Knowledge + Practice

AWS Certified Database Specialty DBS-C01 (DBS-C01) — Questions 751–825

1663 questions total · 23pages · All types, answers revealed

Take a mock exam Exam hub

Page 11 of 23

751

MCQhard

Refer to the exhibit. The output is from the AWS CLI for an RDS instance. The security team suspects that the encryption key used for this DB instance has been compromised. What is the required action to re-encrypt the instance with a new key?

A.Create a snapshot of the DB instance, copy the snapshot with a new KMS key, and restore the DB instance from the copied snapshot.

B.Modify the DB instance to use a new KMS key.

C.Restore the DB instance to a point in time and specify a new KMS key.

D.Enable encryption on a new DB instance and migrate the data.

AnswerA

This process allows re-encryption with a new key.

Why this answer

RDS does not allow changing the encryption key of an existing encrypted DB instance directly. The correct method is to create a snapshot of the DB instance, copy the snapshot with a new KMS key, and then restore the DB instance from the copied snapshot. Option B is incorrect because modifying the DB instance does not allow changing the KMS key.

Option C is incorrect because restoring to a point in time uses the same encryption key as the original instance. Option D is incorrect because this instance is already encrypted; to use a new key, a snapshot copy and restore is required.

Full explanation →

752

MCQmedium

A company has an Amazon Redshift cluster that contains sensitive data. The security team requires that data be encrypted at rest using a customer-managed AWS KMS key. The cluster was initially launched without encryption. How can the company enable encryption with minimal downtime?

A.Unload the data to Amazon S3, create a new encrypted cluster, and reload the data from S3.

B.Use the AWS CLI to update the cluster encryption setting.

C.Take a snapshot of the cluster and restore it to a new cluster with encryption enabled.

D.Modify the cluster and enable encryption using the AWS Management Console.

AnswerC

Taking a snapshot and restoring it to a new cluster with encryption enabled is the correct method with minimal downtime. The original cluster remains available during the process.

Why this answer

To enable encryption on an existing unencrypted Redshift cluster with minimal downtime, the recommended approach is to take a snapshot of the cluster and restore it to a new cluster with encryption enabled. This allows the original cluster to remain operational while the encrypted cluster is being created, minimizing downtime. Once the new cluster is ready, traffic can be redirected.

Option A (unload to S3, create new encrypted cluster, reload) also achieves encryption but requires significant downtime for data transfer. Option B is incorrect because there is no direct CLI command to enable encryption on an existing cluster; a new cluster must be created. Option D is incorrect because the AWS Management Console does not allow enabling encryption on an existing cluster.

Full explanation →

753

MCQmedium

A company has a 200 GB PostgreSQL database on-premises and wants to migrate to Amazon RDS for PostgreSQL. The company requires encrypted data transfer and wants to minimize downtime. Which combination of services should be used?

A.Use native pg_dump to S3, then import to RDS

B.Use AWS VPN to connect on-premises to RDS and perform a database dump

C.Use AWS DMS with SSL and ongoing replication

D.Use an EC2 instance with PostgreSQL replication to RDS

AnswerC

DMS supports encrypted transfer and CDC for minimal downtime.

Why this answer

AWS DMS with SSL provides encrypted data transfer and supports ongoing replication (change data capture) to minimize downtime. This allows the on-premises PostgreSQL database to remain operational during the initial full load and then continuously replicate changes until cutover, meeting both security and minimal-downtime requirements.

Exam trap

The trap here is that candidates often assume native PostgreSQL replication (Option D) is directly supported by RDS, but RDS does not allow external servers to act as replication sources, making DMS with CDC the correct service for minimal-downtime migrations with encrypted transfer.

How to eliminate wrong answers

Option A is wrong because pg_dump creates a logical backup that requires the source database to be offline or in read-only mode during the dump, causing downtime, and transferring to S3 then importing to RDS does not support ongoing replication. Option B is wrong because a database dump via VPN still requires the source database to be stopped or locked during the dump, resulting in downtime, and does not provide ongoing replication. Option D is wrong because native PostgreSQL replication to RDS is not supported directly; RDS does not allow external servers to replicate into it as a standby, and setting up an EC2 intermediary with replication adds complexity without native RDS support for this architecture.

Full explanation →

754

MCQmedium

A company is deploying a new Amazon RDS for MySQL database. The security team requires that all data at rest be encrypted. What is the simplest way to meet this requirement?

A.Enable encryption using AWS Certificate Manager

B.Use client-side encryption in the application

C.Enable encryption at rest when creating the RDS instance using an AWS KMS key

D.Enable encryption at rest on the RDS instance after creation

AnswerC

Encryption at rest can be enabled at instance creation time using a KMS key.

Why this answer

Amazon RDS for MySQL supports encryption at rest using AWS KMS keys, which must be enabled at instance creation time because encryption cannot be added to an existing unencrypted RDS instance. Option C is correct because it describes the simplest and most direct method: enabling encryption at rest during the initial RDS instance creation with an AWS KMS key, which transparently encrypts the underlying storage, automated backups, read replicas, and snapshots.

Exam trap

The trap here is that candidates may think encryption can be enabled after creation (Option D) because some AWS services allow post-creation encryption, but RDS requires encryption to be set at launch, and this is a common exam trick to test knowledge of RDS encryption limitations.

How to eliminate wrong answers

Option A is wrong because AWS Certificate Manager (ACM) is used for SSL/TLS certificate management for data in transit, not for encryption at rest. Option B is wrong because client-side encryption in the application adds unnecessary complexity and does not meet the requirement for data at rest encryption managed by the database service; it also requires application code changes and key management outside of AWS KMS. Option D is wrong because Amazon RDS for MySQL does not allow enabling encryption at rest on an existing unencrypted instance; you must create a new encrypted instance and migrate the data.

Full explanation →

755

MCQmedium

An application is receiving the error shown in the exhibit. The application uses connection pooling. The RDS instance is a db.r5.large with max_connections set to 1000. What is the most likely cause?

A.The security group is blocking incoming connections.

B.The max_connections parameter is set too low for the instance size.

C.The connection pool in the application is not releasing idle connections.

D.The RDS instance is in a different VPC than the application.

AnswerC

If the application's connection pool does not release idle connections, it can exhaust the maximum connections even though max_connections is set appropriately.

Why this answer

If the application's connection pool does not release idle connections, it can exhaust the maximum connections even though max_connections is set appropriately. Option A is incorrect because if the security group blocked connections, the application would receive a timeout or 'connection refused' error, not an error indicating max connections are reached. Option B is incorrect because max_connections is set to 1000, which is the default for a db.r5.large instance and is typically sufficient; the instance size supports that value.

Option D is incorrect because a different VPC would cause network connectivity issues (e.g., timeout) rather than a 'too many connections' error, which indicates the connection is established but the limit is reached.

Full explanation →

756

MCQmedium

A company is migrating an on-premises PostgreSQL database to Amazon RDS for PostgreSQL. The database has a large table that is frequently accessed by reporting queries. The reporting queries filter on a column that has a high cardinality but low selectivity. To optimize query performance on this table, which design choice should the database specialist recommend?

A.Partition the table by the filter column

B.Use a read replica to offload reporting queries

C.Increase the provisioned read IOPS for the RDS instance

D.Create a covering index on the filter column

AnswerD

A covering index includes all columns needed, allowing query results to be returned from the index alone.

Why this answer

A covering index includes all columns needed by the reporting queries, allowing PostgreSQL to satisfy the query entirely from the index without accessing the heap (table) pages. This eliminates the overhead of random I/O for row lookups, which is especially beneficial when filtering on a high-cardinality, low-selectivity column where many rows match but the index scan alone can return the required data. In Amazon RDS for PostgreSQL, this reduces read IOPS consumption and improves query latency.

Exam trap

The trap here is that candidates often choose partitioning (Option A) for any large table with filtering, but fail to recognize that low selectivity means partitioning offers no pruning benefit, while a covering index directly reduces I/O by avoiding heap access.

How to eliminate wrong answers

Option A is wrong because partitioning by a high-cardinality, low-selectivity column would create many partitions with similar row counts, offering minimal pruning benefit and adding management overhead without improving query performance. Option B is wrong because a read replica offloads the query execution but does not optimize the query itself; the same slow table scan or index lookup would still occur on the replica. Option C is wrong because increasing provisioned read IOPS addresses throughput capacity but does not reduce the number of I/O operations required; the query still performs the same inefficient access pattern.

Full explanation →

757

MCQhard

An e-commerce platform uses Amazon RDS for PostgreSQL to store order data. The database has a table "orders" with 500 million rows. The application runs a report query that aggregates daily sales for the last 30 days. The query currently scans the entire table and takes 15 minutes to complete. The team needs to reduce the query time to under 30 seconds. Which solution is MOST cost-effective?

A.Partition the table by month and query only the relevant partitions.

B.Create a materialized view that stores daily sales aggregates and refresh it nightly.

C.Add a composite index on the date column and the sales amount column.

D.Upgrade the RDS instance to a larger size with more vCPUs and memory.

AnswerB

The report reads pre-computed aggregates, reducing query time drastically.

Why this answer

A materialized view precomputes and stores the daily sales aggregates, allowing the application to query the precomputed result set directly instead of scanning 500 million rows. Refreshing the materialized view nightly (e.g., using pg_cron or a scheduled lambda) ensures the data is fresh enough for the report while keeping query time under 30 seconds. This approach avoids the cost of larger instances or complex partitioning and is the most cost-effective solution for a read-heavy, periodic aggregation workload.

Exam trap

The trap here is that candidates often choose partitioning (Option A) thinking it will reduce scan time, but they overlook that partitioning does not precompute aggregates and still requires scanning multiple partitions, whereas a materialized view directly addresses the aggregation bottleneck at a lower cost.

How to eliminate wrong answers

Option A is wrong because partitioning by month would still require scanning all partitions for the last 30 days unless the table is partitioned by day, and even then, querying multiple partitions still incurs overhead; moreover, partitioning alone does not precompute aggregates, so the query would still need to aggregate rows across partitions, which may not achieve sub-30-second performance. Option C is wrong because a composite index on the date and sales amount columns would not eliminate the need to scan and aggregate 500 million rows; the index would help with filtering but the aggregation step would still require a full index scan or table scan, and the query time would remain high. Option D is wrong because upgrading to a larger RDS instance increases cost significantly without addressing the root cause—the query still performs a full table scan and aggregation; it may reduce time but not reliably to under 30 seconds, and it is not cost-effective compared to precomputing results.

Full explanation →

758

MCQmedium

A company is migrating an on-premises Oracle database to Amazon Aurora PostgreSQL. The database is 1 TB and has complex stored procedures. The migration must be completed within a 4-hour downtime window. Which migration approach is most efficient?

A.Use AWS Schema Conversion Tool (SCT) to convert schema only.

B.Use AWS SCT to convert schema and code, then AWS DMS for data migration.

C.Use Oracle Data Pump to export and pg_restore to import.

D.Use AWS DMS with ongoing replication.

AnswerB

SCT converts schema/code, DMS migrates data.

Why this answer

AWS SCT converts the Oracle schema and complex stored procedures to Aurora PostgreSQL-compatible code, while AWS DMS performs the full data migration within the 4-hour window. This combination handles both schema/code conversion and bulk data transfer efficiently, meeting the time constraint.

Exam trap

The trap here is that candidates may think DMS alone can handle the entire migration, overlooking that schema and stored procedure conversion is a prerequisite that SCT must address first.

How to eliminate wrong answers

Option A is wrong because using SCT for schema only leaves the stored procedures unconverted, and no data migration is performed, so the database cannot be used. Option C is wrong because Oracle Data Pump and pg_restore are manual, offline tools that require significant downtime for a 1 TB database and do not handle stored procedure conversion automatically, likely exceeding the 4-hour window. Option D is wrong because DMS with ongoing replication alone does not convert the schema or stored procedures; it requires a compatible target schema, which is missing without SCT.

Full explanation →

759

MCQhard

A company uses Amazon Redshift for data warehousing. A nightly ETL job fails with 'Disk full' error on some nodes. The cluster has 8 dc2.large nodes. Which action will MOST efficiently resolve the issue without increasing costs?

A.Increase the number of slices per node

B.Add more nodes to the cluster

C.Enable compression on all tables

D.Run a VACUUM command to reclaim space

AnswerD

VACUUM removes deleted rows and frees disk space.

Why this answer

Running a VACUUM command on Amazon Redshift reclaims storage space from deleted or updated rows without incurring additional costs. Option A is wrong because increasing the number of slices per node is not possible with dc2.large nodes; slice count is fixed per node type. Option B is wrong because adding more nodes would increase costs and is not the most efficient solution.

Option C is wrong although enabling compression reduces storage usage over time, it requires a table redesign and does not immediately free space to resolve the immediate 'Disk full' error.

Full explanation →

760

MCQhard

A company uses Amazon DocumentDB (with MongoDB compatibility) for its application. The application is experiencing high write latency. The DB cluster has one primary instance and two replicas. Which action should be taken to identify the cause?

A.Migrate the database to Amazon DynamoDB for better write performance.

B.Add more read replicas to distribute the load.

C.Enable Enhanced Monitoring and review OS-level metrics like CPU, memory, and I/O.

D.Enable slow query logging and analyze slow queries.

AnswerC

Enhanced Monitoring provides granular OS metrics to pinpoint bottlenecks.

Why this answer

Enabling Enhanced Monitoring at the instance level provides OS-level metrics (CPU, memory, I/O) that can help identify resource bottlenecks causing high write latency on the primary instance. Option A is incorrect because switching to Amazon DynamoDB is a major architectural change, not a troubleshooting step. Option B is incorrect because adding read replicas does not reduce write latency on the primary; replicas handle read traffic, not writes.

Option D is incorrect because while slow query logging can identify poorly performing queries, high write latency may also be caused by OS-level resource contention, which Enhanced Monitoring captures.

Full explanation →

761

MCQmedium

A company is migrating an on-premises Oracle database to Amazon Aurora PostgreSQL. They used AWS SCT to convert the schema, but some stored procedures failed to convert automatically. What is the best course of action?

A.Use AWS Lambda to automatically convert the stored procedures.

B.Use AWS DMS to replicate the Oracle stored procedures as-is to Aurora.

C.Switch to Amazon RDS for Oracle to avoid conversion issues.

D.Manually rewrite the unconverted stored procedures to PostgreSQL-compatible code based on SCT's assessment report.

AnswerD

SCT provides a report of items that need manual attention; rewriting is necessary.

Why this answer

AWS SCT provides an assessment report that identifies unconverted stored procedures and suggests manual rewrites. Since Oracle and PostgreSQL have fundamentally different procedural languages (PL/SQL vs. PL/pgSQL), automated conversion cannot handle all syntax and semantic differences.

Manually rewriting the unconverted procedures based on SCT's report ensures compatibility and correctness, as SCT highlights the specific lines and constructs that need attention.

Exam trap

The trap here is that candidates may assume AWS DMS can handle stored procedure migration (Option B) because DMS handles schema conversion for tables, but DMS explicitly does not migrate stored procedures, triggers, or other programmatic objects.

How to eliminate wrong answers

Option A is wrong because AWS Lambda is a serverless compute service, not a database schema conversion tool; it cannot interpret or translate Oracle PL/SQL to PostgreSQL PL/pgSQL. Option B is wrong because AWS DMS replicates data, not stored procedures; it cannot convert or execute procedural code, and Oracle stored procedures cannot run on Aurora PostgreSQL. Option C is wrong because switching to Amazon RDS for Oracle avoids the conversion effort but fails to meet the stated goal of migrating to Aurora PostgreSQL, and it may incur higher licensing costs and operational overhead.

Full explanation →

762

MCQeasy

A startup is building a mobile app backend with user profiles and social features. They need a database that can handle flexible schemas, high read throughput for user profiles, and strong consistency for friend requests. Which database service should they choose?

A.Amazon RDS for MySQL

B.Amazon Neptune

C.Amazon DynamoDB

D.Amazon DocumentDB

AnswerC

DynamoDB provides flexible schema and high performance with strong consistency.

Why this answer

Amazon DynamoDB is the correct choice because it provides flexible schemas (schema-less tables) ideal for user profiles that may vary in attributes, supports high read throughput via auto-scaling and DAX caching, and offers strongly consistent reads (when requested) to ensure friend requests are processed reliably. Its fully managed nature and single-digit millisecond latency align with the startup's need for a scalable, consistent database.

Exam trap

The trap here is that candidates may choose Amazon Neptune for social features due to its graph capabilities, overlooking that DynamoDB can handle simple social relationships with strong consistency and lower operational overhead, while Neptune's eventual consistency and complexity are mismatched for this use case.

How to eliminate wrong answers

Option A is wrong because Amazon RDS for MySQL uses a fixed schema, which conflicts with the requirement for flexible schemas, and its read throughput is limited by instance size without native auto-scaling for high traffic. Option B is wrong because Amazon Neptune is a graph database designed for highly connected data (e.g., social graphs), but it does not provide strong consistency by default (it uses eventual consistency) and is overkill for simple user profiles and friend requests. Option D is wrong because Amazon DocumentDB (MongoDB-compatible) offers flexible schemas but does not support strong consistency for read operations (it uses eventual consistency by default), making it unsuitable for friend requests that require immediate consistency.

Full explanation →

763

MCQhard

A database administrator sees the above error logs in CloudWatch for an Amazon RDS for PostgreSQL DB instance. The application team confirms that the password for 'app_user' is correct. What is the most likely cause of the authentication failures?

A.The password has expired for 'app_user'.

B.The user 'app_user' does not have the LOGIN privilege.

C.The host '10.0.1.50' is not listed in the pg_hba.conf file.

D.The database is in read-only mode.

AnswerC

RDS for PostgreSQL uses pg_hba.conf entries to allow client connections; if the host is not allowed, authentication fails despite correct password.

Why this answer

The errors show authentication failures from a specific host. If the password is correct, the most likely cause is that the host is not allowed by the pg_hba.conf configuration. RDS for PostgreSQL uses DB parameter groups to control pg_hba.conf rules; the rds.force_ssl parameter or the pg_hba.conf entries may not include that host.

Full explanation →

764

MCQhard

A company has a multi-player game that uses DynamoDB to store game state. The access pattern is write-heavy, and the game state for each active game session is updated frequently. The team notices throttling on the table during peak hours. The table has a partition key of game_id and no sort key. What design change would best reduce throttling?

A.Use a composite key with a random suffix on the partition key.

B.Enable DynamoDB global tables.

C.Enable DynamoDB Accelerator (DAX) for the table.

D.Increase the provisioned read capacity units (RCU).

AnswerA

Write sharding distributes writes across multiple partitions, reducing hot spots.

Why this answer

The write-heavy access pattern with frequent updates to the same game sessions causes throttling because all writes for a given game_id hit the same partition, creating a hot partition. Using a composite key with a random suffix on the partition key distributes the writes across multiple partitions, reducing the per-partition write throughput and alleviating throttling.

Exam trap

The DBS-C01 exam often tests the misconception that increasing capacity or adding caching solves write throttling, but the real issue is partition-level hot spots that require key distribution strategies like random suffixes.

How to eliminate wrong answers

Option B is wrong because DynamoDB global tables replicate data across regions for disaster recovery and low-latency reads, but they do not solve hot partition issues within a single table. Option C is wrong because DAX is an in-memory cache that accelerates reads, not writes, and does not address write-heavy throttling. Option D is wrong because increasing RCU only improves read capacity, but the problem is write-heavy throttling; increasing write capacity units (WCU) would be needed, and even that does not fix the underlying hot partition issue.

Full explanation →

765

Multi-Selecthard

Which TWO of the following are valid actions to take when an Amazon Redshift query is taking longer than expected due to disk-based operations?

Select 2 answers

A.Use column compression to reduce the amount of data scanned.

B.Increase the number of workload management (WLM) query queues.

C.Redistribute data across nodes using a distribution style that minimizes data movement.

D.Change the sort keys to match the query's ORDER BY clause.

E.Increase the number of nodes in the cluster to provide more memory and CPU.

AnswersC, E

Correct: Redistributing data with a distribution style that minimizes data movement reduces the need for disk-based operations.

Why this answer

(redistributing data with appropriate distribution style) helps minimize data movement across nodes, reducing disk-based operations like spills. Option E (increasing nodes) adds more memory and CPU, enabling more in-memory processing and reducing disk spills. Option A is incorrect because column compression reduces storage but does not prevent disk-based operations.

Option B is incorrect because WLM queues manage concurrency, not query speed. Option D is incorrect because sort keys affect order-based optimizations but not disk spills.

Full explanation →

766

MCQhard

A database team notices that the Amazon Aurora MySQL-Compatible DB cluster is experiencing frequent failovers during peak hours. The failover events are not correlated with any maintenance windows or manual interventions. Which metric in Amazon CloudWatch should be investigated first to identify the root cause?

A.FreeableMemory.

B.DatabaseConnections.

C.ReadLatency.

D.WriteIOPS.

AnswerD

High WriteIOPS can overwhelm the primary instance's write capacity, causing replication lag or resource exhaustion, leading to a failover. This is the most direct metric to investigate first.

Why this answer

(WriteIOPS) is correct because during peak hours, high write IOPS can overwhelm the primary instance's capacity, leading to replication lag or resource exhaustion that triggers a failover. Monitoring WriteIOPS helps identify if the write workload exceeds the instance's limits. Option A (FreeableMemory) is incorrect because low freeable memory can cause performance degradation but is less likely to directly cause failover unless memory is severely exhausted.

Option B (DatabaseConnections) is incorrect because high connection counts can cause performance issues but typically do not directly trigger failovers unless combined with other resource constraints. Option C (ReadLatency) is incorrect because it is a symptom of issues like high read load or replication lag, but not a direct cause of failover; failovers are usually triggered by primary instance failure or unreachability.

Full explanation →

767

MCQmedium

A company runs an Amazon RDS for PostgreSQL instance with Multi-AZ deployment. The primary DB instance fails unexpectedly and a failover occurs. Which action should be taken to minimize downtime during future failovers?

A.Configure an Amazon RDS Proxy to reduce failover time.

B.Increase the DB instance size to reduce failover time.

C.Create a read replica in the same region and promote it during failover.

D.Enable Multi-AZ deployment to automatically failover to the standby.

AnswerA

Correct. RDS Proxy reduces connection disruption and helps applications recover faster during failovers, minimizing downtime.

Why this answer

Amazon RDS Proxy helps minimize downtime during failovers by maintaining database connections, reducing connection disruption and allowing applications to recover faster. The instance already has Multi-AZ enabled, so simply enabling it again is not a valid action. RDS Proxy provides connection pooling and seamless failover handling.

Increasing instance size does not reduce failover time. Read replicas require manual promotion and are not used for automatic failover in RDS for PostgreSQL. Multi-AZ is already enabled, so there is no need to enable it again.

Exam trap

Candidates often assume Multi-AZ is not enabled or that enabling it again provides more failover benefits, but the instance already has it.

Full explanation →

768

MCQmedium

A healthcare company is migrating its patient records database to Amazon RDS for SQL Server. The database contains Protected Health Information (PHI). The compliance team requires that all PHI data be encrypted at rest and that the encryption keys be stored in a dedicated AWS CloudHSM cluster. Additionally, the database must be replicated to a second AWS region for disaster recovery. The DBA has enabled RDS encryption at rest using a KMS key, but the compliance team insists on using CloudHSM. What should the DBA do to meet the compliance requirement while maintaining disaster recovery?

A.Use RDS encryption at rest with a KMS key backed by CloudHSM (custom key store).

B.Migrate the database to Amazon DynamoDB with encryption using CloudHSM via KMS custom key store.

C.Use an RDS Custom for SQL Server instance and configure TDE with CloudHSM, then set up log shipping to another region.

D.Enable Transparent Data Encryption (TDE) using a CloudHSM key and create a cross-region read replica for DR.

AnswerD

RDS for SQL Server supports TDE, which can use a CloudHSM key as the key store. Cross-region read replicas are available for RDS for SQL Server, providing disaster recovery. This meets both the encryption and DR requirements.

Why this answer

RDS for SQL Server supports Transparent Data Encryption (TDE) with CloudHSM as the key store, and RDS read replicas can be created across regions for disaster recovery. Option A is incorrect because RDS encryption at rest with a KMS key does not meet the CloudHSM requirement; KMS custom key stores (backed by CloudHSM) are not supported for RDS encryption at rest. Option B is incorrect because DynamoDB encryption with CloudHSM via KMS custom key store is possible but unnecessary and does not maintain the existing SQL Server database.

Option C is incorrect because using RDS Custom with TDE and manual log shipping is more complex and not the standard approach for cross-region disaster recovery with RDS.

Full explanation →

769

MCQhard

A company uses Amazon DynamoDB to store user session data. The security team requires that all data be encrypted at rest using a customer-managed AWS KMS key. The DynamoDB table is already configured with AWS managed KMS encryption. How can the company meet the encryption requirement without recreating the table?

A.Enable DynamoDB Streams and use a Lambda function to copy data to a new table with the desired encryption.

B.Export the table to Amazon S3 using the on-demand backup feature, then import it into a new table encrypted with the desired KMS key.

C.Use the UpdateTable API to specify the new KMS key in the SSESpecification parameter.

D.Delete the table and recreate it with the new KMS key.

AnswerC

DynamoDB allows updating the encryption key on an existing table via UpdateTable.

Why this answer

DynamoDB supports updating the server-side encryption settings on an existing table using the UpdateTable API with the SSESpecification parameter. This allows you to change from an AWS managed KMS key to a customer managed KMS key without recreating the table or causing downtime. Option A is incorrect because DynamoDB Streams are used for change data capture and cannot modify encryption settings.

Option B is incorrect because exporting to S3 and importing into a new table is unnecessary and introduces additional complexity and potential downtime when an in-place update is available. Option D is incorrect because deleting and recreating the table would result in data loss and downtime, and is not required as the UpdateTable API can change encryption directly.

Full explanation →

770

MCQmedium

An administrator needs to migrate an on-premises MongoDB database to Amazon DocumentDB. The migration must have near-zero downtime. Which approach should the administrator use?

A.Use AWS DataSync to transfer the MongoDB data files

B.Use AWS Glue to extract and load data

C.Use mongodump to export and mongorestore to import

D.Use AWS DMS with MongoDB as source and DocumentDB as target

AnswerD

DMS supports ongoing replication with change data capture for near-zero downtime.

Why this answer

AWS DMS supports ongoing replication (change data capture) from MongoDB to Amazon DocumentDB, enabling near-zero downtime migrations by keeping the target synchronized with the source until cutover. This approach avoids the downtime required by offline methods like mongodump/mongorestore or bulk data transfer tools.

Exam trap

The trap here is that candidates often choose mongodump/mongorestore (Option C) because it's a familiar MongoDB tool, but they overlook that it requires an offline snapshot, making near-zero downtime impossible.

How to eliminate wrong answers

Option A is wrong because AWS DataSync is designed for file-based data transfers (e.g., NFS/SMB) and does not support MongoDB's BSON data format or its replication protocol. Option B is wrong because AWS Glue is an ETL service for batch processing and does not provide continuous change data capture for live MongoDB migrations. Option C is wrong because mongodump/mongorestore performs a point-in-time snapshot export/import, requiring the source database to be quiesced or taken offline, which prevents near-zero downtime.

Full explanation →

771

MCQeasy

A social media startup is selecting a database for user profiles with a flexible schema and high write throughput. The application is built on Node.js and requires low-latency access. Which database should they choose?

A.Amazon Aurora

B.Amazon ElastiCache for Redis

C.Amazon RDS for MySQL

D.Amazon DynamoDB

AnswerD

NoSQL, flexible schema, high throughput.

Why this answer

Amazon DynamoDB is the correct choice because it is a fully managed NoSQL key-value and document database that offers flexible schema (schemaless), single-digit millisecond latency at any scale, and is designed for high write throughput. It integrates natively with Node.js via the AWS SDK and supports auto-scaling to handle unpredictable write loads, making it ideal for a social media startup's user profile store.

Exam trap

The trap here is that candidates often confuse ElastiCache for Redis (Option B) as a primary database due to its low latency, but it is an in-memory cache lacking durability and flexible schema, whereas DynamoDB provides both low latency and persistent storage with a schemaless design.

How to eliminate wrong answers

Option A is wrong because Amazon Aurora is a relational database with a fixed schema, which does not support flexible schema design and incurs higher latency for high-write workloads compared to DynamoDB. Option B is wrong because Amazon ElastiCache for Redis is an in-memory cache, not a durable database; it lacks persistent storage guarantees and is intended for caching, not as a primary data store for user profiles. Option C is wrong because Amazon RDS for MySQL is a relational database with a rigid schema, requiring schema migrations for flexible fields, and its write throughput is limited by the underlying instance size and replication overhead, making it unsuitable for high-write, low-latency access with a flexible schema.

Full explanation →

772

MCQmedium

A company is migrating a 500 GB MySQL database from on-premises to Amazon RDS for MySQL. The database is critical and must have minimal downtime. Which approach should be used to migrate the database with the least downtime?

A.Use AWS Database Migration Service (DMS) with a replication instance to perform a full load and then ongoing replication until cutover.

B.Modify the on-premises database to use a new master user and then use the AWS Schema Conversion Tool to migrate.

C.Create a read replica of the on-premises database and promote it to a standalone RDS instance.

D.Export the database using mysqldump and import into RDS using mysql command-line tool. Schedule a maintenance window for cutover.

AnswerA

DMS supports ongoing replication to minimize downtime during migration.

Why this answer

AWS DMS with ongoing replication (change data capture) is the correct approach because it performs an initial full load of the 500 GB database and then continuously replicates incremental changes from the source to the target RDS instance. This allows the source database to remain operational during migration, and the cutover can be performed in seconds by stopping application writes and applying the final changes, minimizing downtime to near zero.

Exam trap

The trap here is that candidates often confuse the AWS Schema Conversion Tool (SCT) with DMS, or assume that a read replica can be created from an on-premises database to RDS, but MySQL read replicas only work within the RDS ecosystem and require the source to be an RDS instance.

How to eliminate wrong answers

Option B is wrong because the AWS Schema Conversion Tool (SCT) is designed for heterogeneous migrations (e.g., Oracle to Aurora) and does not handle data migration or replication; modifying the master user does not enable minimal downtime. Option C is wrong because MySQL read replicas cannot be created across on-premises and RDS directly; read replicas require a source RDS instance, and promoting a replica does not support ongoing replication from on-premises. Option D is wrong because mysqldump and mysql import are offline methods that require the source database to be stopped or locked during the export/import, causing significant downtime, and scheduling a maintenance window does not reduce the actual data transfer time.

Full explanation →

773

MCQeasy

A company is deploying a new Amazon RDS for MariaDB instance. The database must be accessible from a specific set of EC2 instances in a VPC. How should the company configure security to allow access?

A.Assign the same security group to both the RDS instance and the EC2 instances.

B.Create a security group for the RDS instance that allows inbound traffic from the EC2 instances' security group.

C.Attach an IAM role to the EC2 instances that grants access to the RDS database.

D.Configure a network ACL to allow inbound traffic from the EC2 instance IPs.

AnswerB

Creating a security group for the RDS instance that allows inbound traffic from the EC2 instances' security group is the correct approach. It uses security group referencing, which is secure and easy to manage.

Why this answer

The recommended way to allow access from EC2 instances to an RDS instance is to create a security group for the RDS instance that allows inbound traffic on the database port from the security group attached to the EC2 instances. This leverages security group referencing, which is more secure and easier to manage than specifying IP addresses.

Option A is incorrect because while assigning the same security group to both could work, it is not a best practice as it would allow all members of that group to communicate without granularity, and it does not follow the principle of least privilege.

Option C is incorrect because IAM roles are used for authentication and authorization to AWS services, not for network-level access control. To access the RDS database, you still need to allow network traffic via a security group or NACL.

Option D is incorrect because network ACLs are stateless and operate at the subnet level. While they can be used, security groups are the preferred method for controlling traffic to an RDS instance because they are stateful and more granular.

Full explanation →

774

Multi-Selecthard

Which THREE practices should be implemented to secure an Amazon DynamoDB table that stores personally identifiable information (PII)? (Select THREE.)

Select 3 answers

A.Use a VPC endpoint to access the table.

B.Enable encryption at rest using an AWS KMS customer-managed key.

C.Use an IAM policy to restrict who can access the table.

D.Enable AWS CloudTrail to log all DynamoDB API calls.

E.Enable encryption in transit using SSL/TLS.

AnswersB, C, D

Encryption at rest protects data.

Why this answer

Using IAM policies to restrict access is a security best practice. Encrypting the table at rest with a KMS key protects data. Monitoring with CloudTrail provides audit trail.

VPC endpoints help but are not a security practice for the table itself. Encryption in transit is done by DynamoDB automatically via HTTPS. Fine-grained access control can be achieved with IAM conditions, not attribute-based access control on the table itself.

Full explanation →

775

MCQeasy

A company's Amazon RDS for MySQL DB instance is experiencing high CPU utilization. The DB instance is a db.r5.large with 200 GB of General Purpose SSD (gp2) storage. The application is performing many complex queries. Which action would BEST reduce CPU utilization without changing the application code?

A.Create a read replica and route write queries to it

B.Modify the storage type to gp3

C.Scale up the DB instance to db.r5.xlarge

D.Enable the query cache parameter

AnswerC

More CPU cores/vCPUs reduce utilization.

Why this answer

Scaling up the DB instance to db.r5.xlarge provides more CPU capacity, directly reducing CPU utilization. Option A is wrong because read replicas help with read scaling but do not reduce CPU on the writer instance. Option B is wrong because changing storage type to gp3 does not affect CPU.

Option D is wrong because the query cache is deprecated in MySQL 8.0 and its impact on CPU is minimal for complex queries.

Full explanation →

776

MCQhard

A company is migrating a 500 GB SQL Server database to Amazon RDS for SQL Server. The database has a large number of stored procedures and triggers. The migration must have minimal downtime. Which approach should be used?

A.Use AWS Schema Conversion Tool (AWS SCT) to convert the schema and AWS DMS for data migration

B.Use AWS S3 to store the data and AWS Glue to transform and load into RDS

C.Use AWS Database Migration Service (AWS DMS) with full load and ongoing replication

D.Use native SQL Server backup and restore to Amazon RDS

AnswerC

AWS DMS supports ongoing replication to minimize downtime.

Why this answer

AWS DMS with full load and ongoing replication enables continuous change data capture (CDC) from the source SQL Server database to Amazon RDS for SQL Server, minimizing downtime by keeping the target synchronized until cutover. This approach handles the stored procedures and triggers natively since both source and target are SQL Server, avoiding schema conversion issues.

Exam trap

The trap here is that candidates assume native backup/restore (Option D) is the simplest and fastest method, but they overlook the requirement for minimal downtime, which demands ongoing replication rather than a single offline restore operation.

How to eliminate wrong answers

Option A is wrong because AWS SCT is designed for heterogeneous migrations (e.g., Oracle to Aurora) and is unnecessary for a homogeneous SQL Server to RDS for SQL Server migration; it would add complexity and potential schema errors. Option B is wrong because using S3 and AWS Glue for a 500 GB database with stored procedures and triggers introduces unnecessary ETL overhead and cannot provide ongoing replication for minimal downtime; Glue is not a real-time CDC tool. Option D is wrong because native SQL Server backup and restore requires taking the database offline or using log shipping, which incurs significant downtime during the final restore and does not support ongoing replication for a near-zero-downtime cutover.

Full explanation →

777

Multi-Selecthard

A company uses Amazon DynamoDB with a global secondary index (GSI). The security team requires that only specific IAM users can query the GSI. Which THREE conditions must be met to restrict access to the GSI?

Select 3 answers

A.The policy must include a condition 'dynamodb:IndexName' with the index name.

B.The policy must include a condition key 'dynamodb:Attributes' to restrict which attributes are returned.

C.The user must have permission to query the base table as well.

D.The policy must allow the 'dynamodb:Query' action on the index.

E.The IAM policy must specify the index ARN in the Resource element.

AnswersC, D, E

Querying a GSI requires access to the base table.

Why this answer

The correct answers are C, D, and E. To restrict access to a GSI, you must ensure the user has permission to query the base table (C), allow the dynamodb:Query action on the index (D), and specify the index ARN in the Resource element (E). Option A is incorrect because the dynamodb:IndexName condition key is not used for IAM authorization; access to a GSI is controlled via the resource ARN, not a condition key.

Option B is incorrect because the dynamodb:Attributes condition key restricts which attributes are returned, not access to the GSI itself.

Exam trap

A common mistake is to think the dynamodb:IndexName condition key restricts access to a GSI, but in IAM, you must specify the index ARN in the Resource element of the policy.

Full explanation →

778

MCQmedium

A company wants to enforce encryption in transit for all connections to their ElastiCache for Redis cluster. Which security measure should they implement?

A.Set a parameter group with 'require_secure_transport' to ON.

B.Enable Encryption in-transit when creating the cluster.

C.Use VPC Flow Logs to monitor connections.

D.Enable encryption at rest using KMS.

AnswerB

This enforces TLS for all connections.

Why this answer

ElastiCache for Redis enforces encryption in transit by enabling the feature at cluster creation time. This uses TLS to encrypt data moving between clients and the Redis nodes, ensuring that all connections are secured against eavesdropping or man-in-the-middle attacks. The setting cannot be changed after the cluster is provisioned, so it must be enabled during the initial setup.

Exam trap

The trap here is that candidates confuse the 'require_secure_transport' parameter from RDS with ElastiCache, or assume that encryption in transit can be enabled after cluster creation via a parameter group change, when in fact it is a one-time setting at launch.

How to eliminate wrong answers

Option A is wrong because ElastiCache for Redis does not support a 'require_secure_transport' parameter; that parameter exists in Amazon RDS for MySQL/MariaDB, not in ElastiCache. Option C is wrong because VPC Flow Logs capture metadata about network traffic (source/destination IPs, ports, protocols) but do not enforce or enable encryption in transit; they are a monitoring tool, not a security control for encryption. Option D is wrong because encryption at rest using KMS protects data stored on disk, not data in transit over the network; it addresses a different threat model.

Full explanation →

779

MCQhard

A company is using Amazon DynamoDB with server-side encryption enabled. They need to ensure that all access to the table is audited. Which service should be used to capture data-plane API calls?

A.VPC Flow Logs

B.AWS Config

C.Amazon CloudWatch Logs

D.AWS CloudTrail

AnswerD

CloudTrail can log data events for DynamoDB, including GetItem, PutItem, etc., when configured.

Why this answer

AWS CloudTrail, when configured to capture data events, can record DynamoDB data-plane API calls such as GetItem and PutItem. Option A (VPC Flow Logs) captures network traffic, not API calls. Option B (AWS Config) records configuration changes, not data-plane actions.

Option C (Amazon CloudWatch Logs) can store logs but does not directly capture API calls; it would require another service to send logs to it.

Full explanation →

780

MCQeasy

A company wants to ensure that their Amazon RDS for PostgreSQL database is automatically backed up every day and retains backups for 30 days. Which configuration should they use?

A.Set the backup retention period to 0 to disable automated backups and use manual snapshots.

B.Create a manual snapshot daily using AWS Backup.

C.Enable Multi-AZ deployment for automatic failover.

D.Enable automated backups with a retention period of 30 days.

AnswerD

Automated backups are configurable up to 35 days.

Why this answer

Automated backups are enabled by default with a retention period of 1-35 days. Setting backup retention period to 30 days meets the requirement.

Full explanation →

781

Multi-Selecteasy

Which TWO AWS services can be used to monitor and set alarms on Amazon RDS database performance metrics? (Choose two.)

Select 2 answers

A.Amazon RDS Performance Insights

B.AWS Trusted Advisor

C.Amazon RDS Enhanced Monitoring

D.Amazon CloudWatch

E.AWS CloudTrail

AnswersC, D

Enhanced Monitoring provides OS-level metrics, which are sent to CloudWatch.

Why this answer

CloudWatch monitors metrics and can set alarms; Enhanced Monitoring provides OS-level metrics. RDS Performance Insights is for performance analysis, not alarms.

Full explanation →

782

MCQhard

A startup is building a real-time analytics dashboard on AWS. The data arrives as time-series events from IoT devices at a rate of 10,000 writes per second. Each event is approximately 1 KB. The dashboard requires sub-second query latency for the last hour of data and must support ad-hoc analytical queries on historical data spanning months. The team needs to design a cost-effective database solution. Which combination of AWS services should be used?

A.Amazon ElastiCache for Redis for real-time queries, and Amazon OpenSearch Service for historical analytics.

B.Amazon DynamoDB with DynamoDB Accelerator (DAX) for real-time queries, and Amazon S3 with Amazon Athena for historical analytics.

C.Amazon Redshift for both real-time and historical queries, using auto-scaling and materialized views.

D.Amazon RDS for PostgreSQL with read replicas for real-time queries, and Amazon Redshift for historical analytics.

AnswerB

DynamoDB handles high write throughput, DAX provides sub-second reads, and S3 with Athena allows cost-effective ad-hoc queries on historical data.

Why this answer

DynamoDB with DAX provides microsecond to sub-millisecond latency for real-time queries on the last hour of data, while S3 with Athena offers a cost-effective serverless solution for ad-hoc analytical queries on historical data spanning months. DynamoDB's time-to-live (TTL) feature can automatically expire data older than one hour, keeping the hot dataset small and performant, and Athena's pay-per-query pricing avoids the cost of maintaining a separate analytics cluster.

Exam trap

The trap here is that candidates often choose ElastiCache or Redshift for real-time performance, overlooking that DynamoDB with DAX is purpose-built for high-throughput, low-latency key-value access and that S3 with Athena is the most cost-effective serverless option for infrequent analytical queries on large historical datasets.

How to eliminate wrong answers

Option A is wrong because Amazon ElastiCache for Redis is an in-memory cache, not a durable database; it cannot reliably store 10,000 writes/sec of 1 KB events long-term without data loss on failure, and OpenSearch Service is optimized for search and log analytics, not cost-effective ad-hoc SQL queries on months of historical data. Option C is wrong because Amazon Redshift is a data warehouse designed for batch and complex analytical queries, not for sub-second real-time writes at 10,000/sec; its write throughput is limited by node types and it incurs high costs for continuous ingestion of streaming data. Option D is wrong because Amazon RDS for PostgreSQL with read replicas cannot sustain 10,000 writes/sec on a single primary instance without significant scaling issues, and using Redshift for historical analytics adds unnecessary cost and complexity compared to S3 and Athena.

Full explanation →

783

MCQmedium

An IAM policy is attached to an IAM user. The user wants to connect to an RDS MySQL database using IAM database authentication. What does this policy allow?

A.Allows the user to connect to any database on the RDS instance as any user.

B.Allows the user to manage the RDS instance.

C.Allows the user to connect to the RDS instance with the database user name 'db_user1'.

D.Allows the user to connect to the RDS instance with any database user name.

AnswerC

The resource specifies the database user.

Why this answer

IAM database authentication allows an IAM user to authenticate to an RDS MySQL database using an IAM user or role. The IAM policy must include the rds-db:connect action with a resource ARN specifying the RDS instance and the database user name. When the resource ARN includes 'db_user1', the policy only permits connection as that specific database user, not as any user.

Option A is incorrect because the policy does not grant permissions to any database or any user; it is scoped to 'db_user1'. Option B is incorrect because the rds-db:connect action does not grant management of the RDS instance. Option D is incorrect because the resource ARN restricts to 'db_user1', so connecting with any other database user name would be denied.

Full explanation →

784

MCQhard

A company is migrating a 3 TB Oracle database to Amazon RDS for Oracle. The migration uses AWS DMS with ongoing replication. The source database is actively used by applications. After the initial full load, the target RDS instance is in sync. However, during the ongoing replication phase, the replication task fails with an error: 'ORA-1555: snapshot too old.' The DMS task has been set up with a source endpoint that uses the 'Oracle TNS' connection method. The company needs to resolve the issue without stopping the source database. Which action should be taken?

A.Change the source endpoint to use the 'Oracle SID' connection method.

B.Decrease the batch size of the DMS task.

C.Increase the undo retention period in the source Oracle database.

D.Increase the frequency of the DMS task's log mining.

AnswerC

Longer undo retention keeps snapshot data available for DMS.

Why this answer

The ORA-1555 error indicates that undo data is overwritten before DMS can read it. Increasing undo retention ensures the snapshot data is available longer. Reducing batch size would not address the undo issue.

Increasing logging frequency does not affect undo. Using a different connection method does not solve the underlying undo retention problem.

Full explanation →

785

MCQmedium

A database administrator is troubleshooting a failover event for an Amazon RDS for SQL Server Multi-AZ DB instance. The failover occurred automatically. Which AWS service or feature should the administrator use to view the failover history and the reason for the failover?

A.The Amazon RDS console Events page.

B.Amazon CloudWatch Logs for the DB instance.

C.AWS CloudTrail logs to view the failover API call.

D.The AWS Status Dashboard.

AnswerA

RDS events include failover events with reasons.

Why this answer

The Amazon RDS console Events page stores RDS events, including failover events with reasons. This is the best place to view failover history and reason. CloudTrail records API calls but not internal failover reasons.

CloudWatch Logs does not automatically log failover reasons. The AWS Status Dashboard shows service health, not instance-specific failover history.

Full explanation →

786

MCQeasy

A company is building a real-time analytics dashboard for IoT sensor data. The data arrives as JSON and needs to be stored in a way that supports fast ingestion and complex queries. Which database service is best suited?

A.Amazon RDS for PostgreSQL

B.Amazon DynamoDB with TTL

C.Amazon Timestream

D.Amazon Redshift

AnswerC

Amazon Timestream is purpose-built for time-series data, ingesting JSON sensor payloads via its write-optimised storage tier that automatically partitions data by time. This satisfies the requirement for fast ingestion of high-frequency IoT data, while its separate query-optimised tier enables complex analytical queries using standard SQL, addressing the need for real-time dashboarding without schema management overhead.

Why this answer

Amazon Timestream is purpose-built for time-series data, offering fast ingestion of JSON sensor data and optimized storage for time-based queries. It automatically manages retention, compression, and tiering (memory and magnetic store), enabling complex analytical queries (e.g., window functions, interpolation) without manual tuning. This makes it ideal for real-time IoT analytics dashboards.

Exam trap

The trap here is that candidates often choose Amazon DynamoDB for its fast ingestion and scalability, overlooking that complex time-series queries (e.g., moving averages, gap filling) require purpose-built time-series functions that DynamoDB lacks, while Timestream provides them natively.

How to eliminate wrong answers

Option A is wrong because Amazon RDS for PostgreSQL is a relational database optimized for OLTP workloads, not for high-velocity time-series ingestion or time-based analytical queries; it lacks automatic time-series data lifecycle management and can suffer from write contention under high-frequency sensor data. Option B is wrong because Amazon DynamoDB with TTL is a key-value and document database designed for low-latency lookups and simple queries, not for complex analytical queries over time-series data; TTL only handles data expiration, not time-based aggregation or interpolation. Option D is wrong because Amazon Redshift is a columnar data warehouse optimized for batch analytics and complex queries over large datasets, but it is not designed for real-time, high-frequency ingestion of streaming IoT data; its ingestion latency and cost model are unsuitable for per-second sensor writes.

Full explanation →

787

MCQhard

A financial services company is designing a ledger system using Amazon QLDB. The application records transactions that must never be modified or deleted. The company expects high write throughput and needs to ensure that the ledger can handle the load without throttling. Which design consideration is MOST important to achieve this?

A.Partition the ledger table by transaction date to distribute write load.

B.Create multiple ledgers and distribute writes across them.

C.Enable auto-scaling on the ledger to handle bursts of traffic.

D.Batch multiple document inserts into a single transaction to reduce the number of transactions.

AnswerD

Batching reduces the number of transactions, helping to stay within throughput limits.

Why this answer

Amazon QLDB charges per transaction (document insert, update, or delete) and has a maximum throughput limit of 1,000 transactions per second per ledger. By batching multiple document inserts into a single transaction, you reduce the number of transactions, thereby staying within the throughput limit while still achieving high write throughput. This approach directly addresses the need to avoid throttling without sacrificing the immutability requirements of the ledger system.

Exam trap

The trap here is that candidates often assume QLDB supports auto-scaling like DynamoDB or Aurora, but QLDB has a fixed throughput limit and requires batching to handle high write loads without throttling.

How to eliminate wrong answers

Option A is wrong because QLDB is a fully managed ledger database that automatically partitions data; manual partitioning by transaction date is not supported and would not distribute write load. Option B is wrong because creating multiple ledgers increases operational complexity and does not inherently increase write throughput per ledger; QLDB's throughput limit applies per ledger, and distributing writes across ledgers would require application-level sharding, which is not a recommended design for a single ledger system. Option C is wrong because QLDB does not support auto-scaling; it has a fixed throughput limit of 1,000 transactions per second per ledger, and enabling auto-scaling is not a feature available in QLDB.

Full explanation →

788

MCQhard

A financial services company is using Amazon Aurora MySQL as its primary database. The database has a table 'transactions' that receives high inserts during business hours. The table is partitioned by date. Recently, the application team noticed an increase in lock wait timeouts. The database specialist reviewed the InnoDB status and found that there are frequent gap locks on the 'transaction_date' column. The isolation level is REPEATABLE READ. What should the specialist do to reduce lock waits while maintaining data consistency?

A.Add a secondary index on transaction_date.

B.Increase the innodb_lock_wait_timeout parameter.

C.Modify the partitioning key to use a hash-based partition.

D.Change the transaction isolation level to READ COMMITTED.

AnswerD

READ COMMITTED avoids gap locks for locking reads.

Why this answer

In REPEATABLE READ isolation level, InnoDB uses gap locks on non-unique indexes to prevent phantom reads, which can cause lock wait timeouts. Changing to READ COMMITTED eliminates gap locks for non-unique indexes because it only uses row-level locks (no gap locks). This reduces lock contention.

Option A is incorrect: adding an index on transaction_date does not eliminate gap locks if the index is non-unique; gap locks still occur. Option B is incorrect: increasing innodb_lock_wait_timeout only increases the time a transaction waits for a lock, it does not prevent the lock from happening. Option C is incorrect: modifying the partition key does not affect the locking mechanism at the row level.

Exam trap

Candidates often think that adding an index will reduce locking, but in REPEATABLE READ, non-unique indexes still cause gap locks. The correct solution is to change the isolation level to READ COMMITTED.

Full explanation →

789

Multi-Selecteasy

A company is building a microservices architecture and needs a database for a service that stores JSON documents with variable schema. The database must support high availability and automatic scaling. Which TWO services meet these requirements? (Choose two.)

Select 2 answers

A.Amazon ElastiCache for Redis

B.Amazon DynamoDB

C.Amazon DocumentDB

D.Amazon Neptune

E.Amazon RDS for MySQL

AnswersB, C

DynamoDB supports JSON documents, high availability, and auto scaling.

Why this answer

Amazon DynamoDB is correct because it is a fully managed NoSQL key-value and document database that natively supports JSON documents with variable schema, offers high availability through multi-AZ replication, and provides automatic scaling via its on-demand capacity mode or auto-scaling policies. It is ideal for microservices architectures that require low-latency, serverless, and elastic throughput.

Exam trap

AWS often tests the misconception that any database supporting JSON (like MySQL with JSON data type) qualifies as a document database for variable schema workloads, but the key differentiator is automatic scaling and native document store capabilities, which DynamoDB and DocumentDB provide, while RDS does not.

Full explanation →

790

MCQhard

Refer to the exhibit. An Amazon RDS for Oracle instance is experiencing ORA-00257 errors. The DBA has already increased the archive log retention setting. What is the most efficient next step to resolve the issue without manual intervention?

A.Configure archiving to Amazon S3 to offload logs.

B.Reboot the DB instance to clear the recovery area.

C.Modify the DB instance to increase the allocated storage.

D.Manually delete old archive logs from the recovery area using RMAN.

AnswerC

Increasing storage automatically increases the recovery area size.

Why this answer

The ORA-00257 error indicates the flash recovery area is full. In Amazon RDS for Oracle, the flash recovery area size is tied to the allocated storage (default is 30% of allocated storage). Increasing allocated storage automatically expands the recovery area, resolving the issue without manual intervention.

Option A is incorrect because Amazon RDS for Oracle does not support archiving redo logs directly to Amazon S3 as a built-in feature. Option B is incorrect because rebooting the DB instance does not free space in the recovery area; it only restarts the database. Option D is incorrect because manually deleting archive logs using RMAN requires manual intervention, which is not the most efficient automated solution.

Full explanation →

791

Multi-Selectmedium

Which TWO methods can be used to encrypt an existing unencrypted Amazon RDS for Oracle DB instance? (Choose 2.)

Select 2 answers

A.Use the AWS Management Console to toggle encryption on the DB instance.

B.Create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the DB instance from the encrypted snapshot.

C.Modify the DB instance and enable encryption in the configuration.

D.Use AWS Database Migration Service (DMS) to migrate data to a new encrypted DB instance.

E.Create a read replica with encryption enabled.

AnswersB, D

This is a supported method to encrypt an existing instance.

Why this answer

You can encrypt an existing unencrypted RDS for Oracle DB instance by taking a snapshot, copying it with encryption enabled, and then restoring the instance from the encrypted snapshot. This process creates a new encrypted DB instance from the snapshot copy, effectively encrypting the data at rest using AWS KMS. Option D is correct because AWS DMS can migrate data from an unencrypted source DB instance to a new target DB instance that has encryption enabled, allowing you to move the data while applying encryption during the migration process.

Exam trap

The trap here is that candidates often think encryption can be enabled via a simple modification or toggle in the console, but AWS requires a snapshot copy or migration because encryption is a volume-level attribute that cannot be changed on a running instance.

Full explanation →

792

Multi-Selecthard

A company uses Amazon RDS for SQL Server with Multi-AZ deployment. The security team wants to ensure that all database connections use SSL/TLS encryption. Which TWO actions should the database specialist take to enforce SSL connections? (Choose two.)

Select 2 answers

A.Use the RDS Console to enable 'Force SSL' on the DB instance.

B.Modify the DB parameter group to set 'require_secure_transport' to ON.

C.Create a server-level trigger that requires SSL for all logins.

D.Add an inbound rule to the security group that only allows traffic on port 1433 from IP addresses that use SSL.

E.Set the 'rds.force_ssl' parameter to 1 in the DB parameter group.

AnswersC, E

A trigger can enforce SSL by checking the session's protocol and denying non-SSL connections.

Why this answer

SQL Server allows you to create a server-level DDL trigger that checks the login event and enforces SSL by examining the `@@OPTIONS` or `encrypt_option` in `sys.dm_exec_connections`. This is a supported method to force SSL for all connections to an RDS for SQL Server instance. Option E is correct because setting the `rds.force_ssl` parameter to 1 in the DB parameter group is the native RDS mechanism to enforce SSL/TLS for all connections to the DB instance.

Exam trap

The trap here is that candidates confuse MySQL-specific parameters (like `require_secure_transport`) with SQL Server parameters, or assume that security group rules can enforce encryption at the transport layer, when in fact they only control network access, not the encryption state of the connection.

Full explanation →

793

Drag & Dropmedium

Arrange the steps to perform a point-in-time recovery (PITR) for an Amazon RDS for MySQL DB instance in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

PITR restores the database to a specific time within the backup retention window by selecting the restore option and specifying the time.

Full explanation →

794

MCQmedium

A company is using Amazon RDS for MySQL with Multi-AZ deployment. The application team reports intermittent connection timeouts. CloudWatch shows increased DatabaseConnections and CPU Utilization during peak hours. Which action should the database specialist take to troubleshoot the issue?

A.Add enhanced monitoring to collect additional metrics.

B.Enable slow query log and analyze queries.

C.Create a read replica and redirect read traffic.

D.Failover to the standby instance to refresh connections.

AnswerB

Slow query log helps identify inefficient queries causing high resource usage.

Why this answer

Enabling the slow query log allows the database specialist to identify long-running or inefficient queries that contribute to high CPU utilization and increased database connections, leading to connection timeouts during peak hours. Option A is incorrect because Enhanced Monitoring provides additional metrics (e.g., OS-level metrics) but does not directly address the root cause of the timeouts; it is useful for deeper analysis but not the primary troubleshooting action. Option C is incorrect because creating a read replica and redirecting read traffic reduces load on the primary for read operations, but the issue likely involves write-intensive or poorly optimized queries affecting the primary; while it might alleviate some load, it is not a direct troubleshooting step to identify the cause.

Option D is incorrect because failing over to the standby instance is for high availability and disaster recovery, not for resolving performance issues; it would restart the database but not fix the underlying queries or resource contention.

Full explanation →

795

MCQhard

A company is using Amazon DynamoDB with encryption at rest using an AWS managed key. The security team now requires that the encryption key be rotated every 90 days. What should they do?

A.Enable automatic key rotation in AWS KMS for the default DynamoDB key.

B.Create a new customer managed key and enable automatic rotation every 90 days.

C.Disable encryption at rest and implement client-side encryption.

D.Use a customer managed key and manually rotate it every 90 days by creating a new key and updating the DynamoDB table.

AnswerD

Manual rotation is required to achieve a 90-day rotation schedule.

Why this answer

DynamoDB encryption at rest using an AWS managed key does not support customer-controlled rotation. Option D is correct because using a customer managed key allows you to manually rotate the key every 90 days by creating a new key and updating the DynamoDB table. Option A is incorrect because AWS managed keys rotate automatically every year, not on a 90-day schedule.

Option B is incorrect because KMS automatic rotation for customer managed keys is also yearly and cannot be set to 90 days. Option C is incorrect because disabling encryption at rest is not a valid solution and adds security risk.

Full explanation →

796

MCQhard

A social media company uses Amazon DynamoDB to store user posts. The table has a partition key of 'user_id' and a sort key of 'post_timestamp'. Each item is about 10 KB. The application needs to retrieve all posts for a given user within a date range. The company recently added a new feature that allows users to 'like' posts, and they store the like count as an attribute in the post item. The like count is updated frequently. The application experiences high write throttling on the table. The table has 1000 WCUs provisioned. The write pattern is bursty. Which design change would MOST effectively reduce write throttling?

A.Increase the WCUs to 5000.

B.Enable DynamoDB Accelerator (DAX) to cache writes.

C.Add a random suffix to the user_id partition key to distribute writes across multiple partitions.

D.Create a Global Secondary Index (GSI) on the like count attribute.

AnswerC

Sharding spreads the write load evenly across partitions, reducing throttling.

Why this answer

The write throttling is caused by a 'hot partition' — all writes for a given user_id go to the same partition, and the bursty write pattern (e.g., many likes on a single post) exceeds the partition's 1,000 WCU limit (1,000 write capacity units per partition). Adding a random suffix to the user_id partition key distributes writes across multiple partitions, effectively increasing the write throughput for that logical user's data. This is a common design pattern for DynamoDB to handle high-traffic items without increasing provisioned capacity.

Exam trap

The trap here is that candidates often assume increasing provisioned capacity (Option A) is the universal fix for throttling, but AWS specifically tests the understanding that DynamoDB's partition-level throughput limits require data distribution changes, not just capacity increases.

How to eliminate wrong answers

Option A is wrong because simply increasing WCUs to 5000 does not solve the hot partition issue — the writes are still concentrated on a single partition key (user_id), and a single partition can only handle up to 1,000 WCUs (or 3,000 if using burst capacity), so throttling will persist. Option B is wrong because DynamoDB Accelerator (DAX) is an in-memory cache for reads, not writes — it does not absorb or buffer write requests, so it cannot reduce write throttling. Option D is wrong because creating a Global Secondary Index (GSI) on the like count attribute does not affect the base table's write capacity or partition distribution; GSIs have their own write capacity and are used for querying, not for alleviating write contention on the base table.

Full explanation →

797

MCQhard

A company is designing a disaster recovery plan for an Amazon DynamoDB table that stores critical session data. The table is provisioned with on-demand capacity. The recovery objective is to have the data available in another AWS Region within 15 minutes of a regional outage. Which design should they choose?

A.Use DynamoDB on-demand backups and restore to another Region.

B.Use DynamoDB Streams to replicate data to a table in another Region via AWS Lambda.

C.Use DynamoDB Global Tables to replicate data across Regions.

D.Create cross-Region Read Replicas for DynamoDB.

AnswerC

Global Tables provide active-active replication across Regions.

Why this answer

DynamoDB Global Tables provide multi-Region, fully replicated tables with automatic conflict resolution, enabling active-active replication that meets the 15-minute recovery objective without manual intervention. Global Tables replicate data across Regions in sub-second latency, ensuring data availability within the required RTO during a regional outage.

Exam trap

The trap here is that candidates confuse DynamoDB Global Tables with cross-Region Read Replicas (which exist in RDS but not DynamoDB) or assume that on-demand backups can meet a 15-minute RTO, ignoring the manual restore time and lack of continuous replication.

How to eliminate wrong answers

Option A is wrong because on-demand backups are point-in-time snapshots that require manual restore to another Region, which typically takes longer than 15 minutes and does not provide continuous replication for real-time availability. Option B is wrong because DynamoDB Streams with AWS Lambda introduces eventual consistency and potential replication lag that can exceed 15 minutes, and it requires custom code for conflict resolution and error handling, making it less reliable for strict RTOs. Option D is wrong because DynamoDB does not support cross-Region Read Replicas; this feature is available in Amazon RDS (e.g., Aurora, MySQL) but not in DynamoDB, which uses Global Tables for multi-Region replication.

Full explanation →

798

MCQhard

A gaming company uses Amazon DynamoDB to store player profiles. The table has partition key 'player_id' and sort key 'game_id'. During a new game launch, write traffic to a subset of players (influencers) spikes, causing throttling. The table uses on-demand capacity. Which solution resolves the hot key issue?

A.Increase the maximum read capacity units in the on-demand settings

B.Switch to provisioned capacity mode and increase write capacity units

C.Add a random suffix to the partition key for the hot players to distribute writes

D.Enable DynamoDB Accelerator (DAX) to cache writes

AnswerC

Shuffling hot keys across partitions resolves hot key throttling.

Why this answer

Adding a random suffix to the partition key for hot players distributes the write traffic across multiple partitions, preventing any single partition from being overwhelmed. DynamoDB's on-demand capacity mode automatically scales to handle traffic spikes, but it cannot resolve a hot key issue where all writes target the same partition key. By diversifying the partition key, writes are spread across partitions, allowing DynamoDB to utilize its full throughput capacity.

Exam trap

The trap here is that candidates often assume on-demand capacity mode automatically solves all scaling issues, but it cannot mitigate hot keys because the bottleneck is at the partition level, not the table level.

How to eliminate wrong answers

Option A is wrong because on-demand capacity mode does not have a maximum read capacity unit setting; it scales automatically based on traffic, and increasing a non-existent setting cannot fix a hot key issue. Option B is wrong because switching to provisioned capacity mode and increasing write capacity units does not address the root cause of a hot key; it only increases the overall table throughput, but a single partition still has a hard limit of 1,000 write capacity units, so throttling will persist. Option D is wrong because DynamoDB Accelerator (DAX) is an in-memory cache for reads, not writes; it cannot absorb or distribute write traffic, so it does not solve write throttling due to a hot key.

Full explanation →

799

MCQmedium

A company uses Amazon ElastiCache for Redis to cache session data. The security team requires that all data in transit be encrypted. The Redis cluster currently does not have encryption in transit enabled. The database specialist needs to enable encryption in transit with minimal downtime. Which action should the specialist take?

A.Create a new Redis cluster with encryption in transit enabled, and migrate the data from the existing cluster.

B.Update the Redis parameter group to enable the 'encryption-in-transit' parameter and reboot the cluster.

C.Use a security group to enforce encrypted connections by allowing only TLS traffic.

D.Modify the existing Redis cluster to enable encryption in transit using the AWS CLI.

E.Enable encryption in transit on the existing cluster by using the AWS Management Console.

AnswerA

Encryption in transit can only be enabled at cluster creation time.

Why this answer

Encryption in transit for ElastiCache for Redis can only be enabled at cluster creation time; it cannot be added to an existing cluster. Therefore, the correct approach is to create a new Redis cluster with encryption in transit enabled, migrate the session data from the existing cluster (e.g., using replication or a manual export/import), and then redirect application traffic to the new cluster. This ensures minimal downtime if the migration is performed during a maintenance window or using a blue/green deployment strategy.

Exam trap

The trap here is that candidates assume encryption in transit can be toggled on an existing cluster, similar to enabling encryption at rest, but AWS enforces it as a creation-time-only setting for ElastiCache for Redis.

How to eliminate wrong answers

Option B is wrong because there is no 'encryption-in-transit' parameter in a Redis parameter group; encryption in transit is a cluster-level setting that cannot be changed via parameter groups. Option C is wrong because security groups control network access at the IP/port level but cannot enforce TLS encryption; they do not enable encryption in transit on the Redis cluster itself. Option D is wrong because the AWS CLI cannot modify an existing cluster to enable encryption in transit; this setting is immutable after creation.

Option E is wrong because the AWS Management Console does not allow enabling encryption in transit on an existing cluster; it must be set at launch time.

Full explanation →

800

MCQhard

A financial services company uses Amazon DynamoDB to store transaction records. The table has a partition key of 'AccountId' and a sort key of 'TransactionDate'. The company needs to run analytical queries that aggregate transactions by account and month. Currently, queries are slow due to full table scans. Which design change will improve query performance most effectively?

A.Add DynamoDB Accelerator (DAX) to the table.

B.Change the table's sort key from TransactionDate to Month.

C.Enable DynamoDB Streams and process the stream with AWS Lambda to pre-aggregate results.

D.Create a Global Secondary Index (GSI) with partition key AccountId and sort key Month.

AnswerD

Allows efficient aggregation queries using the GSI.

Why this answer

Creating a Global Secondary Index (GSI) with partition key AccountId and sort key Month allows the analytical queries to efficiently retrieve aggregated data by account and month without scanning the entire base table. The GSI reorganizes data by month, enabling DynamoDB to use the sort key for range queries and avoid full table scans, which directly addresses the performance issue.

Exam trap

The trap here is that candidates often confuse caching solutions like DAX with query optimization, not realizing that DAX does not change the access pattern or eliminate the need for scans when the query lacks an appropriate index.

How to eliminate wrong answers

Option A is wrong because DynamoDB Accelerator (DAX) is an in-memory cache that speeds up read-heavy workloads but does not change the underlying data model or query pattern; it would still require full table scans for analytical queries that aggregate by month. Option B is wrong because changing the sort key from TransactionDate to Month would break existing query patterns that rely on precise date ranges and would not eliminate the need for scans if the partition key alone is used; it also does not support efficient aggregation across all accounts. Option C is wrong because enabling DynamoDB Streams and processing with Lambda to pre-aggregate results introduces eventual consistency and operational complexity, and it does not improve the performance of the existing query directly; it is a workaround for real-time aggregation, not a design change for the current query.

Full explanation →

801

Multi-Selectmedium

A company is designing a database for a global e-commerce platform that requires low-latency reads and writes from multiple AWS Regions. The database must support ACID transactions and complex queries with joins. Which TWO services should they consider? (Choose two.)

Select 2 answers

A.Amazon DynamoDB with Global Tables

B.Amazon ElastiCache for Redis with global datastore

C.Amazon RDS for MySQL with cross-Region read replicas

D.Amazon Aurora with Aurora Global Database

E.Amazon Redshift with cross-Region snapshots

AnswersC, D

Amazon RDS for MySQL with cross-Region read replicas supports ACID and joins, but writes are only in one region, failing the requirement for low-latency writes from multiple regions.

Why this answer

Both Amazon Aurora with Aurora Global Database and Amazon RDS for MySQL with cross-Region read replicas support ACID transactions and complex queries with joins. They can provide low-latency reads from multiple regions through read replicas in each region, though writes are directed to a single primary region, which may impact write latency from non-primary regions. Amazon DynamoDB Global Tables provide multi-region writes but do not support joins for complex queries, so they cannot fully meet the requirements.

ElastiCache Redis and Amazon Redshift lack the necessary ACID and join capabilities.

Exam trap

Candidates often select DynamoDB Global Tables because it supports multi-region writes, but overlook the requirement for complex joins. The correct options for complex queries are either Aurora Global Database or RDS with cross-region read replicas, even though writes are limited to one region. This highlights the trade-off between global write scalability and relational features.

Full explanation →

802

MCQmedium

A company is migrating its on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all data at rest be encrypted using a customer-managed key stored in AWS KMS, and that the key be rotated automatically every year. The company also needs to ensure that only specific IAM roles can access the key. Which combination of steps should the database administrator take to meet these requirements?

A.Create the RDS instance without encryption, then use the AWS Console to enable encryption after creation using a customer-managed key.

B.Create the RDS instance with encryption using the default AWS managed service key, and set up automatic key rotation in KMS.

C.Use AWS CloudHSM to generate and store the encryption key, and configure RDS to use the CloudHSM key for encryption.

D.Create the RDS instance with encryption enabled using a customer-managed KMS key, and configure the key policy to restrict access to the required IAM roles.

AnswerD

This meets encryption, key rotation, and access control requirements.

Why this answer

It enables encryption on the RDS instance with a customer-managed KMS key, which allows automatic yearly key rotation (configurable in KMS) and access control via KMS key policies to restrict usage to specific IAM roles. Option A is wrong because RDS does not support enabling encryption after creation; it must be enabled at launch. Option B is wrong because the default AWS managed service key does not allow customer-managed rotation or custom key policies.

Option C is wrong because CloudHSM is not required; KMS customer-managed keys satisfy the requirements without CloudHSM.

Full explanation →

803

MCQhard

A database engineer is reviewing Amazon RDS for MySQL error logs and sees repeated authentication failures from the same IP address. The application team confirms the password is correct. What is the most likely cause of these errors?

A.The password is incorrect

B.The user 'app_user' does not have access from host '10.0.1.50'

C.The 'app_user' account is locked

D.The database requires SSL connections

AnswerB

The user may be defined as 'app_user'@'%' or from a different host, causing a mismatch.

Why this answer

The error logs show authentication failures despite the password being correct, which indicates the issue is not with the password itself but with the host-based access control. In MySQL, user accounts are defined as 'user'@'host', and if the application is connecting from an IP address (e.g., 10.0.1.50) that is not included in the user's allowed hosts, MySQL will reject the connection with an authentication error even if the password is correct. This is a common misconfiguration when migrating or scaling applications across different subnets.

Exam trap

The trap here is that candidates often assume authentication failures always mean a wrong password, but AWS/DBS-C01 tests your understanding that MySQL's host-based authentication can produce the same error message when the host is not authorized, even with a valid password.

How to eliminate wrong answers

Option A is wrong because the application team has confirmed the password is correct, and authentication failures from a specific IP with a correct password point to host-based restrictions, not an incorrect password. Option C is wrong because a locked account would produce a different error message (e.g., 'Access denied for user ... account is locked') and would affect all connection attempts, not just those from a single IP. Option D is wrong because requiring SSL connections would cause a different error (e.g., 'SSL connection error: ...') and would affect all connection attempts, not just those from a specific IP; the error logs show authentication failures, not SSL handshake failures.

Full explanation →

804

MCQmedium

A database specialist is managing an Amazon RDS for Oracle DB instance. The instance has a large amount of data and the specialist needs to migrate it to a new instance in a different AWS Region. Which method would minimize downtime and be the most efficient?

A.Use AWS Database Migration Service (DMS) with ongoing replication to migrate to the target instance.

B.Export the database to Amazon S3 using Oracle Data Pump, then import into the new instance.

C.Create a cross-region read replica and promote it.

D.Take a full backup using Oracle RMAN, copy the backup files to the target region, and restore.

AnswerA

DMS supports minimal downtime with ongoing replication.

Why this answer

AWS DMS with ongoing replication (change data capture) allows you to perform a full load of the existing Oracle database to the target instance in the new region, and then continuously replicate changes from the source until you cut over. This minimizes downtime because you can keep the source database fully operational during the migration and only stop it for a brief period during the final switchover. It is the most efficient method for cross-region migrations because it handles schema conversion, data validation, and ongoing synchronization automatically.

Exam trap

The trap here is that candidates often assume cross-region read replicas are available for all RDS engines, but Amazon RDS for Oracle does not support cross-region read replicas, making Option C an invalid choice despite its appeal for minimizing downtime.

How to eliminate wrong answers

Option B is wrong because exporting to Amazon S3 using Oracle Data Pump requires the source database to be taken offline or placed in read-only mode during the export, and the import process also incurs significant downtime; it does not support ongoing replication, so the total downtime is much longer than with DMS. Option C is wrong because Amazon RDS for Oracle does not support cross-region read replicas; read replicas are only available within the same region for Oracle, and promoting a replica would not work across regions. Option D is wrong because taking a full RMAN backup and copying it to the target region requires the source database to be in backup mode or incur a brief outage, and the restore process is time-consuming; it also does not provide ongoing replication, so you would lose any changes made after the backup was taken, leading to data loss or extended downtime to capture incremental changes.

Full explanation →

805

MCQeasy

A snapshot of an Amazon RDS DB instance is shown in the exhibit. What does the output indicate?

A.The snapshot creation is still in progress.

B.The snapshot is encrypted and the encryption process is complete.

C.The snapshot is not encrypted.

D.The snapshot is in the process of being encrypted.

AnswerB

The status 'encrypted' means the snapshot is encrypted.

Why this answer

The snapshot is encrypted (Encrypted: true) and the status is 'encrypted', indicating that the encryption process is complete. Option A is incorrect because the snapshot exists and is not in progress. Option C is incorrect because the snapshot is indeed encrypted.

Option D is incorrect because the status shows 'encrypted', not 'encrypting'.

Full explanation →

806

Multi-Selectmedium

A company is designing a database solution for a global user base that requires single-digit millisecond read latency for user profile data. The data is eventually consistent and can tolerate a few seconds of staleness. Which TWO AWS services or features should be combined to achieve this latency?

Select 2 answers

A.Amazon ElastiCache for Redis with global datastore.

B.Amazon DynamoDB Global Tables.

C.Amazon CloudFront with a custom origin pointing to DynamoDB.

D.Amazon RDS for MySQL with cross-Region read replicas.

E.Amazon Aurora Global Database.

AnswersB, C

Global Tables replicate data across regions, enabling low-latency local reads.

Why this answer

Amazon DynamoDB Global Tables provides a fully managed, multi-Region, multi-active database that replicates data across AWS Regions with sub-second latency, enabling single-digit millisecond reads for user profile data. Combined with Amazon CloudFront as a CDN, you can cache DynamoDB responses at edge locations, further reducing read latency for a global user base while tolerating eventual consistency and a few seconds of staleness.

Exam trap

The trap here is that candidates may assume Amazon ElastiCache or Aurora Global Database are required for single-digit millisecond latency, overlooking how DynamoDB Global Tables combined with CloudFront caching can achieve this without the complexity of managing a separate cache layer or dealing with cross-Region replication lag.

Full explanation →

807

MCQeasy

A company is migrating a 2 TB MySQL database from on-premises to Amazon RDS for MySQL. They need to minimize downtime and ensure data consistency. They plan to use AWS DMS. What is the first step they should take before starting the migration task?

A.Create a read replica of the source database to reduce load.

B.Enable binary logging (binlog) on the source MySQL database.

C.Disable foreign key checks on the source database to speed up the load.

D.Enable binary logging on the target RDS for MySQL instance.

AnswerB

Binlog is required for CDC to capture ongoing changes.

Why this answer

AWS DMS requires binary logging (binlog) to be enabled on the source MySQL database to capture ongoing changes during the full-load and change data capture (CDC) phase. This ensures data consistency and minimizes downtime by allowing DMS to replicate incremental changes after the initial load. Without binlog, DMS cannot perform CDC, and the migration would be limited to a one-time snapshot, risking data loss or extended downtime.

Exam trap

The trap here is that candidates often confuse the need for binary logging on the source versus the target, or assume that a read replica or disabling constraints is the first step, but DMS specifically requires binlog on the source for continuous replication.

How to eliminate wrong answers

Option A is wrong because creating a read replica of the source database does not directly enable DMS to capture changes; DMS can already read from the source without a replica, and a replica adds complexity without addressing the core requirement for CDC. Option C is wrong because disabling foreign key checks on the source database is not a prerequisite for DMS; DMS handles foreign key constraints during migration, and disabling them could compromise data integrity. Option D is wrong because binary logging must be enabled on the source database, not the target; the target RDS instance does not need binlog for DMS to write data, and enabling it on the target is irrelevant for capturing source changes.

Full explanation →

808

Multi-Selecthard

Which THREE factors should be considered when selecting the backup strategy for an Amazon RDS for PostgreSQL DB instance? (Choose 3.)

Select 3 answers

A.The backup retention period

B.The Recovery Point Objective (RPO) requirement

C.The impact of the backup window on database performance

D.The need for Multi-AZ deployment

E.The encryption at rest requirement

AnswersA, B, C

Retention period determines how long backups are stored, affecting cost and compliance.

Why this answer

The backup retention period directly determines how far back you can perform a point-in-time recovery (PITR) for an RDS for PostgreSQL instance. Amazon RDS stores automated backups and transaction logs for the specified retention period (1 to 35 days), and this period must be aligned with your compliance and operational requirements. Choosing an appropriate retention period is a fundamental factor in defining the backup strategy.

Exam trap

AWS often tests the misconception that Multi-AZ deployment is part of the backup strategy, but in reality it is a high-availability feature that does not affect backup retention, RPO, or backup window performance.

Full explanation →

809

MCQeasy

A team manages an Amazon Aurora MySQL database. They observe that the 'Deadlocks' metric in CloudWatch is spiking. The application uses a single writer instance and multiple read replicas. Which action is most effective at reducing deadlocks?

A.Increase the instance size to handle more concurrent connections.

B.Redirect read traffic to read replicas to reduce load on the writer.

C.Enable Multi-AZ to distribute the load.

D.Review application code to ensure transactions are as short as possible and access tables in a consistent order.

AnswerD

Minimizing transaction duration and accessing resources in a fixed order reduces deadlock probability.

Why this answer

Deadlocks in Aurora MySQL occur when two or more transactions hold locks that the other needs, and they wait indefinitely. The most effective way to reduce deadlocks is to keep transactions short and access tables in a consistent order, which minimizes lock contention and avoids circular wait conditions. This directly addresses the root cause of deadlocks, unlike scaling or redirecting traffic, which only reduce the probability of contention without fixing the underlying locking pattern.

Exam trap

The trap here is that candidates often confuse load-related issues (e.g., high CPU or connections) with deadlocks, and incorrectly choose scaling or read replica offloading, when deadlocks are fundamentally a locking order and transaction duration problem.

How to eliminate wrong answers

Option A is wrong because increasing instance size improves throughput and reduces resource contention but does not change the application's locking behavior; deadlocks can still occur if transactions hold locks for long periods or access tables in inconsistent orders. Option B is wrong because redirecting read traffic to read replicas reduces load on the writer but does not affect the locking patterns of write transactions; deadlocks are caused by write-write conflicts, not read load. Option C is wrong because Multi-AZ in Aurora is a high-availability feature that provides a standby replica for failover; it does not distribute load or reduce lock contention, and Aurora's storage is already replicated across three AZs by default.

Full explanation →

810

MCQeasy

A company is building a document management system where each document can have multiple tags and users need to query documents by any combination of tags. The number of tags per document is up to 20, and the total number of documents is expected to be 50 million. Which database design is most appropriate for this flexible tag-based querying?

A.Amazon DynamoDB with a global secondary index on the tag attribute

B.Amazon RDS for MySQL with a normalized schema

C.Amazon Neptune

D.Amazon ElastiCache for Memcached

AnswerA

DynamoDB scales easily and supports flexible tag queries.

Why this answer

Amazon DynamoDB with a global secondary index on the tag attribute is the most appropriate design because it supports flexible, low-latency queries on any combination of tags at scale. DynamoDB's single-table design with a GSI allows you to query documents by a specific tag efficiently, and by using composite sort keys or multiple GSIs, you can support queries on multiple tag combinations without the overhead of joins or schema normalization. This approach handles 50 million documents with up to 20 tags per document while maintaining predictable performance.

Exam trap

The trap here is that candidates often choose Amazon RDS for MySQL (Option B) because they assume a normalized relational schema is the 'correct' way to handle many-to-many relationships, but they fail to consider the performance and scalability challenges of multi-table joins at 50 million documents with flexible tag queries.

How to eliminate wrong answers

Option B is wrong because Amazon RDS for MySQL with a normalized schema would require complex multi-table joins (e.g., document, tag, document_tag junction table) to query by tag combinations, which becomes slow and unscalable at 50 million documents and 20 tags per document, leading to performance bottlenecks and the need for extensive indexing and query optimization. Option C is wrong because Amazon Neptune is a graph database designed for highly connected data and complex graph traversals (e.g., social networks, recommendation engines), which is overkill and unnecessarily complex for simple tag-based document queries that do not require graph-specific operations like shortest path or pattern matching. Option D is wrong because Amazon ElastiCache for Memcached is a caching layer, not a persistent database; it lacks query capabilities for tag-based filtering and cannot serve as the primary data store for 50 million documents with flexible query requirements.

Full explanation →

811

MCQhard

An application using Amazon DynamoDB is experiencing higher than expected read costs. The table uses on-demand capacity mode. The read pattern is mostly fetching small items (1 KB) using GetItem. Which of the following is the most cost-effective optimization?

A.Change the table to provisioned capacity mode with auto scaling

B.Compress the items using application-level compression

C.Use DAX to cache the read results

D.Switch to eventually consistent reads for GetItem operations

AnswerD

Eventually consistent reads consume half the RCU of strongly consistent reads.

Why this answer

The most cost-effective because eventually consistent reads consume half the read capacity units (0.5 RCU for items up to 4 KB) compared to strongly consistent reads (1 RCU). Since items are small (1 KB) and the table uses on-demand capacity, halving RCU consumption directly reduces read costs. Option A: Switching to provisioned capacity with auto scaling adds complexity and may not reduce costs if traffic is unpredictable; on-demand is already suitable for variable workloads.

Option B: Application-level compression would not significantly reduce RCU consumption because items are already under the 4 KB RCU threshold. Option C: Adding DAX introduces additional cost and primarily improves latency, not read cost, as DAX still charges for reads from DynamoDB.

Full explanation →

812

Multi-Selecteasy

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all data be encrypted at rest using a customer-managed KMS key. Additionally, the database should be accessible only from a specific VPC. Which THREE steps should the database specialist take to meet these requirements? (Choose three.)

Select 3 answers

A.Configure the security group for the RDS instance to allow inbound traffic only from the application security group.

B.Launch the RDS instance in a private subnet of the VPC.

C.Create a VPC endpoint for RDS and associate it with the DB instance.

D.Store the encryption key in Amazon S3 and configure RDS to use it.

E.Enable encryption at rest using a customer-managed KMS key when creating the RDS instance.

AnswersA, B, E

This restricts access to the application's security group.

Why this answer

Security groups act as a virtual firewall for RDS instances. By configuring the security group to allow inbound traffic only from the application security group, you restrict database access to specific application servers, meeting the requirement that the database be accessible only from a specific VPC.

Exam trap

The trap here is that candidates often confuse VPC endpoints with network access control, thinking a VPC endpoint restricts access to the database, when in fact it only provides a private connection path without limiting which resources can connect.

Full explanation →

813

MCQeasy

A startup is building a social media application that requires a database to store user relationships (followers, following) and support graph queries. The data volume is expected to grow to tens of terabytes. Which AWS database service is most suitable for this workload?

A.Amazon RDS for MySQL with self-joins.

B.Amazon Redshift.

C.Amazon DynamoDB with adjacency list design.

D.Amazon Neptune.

AnswerD

Neptune is a purpose-built graph database.

Why this answer

Amazon Neptune is a fully managed graph database service optimized for storing and querying highly connected data, such as social media user relationships (followers, following). It supports both property graph and RDF models, enabling efficient graph traversal queries using Gremlin or SPARQL, which is ideal for this workload. Neptune scales to tens of terabytes and provides low-latency query performance for complex graph patterns, making it the most suitable choice.

Exam trap

The trap here is that candidates often choose DynamoDB (Option C) because they associate it with NoSQL scalability, but they overlook that adjacency list designs in DynamoDB require multiple queries and client-side logic for graph traversals, making it unsuitable for deep or multi-hop relationship queries at scale.

How to eliminate wrong answers

Option A is wrong because Amazon RDS for MySQL with self-joins is a relational database that does not natively support graph traversal operations; self-joins become exponentially slower and more complex as the depth of relationships increases, leading to poor performance at tens of terabytes. Option B is wrong because Amazon Redshift is a columnar data warehouse designed for analytical queries on large datasets, not for real-time graph queries or transactional relationship storage, and it lacks native graph traversal capabilities. Option C is wrong because Amazon DynamoDB with adjacency list design can model simple one-to-many relationships but is not optimized for multi-hop graph traversals; queries like 'find followers of followers' require multiple round trips and client-side joins, resulting in high latency and complexity at scale.

Full explanation →

814

MCQmedium

A company is migrating a 500 GB MySQL database from on-premises to Amazon RDS for MySQL. The migration must have minimal downtime and support ongoing replication. Which AWS service should be used?

A.Use mysqldump to export the database and import to RDS during a maintenance window.

B.Use AWS Schema Conversion Tool (SCT) to convert the schema and migrate data.

C.Take a physical backup, copy it to Amazon S3, and restore to RDS.

D.Use AWS Database Migration Service (DMS) with a full load and ongoing replication from a change data capture source.

AnswerD

AWS Database Migration Service (DMS) performs a full load of the 500 GB database, then uses change data capture (CDC) to capture ongoing MySQL binary log changes, enabling near-zero-downtime replication. This satisfies the stem’s requirement for minimal downtime and continuous synchronisation during migration, as CDC avoids stopping source writes after the initial load.

Why this answer

AWS DMS is the correct choice because it supports both a full load of the 500 GB database and ongoing replication using change data capture (CDC) from the on-premises MySQL source. This enables minimal downtime by keeping the target RDS instance synchronized during the migration window, and it handles schema conversion automatically for MySQL-to-MySQL migrations without needing a separate tool.

Exam trap

The trap here is that candidates often assume a simple backup-and-restore or logical dump is sufficient for minimal downtime, but they overlook the requirement for ongoing replication, which only DMS with CDC can provide without disrupting the source database.

How to eliminate wrong answers

Option A is wrong because mysqldump is a logical backup tool that requires taking the source database offline or locking tables during export, causing significant downtime, and it does not support ongoing replication after the initial load. Option B is wrong because AWS SCT is designed for heterogeneous migrations (e.g., Oracle to Aurora) and is unnecessary for a homogeneous MySQL-to-MySQL migration; it does not perform the actual data movement or ongoing replication. Option C is wrong because taking a physical backup and restoring to RDS requires stopping writes on the source to ensure consistency, and it cannot provide ongoing replication to keep the target in sync with the source after the restore.

Full explanation →

815

MCQmedium

A company uses Amazon DynamoDB for a session management workload. The access pattern is random and requires single-digit millisecond latency. The table has a read capacity of 5000 RCU. During peak hours, read requests occasionally exceed this capacity, causing throttling. Which design change is most appropriate to handle traffic spikes?

A.Switch to DynamoDB on-demand mode.

B.Add a global secondary index with different partition key.

C.Enable DynamoDB auto scaling for reads.

D.Add a DAX cluster to cache read requests.

AnswerC

Dynamically adjusts capacity to handle spikes.

Why this answer

DynamoDB auto scaling allows the table to dynamically adjust its provisioned read capacity (RCU) in response to traffic spikes, preventing throttling while maintaining single-digit millisecond latency. This is the most appropriate design change for a session management workload with random access patterns, as it handles occasional bursts without requiring manual intervention or architectural changes.

Exam trap

The trap here is that candidates often choose DAX (Option D) thinking it solves throttling by caching, but DAX only reduces read load if the same items are frequently requested—random access patterns with low cache hit rates make DAX ineffective for preventing throttling, and it does not increase the table's RCU limit.

How to eliminate wrong answers

Option A is wrong because switching to DynamoDB on-demand mode would eliminate throttling but introduces unpredictable costs and may not be cost-effective for a workload with a baseline of 5000 RCU and only occasional spikes; on-demand is designed for unpredictable or new workloads, not for optimizing cost in a known pattern. Option B is wrong because adding a global secondary index (GSI) with a different partition key does not address read capacity throttling on the base table; GSIs have their own read/write capacity and are used for alternative query patterns, not for scaling existing read throughput. Option D is wrong because adding a DAX cluster caches read requests to reduce latency and offload reads from the table, but it does not increase the provisioned read capacity; if the cache misses or the DAX cluster itself is overwhelmed, throttling can still occur on the underlying table.

Full explanation →

816

Multi-Selectmedium

A company is planning to deploy a new Amazon RDS for Oracle database in a Multi-AZ configuration. The database must be highly available and fault-tolerant. Which THREE actions should the company take to meet these requirements? (Choose three.)

Select 3 answers

A.Take manual snapshots daily

B.Create a read replica in a different Availability Zone

C.Enable Multi-AZ deployment

D.Enable automated backups with a retention period of 35 days

E.Enable deletion protection

AnswersC, D, E

Multi-AZ provides automatic failover.

Why this answer

Enabling Multi-AZ deployment for Amazon RDS for Oracle automatically provisions and maintains a synchronous standby replica in a different Availability Zone. This provides automatic failover in the event of an AZ outage or primary instance failure, ensuring high availability and fault tolerance without manual intervention.

Exam trap

The trap here is confusing read replicas with Multi-AZ standby replicas: read replicas are for read scaling and do not provide automatic failover, whereas Multi-AZ standby replicas are synchronous and enable automatic failover for high availability.

Full explanation →

817

Multi-Selectmedium

A company is using Amazon DynamoDB for a gaming application. The application stores player scores in a table with a partition key of player_id and a sort key of timestamp. The company wants to query the top 10 scores for a given player efficiently. Which TWO steps should the company take to optimize this query?

Select 2 answers

A.Use the Query API with the LSI and scan index forward set to false to get the top scores.

B.Create a local secondary index (LSI) on the score attribute with the same partition key.

C.Use a Scan operation with a filter expression to retrieve the top scores.

D.Create a local secondary index on the timestamp attribute.

E.Create a global secondary index (GSI) on the score attribute.

AnswersA, B

Querying the LSI with ScanIndexForward=false returns items in descending order, efficiently retrieving the top scores.

Why this answer

The correct answers are A and B. A local secondary index (LSI) on the score attribute (option B) allows efficient sorting of items within the same partition key (player_id) by score. Using the Query API on this LSI with scanIndexForward set to false (option A) retrieves the top scores in descending order.

Option C (Scan with filter) is inefficient as it reads the entire table. Option D (LSI on timestamp) is redundant because the base table already has timestamp as sort key and does not sort by score. Option E (GSI on score) would not be efficient for per-player queries because you would need to query by score globally, not per player.

Full explanation →

818

MCQmedium

A company is running a MySQL database on Amazon RDS for a customer relationship management (CRM) application. The database has a table named 'contacts' with over 100 million rows. The application frequently runs queries to find contacts by email address. The email column has a B-tree index. Recently, the application started experiencing slow query performance. The team checked CloudWatch metrics and saw that the ReadIOPS for the RDS instance is consistently at 80% of the provisioned IOPS limit. The instance type is db.r5.large with 3000 provisioned IOPS (gp2). The buffer pool hit ratio is 95%. What is the most cost-effective design change to improve query performance?

A.Upgrade the RDS instance to db.r5.xlarge with 6000 provisioned IOPS.

B.Migrate the contacts table to Amazon DynamoDB with email as partition key.

C.Implement an Amazon OpenSearch Service cluster for email search.

D.Increase the buffer pool size by changing to a memory-optimized instance.

AnswerA

Increases IOPS capacity, reducing IO bottleneck.

Why this answer

Upgrading to a db.r5.xlarge with 6,000 provisioned IOPS (gp2) doubles the IOPS capacity, directly addressing the high ReadIOPS utilization (80%) without requiring application changes. This is the most cost-effective solution as it leverages the existing RDS infrastructure. Option B is wrong because migrating to DynamoDB would require significant application rework and is not necessary when the bottleneck is IOPS.

Option C is wrong because OpenSearch adds unnecessary complexity and cost for a simple email lookup. Option D is wrong because the buffer pool hit ratio is already at 95%, indicating that increasing memory would yield minimal benefit.

Full explanation →

819

MCQhard

A company uses Amazon DynamoDB to store session data. The security team has enabled DynamoDB Accelerator (DAX) for performance. However, they are concerned about data encryption at rest. DAX encrypts data at rest by default. The security team wants to use a customer managed key (CMK) in AWS KMS. How can this be configured?

A.Use an asymmetric customer managed key because it provides better security.

B.DAX does not support encryption at rest with a customer managed key; only AWS managed keys are supported.

C.Enable encryption at rest on the DAX cluster after creation by modifying the cluster settings.

D.Create a DAX cluster and specify the KMS key ID of a symmetric customer managed key during creation.

AnswerD

DAX allows specifying a symmetric CMK during cluster creation.

Why this answer

DAX supports encryption at rest using a KMS key. You must specify a symmetric customer managed key (CMK) at cluster creation time; encryption configuration cannot be modified after creation. Option A is wrong because DAX does support encryption with a CMK, and asymmetric keys are not supported for DAX; only symmetric keys are allowed.

Option B is wrong because DAX does allow the use of customer managed keys; it is not limited to AWS managed keys. Option C is wrong because encryption cannot be enabled after cluster creation; it must be configured during creation.

Full explanation →

820

MCQmedium

A company is using Amazon Redshift for data warehousing. The data engineering team notices that queries are running slower than expected. CloudWatch shows that 'CPUUtilization' is high and 'DiskSpaceUsage' is also high. The cluster has 4 dc2.large nodes. What is the most likely cause of the performance degradation?

A.Insufficient network bandwidth between nodes

B.CPU is the bottleneck and needs more compute nodes

C.Workload management (WLM) queue is causing query waits

D.Queries are spilling to disk due to insufficient memory

AnswerD

High disk usage suggests memory pressure causing disk-based operations.

Why this answer

High CPU and high disk space usage on dc2.large nodes are classic signs of queries spilling to disk due to insufficient memory. When there isn't enough memory for query processing, Redshift resorts to writing intermediate results to disk, which increases disk space usage and also causes high CPU as the system manages the spill. Option A is insufficient network bandwidth: network bandwidth issues would typically manifest as increased network throughput or latency metrics, not high CPU and disk usage.

Option B is CPU bottleneck: while CPU is high, the simultaneous high disk usage suggests the root cause is memory spilling, not CPU exhaustion alone. Adding compute nodes would not address the memory spilling if the workload is memory-intensive; instead, increasing the node size or using a different instance type with more memory per node would help. Option C is WLM queue: WLM queue waits would be visible in CloudWatch metrics like 'WLMQueueLength' or 'QueryWaitTime', not in CPU or disk usage.

Full explanation →

821

Multi-Selectmedium

A company is troubleshooting an Amazon RDS for MySQL DB instance that is experiencing high CPU utilization. The DB instance is a db.t3.medium. Which TWO actions should the database administrator take to investigate the cause?

Select 2 answers

A.Enable Performance Insights to identify the top SQL queries consuming CPU.

B.Disable Multi-AZ to reduce overhead.

C.Modify the DB parameter group to increase the query cache size.

D.Increase the DB instance class to a larger size.

E.Review the slow query log to find queries with long execution times.

AnswersA, E

Performance Insights provides query-level performance data.

Why this answer

Enabling Performance Insights provides visibility into which SQL queries are consuming CPU resources. Option E is correct because reviewing the slow query log helps identify queries with long execution times that may be causing high CPU. Option B is incorrect because disabling Multi-AZ does not help investigate CPU utilization; it reduces availability but not CPU.

Option C is incorrect because increasing the query cache size is a tuning action, not an investigative step, and may not address the root cause. Option D is incorrect because increasing the DB instance class is a scaling fix, not an investigation method.

Full explanation →

822

MCQeasy

A company wants to migrate a self-hosted MongoDB database to Amazon DocumentDB. They need to convert the schema. Which AWS service should they use?

A.AWS Glue

B.AWS Database Migration Service (DMS)

C.AWS Schema Conversion Tool (SCT)

D.Amazon Athena

AnswerC

SCT can convert MongoDB schemas to DocumentDB-compatible format.

Why this answer

AWS Schema Conversion Tool (SCT) is the correct choice because it is specifically designed to convert database schemas from one engine to another, including from MongoDB to Amazon DocumentDB. SCT analyzes the source schema, identifies incompatible objects, and generates a target schema that is compatible with DocumentDB, handling data type mappings, index conversions, and other structural differences.

Exam trap

The trap here is that candidates often confuse AWS DMS as a full migration solution for heterogeneous databases, not realizing that DMS only handles data movement and relies on SCT for schema conversion when the source and target engines differ.

How to eliminate wrong answers

Option A is wrong because AWS Glue is a serverless data integration service for ETL (extract, transform, load) jobs, not a schema conversion tool; it can transform data but does not convert database schemas between different database engines. Option B is wrong because AWS Database Migration Service (DMS) migrates data from a source to a target database, but it does not perform schema conversion; it relies on SCT for schema conversion when migrating between heterogeneous engines like MongoDB to DocumentDB. Option D is wrong because Amazon Athena is an interactive query service for analyzing data in Amazon S3 using standard SQL, and it has no capability to convert database schemas.

Full explanation →

823

Multi-Selectmedium

A company is migrating a 3 TB on-premises Oracle database to Amazon Aurora PostgreSQL using AWS DMS. The migration task is failing with an error indicating insufficient memory. Which TWO actions should the company take to resolve this issue? (Choose TWO.)

Select 2 answers

A.Change the target database engine to Amazon RDS for MySQL.

B.Disable Multi-AZ on the DMS replication instance.

C.Increase the instance class of the DMS replication instance.

D.Reduce the number of tables being migrated in the task.

E.Use a smaller instance class for the DMS replication instance.

AnswersC, D

A larger instance class provides more memory to handle the migration.

Why this answer

The 'insufficient memory' error during an AWS DMS migration indicates that the replication instance lacks the memory required to handle the data volume, transformation rules, or cache for large transactions. Increasing the instance class (e.g., from dms.c5.large to dms.c5.2xlarge) provides more memory and CPU, directly resolving the resource constraint.

Exam trap

The trap here is that candidates might confuse a DMS replication instance memory issue with a target database performance issue, leading them to incorrectly change the target engine or disable Multi-AZ instead of scaling the replication instance.

Full explanation →

824

MCQeasy

A startup is building a mobile application that needs to store user profiles and preferences. The data is schema-less and will grow rapidly. The application requires single-digit millisecond latency for reads and writes. Which AWS database should they choose?

A.Amazon Aurora (MySQL compatible)

B.Amazon Redshift

C.Amazon RDS for SQL Server

D.Amazon DynamoDB

AnswerD

DynamoDB supports schema-less design and low-latency access.

Why this answer

Amazon DynamoDB is a fully managed NoSQL key-value and document database that delivers single-digit millisecond latency at any scale. It is schema-less, making it ideal for storing user profiles and preferences that have varying attributes, and it automatically scales to handle rapid growth without downtime or performance degradation.

Exam trap

The trap here is that candidates often confuse relational databases like Aurora or RDS with NoSQL requirements, assuming that any 'fast' database can handle schema-less data, but DynamoDB's key-value design and automatic scaling are specifically required for this use case.

How to eliminate wrong answers

Option A is wrong because Amazon Aurora (MySQL compatible) is a relational database with a fixed schema, requiring predefined tables and columns, which conflicts with the schema-less requirement; it also does not natively provide single-digit millisecond latency for all access patterns under high throughput. Option B is wrong because Amazon Redshift is a petabyte-scale data warehouse optimized for complex analytical queries (OLAP), not for low-latency reads and writes of individual user profiles (OLTP). Option C is wrong because Amazon RDS for SQL Server is a relational database with a rigid schema and is not designed for schema-less data; it also cannot guarantee single-digit millisecond latency under rapid growth and high concurrency without significant over-provisioning.

Full explanation →

825

Multi-Selecteasy

A company is deploying a new Amazon RDS for PostgreSQL DB instance. Which THREE actions are recommended for a secure deployment?

Select 3 answers

A.Enable encryption at rest using AWS KMS

B.Use the default VPC for simplicity

C.Delete automated backups after the initial snapshot to reduce costs

D.Enable automated backups with a retention period

E.Place the DB instance in a private subnet

AnswersA, D, E

Encryption at rest protects data if storage is compromised.

Why this answer

Enabling encryption at rest using AWS KMS ensures that the underlying storage for the RDS for PostgreSQL DB instance is encrypted using AES-256 encryption. This protects data at rest against unauthorized physical access to the storage media and is a fundamental security best practice. KMS integration also allows for centralized key management and audit trails via AWS CloudTrail.

Exam trap

The trap here is that candidates often confuse 'default VPC' with being secure because it is provided by AWS, but the default VPC includes a public subnet with an internet gateway, which is inherently less secure for database deployments than using a custom VPC with private subnets.

Full explanation →

Page 11 of 23

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23

Practice DBS-C01 by domain

Target a specific domain to shore up weak areas.

Workload-Specific Database Design Deployment and Migration Management and Operations Monitoring and Troubleshooting Database Security

See all domains with question counts →