though 'StorageEncrypted' is true, if the KMS key is not available, the database may become inaccessible or the encryption may not be effective. Option A is incorrect because using a default AWS managed key still provides encryption; the security team's concern is about encryption itself, not key type.

Option C is incorrect because the CLI output clearly shows 'StorageEncrypted' is true, so the field is not false. Option D is incorrect because there is no indication that a CloudHSM key is involved, and using a KMS key is the standard approach for RDS encryption.

42
MCQmedium

A company is using Amazon ElastiCache for Redis as a caching layer. The application performance degrades when cache misses increase. Which metric should be monitored to track the cache hit rate?

A.CurrConnections
B.CacheHits and CacheMisses
C.CPUUtilization
D.Evictions
AnswerB

CacheHits and CacheMisses are used to calculate hit rate.

Why this answer

CacheHits and CacheMisses. The cache hit rate is calculated as CacheHits / (CacheHits + CacheMisses), so monitoring both metrics is essential. Option A (CurrConnections) tracks active connections, not hit rate.

Option C (CPUUtilization) reflects resource usage. Option D (Evictions) indicates memory pressure but does not directly measure hit rate.

43
MCQhard

A security engineer runs the commands shown in the exhibit for an RDS MySQL DB instance. The engineer wants to enforce SSL connections to the database. What should the engineer do?

A.Modify the default.mysql8.0 parameter group to set require_secure_transport to ON and reboot the instance.
B.Run the modify-db-instance command with --require-ssl-transport.
C.Create a custom DB parameter group with require_secure_transport set to ON, associate it with the DB instance, and reboot the instance.
D.Modify the DB instance and set the --enable-iam-database-authentication flag.
AnswerC

This is the correct method to enforce SSL.

Why this answer

Enforcing SSL for MySQL requires setting require_secure_transport to ON in a custom DB parameter group, then associating it with the DB instance and rebooting. Option A is wrong because the default parameter group cannot be modified. Option B is wrong because there is no --require-ssl-transport flag; the setting is a parameter group parameter, not an instance-level flag.

Option D is wrong because IAM database authentication does not enforce SSL connections.

44
MCQhard

A company is migrating an on-premises Oracle data warehouse to AWS. The warehouse contains 20 TB of data and supports complex SQL queries with joins and aggregations. The migration should minimize downtime and require minimal changes to existing SQL queries. Which database service is MOST appropriate?

A.Amazon RDS for Oracle
B.Amazon DynamoDB
C.Amazon ElastiCache for Redis
D.Amazon Redshift
AnswerD

Redshift is purpose-built for data warehousing with complex query support.

Why this answer

Amazon Redshift is the most appropriate choice because it is a fully managed, petabyte-scale data warehouse service designed for complex SQL queries with joins and aggregations. It supports standard SQL with minimal changes to existing queries, and its columnar storage and massively parallel processing (MPP) architecture are optimized for analytical workloads. The 20 TB data size and requirement to minimize downtime align with Redshift's ability to perform online resizing and use features like RA3 nodes with managed storage for elastic scaling.

Exam trap

The trap here is that candidates may choose Amazon RDS for Oracle because they recognize Oracle as a familiar database, overlooking that RDS is optimized for OLTP, not for the analytical, large-scale data warehouse workload described in the question.

How to eliminate wrong answers

Option A is wrong because Amazon RDS for Oracle is a transactional (OLTP) database not optimized for complex analytical queries with joins and aggregations on 20 TB of data; it lacks the MPP architecture and columnar storage needed for data warehouse performance. Option B is wrong because Amazon DynamoDB is a NoSQL key-value and document database that does not support complex SQL joins or aggregations, and it is designed for high-throughput, low-latency transactional workloads, not analytical queries. Option C is wrong because Amazon ElastiCache for Redis is an in-memory cache, not a persistent data warehouse; it cannot handle 20 TB of data cost-effectively and does not support complex SQL queries with joins and aggregations.

45
MCQmedium

A team is using Amazon RDS for Oracle with an option group that includes the Oracle Enterprise Manager (OEM) option. After modifying the option group to add a new option, the DB instance is stuck in the 'modifying' state for an extended period. What should the team do?

A.Reboot the DB instance to complete the modification.
B.Contact AWS Support to force the modification.
C.Create a new DB instance with the desired options and migrate the data.
D.Modify the DB instance again to reset the state.
AnswerA

Some option changes require a reboot to take effect.

Why this answer

Adding certain options may require a reboot. Option B is incorrect because the option group modification is likely valid; the issue is that it requires a reboot. Option C is incorrect because modifying the DB instance again would not help.

Option D is incorrect because the DB instance is not in a failed state.

46
MCQhard

Refer to the exhibit. An IAM policy is attached to a user. The user reports that they cannot delete the production-db database. Which statement best explains the behavior?

A.An explicit Deny statement prevents the deletion of the production-db instance
B.The user needs additional permissions to delete any DB instance
C.The user does not have permission to describe DB instances
D.The user does not have permission to create a DB instance
AnswerA

Explicit Deny overrides Allow.

Why this answer

The IAM policy includes an explicit Deny statement that specifically denies the DeleteDBInstance action on the production-db instance. In IAM, an explicit Deny overrides any Allow, so even if other statements allow DeleteDBInstance, this Deny prevents the deletion. Option B is incorrect because the policy does allow DeleteDBInstance on other resources, so the issue is not a lack of general permissions.

Option C is incorrect because the policy includes Allow on DescribeDBInstances. Option D is incorrect because the policy does not restrict CreateDBInstance; the problem is specific to deletion of production-db.

47
MCQhard

A database specialist is troubleshooting a performance issue on an Amazon RDS for MySQL DB instance. The CPU utilization is consistently above 90%, but the IOPS and memory metrics are well within limits. Which tool should the specialist use to identify the root cause?

A.Enable AWS CloudTrail to log database queries.
B.Use Amazon RDS Enhanced Monitoring to view OS-level metrics.
C.Check RDS events in the AWS Management Console.
D.Use Amazon RDS Performance Insights to identify the top SQL queries by CPU usage.
AnswerD

Performance Insights provides query-level performance data.

Why this answer

Amazon RDS Performance Insights provides a database performance tuning and monitoring feature that visualizes database load and helps identify the top SQL queries consuming the most CPU. Since the CPU is consistently above 90% while IOPS and memory are normal, Performance Insights can directly correlate high CPU usage to specific SQL statements, enabling the specialist to pinpoint the root cause efficiently.

Exam trap

The trap here is that candidates confuse Enhanced Monitoring (OS-level metrics) with Performance Insights (database-level query analysis), assuming OS metrics alone can identify the specific SQL causing high CPU, when in fact they only show the symptom, not the cause.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail logs API calls and management actions, not database queries or SQL execution details, so it cannot help identify CPU-intensive queries. Option B is wrong because Amazon RDS Enhanced Monitoring provides OS-level metrics (e.g., CPU, memory, disk I/O at the hypervisor level) but does not show which SQL queries are consuming CPU; it only indicates that CPU is high, not the cause. Option C is wrong because RDS events in the AWS Management Console notify about operational events (e.g., failovers, maintenance) but do not provide query-level performance data or SQL execution details.

48
MCQhard

A company is deploying an Amazon Aurora MySQL database. The company requires that the database withstand the loss of two copies of data without impacting write availability. Which configuration should the company use?

A.Aurora with 3 copies of data in 3 Availability Zones
B.Aurora with 2 copies of data in 2 Availability Zones
C.Aurora with 3 copies of data in 2 Availability Zones
D.Aurora with 6 copies of data across 3 Availability Zones
AnswerD

Aurora automatically stores 6 copies across 3 AZs, allowing it to tolerate loss of two copies without affecting write availability.

Why this answer

Aurora MySQL stores 6 copies of data across 3 Availability Zones. The database can withstand the loss of up to two copies without affecting write availability, provided the copies are distributed across AZs. Option D (6 copies across 3 AZs) is correct.

Option A (3 copies in 3 AZs) is incorrect because Aurora uses 6 copies, not 3. Option B (2 copies in 2 AZs) provides insufficient redundancy. Option C (3 copies in 2 AZs) is not the architecture; Aurora uses 6 copies across 3 AZs.

49
Multi-Selectmedium

A company runs an Amazon RDS for MySQL DB instance in a VPC. Security requirements mandate that only specific EC2 instances in the same VPC can connect to the database. The security group attached to the RDS instance currently allows inbound traffic on port 3306 from 0.0.0.0/0. Which combination of steps should a database specialist take to meet the security requirement without impacting existing application connectivity? (Choose two.)

Select 2 answers
A.Modify the network ACL for the DB subnet to allow inbound port 3306 from the EC2 instance's private IP.
B.Remove the inbound rule for 0.0.0.0/0 on the RDS security group.
C.Add an inbound rule to the RDS security group referencing the security group ID of the EC2 instances.
D.Modify the DB subnet group to place the RDS instance in a public subnet with a route to the EC2 instance.
E.Add an inbound rule to the RDS security group allowing traffic from the VPC CIDR on port 3306.
AnswersB, C

Removing the overly permissive rule is necessary to restrict access.

Why this answer

Removing the overly permissive inbound rule for 0.0.0.0/0 on the RDS security group eliminates unrestricted access, which is a direct violation of the security requirement. Option C is correct because adding an inbound rule that references the security group ID of the EC2 instances allows traffic only from those instances, leveraging security group referencing for granular, stateful access control within the same VPC.

Exam trap

The trap here is that candidates often confuse network ACLs with security groups, thinking that modifying the NACL at the subnet level is sufficient, but they overlook that NACLs are stateless and less granular, while security group referencing provides precise, stateful control for instance-to-instance communication.

50
MCQmedium

A gaming company uses Amazon Aurora PostgreSQL for its leaderboard data. The database has a writer instance and two reader instances. The application frequently queries the leaderboard to display top players. The queries involve sorting and aggregation on a large table with millions of rows. Recently, the queries started timing out during peak hours. The database administrator analyzed the workload and found that the reader instances are underutilized, while the writer instance has high CPU due to write operations. The administrator wants to offload the read-heavy leaderboard queries to the readers without modifying the application code. What should the administrator do?

A.Configure the application to use the Aurora reader endpoint for read-only queries.
B.Upgrade the writer instance to a larger instance class to handle both read and write operations.
C.Create additional reader instances to distribute the read load.
D.Implement a read-only Aurora cluster and point read queries to it.
AnswerA

The reader endpoint load balances across readers, offloading reads from the writer.

Why this answer

The Amazon Aurora reader endpoint automatically distributes read-only connections across all available reader instances. Since the reader instances are underutilized, using the reader endpoint offloads the read-heavy leaderboard queries from the writer instance without any application code modifications. Option B is incorrect because upgrading the writer instance does not offload read queries and does not utilize the underutilized readers.

Option C is incorrect because the existing readers are underutilized; adding more readers would not solve the problem of directing queries to them. Option D is incorrect because creating a separate read-only Aurora cluster is unnecessary and more complex than using the existing reader endpoint.

51
MCQeasy

A company is using Amazon DynamoDB and has enabled DynamoDB Streams. The application needs to process stream records in real-time. Which AWS service can be used to invoke a Lambda function automatically for each stream record?

A.Amazon Kinesis Data Firehose
B.Amazon Simple Queue Service (SQS)
C.AWS Step Functions
D.AWS Lambda
AnswerD

AWS Lambda can be directly integrated with DynamoDB Streams to automatically process each stream record in real-time.

Why this answer

DynamoDB Streams can be directly integrated with AWS Lambda, enabling automatic invocation of a Lambda function for each stream record in near real-time. This is the natural choice for processing stream records without additional services. Option A (Amazon Kinesis Data Firehose) is used to load streaming data into data stores, not to invoke Lambda.

Option B (Amazon SQS) is a message queue service; DynamoDB Streams does not directly integrate with SQS, and Lambda would still be needed to poll or process. Option C (AWS Step Functions) orchestrates workflows but does not directly trigger from DynamoDB Streams without Lambda.

52
MCQhard

A company uses Amazon DynamoDB with global tables for a multi-region application. The application writes to the table in us-east-1. A developer notices that updates made in us-east-1 are not appearing in the replica in eu-west-1 after several minutes. Which action should be taken to diagnose the issue?

A.Review the CloudWatch metrics for ReplicationLatency and PendingReplicationCount for the global table.
B.Modify the application to use the eu-west-1 endpoint for writes.
C.Check that the table has an active DynamoDB Streams stream with StreamSpecification set to KEYS_ONLY.
D.Verify that the TTL attribute on the table is correctly configured.
AnswerA

These metrics show the replication status and can identify delays or errors in the replication process.

Why this answer

CloudWatch metrics ReplicationLatency (the time lag between when an item is written to one replica and when it appears in another) and PendingReplicationCount (the number of items waiting to be replicated) directly help diagnose replication delays in DynamoDB global tables. Option B is incorrect because writes should continue to the local region (us-east-1); using the eu-west-1 endpoint would not resolve replication latency and could cause consistency issues. Option C is incorrect because DynamoDB Streams is automatically enabled for global tables with NEW_AND_OLD_IMAGES (not KEYS_ONLY) to replicate updates; checking the stream specification is not a diagnostic step for delays.

Option D is incorrect because TTL (Time to Live) is for automatic item expiration, not related to replication performance or delays.

53
Matchingmedium

Match each database engine to its default port number.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

3306

5432

1521

1433

3306

Why these pairings

The default ports are: MySQL on 3306, PostgreSQL on 5432, Oracle on 1521, and SQL Server on 1433. Common confusions include swapping MySQL and PostgreSQL ports.

54
MCQmedium

A company is using Amazon Aurora MySQL and needs to audit all database logins, including failed attempts, and store the audit logs for one year for compliance. The logs must be immutable and accessible only by the security team. Which solution should the company implement?

A.Enable VPC Flow Logs to capture network connections to the database endpoint.
B.Enable AWS CloudTrail to log database login events.
C.Enable RDS for Aurora database activity streams, stream to CloudWatch Logs, and export to S3 with S3 Object Lock enabled.
D.Enable the standard MySQL audit log plugin and store logs in a database table with restricted access.
AnswerC

Activity streams provide immutable audit logs.

Why this answer

Amazon Aurora MySQL supports Database Activity Streams, which capture detailed audit information including login attempts (both successful and failed). These streams can be sent to Amazon CloudWatch Logs for monitoring and then exported to Amazon S3. To ensure immutability and restricted access, S3 Object Lock can be enabled, preventing any updates or deletions, and S3 bucket policies can limit access to only the security team.

Option A is incorrect because VPC Flow Logs capture network-level traffic, not database login events. Option B is incorrect because AWS CloudTrail logs API calls made to AWS services, not database-level login attempts. Option D is incorrect because the standard MySQL audit log plugin stores logs in a table that can be modified, lacking immutability, and does not natively integrate with S3 Object Lock for long-term immutable storage.

55
MCQeasy

A small business runs a web application on a single Amazon RDS for MySQL DB instance. The application uses a master user account for all database operations. The security team is concerned about the risk of SQL injection and wants to implement the principle of least privilege. They want to create separate database users for read-only and read-write operations. The application currently uses a single connection string. The developer needs to modify the application to use two separate users. What is the correct approach to implement this securely?

A.Use stored procedures for all database operations and grant execute only to the master user.
B.Keep using the master user but restrict its IP address.
C.Enable IAM database authentication and use a single IAM role.
D.Create a read-only user and a read-write user in the database, grant minimal privileges, and modify the application to use the appropriate user for each operation.
AnswerD

Enforces least privilege.

Why this answer

Creating separate users with minimal privileges and modifying the application to use the appropriate user for each operation reduces the risk of SQL injection and enforces least privilege. Option A is wrong because using stored procedures with a single master user does not eliminate the need for separate users for different privilege levels. Option B is wrong because restricting IP address does not address the need for granular permissions.

Option C is wrong because enabling IAM database authentication with a single IAM role does not provide separate read-only and read-write capabilities.

56
Multi-Selecthard

A company runs a customer relationship management (CRM) application on Amazon RDS for PostgreSQL. The application has a table 'customers' with columns: id (primary key), name, email, signup_date, and status. The table has 10 million rows. The application frequently queries by email address. The company also needs to run analytical queries that aggregate customers by signup_date and status. The DBA notices that the index on email is heavily used and causes high write latency. The company wants to improve write performance without sacrificing read performance for email queries. Which THREE actions should the database specialist take? (Choose THREE.)

Select 3 answers
A.Create a BRIN index on signup_date.
B.Change the index on email from B-tree to hash.
C.Partition the customers table by signup_date using range partitioning.
D.Remove the index on email to reduce write latency.
E.Create a GIN index on email.
AnswersA, B, C

BRIN indexes are lightweight and efficient for large tables with natural ordering, improving analytical queries with low write overhead.

Why this answer

A BRIN (Block Range INdex) index on signup_date is ideal for large tables where data is naturally ordered by insertion time. BRIN indexes are much smaller and have lower write overhead than B-tree indexes, making them suitable for analytical queries on signup_date without significantly impacting write performance.

Exam trap

The trap here is that candidates may think removing the email index (Option D) is acceptable to reduce write latency, but the question explicitly states read performance for email queries must not be sacrificed, so the index must be retained and optimized instead.

57
MCQmedium

A company is migrating a 2 TB SQL Server database to Amazon RDS for SQL Server. They need to minimize downtime and are using AWS DMS with CDC. The migration is taking longer than expected during the full load phase. Which change would most likely improve the full load performance?

A.Disable CDC to focus on full load only
B.Use AWS Schema Conversion Tool to optimize schema
C.Use a larger RDS instance class for the target
D.Increase the number of parallel load tasks in the DMS task settings
AnswerD

More parallel tasks can load data faster.

Why this answer

Increasing the number of parallel load tasks in the DMS task settings allows the full load to be split into multiple concurrent threads, each handling a subset of tables or partitions. This directly improves throughput by utilizing more of the available source and target resources, which is the most effective way to accelerate a slow full load phase when using AWS DMS with CDC.

Exam trap

The trap here is that candidates often assume a larger target instance (Option C) is the universal performance fix, but AWS DMS full load performance is more commonly limited by the parallelism of the load tasks, not the target instance size, especially when the target can keep up with writes.

How to eliminate wrong answers

Option A is wrong because disabling CDC would stop capturing ongoing changes, potentially increasing downtime when CDC is re-enabled later, and it does not address the root cause of slow full load performance. Option B is wrong because the AWS Schema Conversion Tool (SCT) is used for converting database schemas between different engines (e.g., Oracle to SQL Server), not for optimizing performance of an existing SQL Server migration to RDS for SQL Server. Option C is wrong because while a larger RDS instance class can improve target write performance, the bottleneck during full load is often the DMS replication instance or the source database's ability to export data, not the target instance size alone; increasing parallel load tasks is a more direct and effective tuning parameter.

58
MCQeasy

A company is deploying a new web application that uses Amazon RDS for PostgreSQL. The database must be highly available with automatic failover across two Availability Zones. Which deployment option meets this requirement?

A.Deploy RDS PostgreSQL in a cross-region replication setup.
B.Deploy RDS PostgreSQL with Multi-AZ configuration.
C.Deploy RDS PostgreSQL in a single Availability Zone.
D.Deploy RDS PostgreSQL with a read replica in another AZ.
AnswerB

Multi-AZ provides automatic failover.

Why this answer

Amazon RDS Multi-AZ deployment automatically provisions and maintains a synchronous standby replica in a different Availability Zone. If the primary DB instance fails, Amazon RDS automatically fails over to the standby, providing high availability with automatic failover across two AZs. This meets the requirement without manual intervention or application changes.

Exam trap

The trap here is confusing a read replica in another AZ with Multi-AZ, as both involve a second AZ, but only Multi-AZ provides automatic synchronous failover without data loss or manual intervention.

How to eliminate wrong answers

Option A is wrong because cross-region replication is designed for disaster recovery and read scaling, not automatic failover within the same region; it requires manual promotion and does not provide synchronous replication. Option C is wrong because a single-AZ deployment has no standby replica and cannot provide automatic failover across Availability Zones. Option D is wrong because a read replica in another AZ is an asynchronous copy used for read scaling, not for automatic failover; promoting a read replica requires manual action and may lose data.

59
Multi-Selectmedium

A company is migrating a self-managed MongoDB database to Amazon DocumentDB. The database stores user profiles and activity logs. The activity logs are write-heavy and accessed infrequently. The company wants to optimize cost and performance for the workload. Which THREE design decisions should the company make?

Select 3 answers
A.Enable encryption at rest for both databases.
B.Use a t3.medium instance for the activity logs collection to reduce cost.
C.Use Amazon S3 for storing activity logs instead of DocumentDB.
D.Create separate DocumentDB clusters for user profiles and activity logs.
E.Use a single DocumentDB cluster for both workloads with appropriate read replicas.
AnswersA, B, D

Encryption at rest is a security best practice.

Why this answer

Enabling encryption at rest for Amazon DocumentDB is a security best practice that ensures data is encrypted using AWS Key Management Service (KMS) keys. This is a mandatory design consideration for compliance and data protection, and it does not significantly impact cost or performance for the workload described.

Exam trap

The trap here is that candidates may assume a single cluster with read replicas is sufficient for mixed workloads, but the exam tests the understanding that separate clusters are needed to isolate write-heavy and read-heavy workloads for cost and performance optimization.

60
MCQmedium

A database specialist is investigating a sudden increase in Amazon RDS for PostgreSQL connections. The DB instance's CloudWatch metric DatabaseConnections shows a spike from 100 to 500 within minutes. The application connects using a connection pool. Which step should the specialist take first to mitigate the issue while preserving application availability?

A.Use the RDS console to terminate all active connections and then restart the database.
B.Modify the security group to restrict inbound traffic to the database.
C.Increase the DB instance size to handle more connections.
D.Modify the DB parameter group to reduce the max_connections value and reboot the instance to apply changes.
AnswerD

Lowering max_connections limits the number of concurrent connections, preventing overload.

Why this answer

Reducing the max_connections value in the DB parameter group and rebooting the instance will limit the number of concurrent connections, preventing the database from being overwhelmed. This is the fastest way to mitigate the spike while preserving application availability. Option A is wrong because terminating all connections and restarting the database would disrupt the application.

Option B is wrong because modifying the security group does not affect the number of connections, only the allowed sources. Option C is wrong because increasing the instance size may take time to provision and does not immediately address the connection spike.

61
MCQhard

A company is using Amazon DynamoDB with AWS Lambda to process data. The Lambda function needs to read and write items to a DynamoDB table. The security team wants to follow the principle of least privilege. Which IAM policy statement should be attached to the Lambda execution role?

A.{"Effect":"Allow","Action":"dynamodb:*","Resource":"*"}
B.{"Effect":"Allow","Action":["dynamodb:DescribeTable","dynamodb:ListTables"],"Resource":"*"}
C.{"Effect":"Allow","Action":["dynamodb:GetItem","dynamodb:PutItem","dynamodb:UpdateItem","dynamodb:DeleteItem"],"Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/MyTable"}
D.{"Effect":"Allow","Action":"dynamodb:*","Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/MyTable"}
AnswerC

This policy grants only the necessary read/write actions (GetItem, PutItem, UpdateItem, DeleteItem) on the specific table, following least privilege.

Why this answer

It grants only the necessary DynamoDB actions (GetItem, PutItem, UpdateItem, DeleteItem) on the specific table. Option A is wrong because it grants full DynamoDB access on all resources, which is too permissive. Option B is wrong because it only allows DescribeTable and ListTables on all tables, which does not provide the read/write permissions needed.

Option D is wrong because it allows all DynamoDB actions on a specific table, which is overly permissive and violates least privilege.

62
Multi-Selectmedium

Which TWO are valid considerations when designing a global database with Amazon Aurora Global Database? (Select TWO.)

Select 2 answers
A.Secondary regions cannot have their own reader instances.
B.Failover requires promoting the secondary cluster to a standalone cluster.
C.Cross-region replication latency is typically under 100 milliseconds.
D.Secondary regions can forward write operations to the primary region.
E.Aurora Global Database supports up to 5 secondary AWS Regions.
AnswersD, E

Correct: Write forwarding is a feature of Aurora Global Database.

Why this answer

Amazon Aurora Global Database uses a primary-region architecture where secondary regions are fully readable and can forward write operations to the primary region. This is achieved through a dedicated replication channel that allows secondary clusters to accept write requests and asynchronously forward them to the primary, ensuring low-latency local writes while maintaining global consistency.

Exam trap

The trap here is that candidates often assume secondary regions are read-only and cannot accept writes, but Aurora Global Database allows secondary regions to forward write operations to the primary, which is a key differentiator from traditional read replicas.

63
MCQmedium

A company is migrating a large Oracle Data Warehouse (10 TB) to Amazon Redshift. The current system uses complex stored procedures, materialized views, and window functions. The company wants to minimize migration effort. Which approach is MOST suitable?

A.Migrate to Amazon Aurora MySQL and use its parallel query feature.
B.Migrate to Amazon Redshift and rewrite stored procedures as SQL scripts.
C.Migrate to Amazon DynamoDB and use DAX for caching.
D.Migrate to Amazon RDS for PostgreSQL and use its foreign data wrappers.
AnswerB

Redshift supports window functions, materialized views, and SQL scripting.

Why this answer

Amazon Redshift is purpose-built for large-scale data warehousing and analytics, making it the natural target for a 10 TB Oracle Data Warehouse. While stored procedures would need to be rewritten as SQL scripts (since Redshift uses a different procedural language), materialized views and window functions are natively supported, minimizing migration effort compared to other options.

Exam trap

The trap here is that candidates may assume all cloud databases are equally suitable for data warehousing, overlooking that Redshift's columnar storage and MPP architecture are specifically designed for analytical workloads, while options like Aurora or DynamoDB are optimized for different use cases (OLTP or NoSQL).

How to eliminate wrong answers

Option A is wrong because Amazon Aurora MySQL is an OLTP-oriented database, not designed for the analytical workloads and large data volumes (10 TB) of a data warehouse; its parallel query feature is limited and cannot replace Oracle's data warehouse capabilities. Option C is wrong because Amazon DynamoDB is a NoSQL key-value store optimized for high-throughput, low-latency transactions, not for complex analytical queries, stored procedures, or materialized views required by a data warehouse. Option D is wrong because Amazon RDS for PostgreSQL, while supporting foreign data wrappers, lacks the columnar storage, massively parallel processing (MPP), and advanced analytics features (e.g., automatic compression, workload management) that Redshift provides for large-scale data warehousing.

64
MCQhard

A company is using an RDS for MySQL DB instance encrypted at rest with AWS KMS. The security team requires that all access to the database be logged, including queries that fail due to authentication errors. Which configuration meets this requirement?

A.Enable the RDS audit log by setting the 'audit_log_enabled' parameter to 1 in the DB parameter group and export logs to CloudWatch Logs.
B.Enable RDS Enhanced Monitoring and publish metrics to CloudWatch.
C.Enable AWS CloudTrail for the RDS instance and store logs in S3.
D.Use S3 server access logs to capture database connection attempts.
AnswerA

Audit logs capture authentication failures and queries; exporting to CloudWatch allows monitoring.

Why this answer

RDS for MySQL supports audit logs that can capture authentication failures and queries. By setting the 'audit_log_enabled' parameter to 1 in the DB parameter group and exporting logs to CloudWatch Logs, you meet the requirement to log all access including failed authentication attempts. Option B is incorrect because Enhanced Monitoring provides OS-level metrics, not query logs.

Option C is incorrect because AWS CloudTrail logs control plane API calls for RDS, not data plane activities like database queries. Option D is incorrect because S3 server access logs capture requests made to S3 buckets, not database connections.

65
Multi-Selectmedium

A company is running a production Amazon RDS for MySQL Multi-AZ DB instance. The database administrator needs to perform a minor version upgrade with minimal downtime. Which TWO actions should be taken? (Choose TWO.)

Select 2 answers
A.Modify the DB instance to enable automatic minor version upgrade.
B.Apply the upgrade immediately during the next maintenance window.
C.Create a read replica, upgrade the replica, and promote it.
D.Modify the DB instance to be a Single-AZ deployment to simplify the upgrade.
E.Stop the DB instance before applying the upgrade.
AnswersA, B

Automatic upgrades apply during maintenance window with minimal downtime.

Why this answer

Enabling automatic minor version upgrades on an RDS for MySQL Multi-AZ instance allows Amazon RDS to apply the upgrade during the next maintenance window with minimal downtime. During the upgrade, RDS patches the standby first, then performs a failover to make the standby the new primary, resulting in a brief (typically under 60 seconds) interruption rather than a full outage. This approach leverages the Multi-AZ architecture to reduce downtime compared to manual upgrades.

Exam trap

The trap here is that candidates often assume 'immediate' means faster and less downtime, but in a Multi-AZ setup, applying the upgrade immediately actually causes more downtime than using the maintenance window with automatic upgrades, because the rolling failover approach is designed to minimize disruption.

66
Multi-Selectmedium

A company is designing a security strategy for Amazon RDS for SQL Server. Which TWO actions should be taken to encrypt data at rest? (Choose TWO.)

Select 2 answers
A.Enable Amazon EBS encryption on the underlying volumes.
B.Enable Transparent Data Encryption (TDE) on the SQL Server database.
C.Use AWS CloudHSM to store encryption keys.
D.Enable SSL/TLS for connections.
E.Enable RDS encryption at rest using AWS KMS.
AnswersB, E

Correct. Transparent Data Encryption (TDE) is a SQL Server feature that encrypts data at rest within the database files.

Why this answer

For Amazon RDS for SQL Server, encryption at rest can be achieved using two methods: enabling RDS encryption at rest with AWS KMS (option E) or enabling Transparent Data Encryption (TDE) natively within SQL Server (option B). Option A is incorrect because EBS encryption is automatically handled by RDS when you enable encryption at rest via KMS, but you cannot enable EBS encryption directly on the underlying volumes. Option C is incorrect because AWS CloudHSM can be used for key management but is not required for RDS encryption at rest.

Option D is incorrect because SSL/TLS encrypts data in transit, not at rest.

67
MCQmedium

A company is migrating an on-premises MySQL database to Amazon RDS for MySQL. The database has a large table with frequent inserts and updates. To minimize downtime during migration, which AWS service should be used?

A.Amazon RDS read replica
B.AWS Schema Conversion Tool (SCT)
C.AWS Glue
D.AWS Database Migration Service (DMS)
AnswerD

DMS supports minimal downtime with ongoing replication.

Why this answer

AWS Database Migration Service (DMS) is the correct choice because it supports ongoing replication (change data capture, CDC) from an on-premises MySQL source to Amazon RDS for MySQL, allowing the source database to remain fully operational during the migration. This minimizes downtime by continuously applying inserts and updates from the source to the target until you perform the final cutover, which can be a brief pause of seconds to minutes.

Exam trap

The trap here is that candidates confuse AWS DMS with AWS SCT, assuming SCT handles data migration, but SCT only converts schema/code for heterogeneous migrations, while DMS handles the actual data transfer and CDC for both homogeneous and heterogeneous migrations.

How to eliminate wrong answers

Option A is wrong because an Amazon RDS read replica is a feature for offloading read traffic or creating a standby within RDS, not for migrating data from an on-premises database; it cannot connect to an external MySQL instance. Option B is wrong because the AWS Schema Conversion Tool (SCT) is used to convert database schemas and code between different database engines (e.g., Oracle to Aurora), not for migrating data with minimal downtime from on-premises MySQL to RDS MySQL (which uses the same engine). Option C is wrong because AWS Glue is a serverless ETL service designed for batch data processing and transformation, not for real-time, low-downtime database migration with ongoing replication.

68
Drag & Dropmedium

Arrange the steps to enable automated backups for an Amazon RDS for PostgreSQL DB instance in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Automated backups are enabled by adjusting the backup retention period in the instance settings and applying the change.

69
Multi-Selecteasy

A company is using Amazon RDS for MySQL and has enabled Enhanced Monitoring. The database administrator wants to identify the top contributors to disk I/O. Which THREE metrics from Enhanced Monitoring should they examine?

Select 3 answers
A.DirtyBufferFlushRate
B.NetworkThroughput
C.LogicalReads
D.WriteOps
E.PhysicalReads
AnswersA, D, E

Indicates how often dirty buffers are written to disk.

Why this answer

(DirtyBufferFlushRate) is correct because it indicates the rate at which dirty (modified) buffers are flushed from memory to disk, directly contributing to disk writes and I/O. Option D (WriteOps) is correct as it measures the number of write operations performed on disk, a direct contributor to disk I/O. Option E (PhysicalReads) is correct because it represents read operations that actually hit the disk (i.e., cache misses), contributing to disk I/O.

Options B (NetworkThroughput) and C (LogicalReads) are incorrect: NetworkThroughput relates to network traffic, not disk I/O; LogicalReads are reads satisfied from the buffer pool (memory), not disk.

70
MCQeasy

A company runs an online transaction processing (OLTP) workload on Amazon RDS for PostgreSQL. The database has grown to 2 TB and the company needs to run complex analytical queries that join multiple large tables. These analytical queries are slowing down the OLTP operations. What is the MOST cost-effective solution to separate the workloads?

A.Create an RDS for PostgreSQL read replica and route analytical queries to it.
B.Use Amazon ElastiCache for caching analytical query results.
C.Migrate the analytical queries to Amazon Redshift.
D.Migrate the OLTP workload to Amazon DynamoDB.
AnswerA

Read replica offloads read-only queries, cost-effective.

Why this answer

Creating an RDS for PostgreSQL read replica is the most cost-effective solution because it offloads analytical queries to a separate read-only instance without requiring a full database migration. The read replica uses PostgreSQL's native streaming replication to maintain near-real-time data consistency, allowing complex joins on large tables without competing for the primary instance's I/O and CPU resources. This approach minimizes operational overhead and cost compared to migrating to a separate analytics platform like Redshift.

Exam trap

The trap here is that candidates may choose Redshift (Option C) assuming it is always the best for analytics, but the question asks for the most cost-effective solution, and a read replica avoids the cost and complexity of a full data warehouse migration while still separating workloads.

How to eliminate wrong answers

Option B is wrong because ElastiCache caches query results but does not support complex analytical joins across multiple large tables; it is designed for low-latency key-value lookups, not full table scans or multi-table aggregations. Option C is wrong because migrating analytical queries to Amazon Redshift would require data extraction, transformation, and loading (ETL) processes, increasing complexity and cost for a workload that can be handled by a read replica. Option D is wrong because DynamoDB is a NoSQL key-value and document database that does not support the relational joins and SQL analytical queries required by the workload, and migrating from PostgreSQL would involve significant application rewrites.

71
MCQhard

A financial services company runs a core banking application on Amazon RDS for MySQL. They need to maintain a full audit trail of all changes to customer account balances for regulatory compliance. The audit trail must be immutable and queryable for up to 7 years. Which solution meets these requirements with minimal impact on the source database?

A.Use Amazon RDS Performance Insights to capture SQL queries and store them in Amazon S3
B.Use Amazon DynamoDB Streams with a Lambda function to capture changes from the MySQL database
C.Enable binary logging on the RDS instance and stream the binlog to Amazon S3 using AWS Database Migration Service (DMS)
D.Migrate to Amazon Aurora MySQL and enable database activity streams, streaming to Amazon Kinesis Data Streams and then to Amazon S3
AnswerD

Aurora database activity streams provide an immutable, near real-time feed of database activities that can be consumed via Kinesis.

Why this answer

Amazon Aurora MySQL Database Activity Streams provide a near-real-time, immutable audit trail of database activities at the transaction level, which can be streamed to Amazon Kinesis Data Streams and then stored in Amazon S3 for long-term queryable retention. This solution meets the 7-year compliance requirement with minimal impact on the source database because it offloads the audit processing to external services and does not require changes to the application or additional logging overhead on the database instance.

Exam trap

The trap here is that candidates may confuse binary logging (binlog) replication with a compliant audit trail, but binlog is designed for replication and point-in-time recovery, not for immutable, queryable long-term storage, and streaming it to S3 via DMS is not a supported AWS service integration.

How to eliminate wrong answers

Option A is wrong because Amazon RDS Performance Insights captures performance metrics and SQL query patterns, not a full, immutable audit trail of all changes to specific rows like customer account balances; it is designed for performance tuning, not compliance auditing. Option B is wrong because Amazon DynamoDB Streams is a feature of DynamoDB, not MySQL or RDS; it cannot capture changes from a MySQL database, and there is no native integration to stream MySQL binlog changes into DynamoDB Streams. Option C is wrong because while binary logging (binlog) can capture changes, streaming the binlog to S3 using AWS DMS is not a supported or recommended pattern; DMS is for database migration and continuous replication, not for streaming raw binlog files to S3, and this approach would require complex custom tooling and could impact source database performance.

72
Multi-Selecthard

A company is migrating a large Oracle data warehouse to Amazon Redshift. The source database has many complex stored procedures, views, and joins. Which THREE actions should the company take during the migration?

Select 3 answers
A.Migrate triggers as they are in Redshift.
B.Use the AWS Schema Conversion Tool (SCT) to convert stored procedures.
C.Recreate all indexes from Oracle in Redshift.
D.Denormalize the schema to reduce the number of joins.
E.Design the schema using a star schema with fact and dimension tables.
AnswersB, D, E

SCT converts database schema and code.

Why this answer

AWS Schema Conversion Tool (SCT) is the recommended tool for converting Oracle stored procedures, functions, and packages to Amazon Redshift's PL/pgSQL-compatible language. It automates the translation of complex procedural logic, reducing manual effort and errors during migration. Redshift does not support Oracle-specific PL/SQL constructs natively, so SCT handles syntax and semantic conversion.

Exam trap

The trap here is that candidates assume traditional database features like triggers and indexes are universally applicable, but Redshift intentionally omits them for performance and scalability, and the exam tests understanding of Redshift's unique design trade-offs.

73
MCQeasy

A company is running a MySQL database on Amazon RDS and needs to store JSON documents that are frequently queried by fields within the JSON. The company wants to reduce development complexity and improve query performance. Which RDS MySQL feature should the database specialist recommend?

A.Migrate the JSON data to Amazon DynamoDB and use DynamoDB's document model
B.Use the JSON data type in MySQL 8.0 and utilize JSON path expressions in queries
C.Store JSON documents in a VARCHAR(MAX) column and use LIKE operations for queries
D.Store JSON documents as BLOBs and parse them in application code
AnswerB

MySQL's JSON data type allows efficient storage and querying using JSON path expressions and indexes.

Why this answer

MySQL 8.0's native JSON data type stores JSON documents in an optimized binary format, enabling efficient indexing and querying via JSON path expressions (e.g., `JSON_EXTRACT`, `->`, `->>`). This reduces development complexity by allowing direct SQL access to JSON fields without application-level parsing, and improves query performance through generated columns and virtual indexes.

Exam trap

The trap here is that candidates may assume DynamoDB (Option A) is the only way to handle JSON efficiently, overlooking MySQL 8.0's native JSON support which avoids cross-service complexity while providing comparable query capabilities.

How to eliminate wrong answers

Option A is wrong because migrating to DynamoDB introduces a separate NoSQL service, increasing architectural complexity and requiring application changes, whereas the requirement is to stay within RDS MySQL. Option C is wrong because storing JSON in VARCHAR(MAX) and using LIKE operations is inefficient—LIKE cannot leverage indexes for JSON field queries and requires full table scans, degrading performance. Option D is wrong because storing JSON as BLOBs and parsing in application code offloads query logic to the client, increasing development complexity and preventing server-side indexing or optimization of JSON fields.

74
MCQeasy

A company is migrating a 10 GB MySQL database to Amazon RDS for MySQL. They have a 1 Gbps connection to AWS. The migration must be completed in the least amount of time with minimal manual effort. Which tool should be used?

A.AWS Schema Conversion Tool (SCT).
B.AWS Snowball Edge.
C.mysqldump and mysql command-line tools.
D.AWS Database Migration Service (DMS).
AnswerD

DMS automates the migration process and can complete quickly over high bandwidth.

Why this answer

AWS Database Migration Service (DMS) is the correct choice because it can perform a live, continuous migration of a 10 GB MySQL database to Amazon RDS for MySQL with minimal downtime and manual effort. DMS handles schema conversion (if needed), data replication, and ongoing changes via Change Data Capture (CDC), allowing the migration to complete in the least amount of time while automatically managing the full load and sync process over the 1 Gbps connection.

Exam trap

The trap here is that candidates often choose mysqldump (Option C) because it is familiar and free, but they overlook the requirement for minimal manual effort and the need for continuous replication, which DMS provides automatically.

How to eliminate wrong answers

Option A is wrong because AWS Schema Conversion Tool (SCT) is designed for heterogeneous migrations (e.g., Oracle to MySQL) and does not perform the actual data transfer; it only converts schema objects, so it cannot complete the migration alone. Option B is wrong because AWS Snowball Edge is intended for large-scale offline data transfers (typically >10 TB or over slow/unstable networks) and would introduce unnecessary shipping delays and manual effort for a 10 GB database that can easily be migrated online. Option C is wrong because mysqldump and mysql command-line tools require manual execution, do not support continuous replication or CDC, and would cause significant downtime during the dump and restore process, making it slower and more error-prone than DMS.

75
MCQmedium

A company is migrating a 500 GB Oracle database to Amazon RDS for Oracle. They want to minimize downtime and use AWS DMS for ongoing replication. The source database is in a corporate data center behind a firewall. What is the recommended network setup for the DMS replication instance?

A.Deploy the DMS replication instance in a VPC that has a VPN or AWS Direct Connect connection to the corporate data center.
B.Launch the DMS replication instance with a public IP address and allow inbound traffic from the corporate firewall.
C.Create a VPC endpoint for the DMS service and route traffic through it.
D.Install the DMS replication software on a server in the corporate data center to connect directly to the source.
AnswerA

This provides a private network path for DMS to access the source database.

Why this answer

AWS DMS requires network connectivity between the replication instance and both the source and target databases. Since the source Oracle database is behind a corporate firewall, the DMS replication instance must be deployed in a VPC that has a VPN or AWS Direct Connect connection to the corporate data center. This establishes a private, secure, and low-latency network path for ongoing replication, minimizing downtime during migration.

Exam trap

The trap here is that candidates often assume DMS can use a public IP address or VPC endpoints for source connectivity, but DMS replication instances require direct network layer connectivity (Layer 3) to the source, which is only achieved via VPN or Direct Connect for on-premises sources.

How to eliminate wrong answers

Option B is wrong because assigning a public IP address to the DMS replication instance and allowing inbound traffic from the corporate firewall exposes the instance to the internet, which is a security risk and not recommended for sensitive database migrations; DMS does not natively support direct public IP connectivity for source databases behind firewalls without additional tunneling. Option C is wrong because a VPC endpoint for DMS is used to privately connect to the DMS service API, not to route replication traffic between the replication instance and the source database; it does not provide connectivity to an on-premises source. Option D is wrong because DMS replication software cannot be installed on a customer-managed server; AWS DMS is a fully managed service that runs only on AWS infrastructure, and the replication instance must be an AWS resource.

Page 1 of 23

Page 2