Courseiva

AWS Certified Database Specialty DBS-C01 (DBS-C01) — Questions 826900

1663 questions total · 23pages · All types, answers revealed

Page 11

Page 12 of 23

Page 13
826
MCQhard

A company runs a critical e-commerce platform on Amazon Aurora MySQL. The database is 2 TB and experiences a sudden spike in write latency during flash sales. The application uses auto-generated UUIDs as primary keys. The CPU utilization on the writer instance is 80%, and the read replicas show low utilization. Write latency has increased from 5 ms to 200 ms. The company needs to reduce write latency with minimal application changes. Which course of action is MOST effective?

A.Implement sharding across multiple Aurora clusters.
B.Change the primary key to an auto-increment BIGINT and recreate indexes.
C.Add more read replicas and redirect write-heavy queries to replicas.
D.Upgrade the writer instance to a larger instance type with more IOPS.
AnswerB

Sequential keys reduce index page splits, improving write performance.

Why this answer

B is correct because UUID primary keys cause random writes that fragment the B-tree index, leading to frequent page splits and high write latency. Changing to an auto-increment BIGINT allows sequential writes, which fill index pages contiguously and reduce the write amplification that drives latency from 5 ms to 200 ms. This requires no application logic changes beyond the schema migration, making it the most effective minimal-change solution.

Exam trap

The trap here is that candidates assume scaling compute or storage (Option D) is the universal fix for write latency, but the exam specifically tests the impact of primary key design on index write amplification in Aurora MySQL.

How to eliminate wrong answers

Option A is wrong because sharding across multiple Aurora clusters adds significant application complexity (e.g., distributed transactions, cross-cluster joins) and does not address the root cause of random-write overhead from UUIDs. Option C is wrong because read replicas cannot handle write traffic; they only serve read queries, so redirecting write-heavy queries to replicas is impossible and would not reduce write latency on the writer instance. Option D is wrong because upgrading the instance type with more IOPS only masks the symptom of high write latency; it does not fix the underlying index fragmentation caused by UUID primary keys, so the latency will persist after the upgrade.

827
MCQhard

A company is using Amazon ElastiCache for Redis as a caching layer for a web application. The application team reports that cache miss rates have increased significantly, causing higher database load. The Redis cluster has two nodes (one primary, one replica) with the default eviction policy of noeviction. Which action should the database specialist recommend to reduce cache misses?

A.Increase the memory of existing nodes to accommodate more keys.
B.Change the eviction policy to allkeys-lru to allow Redis to evict less recently used keys.
C.Enable AOF persistence to improve cache durability.
D.Add more read replicas to distribute the cache load.
AnswerB

Changing the eviction policy to allkeys-lru allows Redis to evict less recently used keys when memory is full, reducing cache misses.

Why this answer

Changing the eviction policy to allkeys-lru allows Redis to evict less recently used keys when memory is full, reducing cache misses. Option A is incorrect because simply increasing memory does not change the eviction policy; with noeviction, writes will fail when memory is full. Option C is incorrect because enabling AOF persistence improves durability but does not affect cache misses.

Option D is incorrect because adding read replicas distributes read traffic but does not reduce cache misses if the keys are not in the cache.

828
MCQhard

A company uses Amazon DynamoDB with a table that stores sensitive customer data. The security team requires that all data at rest be encrypted using a customer-managed AWS KMS key (CMK). Additionally, the company needs to ensure that only specific IAM roles can access the table. Which solution meets these requirements with the least operational overhead?

A.Enable encryption at rest using AWS KMS with a CMK and use column-level encryption with AWS KMS to restrict access.
B.Attach a resource-based policy to the DynamoDB table that grants access only to the specific IAM roles.
C.Use a DynamoDB Accelerator (DAX) cluster with encryption at rest using a CMK, and attach a resource-based policy to the table.
D.Configure the DynamoDB table to use AWS KMS encryption with a CMK. Create an IAM role with a policy that grants access to the table and includes a condition that the encryption context matches the CMK.
E.Configure the DynamoDB table to use AWS KMS encryption with a CMK, and attach a key policy to the CMK that allows only the specific IAM roles.
AnswerD

This ensures encryption with a CMK and restricts access using IAM conditions on the encryption context.

Why this answer

It combines DynamoDB encryption at rest with a customer-managed KMS CMK and uses an IAM role policy with an encryption context condition. This ensures that only specific IAM roles can access the table, and the encryption context condition ties the KMS key usage to the table, providing fine-grained access control with minimal operational overhead. The encryption context is automatically set by DynamoDB to the table ARN, so the condition key `kms:EncryptionContext:aws:dynamodb:tableName` can be used to restrict decryption to that specific table.

Exam trap

The trap here is that candidates often confuse key policies with IAM policies, thinking that a key policy alone can restrict table access, or they incorrectly assume DynamoDB supports resource-based policies like S3 bucket policies.

How to eliminate wrong answers

Option A is wrong because column-level encryption is not a feature of DynamoDB; it would require application-level encryption, adding operational overhead and not directly restricting IAM role access to the table. Option B is wrong because DynamoDB does not support resource-based policies; it uses IAM policies for access control, and attaching a resource-based policy is not possible. Option C is wrong because DAX is a caching layer, not a security mechanism; it does not enforce table-level access control, and attaching a resource-based policy to the table is still not supported.

Option E is wrong because a key policy on the CMK controls who can use the key for encryption/decryption, but it does not directly control access to the DynamoDB table itself; IAM policies are needed for table access.

829
Multi-Selectmedium

Which THREE factors should be considered when selecting a database for a time-series workload (e.g., IoT sensor data) that requires high write throughput and efficient data retention?

Select 3 answers
A.Normalize the schema to reduce data duplication.
B.Use Amazon RDS Proxy to manage database connections.
C.Configure automatic data expiration using TTL (Time-to-Live).
D.Partition the table by time intervals (e.g., hourly or daily).
E.Use Amazon Timestream for its built-in time-series optimizations.
AnswersC, D, E

TTL automates data retention.

Why this answer

TTL (Time-to-Live) is a critical feature for time-series workloads, allowing automatic deletion of data that has exceeded a specified retention period. This reduces storage costs and manual maintenance overhead, which is essential for high-volume IoT sensor data where old data loses value over time.

Exam trap

The trap here is that candidates may confuse general database best practices (like normalization or connection pooling) with the specialized optimizations required for time-series workloads, overlooking that TTL and time-based partitioning are the key architectural patterns for write-heavy, retention-focused IoT data.

830
Multi-Selecteasy

A company uses an Amazon RDS for MySQL DB instance that needs to be accessed by a Lambda function. Which TWO steps should be taken to ensure secure access?

Select 2 answers
A.Create an IAM role for the Lambda function with permissions to use RDS IAM database authentication.
B.Place the Lambda function in the same VPC as the RDS instance to avoid traversing the internet.
C.Store the database credentials in the Lambda environment variables.
D.Use the database master user account for the Lambda function.
E.Attach a NAT gateway to the Lambda function's VPC for outbound internet access.
AnswersA, B

IAM database authentication allows passwordless access using IAM roles.

Why this answer

Options A and B are correct. Creating an IAM role for the Lambda function with permissions to use RDS IAM database authentication (A) avoids hardcoding credentials and enables secure, temporary authentication. Placing the Lambda function in the same VPC as the RDS instance (B) ensures traffic stays within the AWS network without traversing the internet.

Option C is wrong because storing credentials in Lambda environment variables is insecure and exposes them. Option D is wrong because using the database master user account violates least privilege and is insecure. Option E is wrong because a NAT gateway is not needed for RDS access within the same VPC.

831
MCQhard

A company is using Amazon DynamoDB with Auto Scaling enabled. During a flash sale, write traffic spikes and the application experiences ProvisionedThroughputExceededException errors. The DynamoDB table has provisioned write capacity of 1000 WCU and Auto Scaling is set to scale between 1000 and 10000 WCU. What is the most likely cause of the throttling?

A.Auto Scaling cannot react quickly enough to sudden traffic spikes.
B.The DynamoDB table has insufficient partitions to handle the traffic.
C.The table's burst capacity is exhausted and Auto Scaling has not yet increased capacity.
D.The Auto Scaling policy has a maximum WCU limit that is too low.
AnswerA

Auto Scaling adjusts capacity based on CloudWatch metrics with a delay.

Why this answer

DynamoDB Auto Scaling uses a target tracking policy that adjusts capacity based on consumed WCU over a period (typically 5 minutes). During sudden traffic spikes, the consumption increases rapidly, but Auto Scaling cannot react immediately; there is a lag before the scaling policy triggers and additional capacity is provisioned. This results in ProvisionedThroughputExceededException errors until the new capacity takes effect.

Option B is incorrect because throttling is due to insufficient write capacity, not partitioning. Option C is incorrect because burst capacity provides a short-term buffer but is quickly exhausted during sustained spikes. Option D is incorrect because the maximum WCU of 10000 is higher than the spike demand, so the limit is not the issue—the timing of the scaling action is the problem.

832
MCQeasy

A startup is building a real-time leaderboard for a mobile game using Amazon DynamoDB. The leaderboard must update frequently and support global access with low latency. Which database design approach is most suitable?

A.Use Amazon DynamoDB global tables with appropriate partition key design.
B.Use Amazon ElastiCache for Redis with replication across Regions.
C.Use Amazon Aurora Global Database with a single writer and multiple readers.
D.Use Amazon S3 with event notifications to update a leaderboard file.
AnswerA

Provides low-latency global access and high throughput.

Why this answer

Amazon DynamoDB global tables provide multi-Region, fully managed, multi-master replication, which is ideal for a real-time leaderboard requiring frequent updates and low-latency global access. By designing an appropriate partition key (e.g., game ID or time-based composite key), you can distribute write traffic evenly and avoid hot partitions, ensuring consistent performance under high update frequency.

Exam trap

The trap here is that candidates often assume a caching layer like ElastiCache is always the best for low-latency global access, but they overlook the need for multi-Region write capability and the inherent limitations of Redis cross-Region replication for high-frequency updates.

How to eliminate wrong answers

Option B is wrong because Amazon ElastiCache for Redis with replication across Regions is not natively multi-master; cross-Region replication requires additional tooling (e.g., Global Datastore for Redis) and does not offer the same strong consistency or automatic conflict resolution as DynamoDB global tables for frequent writes. Option C is wrong because Amazon Aurora Global Database is designed for relational workloads with a single writer and multiple readers, which cannot handle the high-velocity, concurrent writes required by a real-time leaderboard without introducing write bottlenecks and latency. Option D is wrong because Amazon S3 with event notifications is not a real-time database; it introduces significant latency for updates and lacks the low-latency query capabilities needed for a live leaderboard, making it unsuitable for frequent updates and global access.

833
MCQhard

A company runs a time-series application on Amazon RDS for PostgreSQL. The table 'events' has 500 million rows and is queried by event_time and event_type. Queries for the last hour are slow despite indexing. Which design change would most improve query performance?

A.Add a composite index on (event_type, event_time)
B.Partition the table by month using PostgreSQL declarative partitioning
C.Migrate to Amazon DynamoDB with TTL
D.Upgrade to a larger RDS instance
AnswerB

Partition pruning limits scans to relevant partitions.

Why this answer

Partitioning the 'events' table by month using PostgreSQL declarative partitioning allows the query planner to prune partitions that do not contain data for the last hour. This dramatically reduces the number of rows scanned, even with a large table of 500 million rows, and directly addresses the slow query performance for time-range queries. Indexing alone cannot overcome the overhead of scanning a massive monolithic table for a narrow time window.

Exam trap

The trap here is that candidates often assume adding a composite index is sufficient for all query patterns, but for time-series data with a large table and narrow time-range queries, partition pruning provides a far more significant reduction in scanned data than any index can achieve.

How to eliminate wrong answers

Option A is wrong because adding a composite index on (event_type, event_time) may improve some queries but does not solve the fundamental problem of scanning a 500-million-row table for a one-hour time range; the index still has to traverse a large B-tree and fetch rows from the heap, leading to significant I/O. Option C is wrong because migrating to DynamoDB with TTL is designed for automatic item expiration, not for improving query performance on time-series data; DynamoDB lacks native time-range query optimization like partition pruning and would require careful design of partition keys and secondary indexes to avoid hot partitions. Option D is wrong because upgrading to a larger RDS instance provides more CPU and memory but does not change the fact that queries must scan the entire table or a large index; it is a vertical scaling approach that does not address the architectural inefficiency of a monolithic table for time-based queries.

834
Multi-Selecthard

A company is migrating an on-premises MongoDB database to Amazon DocumentDB. The migration must have minimal downtime. Which THREE steps should be taken? (Choose three.)

Select 3 answers
A.Use AWS Snowball Edge to transfer initial data.
B.Create an Amazon DocumentDB cluster as the target.
C.Use AWS DMS to perform a full load and then ongoing replication.
D.Shard the DocumentDB cluster across multiple regions.
E.Configure the source MongoDB to send oplog events to DMS.
AnswersB, C, E

DocumentDB is the target for migration.

Why this answer

You must create the target DocumentDB cluster before migration. Option C is correct: AWS DMS can perform a full load followed by ongoing replication to minimize downtime. Option E is correct: the source MongoDB must be configured to capture oplog events so that DMS can replicate changes.

Option A is incorrect because AWS Snowball Edge is for offline data transfer, which would not achieve minimal downtime. Option D is incorrect because sharding the cluster across multiple regions is not required for a migration with minimal downtime.

835
MCQmedium

A company runs an Oracle database on Amazon RDS. The database is used by multiple applications, and the company needs to capture all data modification language (DML) changes for auditing. Which solution should be used?

A.Use AWS CloudTrail to capture database events.
B.Enable Oracle Flashback and store the flashback logs.
C.Install Oracle Audit Vault on the RDS instance.
D.Use AWS DMS with change data capture (CDC) to stream changes to Amazon S3.
AnswerD

DMS CDC captures DML changes and can write to S3.

Why this answer

AWS DMS with change data capture (CDC) can continuously capture DML changes from an Oracle RDS instance and stream them to Amazon S3 in a format such as Parquet or CSV. This provides a durable, queryable audit trail of all data modifications without requiring additional Oracle licensing or impacting database performance. CloudTrail captures API-level events, not DML changes, and Oracle Flashback and Audit Vault are not fully supported or manageable on Amazon RDS.

Exam trap

The trap here is that candidates confuse AWS CloudTrail (API auditing) with database-level DML auditing, or assume that Oracle-specific features like Flashback or Audit Vault are fully functional on RDS, when in fact RDS restricts OS and software installation, making DMS CDC the only viable managed solution.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail records AWS API calls (e.g., RDS instance creation, modification) but does not capture database-level DML operations like INSERT, UPDATE, or DELETE. Option B is wrong because Oracle Flashback is a feature for point-in-time recovery and historical queries, not for continuous auditing of DML changes; additionally, flashback logs are stored internally and cannot be easily exported to an external audit store. Option C is wrong because Oracle Audit Vault requires installation of an agent on the database host and is not supported on Amazon RDS, which does not allow custom software installation or OS-level access.

836
MCQhard

An administrator is setting up an AWS DMS replication instance and attaches the IAM policy shown in the exhibit. The administrator receives an error that the replication instance cannot be created. Which missing permission is the MOST likely cause?

A.ec2:DescribeVpcPeeringConnections
B.ec2:DescribeSecurityGroups
C.ec2:CreateNetworkInterfacePermission
D.dms:CreateReplicationInstance
AnswerB

DMS needs to describe security groups to attach to the replication instance.

Why this answer

When creating a DMS replication instance, AWS DMS needs to create and manage network interfaces in the customer's VPC. The `ec2:DescribeSecurityGroups` permission is required for DMS to validate and describe the security groups specified during replication instance creation. Without this permission, the service cannot verify the security group IDs, leading to a creation failure.

Exam trap

The trap here is that candidates often focus on the DMS-specific action (`dms:CreateReplicationInstance`) or assume network interface creation is the missing permission, overlooking that DMS requires read-only EC2 describe permissions to validate the VPC resources before creation.

How to eliminate wrong answers

Option A is wrong because `ec2:DescribeVpcPeeringConnections` is not required for creating a DMS replication instance; it is used for managing VPC peering connections, which are irrelevant to the initial provisioning of the replication instance. Option C is wrong because `ec2:CreateNetworkInterfacePermission` is not a standard IAM permission; the correct action is `ec2:CreateNetworkInterface`, and DMS handles network interface creation via its service-linked role, not via a direct user-attached policy. Option D is wrong because `dms:CreateReplicationInstance` is the API call being made, not a missing permission; the error occurs due to insufficient EC2 permissions, not the DMS action itself.

837
Multi-Selecthard

A company runs a critical Oracle database on Amazon RDS. They need to implement a disaster recovery strategy that provides the lowest possible recovery point objective (RPO) and recovery time objective (RTO) across AWS Regions. Which TWO actions should they take? (Choose two.)

Select 2 answers
A.Configure cross-Region automated backups to copy backups to another Region.
B.Configure an AWS DMS task to replicate data from the primary RDS Oracle instance to an RDS Oracle instance in another Region.
C.Enable Multi-AZ on the primary RDS instance.
D.Create a cross-Region read replica of the Oracle DB instance.
E.Use Amazon Aurora Global Database to replicate data across Regions.
AnswersA, B

Cross-Region automated backups provide an RPO of a few minutes and allow restore in the secondary Region.

Why this answer

Cross-Region automated backups copy RDS snapshots and transaction logs to a secondary Region, enabling point-in-time recovery with an RPO of minutes and an RTO of hours (depending on snapshot restore time). Option B is correct because AWS DMS with ongoing replication (change data capture) can continuously replicate Oracle data to a standby instance in another Region, achieving an RPO of seconds and an RTO of minutes by failing over to the replicated instance.

Exam trap

The trap here is that candidates often confuse Multi-AZ with cross-Region DR, or incorrectly assume Oracle RDS supports cross-Region read replicas like MySQL or PostgreSQL, but Oracle RDS does not offer that feature.

838
MCQhard

An IAM role with the above trust policy is created. The role is then attached to an EC2 instance. The application on the EC2 instance tries to create an RDS DB instance using the AWS SDK. What will happen?

A.The call will fail because the role's permissions policy does not allow rds:CreateDBInstance
B.The call will succeed because the trust policy grants permissions to EC2
C.The call will succeed because the trust policy allows EC2 to create RDS instances
D.The call will fail because the trust policy does not include the RDS service
AnswerA

The role needs a permissions policy allowing the action.

Why this answer

The call will fail because the IAM role attached to the EC2 instance lacks a permissions policy (e.g., an identity-based policy) that explicitly grants the `rds:CreateDBInstance` action. The trust policy shown in the question only defines which principal (the EC2 service) can assume the role, not what actions the role can perform. Without a permissions policy allowing RDS operations, the SDK call is denied by default.

Exam trap

The trap here is confusing the trust policy with the permissions policy; candidates often assume that allowing EC2 to assume the role implicitly grants all permissions to EC2, but the trust policy only controls role assumption, not the actions the role can take.

How to eliminate wrong answers

Option B is wrong because a trust policy grants the EC2 service permission to assume the role, not to perform any specific AWS actions; the role's permissions policy must separately allow `rds:CreateDBInstance`. Option C is wrong because the trust policy cannot authorize EC2 to create RDS instances; it only controls role assumption, not service-level actions. Option D is wrong because the trust policy does not need to include the RDS service; trust policies specify which principals can assume the role, not which services the role can interact with.

839
Multi-Selectmedium

A company is migrating a 2 TB SQL Server database to Amazon RDS for SQL Server. They have a limited maintenance window and need to minimize downtime. Which TWO strategies should they combine?

Select 2 answers
A.Use AWS DMS to perform a full load and ongoing replication.
B.Use AWS Direct Connect to increase bandwidth.
C.Use AWS SCT to convert the schema and assess compatibility.
D.Use AWS CloudEndure Migration.
E.Use AWS Snowball to transfer a backup offline.
AnswersA, C

DMS enables near-zero downtime migration.

Why this answer

AWS DMS (Database Migration Service) is correct because it can perform a full load of the 2 TB SQL Server database to Amazon RDS for SQL Server, then continuously replicate ongoing changes using change data capture (CDC). This minimizes downtime by allowing the source database to remain operational during migration, and the target can be synchronized with minimal interruption before cutover.

Exam trap

The trap here is that candidates often choose Direct Connect (Option B) thinking it reduces downtime by speeding up data transfer, but it does not address the need for ongoing replication; the key is to use DMS for continuous sync, not just bandwidth.

840
MCQeasy

A company wants to encrypt data at rest for an existing Amazon RDS for MySQL DB instance. The database is currently unencrypted. What is the most efficient way to enable encryption?

A.Enable encryption on the existing DB instance by modifying the parameter group.
B.Create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the DB instance from the encrypted snapshot.
C.Use AWS KMS to automatically encrypt the DB instance.
D.Modify the DB instance and enable encryption from the RDS console.
AnswerB

This is the standard procedure to encrypt an unencrypted RDS instance.

Why this answer

RDS does not support enabling encryption on an existing unencrypted DB instance directly. You must create a snapshot, copy it with encryption enabled, and restore from that encrypted snapshot. Option A is incorrect because you cannot modify the DB instance to enable encryption.

Option C is incorrect because AWS KMS does not automatically encrypt the DB instance. Option D is incorrect because you cannot directly configure encryption on the existing instance.

841
MCQeasy

A company uses Amazon DynamoDB as a session store for a web application. The application uses a TTL attribute to expire old sessions. The company noticed that expired sessions are not being deleted promptly, causing the table size to grow and increasing costs. The TTL attribute is defined as 'expire_time' with a Unix epoch timestamp. The database specialist verified that TTL is enabled. What should the specialist do to ensure expired sessions are deleted in a timely manner?

A.Change the TTL attribute type to String format.
B.Increase the provisioned write capacity on the table to allow TTL to delete items faster.
C.Configure the 'ttl_deletion_lag' parameter to a lower value.
D.Create an AWS Lambda function that scans the table and deletes expired items.
AnswerB

TTL deletion uses write capacity; increasing it speeds up deletion.

Why this answer

TTL deletion can be delayed if the table has a high write rate; increasing provisioned write capacity can allocate more resources to the background deletion process, allowing expired items to be removed more quickly. Option A is wrong because changing the attribute type to String would not resolve the deletion delay (the TTL attribute should be a Number). Option C is wrong because there is no 'ttl_deletion_lag' parameter in DynamoDB.

Option D is wrong because using a Lambda function to scan and delete expired items is unnecessary and inefficient compared to properly tuning TTL.

842
MCQhard

A company uses Amazon DynamoDB with on-demand capacity for a mobile application. During a marketing campaign, write traffic spikes to 10,000 writes per second for 5 minutes. The application experiences throttling after the first minute. The DynamoDB table has a single partition key. What should be done to prevent throttling in future campaigns?

A.Redesign the partition key to ensure write traffic is evenly distributed across partitions.
B.Enable DynamoDB Accelerator (DAX) to cache write requests.
C.Switch to provisioned capacity and increase write capacity units to 10,000.
D.Pre-warm the table by writing dummy data before the campaign.
AnswerA

Throttling with on-demand capacity often results from a hot partition caused by a single partition key. On-demand capacity handles total throughput but still has per-partition throughput limits. Redesigning the partition key to distribute writes evenly across partitions resolves the hotspot.

Why this answer

Throttling with on-demand capacity often results from a hot partition caused by a single partition key. On-demand capacity handles total throughput but still has per-partition throughput limits. Redesigning the partition key to distribute writes evenly across partitions resolves the hotspot.

Option B is wrong because DAX is an in-memory cache for reads, not writes. Option C is wrong because switching to provisioned capacity with 10,000 WCUs would still hit partition-level limits if the partition key design is poor. Option D is wrong because pre-warming does not affect per-partition throughput ceilings.

843
MCQhard

A company is designing a multi-region active-active application that requires low-latency reads and writes across regions. The database must support conflict resolution. Which database should be used?

A.Amazon RDS Multi-AZ
B.Amazon DynamoDB Global Tables
C.Amazon Redshift
D.Amazon Aurora Global Database
AnswerB

DynamoDB global tables offer active-active replication with eventual consistency and conflict resolution.

Why this answer

Amazon DynamoDB Global Tables is the correct choice because it provides a fully managed, multi-region, multi-active database that replicates data across regions with eventual consistency, supporting low-latency reads and writes. It includes built-in conflict resolution using a last-writer-wins (LWW) mechanism based on timestamps, which meets the requirement for conflict resolution in an active-active architecture.

Exam trap

The trap here is that candidates often confuse Amazon Aurora Global Database with an active-active solution, but it is actually active-passive with a single write region, whereas DynamoDB Global Tables supports multi-region writes with automatic conflict resolution.

How to eliminate wrong answers

Option A is wrong because Amazon RDS Multi-AZ is a single-region, high-availability feature that provides a standby replica in a different Availability Zone, not multi-region active-active capability, and it does not support conflict resolution. Option C is wrong because Amazon Redshift is a data warehouse optimized for analytical queries, not low-latency transactional reads and writes across regions, and it lacks conflict resolution mechanisms. Option D is wrong because Amazon Aurora Global Database is designed for cross-region replication but supports only one primary region for writes (active-passive), not active-active, and it does not provide built-in conflict resolution for concurrent writes.

844
Matchingmedium

Match each AWS database migration tool/service to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Migrates databases to AWS with minimal downtime

Converts database schema and code to target engine

Physical device for large-scale data transfer

Continuous replication for ongoing changes

ETL service for preparing and transforming data

Why these pairings

AWS DMS is for minimal-downtime database migration, AWS SCT for schema conversion, and AWS Snowball for physical data transfer. Common confusions involve swapping these functions.

845
MCQeasy

A company is using Amazon DynamoDB with on-demand capacity mode. The application experiences occasional throttling during peak hours. The operations team wants to reduce throttling without changing the application code. What should they do?

A.Increase the read and write capacity units in the on-demand mode.
B.Switch to provisioned capacity mode and configure auto scaling.
C.Enable DynamoDB Accelerator (DAX) to cache reads.
D.Use DynamoDB global tables to distribute traffic across regions.
AnswerB

Provisioned capacity with auto scaling ensures adequate capacity for peak traffic.

Why this answer

DynamoDB on-demand capacity mode does not allow manual adjustment of capacity units; it scales automatically but can still throttle if traffic exceeds the previous peak by a large margin. Switching to provisioned capacity mode with auto scaling allows you to set a higher minimum capacity and scale proactively based on actual usage patterns, reducing throttling without code changes. This approach gives more control over capacity limits while still automating adjustments.

Exam trap

The trap here is that candidates assume on-demand mode never throttles, but it can throttle during sudden traffic spikes that exceed the previous 30-minute peak, and they mistakenly think increasing capacity units is possible in on-demand mode.

How to eliminate wrong answers

Option A is wrong because on-demand mode does not have configurable read/write capacity units; it automatically adjusts capacity based on traffic, and you cannot increase them manually. Option C is wrong because DAX only caches reads, reducing read load on the table, but it does not address write throttling or the root cause of capacity limits; it also requires application code changes to use the DAX client. Option D is wrong because global tables replicate data across regions for disaster recovery and low-latency reads, but they do not reduce throttling in a single region; they add complexity and cost without solving the immediate capacity issue.

846
MCQmedium

An RDS DB instance has two security groups attached. Security group sg-12345678 allows inbound traffic on port 3306 from 0.0.0.0/0. Security group sg-87654321 allows inbound traffic on port 3306 from 10.0.0.0/16. What is the effective inbound access to the DB instance?

A.No IP addresses are allowed because the rules conflict.
B.Only the 0.0.0.0/0 range is allowed because sg-12345678 is more permissive.
C.Only the 10.0.0.0/16 range is allowed because sg-87654321 is more restrictive.
D.All IP addresses (0.0.0.0/0) are allowed to connect.
AnswerD

Since sg-12345678 allows all traffic, any IP can connect.

Why this answer

When multiple security groups are attached to an RDS instance, the rules are combined, and the most permissive inbound rule applies. Security group sg-12345678 allows all IP addresses (0.0.0.0/0), so the effective inbound access is from all IPs. Option A is wrong because the rules do not conflict; they are additive.

Option B is wrong because the more restrictive rule does not override the more permissive one. Option C is wrong because the less restrictive rule (0.0.0.0/0) applies, not just the 10.0.0.0/16 range.

Exam trap

Candidates often mistakenly think that security groups apply only the most restrictive rule, or that rules conflict. In reality, rules are additive and the most permissive rule takes effect.

847
MCQhard

A financial services company runs a critical PostgreSQL database on Amazon RDS. The DBA needs to ensure that any database failover is detected within 30 seconds. Which monitoring approach should be used to meet this requirement?

A.Subscribe to RDS Event Notifications and create an SNS topic for 'failover' events.
B.Create a CloudWatch alarm on the 'DatabaseConnections' metric with a 1-minute evaluation period.
C.Use Enhanced Monitoring to monitor the 'engine' process status every second.
D.Enable CloudTrail and monitor the 'FailoverDBCluster' API call.
AnswerA

Event notifications are near real-time and can trigger actions within seconds.

Why this answer

Amazon RDS Event Notifications for 'failover' events are delivered within seconds, meeting the 30-second requirement. Subscribing to SNS topics ensures near real-time notification. Option B is wrong because the 'DatabaseConnections' metric with a 1-minute evaluation period introduces a delay of up to 1 minute, exceeding the 30-second threshold.

Option C is wrong because Enhanced Monitoring provides OS-level metrics every second but does not directly indicate a failover event. Option D is wrong because CloudTrail logs API calls with a typical delay of several minutes, not suitable for sub-minute detection.

848
MCQhard

A company runs an e-commerce platform on Amazon RDS for MySQL with a Multi-AZ deployment. The database has a table 'orders' with 50 million rows. During Black Friday sales, the application experiences severe slowdowns. Analysis shows that the CPU utilization is at 90% and there are many slow queries that perform full table scans on the 'orders' table. The development team has already added indexes on the most queried columns, but the problem persists. The database specialist suspects that the issue is not solely due to missing indexes. They notice that the queries often filter on a combination of 'order_date', 'customer_id', and 'status', and that the data distribution is heavily skewed: 80% of orders are 'completed' status. The 'order_date' range is typically the last 30 days. What should the database specialist do to improve query performance?

A.Partition the 'orders' table by 'status' and 'order_date' and create covering indexes on common query patterns.
B.Create multiple read replicas and distribute read traffic.
C.Implement an in-memory caching layer using Amazon ElastiCache for frequently accessed data.
D.Upgrade the RDS instance to a larger instance class with more vCPUs and memory.
AnswerA

Partitioning reduces the data scanned, and covering indexes speed up queries without accessing the table.

Why this answer

Partitioning the 'orders' table by 'status' and 'order_date' can significantly reduce the amount of data scanned, as queries often filter on these columns. With 80% of orders being 'completed', partitioning by status allows queries for non-completed statuses to skip most rows, and range partitioning by order_date (e.g., monthly) further limits scans to relevant time periods. Adding covering indexes on common query patterns (e.g., (status, order_date, customer_id)) can make these partition scans index-only.

Option B (read replicas) offloads read traffic but does not fix the slow queries themselves—they would still perform full scans on the replicas. Option C (caching) helps with repeated queries but not with ad-hoc analytical scans that still hit the database. Option D (vertical scaling) provides temporary relief but does not address the root cause of unnecessary full table scans.

849
MCQeasy

A security auditor reviews the output of a DynamoDB table description command as shown in the exhibit. Which statement accurately describes the encryption configuration of the Users table?

A.The table is encrypted using an AWS managed KMS key.
B.The table uses server-side encryption with an S3 managed key.
C.The table is not encrypted at rest.
D.The table is encrypted using a customer managed KMS key.
AnswerD

The output shows a specific KMS key ARN, indicating a customer managed key.

Why this answer

The output shows SSEDescription with Status ENABLED, SSEType KMS, and a KMSMasterKeyArn, which indicates that the table is encrypted using a customer-managed KMS key. Option A is incorrect because AWS managed KMS keys do not have an ARN like the one shown; they would have an alias like 'aws/dynamodb'. Option B is incorrect because DynamoDB does not use S3 managed keys; the SSEType is KMS.

Option C is incorrect because the status is ENABLED, indicating encryption at rest is enabled.

850
MCQhard

A gaming company uses Amazon DynamoDB to store player scores. The table has a partition key of 'game_id' and a sort key of 'player_id'. The application needs to retrieve the top 10 players for a given game_id based on score (stored as an attribute). The game_id has high cardinality. The team wants to avoid full table scans. Which design pattern is MOST efficient?

A.Query the table by game_id and sort the results in the application
B.Use a Scan operation with a filter expression and limit 10
C.Create a local secondary index with partition key game_id and sort key score
D.Create a global secondary index with partition key game_id and sort key score
AnswerD

Query the GSI with ScanIndexForward=false and limit 10 for fast retrieval.

Why this answer

A global secondary index (GSI) with partition key 'game_id' and sort key 'score' allows DynamoDB to efficiently retrieve the top 10 players for a given game_id by querying the index with the Query API, using ScanIndexForward=false to get items in descending order of score, and Limit=10. This avoids full table scans and leverages GSI's separate throughput capacity. Option C (LSI) could theoretically be used if the table was created with the LSI, but GSIs are preferred because they can be added after table creation, have dedicated throughput, and are more scalable.

Additionally, querying an LSI still consumes base table capacity, which may affect performance.

Exam trap

Candidates may think a Local Secondary Index (LSI) with sort key 'score' is a good fit because it shares the same partition key 'game_id' and allows ordering by score. However, LSIs share throughput capacity with the base table and have a 10 GB storage limit per partition key value. For high-cardinality game_id values with many players, the 10 GB limit can be restrictive, and the shared throughput may lead to throttling.

A Global Secondary Index (GSI) provides dedicated throughput and is the recommended pattern for top-N queries.

How to eliminate wrong answers

Option A is wrong because querying the table by game_id and sorting results in the application requires retrieving all players for that game, which is inefficient for large datasets and does not scale. Option B is wrong because a Scan operation with a filter expression and Limit=10 still reads the entire table (up to 1 MB per scan) before applying the filter, incurring high read costs and latency. Option C is wrong because a local secondary index (LSI) shares the table's partition key but cannot be queried independently; it requires the same partition key and sort key combination as the base table, and the LSI's sort key (score) cannot be used to retrieve top N items without scanning all items for that partition key.

851
Multi-Selectmedium

A company is using Amazon RDS for MySQL and needs to monitor for slow queries. Which TWO AWS services can be used to capture and analyze slow query logs? (Choose TWO.)

Select 2 answers
A.Amazon S3
B.Amazon RDS Performance Insights
C.AWS Config
D.AWS CloudTrail
E.Amazon CloudWatch Logs
AnswersB, E

Performance Insights can help identify slow queries by analyzing database load.

Why this answer

Amazon RDS Performance Insights (Option B) provides database performance analysis and can help identify slow queries by visualizing database load. Amazon CloudWatch Logs (Option E) can ingest and analyze RDS slow query logs by streaming them from RDS. Amazon S3 (Option A) is an object storage service, not a monitoring or analysis service.

AWS Config (Option C) is for recording configuration changes, not database logs. AWS CloudTrail (Option D) records API calls for governance, not database-level query logs.

852
MCQeasy

A company is designing a multi-tier application that uses Amazon RDS for PostgreSQL. The application must encrypt data at rest and in transit. Which combination of steps should be taken to meet these requirements? (Choose the single best answer.)

A.Use client-side encryption for data before sending to RDS, and enable encryption at rest after the instance is created.
B.Enable encryption at rest when launching the RDS instance, and configure the DB parameter group to require SSL connections.
C.Launch the RDS instance without encryption, then enable encryption at rest using the AWS Console.
D.Use AWS KMS to encrypt the connection between the application and RDS.
AnswerB

Encryption at rest is enabled at creation; SSL enforcement ensures encryption in transit.

Why this answer

Amazon RDS for PostgreSQL supports encryption at rest only when enabled at instance launch, and SSL/TLS encryption in transit is enforced by configuring the DB parameter group to require SSL connections (e.g., setting `rds.force_ssl=1`). Encryption at rest cannot be added after creation, and SSL ensures data is encrypted between the application and the database.

Exam trap

The trap here is that candidates assume encryption at rest can be enabled after launch (like modifying an EBS volume) or that KMS alone handles in-transit encryption, but RDS requires upfront planning for at-rest encryption and explicit SSL configuration for transit.

How to eliminate wrong answers

Option A is wrong because client-side encryption does not protect data in transit between the application and RDS, and encryption at rest cannot be enabled after the instance is created—it must be specified at launch. Option C is wrong because encryption at rest cannot be enabled on an existing unencrypted RDS instance; you must migrate to a new encrypted instance. Option D is wrong because AWS KMS is used for managing encryption keys, not for encrypting network connections; SSL/TLS is the correct mechanism for encryption in transit.

853
Multi-Selectmedium

A company uses Amazon DynamoDB for a gaming application. During a new game launch, the application experiences high latency and throttling on a table with a partition key of 'user_id' and a sort key of 'timestamp'. The access pattern is to query recent items for a given user. Which TWO design changes can improve performance?

Select 2 answers
A.Use strongly consistent reads for all queries.
B.Use a composite key with 'game_id' as partition key and 'timestamp' as sort key.
C.Add a Global Secondary Index (GSI) with a different partition key.
D.Increase the provisioned read capacity for the table.
E.Enable DynamoDB Accelerator (DAX) to cache write operations.
AnswersB, C

A better partition key (game_id) can distribute writes evenly.

Why this answer

Using a composite key with 'game_id' as partition key and 'timestamp' as sort key distributes traffic more evenly if 'game_id' has high cardinality, reducing hot partitions. Option C is correct because adding a Global Secondary Index (GSI) with a different partition key allows queries to be served from the index, offloading read traffic from the base table. Option A is incorrect because strongly consistent reads do not solve hot partition issues and consume more throughput.

Option D is incorrect because increasing read capacity does not address the root cause of a hot partition; the table may still throttle requests to the hot partition. Option E is incorrect because DAX is a caching layer for reads, not writes, and does not resolve partition-level throttling.

854
Multi-Selecthard

Which THREE design patterns are commonly used to optimize DynamoDB performance for write-heavy workloads?

Select 3 answers
A.Using DynamoDB adaptive capacity to handle unbalanced access patterns.
B.Using sparse indexes on rarely accessed attributes.
C.Batch writes using BatchWriteItem.
D.Write sharding using a random suffix on the partition key.
E.Using global tables to distribute writes across regions.
AnswersA, C, D

Adaptive capacity automatically rebalances partitions to handle hot spots.

Why this answer

DynamoDB adaptive capacity automatically isolates heavily accessed partitions, allowing them to consume more throughput without throttling other partitions. This is critical for write-heavy workloads with uneven access patterns, as it prevents hot partitions from degrading overall performance.

Exam trap

The trap here is that candidates may confuse global tables (Option E) as a write optimization technique, but it is primarily a replication feature for availability and read performance, not a direct write throughput optimization.

855
MCQeasy

What is the purpose of the 'TimeToLiveSpecification' in this template?

A.It enables DynamoDB to automatically delete items after the specified timestamp
B.It enforces that the 'expire_time' attribute must be unique
C.It automatically updates the 'expire_time' attribute when an item is read
D.It creates a backup of items that have expired
AnswerA

TTL deletes items when the timestamp is reached.

Why this answer

The 'TimeToLiveSpecification' in an AWS DynamoDB CloudFormation template enables DynamoDB's Time to Live (TTL) feature, which automatically deletes items when the current time exceeds the epoch timestamp value stored in the specified attribute (e.g., 'expire_time'). This is a cost-effective way to manage data retention without requiring custom delete logic or additional write capacity.

Exam trap

The trap here is that candidates confuse TTL with a feature that actively manages or updates timestamps, when in reality TTL is a passive, background deletion mechanism that only reads the existing attribute value and never modifies it.

How to eliminate wrong answers

Option B is wrong because TTL does not enforce uniqueness on the 'expire_time' attribute; DynamoDB only uses the attribute's value to determine expiration, and multiple items can share the same timestamp. Option C is wrong because TTL never automatically updates the 'expire_time' attribute when an item is read; it is a passive deletion mechanism based solely on the stored timestamp. Option D is wrong because TTL does not create backups of expired items; expired items are permanently deleted within 48 hours of expiration, and you must use DynamoDB Streams or separate backup mechanisms to capture them before deletion.

856
MCQmedium

A company is migrating an on-premises MongoDB database to AWS. The database stores JSON documents for a content management system. The workload requires read-after-write consistency and automatic scaling. Which AWS database service is MOST appropriate?

A.Amazon ElastiCache for Redis
B.Amazon DynamoDB
C.Amazon RDS for PostgreSQL
D.Amazon DocumentDB
AnswerD

DocumentDB is MongoDB-compatible, provides read-after-write consistency, and scales automatically.

Why this answer

Amazon DocumentDB is the most appropriate choice because it is a fully managed, MongoDB-compatible document database that natively stores JSON documents, supports read-after-write consistency via its default session consistency model, and provides automatic scaling of storage (up to 64 TB) and compute resources. It directly replaces on-premises MongoDB workloads without requiring schema changes or application rewrites, making it ideal for a content management system.

Exam trap

The trap here is that candidates often choose DynamoDB (Option B) because it is a NoSQL document database with automatic scaling, but they overlook the requirement for MongoDB compatibility and read-after-write consistency, which DynamoDB does not provide by default and requires additional configuration, whereas DocumentDB is purpose-built for MongoDB workloads with strong consistency out of the box.

How to eliminate wrong answers

Option A is wrong because Amazon ElastiCache for Redis is an in-memory key-value store, not a document database; it does not natively support JSON document storage with MongoDB-compatible querying, and its eventual consistency model (with optional strong consistency via WAIT command) is not designed for persistent, read-after-write consistent document workloads. Option B is wrong because Amazon DynamoDB is a key-value and document database but uses a different API and consistency model (eventually consistent reads by default, with strongly consistent reads available at additional cost); it lacks MongoDB wire protocol compatibility, requiring application refactoring. Option C is wrong because Amazon RDS for PostgreSQL is a relational database that stores data in tables with a fixed schema, not as JSON documents; while it supports JSONB, it does not provide MongoDB-compatible APIs or automatic scaling of storage without manual intervention, and it requires schema migration from MongoDB's document model.

857
MCQeasy

A developer needs to grant an IAM user the ability to perform all operations on an Amazon RDS DB instance except the ability to delete it. Which IAM policy action should be explicitly denied?

A.rds:RebootDBInstance
B.rds:StopDBInstance
C.rds:ModifyDBInstance
D.rds:DeleteDBInstance
AnswerD

Explicitly denying this action prevents deletion.

Why this answer

To prevent deletion, you must explicitly deny the rds:DeleteDBInstance action. Option A (rds:RebootDBInstance) is incorrect because it only reboots the instance. Option B (rds:StopDBInstance) is incorrect because it only stops the instance.

Option C (rds:ModifyDBInstance) is incorrect because it only modifies the instance. Option D (rds:DeleteDBInstance) is the correct action to deny to prevent deletion.

858
MCQmedium

A company is running an Amazon RDS for MySQL database. The application team reports that the database is slow. Upon investigation, you notice that the DB instance's CPU utilization is consistently above 90%. Which initial troubleshooting step should you take?

A.Increase the DB instance size to improve performance.
B.Enable Enhanced Monitoring to identify the source of high CPU usage.
C.Delete the slow query logs to reduce I/O.
D.Change the storage type from General Purpose (gp2) to Provisioned IOPS (io1).
AnswerB

Enhanced Monitoring provides OS-level metrics to diagnose CPU bottlenecks.

Why this answer

Enabling Enhanced Monitoring provides OS-level metrics that can help identify resource bottlenecks. Option A is wrong because increasing instance size without diagnosis may not address the root cause. Option C is wrong because switching storage type does not reduce CPU load.

Option D is wrong because deleting slow query logs removes diagnostic data.

859
MCQmedium

A company is running a MongoDB-compatible workload on Amazon DocumentDB. They are experiencing high write latency during peak hours. The current cluster has one instance (db.r5.large) with 100 GB storage. Which change is most likely to improve write performance?

A.Increase storage to 500 GB
B.Enable Multi-AZ deployment
C.Increase the instance size to db.r5.xlarge
D.Add a read replica in a different Availability Zone
AnswerC

A larger instance provides more CPU and memory, which can improve write performance.

Why this answer

Increasing the instance size to db.r5.xlarge provides more CPU and memory resources, which directly improves the cluster's ability to handle write operations under load. In Amazon DocumentDB, write performance is primarily bound by the instance's compute capacity (vCPUs and memory) for processing write requests and managing the storage engine's buffer cache. A larger instance reduces contention and allows more concurrent writes to be processed efficiently.

Exam trap

The trap here is that candidates often assume increasing storage or adding read replicas will improve write performance, but in DocumentDB, write throughput is limited by the primary instance's compute resources, not by storage size or read capacity.

How to eliminate wrong answers

Option A is wrong because increasing storage to 500 GB does not improve write throughput; DocumentDB storage is automatically scaled and write performance is not tied to storage size but to instance compute and I/O credits. Option B is wrong because enabling Multi-AZ deployment adds a standby replica for high availability but does not increase write capacity—the primary instance still handles all writes, and Multi-AZ can even add slight latency due to synchronous replication. Option D is wrong because adding a read replica in a different Availability Zone offloads read traffic but does not affect write performance on the primary instance; writes are still handled by the single primary instance.

860
MCQmedium

A company is using Amazon DynamoDB with a global table. The security team requires that all data be encrypted at rest using a customer-managed KMS key. The table was originally created with AWS managed key encryption. The company wants to switch to a customer-managed key without downtime. What should they do?

A.Use the UpdateTable API to change the KMS key to the customer-managed key.
B.Enable DynamoDB Streams on the old table and use a Lambda function to copy data to a new table with the customer-managed key.
C.Create a new replica in the global table with the customer-managed key and then delete the old replica.
D.Create a new table with the customer-managed key, export the data from the old table using AWS Data Pipeline, and import into the new table.
AnswerD

This avoids downtime if done carefully, but there is no direct migration tool; however, it is the only way.

Why this answer

You cannot modify the encryption key of an existing DynamoDB table. To switch to a customer-managed KMS key without downtime, you must create a new table with the desired key, export data from the old table using AWS Data Pipeline, and import into the new table. Option A is incorrect because the UpdateTable API does not support changing the KMS key after table creation.

Option B is incorrect because DynamoDB Streams and Lambda are not suitable for full table migration, especially for global tables. Option C is incorrect because replicas inherit the table's encryption key and cannot have a different key.

861
MCQeasy

A startup is building a social media application that needs to store user profiles, posts, comments, and likes. The data is highly interconnected, and the team wants to query relationships efficiently, such as 'find all friends of a user who liked a post'. Which database service is best suited for this workload?

A.Amazon ElastiCache for Redis
B.Amazon DynamoDB
C.Amazon RDS for PostgreSQL
D.Amazon Neptune
AnswerD

Neptune is a graph database built for relationship queries.

Why this answer

Amazon Neptune is a fully managed graph database service optimized for highly interconnected data. It supports property graph and RDF models, enabling efficient traversal of relationships such as 'find all friends of a user who liked a post' using Gremlin or SPARQL queries. This makes it the ideal choice for social media applications requiring real-time relationship queries.

Exam trap

The DBS-C01 exam often tests the misconception that a relational database (like PostgreSQL) can handle graph workloads efficiently via joins, but the trap is that relational databases suffer from exponential join complexity and lack native graph traversal optimizations, making Neptune the correct choice for deeply interconnected data.

How to eliminate wrong answers

Option A is wrong because Amazon ElastiCache for Redis is an in-memory key-value store and cache, not designed for complex relationship traversals or graph queries; it lacks native graph query capabilities. Option B is wrong because Amazon DynamoDB is a NoSQL key-value and document database that excels at high-throughput, low-latency access patterns but does not natively support graph traversal or join operations required for interconnected data queries. Option C is wrong because Amazon RDS for PostgreSQL is a relational database that can model relationships using foreign keys and joins, but it becomes inefficient for deep or multi-hop graph traversals (e.g., friends-of-friends) at scale, requiring complex recursive CTEs or multiple queries, whereas Neptune is purpose-built for such workloads.

862
MCQhard

A company wants to enforce that all new Amazon RDS DB instances are created with encryption at rest enabled. Which approach should be taken?

A.Use an IAM policy that denies the rds:CreateDBInstance action unless rds:StorageEncrypted is set to true.
B.Use AWS CloudTrail to detect unencrypted instance creation and automatically delete them.
C.Use AWS Config rules to mark unencrypted instances as noncompliant.
D.Enable encryption by default in the RDS console.
AnswerA

This preventive control enforces encryption at creation time via IAM conditions.

Why this answer

An IAM policy with a condition key `rds:StorageEncrypted` set to `true` can deny the `rds:CreateDBInstance` action when encryption is not enabled, enforcing encryption at rest at creation time. Option B is wrong because CloudTrail is an auditing service; it logs API calls but cannot automatically delete unencrypted instances without additional services like Lambda. Option C is wrong because AWS Config detects and reports noncompliant resources but does not prevent creation; it is reactive.

Option D is wrong because Amazon RDS does not offer a default encryption setting at the account level; encryption must be explicitly enabled per instance.

863
MCQeasy

A developer reports that an Amazon RDS for MySQL DB instance is experiencing high CPU utilization. You suspect a specific query is causing the issue. Which CloudWatch metric should you examine to confirm this?

A.CPUUtilization
B.DatabaseConnections
C.ReadLatency
D.FreeableMemory
AnswerA

CPUUtilization directly measures CPU usage.

Why this answer

The CPUUtilization metric directly measures the percentage of CPU usage on the DB instance. While it does not isolate a specific query, it confirms that high CPU utilization is occurring. DatabaseConnections, ReadLatency, and FreeableMemory are not direct indicators of CPU usage.

864
MCQmedium

A company is migrating a 500 GB on-premises PostgreSQL database to Amazon RDS for PostgreSQL. The migration must have minimal downtime and support ongoing replication after the initial load. The network link has limited bandwidth, and the company wants to avoid costly data transfer fees. Which approach should be used?

A.Use AWS DMS with ongoing replication (CDC) from the start.
B.Use AWS Database Migration Service (DMS) with a full load only, then cut over.
C.Use pg_dump to export the database and pg_restore to import into RDS.
D.Use AWS Snowball Edge to transfer the database files, then load into RDS.
AnswerA

CDC captures changes continuously, minimizing downtime and supporting ongoing sync.

Why this answer

AWS DMS with ongoing replication (CDC) enables a full load followed by continuous change data capture, which meets the requirements of minimal downtime and ongoing replication. DMS compresses data in transit and can throttle network usage, helping to manage limited bandwidth and avoid costly data transfer fees by using the existing network link efficiently.

Exam trap

The trap here is that candidates often assume Snowball Edge is always the best choice for large databases to avoid bandwidth costs, but for 500 GB and the need for ongoing replication, DMS with CDC is more appropriate and cost-effective.

How to eliminate wrong answers

Option B is wrong because a full load only does not support ongoing replication after the initial load, so changes made during the migration would be lost, requiring downtime for a final cutover. Option C is wrong because pg_dump and pg_restore are offline tools that require the source database to be stopped or made read-only during the export, causing significant downtime and no ongoing replication capability. Option D is wrong because AWS Snowball Edge is designed for large-scale offline data transfer (typically >10 TB) and would introduce unnecessary latency and complexity for a 500 GB database, plus it does not support ongoing replication after the data is loaded.

865
MCQhard

A company is designing a multi-tenant application using Amazon Aurora MySQL. Each tenant's data must be isolated from others. They need to encrypt data at rest with a unique AWS KMS key per tenant. How can this be achieved?

A.Create separate databases within the same Aurora cluster and assign a different KMS key to each database.
B.Use client-side encryption with different KMS keys per tenant before inserting data into the database.
C.Use a single Aurora cluster with row-level encryption using different KMS keys per tenant.
D.Launch separate Aurora clusters for each tenant, each with its own KMS key for encryption at rest.
AnswerD

Each Aurora cluster can be encrypted with a different KMS key, providing per-tenant encryption at rest.

Why this answer

Aurora MySQL encryption at rest is applied at the cluster level using a single AWS KMS key. You cannot assign different KMS keys to individual databases or tables within the same cluster. Therefore, the only way to achieve unique per-tenant encryption keys is to use separate Aurora clusters, each with its own KMS key.

Option A is incorrect because RDS encryption is cluster-wide, not per-database. Option B implements client-side encryption, not encryption at rest. Option C is not supported by Aurora MySQL, as there is no row-level encryption with per-tenant KMS keys.

Thus, Option D is correct.

866
MCQmedium

A company is designing a database for an e-commerce platform that stores product catalog data. The catalog has frequent reads and occasional writes. The data is highly relational but the team wants the lowest possible latency for read queries. Which database service should they choose?

A.Amazon DocumentDB
B.Amazon RDS for PostgreSQL with read replicas
C.Amazon DynamoDB with DAX
D.Amazon ElastiCache for Redis
AnswerC

DAX provides in-memory acceleration for DynamoDB, delivering microsecond read latency.

Why this answer

Amazon DynamoDB with DAX is the best choice because the workload requires the lowest possible latency for read queries on a highly relational product catalog with frequent reads and occasional writes. DynamoDB provides single-digit millisecond latency at scale, and DAX (DynamoDB Accelerator) is an in-memory cache that reduces read latency to microseconds for eventually consistent reads, directly addressing the low-latency requirement without sacrificing the ability to handle occasional writes.

Exam trap

The trap here is that candidates often choose Amazon RDS with read replicas (Option B) because they see 'highly relational' and assume a relational database is mandatory, but they overlook that DynamoDB can model relational data using single-table design with composite keys and that DAX provides far lower read latency than any disk-based relational database with replicas.

How to eliminate wrong answers

Option A is wrong because Amazon DocumentDB is a document database (MongoDB-compatible) that, while offering low latency, does not match the 'highly relational' nature of the data and cannot match the sub-millisecond read latency of DAX for this use case. Option B is wrong because Amazon RDS for PostgreSQL with read replicas is a relational database that can handle relational data well, but read replicas introduce replication lag and still involve disk I/O, resulting in higher latency than an in-memory cache like DAX; it is not designed for the absolute lowest read latency. Option D is wrong because Amazon ElastiCache for Redis is a standalone caching layer that would require the application to manage cache invalidation and data synchronization with a primary database, adding complexity and potential inconsistency, whereas DAX is tightly integrated with DynamoDB and automatically handles cache coherence for the product catalog data.

867
MCQmedium

A company runs an Amazon DynamoDB table with on-demand capacity. They notice that a specific partition key receives a high volume of read requests, causing throttling for that partition. What is the BEST solution to distribute the load evenly?

A.Create a global secondary index with a different partition key.
B.Add a random suffix to the partition key values to increase partition cardinality.
C.Use DynamoDB Accelerator (DAX) to cache reads.
D.Switch the table to provisioned capacity with auto-scaling.
AnswerB

This spreads reads across multiple partitions, reducing hot spots.

Why this answer

Adding a suffix to the partition key to create multiple partitions distributes read load across partitions.

868
MCQmedium

A company wants to restrict access to an Amazon DynamoDB table so that only requests from a specific VPC endpoint are allowed. Which policy should be attached to the table?

A.A security group rule that allows traffic only from the VPC endpoint.
B.An IAM policy that denies access unless the request comes from the specific VPC.
C.A VPC endpoint policy that allows only the specific VPC endpoint to access the DynamoDB table.
D.An S3 bucket policy that references the DynamoDB table.
AnswerC

A VPC endpoint policy attached to the VPC endpoint can restrict which resources, such as DynamoDB tables, are accessible through that endpoint.

Why this answer

A VPC endpoint policy attached to the VPC endpoint can restrict which DynamoDB tables are accessible through that endpoint. Option A is incorrect because security groups apply to EC2 instances and other network interfaces, not to DynamoDB tables. Option B is incorrect because while IAM policies can include conditions to restrict access based on source VPC, they are attached to IAM users or roles, not directly to the DynamoDB table.

Option D is incorrect because bucket policies are used for Amazon S3, not DynamoDB.

869
Multi-Selectmedium

A company is migrating an on-premises MongoDB database to Amazon DocumentDB. The database stores IoT sensor data with time-series characteristics. The application performs range queries on timestamp fields and updates recent documents frequently. Which THREE aspects of DocumentDB should the company consider to optimize performance for this workload? (Choose three.)

Select 3 answers
A.Use global secondary indexes to speed up queries on the timestamp field.
B.Implement sharding to distribute write load across multiple instances.
C.Enable a TTL index on the timestamp field to automatically delete old data.
D.Create a compound index on (device_id, timestamp) to support range queries.
E.Use a single large instance class to avoid sharding complexity.
AnswersB, C, D

Sharding helps scale writes by distributing data across shards.

Why this answer

DocumentDB does not support native sharding like MongoDB; however, for workloads with high write throughput, you can distribute writes by using multiple DocumentDB instances and routing writes based on a shard key in the application layer. This helps avoid write bottlenecks on a single instance and scales write capacity horizontally.

Exam trap

The trap here is that candidates may assume DocumentDB supports sharding natively like MongoDB, but DocumentDB does not have built-in sharding; instead, you must implement application-level sharding or use multiple clusters to distribute write load.

870
Multi-Selecteasy

Which TWO actions are recommended when deploying an Amazon RDS for MySQL instance in a production environment to ensure high availability and durability? (Choose two.)

Select 2 answers
A.Enable Enhanced Monitoring
B.Enable automated backups with a retention period of at least 7 days
C.Enable Performance Insights
D.Enable deletion protection
E.Enable Multi-AZ deployment
AnswersB, E

Automated backups allow point-in-time recovery within the retention period.

Why this answer

Automated backups with a retention period of at least 7 days enable point-in-time recovery (PITR) within that window, which is critical for restoring a database to a specific second in the event of a failure or data corruption. This ensures durability by allowing you to recover from logical errors or accidental deletions, not just hardware failures. Option E is correct because Multi-AZ deployment automatically provisions and maintains a synchronous standby replica in a different Availability Zone, providing automatic failover for high availability without manual intervention.

Exam trap

The trap here is that candidates often confuse monitoring and performance tools (Enhanced Monitoring, Performance Insights) with high availability or durability features, or they mistakenly think deletion protection provides data durability, when in fact only automated backups and Multi-AZ deployment directly address these concerns.

871
MCQhard

A DBA runs the above AWS CLI command. The DB instance is an Amazon RDS for MySQL instance. The DBA needs to connect to the database from an EC2 instance in the same VPC but cannot connect. Which action should be taken first?

A.Verify that the DB instance endpoint resolves correctly from the EC2 instance.
B.Check the inbound rules of the security group for port 3306.
C.Enable encryption on the DB instance.
D.Check the DB instance status in the output.
AnswerB

Security group inbound rules control access to the DB instance.

Why this answer

The most common cause of connectivity failure from an EC2 instance to an RDS for MySQL instance in the same VPC is that the security group associated with the RDS instance does not allow inbound traffic on port 3306 from the EC2 instance's security group or IP address. Checking the inbound rules of the security group for port 3306 is the first logical troubleshooting step because it directly addresses the network access control that governs whether the EC2 instance can initiate a TCP connection to the database.

Exam trap

The trap here is that candidates often jump to checking DNS resolution (Option A) or instance status (Option D) first, overlooking that security group inbound rules are the most frequent cause of connectivity failures in same-VPC RDS scenarios.

How to eliminate wrong answers

Option A is wrong because if the DB instance endpoint does not resolve correctly, the DBA would typically receive a 'Name or service not known' error, not a generic 'cannot connect' error; DNS resolution is rarely the first issue in a same-VPC scenario. Option C is wrong because enabling encryption on the DB instance (using AWS KMS) protects data at rest and in transit but does not affect network-level connectivity or security group rules; it would not resolve a connection failure caused by missing inbound rules. Option D is wrong because checking the DB instance status in the CLI output only confirms the instance is available and running, but a running instance can still be unreachable if security groups block traffic; this step does not diagnose the connectivity problem.

872
MCQeasy

A database administrator notices that an Amazon RDS for MySQL DB instance has experienced a failover during a maintenance window. What is the most likely cause of this failover?

A.The DB instance ran out of storage and automatically failed over
B.A read replica was promoted to a primary instance
C.A manual failover was initiated by the administrator
D.A system update was applied during the maintenance window, causing a reboot
AnswerD

RDS applies patches during maintenance windows; Multi-AZ instances may fail over to reduce downtime.

Why this answer

The RDS maintenance window is used to apply system updates, which may require a reboot and failover if Multi-AZ is enabled. Option A is wrong because running out of storage does not cause a failover; instead, it would cause the instance to become unavailable. Option B is wrong because promoting a read replica is a manual action, not an automatic failover during maintenance.

Option C is wrong because a manual failover is initiated by the administrator, not automatically during the maintenance window.

873
MCQeasy

A developer needs to deploy an Amazon RDS for MySQL DB instance that is accessible only from a specific EC2 instance in a VPC. Which configuration ensures this?

A.Use an IAM role to allow the EC2 instance to connect to the RDS instance
B.Enable public accessibility and assign a public IP to the RDS instance
C.Place RDS and EC2 in different subnets and configure a network ACL
D.Place the RDS instance in the same VPC as the EC2 instance and configure a security group inbound rule referencing the EC2 security group
AnswerD

This ensures traffic is allowed only from the specific EC2 security group.

Why this answer

Placing the RDS instance in the same VPC as the EC2 instance and configuring a security group inbound rule that references the EC2 instance's security group allows traffic only from that specific EC2 instance. Security group rules are stateful and support referencing other security groups as sources, which provides a precise and secure method for controlling database access without exposing the RDS instance to the broader network.

Exam trap

The trap here is that candidates often confuse IAM roles with network security, thinking they can control database access via IAM, when in fact IAM is used for API-level permissions and not for filtering TCP/IP traffic to an RDS instance.

How to eliminate wrong answers

Option A is wrong because IAM roles control authentication and authorization for AWS API actions, not network-level access to an RDS database; they cannot replace security group rules or network ACLs for allowing TCP connections to the database port. Option B is wrong because enabling public accessibility assigns a public IP address and exposes the RDS instance to the internet, which violates the requirement of restricting access to only a specific EC2 instance and introduces unnecessary security risks. Option C is wrong because placing RDS and EC2 in different subnets does not inherently restrict access; network ACLs are stateless and require explicit inbound and outbound rules, but they operate at the subnet level and cannot target a specific EC2 instance as precisely as a security group rule referencing the EC2 security group.

874
MCQmedium

A company has an Amazon RDS for SQL Server DB instance that stores financial data. The security team requires that all database activity be monitored in real-time for suspicious queries. Which AWS service should be used to meet this requirement?

A.AWS CloudTrail
B.AWS Security Hub
C.Amazon GuardDuty with RDS Protection
D.Amazon Inspector
AnswerC

GuardDuty RDS Protection monitors database activity for threats.

Why this answer

Amazon GuardDuty with RDS Protection provides real-time monitoring of database activity on Amazon RDS instances, analyzing SQL queries and detecting suspicious behavior such as SQL injection or unusual access patterns. Option A (AWS CloudTrail) is incorrect because it records API calls made to the AWS environment, not the database queries themselves. Option B (AWS Security Hub) is incorrect as it aggregates security findings from multiple AWS services but does not perform real-time database activity monitoring.

Option D (Amazon Inspector) is incorrect because it is a vulnerability assessment service that scans for software vulnerabilities and unintended network exposure, not for database query threats.

875
Multi-Selecteasy

Which TWO of the following are valid methods to migrate an on-premises MySQL database to Amazon RDS for MySQL? (Select TWO.)

Select 2 answers
A.Use pg_dump to export the data and import into RDS.
B.Use AWS DMS to migrate from on-premises MySQL to RDS.
C.Use SQL Server Integration Services (SSIS) to migrate the data.
D.Use Oracle Data Pump to export the data and import into RDS.
E.Use mysqldump to export the database and import it into RDS.
AnswersB, E

DMS supports MySQL as source.

Why this answer

AWS DMS (Database Migration Service) is a fully managed service designed to migrate databases to AWS with minimal downtime. It supports homogeneous migrations like MySQL to Amazon RDS for MySQL, handling schema conversion, data replication, and ongoing changes via change data capture (CDC). This makes option B a valid and recommended method for migrating an on-premises MySQL database to RDS.

Exam trap

The trap here is that candidates may confuse database-specific tools (pg_dump for PostgreSQL, Oracle Data Pump for Oracle, SSIS for SQL Server) with MySQL-compatible tools, leading them to select options that are technically incorrect for migrating a MySQL database to Amazon RDS for MySQL.

876
MCQeasy

A company is deploying a new web application that uses Amazon RDS for MySQL. The application must be highly available across three Availability Zones with automatic failover. Which deployment configuration should be used?

A.Deploy Amazon RDS for MySQL in a Single-AZ configuration and use an Application Load Balancer.
B.Deploy Amazon Aurora MySQL with three Aurora Replicas in different Availability Zones.
C.Deploy Amazon RDS for MySQL with Multi-AZ and a standby instance in a different Availability Zone.
D.Deploy Amazon RDS for MySQL with Read Replicas in two additional Availability Zones.
AnswerB

Aurora with Replicas provides automatic failover and high availability across multiple AZs.

Why this answer

Amazon Aurora MySQL is the correct choice because it is designed for high availability across three Availability Zones by default, with six copies of data across three AZs and the ability to create up to 15 Aurora Replicas. The requirement for automatic failover across three AZs is met by deploying three Aurora Replicas in different AZs, ensuring continuous availability even if two AZs fail. Standard Amazon RDS for MySQL Multi-AZ only supports a single standby in one other AZ, not three AZs.

Exam trap

The trap here is that candidates often confuse Amazon RDS for MySQL Multi-AZ with true multi-AZ high availability across three AZs, not realizing that Multi-AZ only covers two AZs, while Aurora is the only MySQL-compatible option that supports three AZs with automatic failover.

How to eliminate wrong answers

Option A is wrong because a Single-AZ configuration has no automatic failover capability, and an Application Load Balancer operates at the application layer, not the database layer, so it cannot handle database failover. Option C is wrong because Amazon RDS for MySQL Multi-AZ only provides a standby instance in a single different Availability Zone, not across three AZs, so it cannot meet the requirement for high availability across three AZs. Option D is wrong because Read Replicas are for read scaling and do not provide automatic failover; they require manual promotion to become the primary instance, which does not meet the automatic failover requirement.

877
MCQmedium

Refer to the exhibit. An IAM policy is attached to an IAM role used by a Lambda function that writes to a DynamoDB table. The function also needs to read items from the table. What is the outcome of this policy?

A.The policy is invalid because it contains both Allow and Deny for the same table
B.The Lambda function can both read and write items
C.The Lambda function can write items but cannot read items
D.The Lambda function cannot perform any operations on the table
AnswerC

The Deny for GetItem overrides the Allow, so reads fail.

Why this answer

The IAM policy includes an explicit Deny for the `dynamodb:GetItem` action on the table, which overrides any Allow statements due to the explicit deny evaluation logic in AWS IAM. Since the Lambda function assumes a role with this policy, it is denied read access while the Allow for `dynamodb:PutItem` permits write operations. Therefore, the function can write but cannot read items from the DynamoDB table.

Exam trap

The trap here is that candidates often assume a single Allow statement grants all actions on a resource, overlooking that an explicit Deny for a specific action will block that action even if other actions are allowed.

How to eliminate wrong answers

Option A is wrong because a policy can contain both Allow and Deny for the same resource; this is valid and results in the Deny taking precedence. Option B is wrong because the explicit Deny on `dynamodb:GetItem` prevents read operations, so the function cannot both read and write. Option D is wrong because the Allow for `dynamodb:PutItem` is not overridden by any Deny, so write operations are permitted.

878
MCQhard

A media company stores video metadata in Amazon DynamoDB. The table has partition key 'video_id' and sort key 'upload_date'. The application frequently queries videos by 'category' and 'status'. The access pattern changes over time. Which design minimizes cost and maximizes query flexibility?

A.Create a single GSI with partition key 'category' and sort key 'status'
B.Create multiple GSIs with different partition keys to support various query patterns
C.Use DynamoDB Streams to replicate data to Amazon Elasticsearch Service
D.Redesign to a single DynamoDB table that aggregates all attributes into the partition key
AnswerB

Multiple GSIs provide query flexibility at the cost of additional storage, but DynamoDB allows up to 20 GSIs.

Why this answer

Creating multiple GSIs with different partition keys allows the application to support various query patterns (e.g., by category, by status, or combined) without incurring the cost of scanning the base table. DynamoDB charges for read/write capacity and storage per GSI, so multiple GSIs are cost-effective only if each serves a distinct access pattern, and this design maximizes query flexibility by enabling efficient key-based lookups for changing workloads.

Exam trap

The DBS-C01 exam often tests the misconception that a single GSI with a composite sort key can replace multiple GSIs, but the trap here is that a GSI's partition key determines the primary query dimension, and using a single GSI with 'category' as partition key cannot efficiently serve queries that filter only by 'status' without a full scan of that GSI.

How to eliminate wrong answers

Option A is wrong because a single GSI with partition key 'category' and sort key 'status' only supports queries filtering by category and optionally sorting by status, but it cannot efficiently handle queries that filter only by status or by other attributes that may become relevant as access patterns change. Option C is wrong because using DynamoDB Streams to replicate data to Amazon Elasticsearch Service introduces additional cost, latency, and operational complexity (managing an Elasticsearch cluster) that is unnecessary for simple key-based queries; this approach is better suited for full-text search or complex analytics, not for optimizing DynamoDB query flexibility. Option D is wrong because redesigning to a single DynamoDB table that aggregates all attributes into the partition key violates best practices for DynamoDB schema design, leading to hot partitions, increased storage costs due to data duplication, and reduced query flexibility since you cannot efficiently filter by individual attributes without scanning.

879
MCQeasy

A company has a 50 GB MariaDB database on an on-premises server. They want to migrate to Amazon RDS for MariaDB. They have a 100 Mbps network connection. The migration window is 2 hours. The database can be offline for up to 30 minutes. Which migration approach is most appropriate?

A.Use AWS DMS with ongoing replication.
B.Use AWS Snowball to transfer the database files.
C.Create a MariaDB dump, transfer to an EC2 instance in the same region, then import to RDS.
D.Use AWS SCT to convert schema and then use DMS.
AnswerC

Simple and within window; dump/import time ~20 minutes.

Why this answer

The most appropriate because a MariaDB dump to an EC2 instance in the same region allows for a fast transfer over the network, and the import into RDS can be completed within the 2-hour migration window. The 50 GB database at 100 Mbps can be transferred in just over an hour, well within the window. Option A (DMS with ongoing replication) is unnecessarily complex for a one-time migration and may require more setup time.

Option B (Snowball) is overkill for 50 GB and would not meet the 2-hour window due to shipping and processing delays. Option D (SCT) is not needed since the source and target are both MariaDB, and schema conversion is unnecessary.

880
MCQmedium

A company has a production Amazon RDS for SQL Server database that stores financial data. The database administrator wants to audit all access to sensitive columns (e.g., credit card numbers) using the SQL Server Audit feature. The database is part of a Multi-AZ deployment. The administrator has enabled audit logging to the 'DEFAULT' file audit target, but the audit files are being written to the local instance storage and are not being retained after failover. The compliance team requires that audit logs be stored in Amazon S3 for at least 7 years. The administrator has set up an event subscription to send database events to an S3 bucket using AWS DMS, but the audit logs are not being captured. What should the administrator do to meet the compliance requirements?

A.Use RDS event subscriptions to send database audit logs to an S3 bucket.
B.Configure AWS DMS to continuously replicate the audit database to an S3 bucket.
C.Create a new SQL Server Audit target using the Amazon S3 option and configure the audit to write to an S3 bucket.
D.Enable RDS Enhanced Monitoring and configure it to send logs to CloudWatch Logs.
AnswerC

RDS for SQL Server supports custom audit targets to S3, allowing persistent storage of audit logs.

Why this answer

Amazon RDS for SQL Server supports writing SQL Server Audit logs directly to an Amazon S3 bucket as an audit target. This is the only native method that persists audit logs beyond the instance lifecycle, ensuring they survive Multi-AZ failover and meet the 7-year retention requirement. The DEFAULT file target writes to ephemeral instance storage, which is lost on failover, and RDS event subscriptions or DMS cannot capture SQL Server Audit output.

Exam trap

The trap here is that candidates confuse RDS event subscriptions (which send metadata events) with actual audit log delivery, or assume DMS can replicate arbitrary file output, when in fact only the native S3 audit target persists SQL Server Audit logs in a durable, compliant manner.

How to eliminate wrong answers

Option A is wrong because RDS event subscriptions only send database events (e.g., instance state changes, backups) to S3, not the actual SQL Server Audit log files. Option B is wrong because AWS DMS is a database migration service that replicates tables or schemas, not audit file output; it cannot capture or stream SQL Server Audit binary files to S3. Option D is wrong because RDS Enhanced Monitoring collects OS-level metrics (CPU, memory, I/O) and sends them to CloudWatch Logs, not SQL Server Audit logs.

881
MCQhard

A company runs a critical OLTP workload on Amazon RDS for PostgreSQL. The database size is 2 TB and growing. To reduce storage costs, the company wants to archive old data that is rarely accessed. Which approach is most cost-effective and minimally impacts performance?

A.Move the database to Amazon Aurora PostgreSQL with storage auto-scaling.
B.Migrate the entire database to Amazon DynamoDB.
C.Implement table partitioning and use S3 as an external table for old partitions.
D.Delete old rows and run VACUUM FULL to reclaim space.
AnswerC

Reduces primary storage cost while preserving data access.

Why this answer

It uses PostgreSQL table partitioning (e.g., range partitioning by date) combined with the `postgres_fdw` or `pg_parquet` extension to treat old partitions as foreign tables stored in Amazon S3. This keeps the hot data in RDS for fast OLTP access while offloading cold data to low-cost S3 storage, minimizing performance impact and reducing storage costs without requiring a full migration or schema redesign.

Exam trap

The trap here is that candidates assume deleting rows and running VACUUM FULL (Option D) reduces storage costs, but RDS bills for allocated storage, not used space, so reclaiming space does not lower the bill and VACUUM FULL can cause significant performance disruption.

How to eliminate wrong answers

Option A is wrong because moving to Aurora PostgreSQL with storage auto-scaling does not reduce storage costs for rarely accessed data; it only automates scaling and still incurs Aurora storage costs for all data. Option B is wrong because migrating an entire 2 TB OLTP workload to DynamoDB would require a complete application rewrite to fit the NoSQL model, and DynamoDB is not optimized for complex relational queries or large-volume archival patterns. Option D is wrong because deleting old rows and running VACUUM FULL reclaims space but does not reduce storage costs long-term (RDS bills for allocated storage, not used space) and VACUUM FULL causes table bloat, performance degradation, and downtime.

882
MCQeasy

A company uses Amazon Redshift for its data warehouse. The security team wants to encrypt the data at rest and ensure that only authorized users can access the encryption keys. Which AWS service should be used to manage the encryption keys?

A.AWS CloudHSM
B.AWS Key Management Service (KMS)
C.AWS Secrets Manager
D.AWS Systems Manager Parameter Store
AnswerB

KMS is the integrated key management service for Redshift encryption at rest.

Why this answer

Amazon Redshift uses AWS KMS for encryption at rest. You can use either the default AWS-managed key or a customer-managed CMK. KMS integrates with Redshift to encrypt data in the cluster and allows fine-grained control over key access via IAM policies.

CloudHSM is not directly integrated with Redshift. Secrets Manager and Systems Manager Parameter Store are for secrets, not encryption keys for Redshift.

883
Multi-Selecteasy

Which TWO of the following are valid considerations when designing a database for an e-commerce application with high read traffic and low write latency requirements?

Select 2 answers
A.Use Amazon DynamoDB Accelerator (DAX) to improve read performance.
B.Store session data in Amazon S3 for fast access.
C.Use Amazon Redshift to serve read traffic directly.
D.Use Amazon ElastiCache to cache frequently accessed data.
E.Deploy Amazon RDS for MySQL with Multi-AZ for read scaling.
AnswersA, D

DAX is a caching layer for DynamoDB.

Why this answer

Amazon DynamoDB Accelerator (DAX) is a fully managed, in-memory cache for DynamoDB that delivers up to 10x read performance improvement by reducing response times from milliseconds to microseconds. For an e-commerce application with high read traffic and low write latency requirements, DAX offloads read-heavy workloads from the DynamoDB table, ensuring consistent low-latency reads without impacting write throughput.

Exam trap

The trap here is that candidates often confuse Multi-AZ with read scaling, assuming that Multi-AZ automatically distributes read traffic, when in fact it only provides a standby replica for failover and does not serve reads.

884
Multi-Selectmedium

A database specialist is troubleshooting an Amazon RDS for SQL Server instance that is experiencing high CPU utilization. The instance has multiple databases. Which TWO actions should the specialist take to identify the cause?

Select 2 answers
A.Create a read replica to offload read traffic
B.Use Performance Insights to identify top SQL queries
C.Increase the instance size to handle the load
D.Modify the DB instance class to a burstable type
E.Enable Enhanced Monitoring to view OS-level metrics
AnswersB, E

Performance Insights shows top queries by CPU.

Why this answer

Options B and E are correct because Performance Insights helps identify top SQL queries causing high CPU, and Enhanced Monitoring provides OS-level metrics (like CPU utilization per database process) to pinpoint the source. Option A is wrong: read replicas offload read traffic but do not diagnose CPU issues. Option C is wrong: increasing instance size is a remediation, not a diagnostic step.

Option D is wrong: changing to a burstable instance class is also a remediation, not diagnostic.

885
Multi-Selectmedium

Which TWO of the following are methods to control access to an Amazon RDS DB instance? (Select TWO.)

Select 2 answers
A.VPC security groups
B.IAM policies
C.Amazon CloudWatch alarms
D.Database passwords
E.Amazon S3 bucket policies
AnswersA, B

Security groups act as a virtual firewall to control inbound traffic to the DB instance.

Why this answer

Options A and B are correct. VPC security groups control network access to the RDS instance at the instance level, acting as a virtual firewall. IAM policies can control who can perform administrative actions on the RDS instance via the AWS API, such as creating, modifying, or deleting the instance.

Option C is incorrect because CloudWatch alarms monitor performance metrics and trigger actions, but do not control access. Option D is incorrect because database passwords are a form of authentication for users connecting to the database, not a method to control access to the RDS instance itself. Option E is incorrect because S3 bucket policies control access to Amazon S3 resources, not RDS.

886
Multi-Selecthard

A company is migrating a self-managed PostgreSQL database to Amazon Aurora PostgreSQL. They want to use the pglogical extension for logical replication to minimize downtime. Which THREE prerequisites must be met before setting up pglogical?

Select 3 answers
A.Add pglogical to shared_preload_libraries and restart the source database
B.Set wal_level to logical in the source PostgreSQL configuration
C.Configure max_wal_senders to at least 10
D.Enable track_commit_timestamp on the source
E.Ensure the source PostgreSQL version is 9.4 or later
AnswersA, B, E

The extension must be loaded.

Why this answer

Pglogical must be loaded into the shared preload libraries on the source PostgreSQL instance so that it is available at server start. Without this, the extension cannot be installed or used. The database must be restarted after modifying shared_preload_libraries for the change to take effect.

Exam trap

The trap here is that candidates often confuse the prerequisites for pglogical with those for native PostgreSQL logical replication, which also requires max_replication_slots and max_wal_senders to be set, but pglogical does not mandate a specific value like 10 for max_wal_senders.

887
Multi-Selectmedium

Which TWO of the following are best practices for designing a DynamoDB table for high traffic? (Choose 2)

Select 2 answers
A.Store large items to reduce the number of items
B.Use normalized tables and perform joins in application
C.Use global secondary indexes for alternate access patterns
D.Always use strongly consistent reads for best performance
E.Use partition keys with high cardinality
AnswersC, E

GSIs allow efficient queries on non-key attributes.

Why this answer

Global secondary indexes (GSIs) allow you to define alternate partition and sort keys to support different query patterns without duplicating data. This is a best practice for high-traffic workloads because it enables efficient access to data using multiple access patterns while maintaining a single base table, reducing the need for expensive scans or application-level joins.

Exam trap

AWS often tests the misconception that strongly consistent reads always provide better performance, when in fact they are more expensive and slower than eventually consistent reads, and should only be used when strict read-after-write consistency is required.

888
MCQmedium

A company uses Amazon RDS for PostgreSQL to run a reporting application. The reporting queries are complex and take several minutes to complete, causing performance impact on the primary instance. The company wants to isolate the reporting workload without data staleness. Which solution should they implement?

A.Implement an Amazon ElastiCache cluster to cache query results.
B.Enable Multi-AZ and use the standby instance for reporting.
C.Take a manual snapshot of the database and restore it for reporting.
D.Create a read replica and direct reporting queries to it.
AnswerD

Read replicas offload read traffic and are updated asynchronously.

Why this answer

Creating a read replica of the Amazon RDS for PostgreSQL primary instance allows you to offload complex reporting queries to the replica without impacting the primary. Read replicas use asynchronous replication (based on PostgreSQL streaming replication), which provides near-real-time data with minimal staleness, satisfying the requirement to isolate the reporting workload without significant data staleness.

Exam trap

The trap here is that candidates often confuse the Multi-AZ standby instance as usable for read traffic, but AWS explicitly prevents read access to the standby to maintain crash recovery consistency, whereas a read replica is purpose-built for offloading read workloads.

How to eliminate wrong answers

Option A is wrong because Amazon ElastiCache caches query results, not the underlying data; it would serve stale results until the cache is invalidated, and complex queries that take minutes to run would not benefit from caching if the underlying data changes frequently. Option B is wrong because the Multi-AZ standby instance is not directly accessible for read or write operations; it is only used for automatic failover and cannot serve reporting traffic. Option C is wrong because taking a manual snapshot and restoring it creates a point-in-time copy that is static; any subsequent changes to the primary database would not be reflected, leading to data staleness, and the restore process is time-consuming.

889
Multi-Selectmedium

Which TWO metrics should be monitored to troubleshoot an Amazon RDS for PostgreSQL database that is experiencing high connection count and connection timeouts?

Select 2 answers
A.DatabaseConnections
B.NetworkTransmitThroughput
C.BurstBalance
D.SwapUsage
E.ReadLatency
AnswersA, C

DatabaseConnections shows the number of client connections.

Why this answer

Options A and C are correct. DatabaseConnections directly shows the number of concurrent connections to the RDS instance, helping monitor connection count. BurstBalance indicates whether the instance has exhausted its I/O burst credits; if it drops, I/O performance degrades and can cause connection timeouts.

Option B (NetworkTransmitThroughput) measures network traffic, not connections. Option D (SwapUsage) tracks memory swapping, which is not a standard RDS metric and does not directly relate to connection timeouts. Option E (ReadLatency) measures I/O read latency, which can affect performance but is not a primary metric for high connection count or connection timeouts.

890
MCQeasy

A company needs to store session data for millions of users with sub-millisecond latency. The data is key-value in nature and can tolerate eventual consistency. Which database service is best suited?

A.Amazon Redshift
B.Amazon Neptune
C.Amazon RDS for MySQL
D.Amazon DynamoDB
AnswerD

Low-latency, scalable key-value store.

Why this answer

Amazon DynamoDB is the best choice because it is a fully managed NoSQL key-value and document database designed for single-digit millisecond latency at any scale, making it ideal for session data storage. It supports eventual consistency, which is acceptable for this use case, and can handle millions of users with sub-millisecond read and write performance using its SSD-backed storage and distributed architecture.

Exam trap

The trap here is that candidates may choose Amazon RDS for MySQL (Option C) because they associate MySQL with web applications and session storage, but they overlook the strict latency and scalability requirements that DynamoDB's distributed NoSQL architecture uniquely satisfies.

How to eliminate wrong answers

Option A is wrong because Amazon Redshift is a petabyte-scale data warehouse optimized for complex analytical queries using SQL, not for low-latency key-value lookups or session storage. Option B is wrong because Amazon Neptune is a graph database designed for highly connected data (e.g., social networks, recommendation engines) and is not optimized for simple key-value access patterns with sub-millisecond latency. Option C is wrong because Amazon RDS for MySQL is a relational database that, while capable of key-value operations, introduces overhead from SQL parsing, indexing, and ACID compliance that prevents consistent sub-millisecond latency at the scale of millions of concurrent users, and it does not natively support eventual consistency as a tunable feature.

891
MCQeasy

A developer is troubleshooting an application that writes to an Amazon ElastiCache for Redis cluster. The application occasionally fails with 'OOM command not allowed when used memory > maxmemory'. What is the most likely cause?

A.The cluster's maxclients limit has been reached.
B.The cluster's maxmemory-policy is set to noeviction.
C.The cluster has too many keyspace notifications enabled.
D.The cluster is in cluster mode and cross-slot commands are used.
AnswerB

Correct. Setting 'maxmemory-policy' to 'noeviction' prevents eviction and causes Redis to reject write commands when memory is full.

Why this answer

The error 'OOM command not allowed when used memory > maxmemory' occurs when Redis has reached its configured memory limit and the eviction policy is set to 'noeviction', which prevents any further writes. Option B is correct because 'noeviction' causes Redis to return an error instead of evicting keys. Option A is incorrect because the 'maxclients' limit produces a different error ('max number of clients reached').

Option C is incorrect because keyspace notifications do not affect memory limits. Option D is incorrect because cross-slot commands relate to cluster mode, not memory errors.

892
MCQmedium

A company uses the IAM policy shown in the exhibit to control access to a DynamoDB table. The table has a partition key user_id and a sort key timestamp. The application uses the AWS SDK to query items. When a user tries to query items with a filter condition, they receive an AccessDeniedException. What is the most likely cause?

A.The aws:userid variable is not being resolved correctly.
B.The query does not specify a partition key that matches the user's LeadingKeys condition.
C.The policy is missing a Condition element with dynamodb:Select.
D.The policy does not allow the Query action.
AnswerB

The condition restricts access to items with a partition key equal to the user's ID; if the query does not use that partition key, access is denied.

Why this answer

The IAM policy uses a `Condition` block with `ForAllValues:StringEquals` on `dynamodb:LeadingKeys` to restrict access to items where the partition key (`user_id`) matches the caller's IAM user ID (`${aws:userid}`). When a query does not specify a partition key that satisfies this condition, the request fails with an `AccessDeniedException`. The error occurs because the query must include a partition key equal to the user's ID to pass the leading keys restriction.

Exam trap

The trap here is that candidates may overlook the `LeadingKeys` condition and assume the error is due to a missing action or a policy syntax issue, rather than recognizing that the query must include a partition key matching the condition value.

How to eliminate wrong answers

Option A is wrong because the `aws:userid` variable is resolved correctly at runtime to the IAM user's unique ID; the issue is not with variable resolution but with the query not including a matching partition key. Option C is wrong because `dynamodb:Select` is not a valid condition key for DynamoDB IAM policies; the policy does not need a `Condition` element for `Select`. Option D is wrong because the policy explicitly allows the `Query` action on the table; the denial is due to the condition on the partition key, not the action itself.

893
MCQhard

A company is migrating a 3 TB MySQL database to Amazon Aurora MySQL. They need to validate data consistency after migration. Which approach should they use?

A.Compare row counts between source and target tables.
B.Use AWS DMS data validation feature.
C.Run random SELECT queries on a subset of rows to compare values.
D.Compute MD5 checksums of the entire dataset in both databases.
AnswerB

DMS data validation compares source and target data using table-level checksums.

Why this answer

AWS DMS data validation feature is the correct approach because it automatically compares source and target records by computing checksums at the table level, ensuring end-to-end consistency without manual intervention. For a 3 TB migration, this built-in feature handles large-scale validation efficiently by validating ongoing replication and full-load data, which is critical for MySQL to Aurora MySQL migrations.

Exam trap

The trap here is that candidates often assume row count comparison (Option A) is sufficient for data consistency, but the exam tests the understanding that only a row-level checksum comparison (like DMS validation) can guarantee data integrity in large-scale migrations.

How to eliminate wrong answers

Option A is wrong because comparing row counts alone does not verify data integrity; row counts can match even if data values differ due to corruption or transformation errors. Option C is wrong because running random SELECT queries on a subset of rows provides only a statistical sample, not a full validation, and risks missing inconsistencies in the 3 TB dataset. Option D is wrong because computing MD5 checksums of the entire dataset in both databases is impractical and resource-intensive for 3 TB, requiring custom scripting and potentially causing performance impact, whereas DMS handles this natively.

894
MCQmedium

A security engineer is investigating an Amazon RDS for MySQL database that was compromised. The engineer finds that the compromise was due to a SQL injection vulnerability in a web application. The web application uses a database user with full administrative privileges. What is the BEST practice to prevent such incidents in the future?

A.Create dedicated database users with minimal privileges required for each application function.
B.Configure the DB parameter group to use the 'sql_mode' option to reject dangerous queries.
C.Enable RDS audit logs to capture all SQL queries.
D.Place the RDS instance in a private subnet with a security group that restricts inbound traffic.
AnswerA

Least privilege ensures that even if compromised, the attacker has limited access.

Why this answer

The best practice is to use dedicated database users with minimal privileges for each application function (Option A). This principle of least privilege limits the damage a SQL injection attack can cause because the compromised user cannot perform unauthorized actions beyond its specific scope. Option B is incorrect because the 'sql_mode' parameter can reject certain dangerous queries but does not address the root cause of excessive privileges and may not prevent all injection attacks.

Option C is incorrect because audit logs only help detect incidents after they occur, not prevent them. Option D is incorrect because while placing the RDS instance in a private subnet and restricting inbound traffic reduces the network attack surface, it does not prevent SQL injection attacks that originate from the application itself; the vulnerability lies in how the application interacts with the database.

895
MCQmedium

A company is migrating a 500 GB SQL Server database to Amazon RDS for SQL Server. They need to minimize downtime and support ongoing changes during migration. Which approach should they take?

A.Use native SQL Server backup and restore to RDS
B.Set up a Direct Connect connection and use log shipping
C.Use SQL Server Integration Services (SSIS) to replicate data
D.Use AWS DMS with full load and change data capture (CDC)
AnswerD

DMS with CDC enables minimal downtime by replicating changes.

Why this answer

AWS DMS with full load and change data capture (CDC) is the correct approach because it allows the initial 500 GB data load to be migrated while continuously replicating ongoing changes from the source SQL Server database to Amazon RDS for SQL Server. This minimizes downtime by enabling a cutover only after the target is fully synchronized, and it supports ongoing changes during migration without requiring the source database to be taken offline.

Exam trap

The trap here is that candidates often confuse log shipping (a native SQL Server HA feature) with AWS DMS CDC, but log shipping is not supported on RDS for SQL Server, making DMS the only viable option for minimizing downtime with ongoing changes.

How to eliminate wrong answers

Option A is wrong because native SQL Server backup and restore to RDS requires the database to be in full recovery mode and taken offline or read-only during the backup and restore process, causing significant downtime and not supporting ongoing changes. Option B is wrong because log shipping is a SQL Server-native feature that is not supported for Amazon RDS for SQL Server as RDS does not provide access to the underlying operating system or SQL Server Agent to configure and manage log shipping jobs. Option C is wrong because SSIS is an ETL tool designed for batch data movement and transformation, not for real-time replication of ongoing changes, and it would require complex custom logic to capture and apply CDC, making it unsuitable for minimizing downtime during a live migration.

896
MCQhard

A development team is using Amazon DynamoDB with on-demand capacity mode for a new application. During initial testing, they notice that write requests are occasionally throttled during traffic bursts. They have enabled DynamoDB Accelerator (DAX) for read-heavy operations. What is the best recommendation to eliminate write throttling?

A.Enable DynamoDB adaptive capacity to automatically adjust partition throughput.
B.Switch to provisioned capacity mode with Auto Scaling.
C.Increase the DAX cluster node size to handle more write traffic.
D.Review the table's partition key design to avoid hot keys.
AnswerD

Hot keys cause throttling even with on-demand.

Why this answer

Write throttling in DynamoDB on-demand mode indicates a hot partition, often due to uneven partition key distribution. Reviewing and improving partition key design can eliminate hot keys and distribute write traffic evenly, preventing throttling. Option A is incorrect: while adaptive capacity helps, it does not fully resolve throttling from skewed access patterns.

Option B is incorrect: provisioned capacity with Auto Scaling adds complexity but does not address hot partitions; on-demand already scales automatically. Option C is incorrect: DAX is a read cache and does not affect write operations; increasing DAX node size only improves read performance.

897
MCQhard

A company has a compliance requirement to encrypt all RDS snapshots at rest using a customer-managed KMS key. The RDS instance is already encrypted with an AWS-managed key. What is the correct procedure to ensure snapshots use the customer-managed key?

A.Create a new RDS instance with the customer-managed KMS key and migrate data using DMS.
B.Take a snapshot of the RDS instance, copy the snapshot specifying the customer-managed KMS key, and restore from the copied snapshot.
C.Change the default KMS key for the AWS account to the customer-managed key.
D.Modify the RDS instance to use the customer-managed KMS key directly.
AnswerB

This is the only way to re-encrypt the database with a new KMS key.

Why this answer

To encrypt RDS snapshots with a customer-managed KMS key, you must first take a snapshot of the existing instance (which uses an AWS-managed key). Then, copy that snapshot and specify the customer-managed KMS key during the copy operation. Finally, restore from the copied snapshot to create a new instance encrypted with the customer-managed key.

Option A is incorrect because you cannot change the encryption key of an existing instance; you must copy the snapshot. Option B is correct and describes the proper procedure. Option C is incorrect because the default KMS key for the account does not affect existing instance snapshots.

Option D is incorrect because you cannot modify an existing RDS instance to use a different encryption key directly; the encryption key is set at creation.

898
MCQhard

A team is troubleshooting an Amazon DynamoDB table that is throttling write requests. The table has on-demand capacity mode enabled. Which of the following is the most likely cause of the throttling?

A.The table has exceeded its provisioned write capacity units.
B.The write traffic exceeds the table's previous peak traffic by more than double.
C.The table is not using adaptive capacity.
D.There is an active AWS Health event affecting the DynamoDB service.
AnswerB

DynamoDB on-demand can throttle if traffic exceeds the previous peak by more than double in a short time.

Why this answer

Even with on-demand capacity, DynamoDB can throttle write requests if the write traffic exceeds the table's previous peak traffic by more than double. On-demand capacity is designed to handle traffic spikes up to double the previous peak within a 30-minute window. If the spike surpasses that threshold, throttling may occur.

Option B correctly identifies this cause. Option A is incorrect because on-demand mode does not use provisioned capacity. Option C is incorrect because adaptive capacity is a feature of provisioned mode, not on-demand.

Option D, an AWS Health event, could cause issues but is not the most likely given normal operation.

899
MCQhard

A company has a critical application that uses Amazon RDS for MySQL with Multi-AZ deployment. During a recent failure, the automatic failover took 2 minutes, causing application timeout. The company needs to reduce failover time to under 30 seconds. Which solution should the database specialist recommend?

A.Migrate the database to Amazon Aurora MySQL.
B.Create a read replica and promote it during failover.
C.Increase the DB instance class to a larger size.
D.Implement Amazon RDS Proxy to handle connection draining.
AnswerA

Aurora has a distributed storage layer that allows faster failover.

Why this answer

Amazon Aurora MySQL is designed to reduce failover time significantly compared to standard RDS MySQL Multi-AZ. Aurora typically completes failover in under 30 seconds by using a shared distributed storage volume across multiple Availability Zones, allowing the primary instance to fail over to a read replica without the need to replay redo logs or perform crash recovery. This meets the requirement of reducing failover time to under 30 seconds.

Exam trap

The trap here is that candidates may think increasing instance size or using RDS Proxy directly reduces failover time, but failover time is dominated by crash recovery and log replay, not compute or connection management.

How to eliminate wrong answers

Option B is wrong because creating a read replica and promoting it during failover is a manual process that can take several minutes, not under 30 seconds, and does not provide automatic failover with the same consistency guarantees as Multi-AZ or Aurora. Option C is wrong because increasing the DB instance class does not reduce failover time; failover time is dominated by crash recovery and redo log replay, which are independent of instance size. Option D is wrong because Amazon RDS Proxy manages connection pooling and draining but does not affect the underlying database failover time; it only helps with application connection handling during a failover event.

900
Matchingmedium

Match each AWS security feature to its purpose for databases.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Virtual firewall controlling inbound/outbound traffic at instance level

Use IAM users/roles to authenticate to RDS/Aurora

Protects data stored on disk using KMS keys

Encrypts data in transit between client and database

Managed service to create and control encryption keys

Why these pairings

AWS KMS handles encryption keys, IAM controls access, Security Groups provide network firewall, and Secrets Manager manages credentials. Common confusions include mixing up KMS with IAM for key management vs. access control.

Page 11

Page 12 of 23

Page 13