Courseiva

AWS Certified Database Specialty DBS-C01 (DBS-C01) — Questions 1051–1125

1663 questions total · 23pages · All types, answers revealed

Take a mock examExam hub
Page 14

Page 15 of 23

Page 16
1051
Multi-Selecteasy

Which TWO AWS services can be used to centrally manage database credentials and automate rotation for Amazon RDS? (Choose two.)

Select 2 answers
A.AWS Secrets Manager
B.AWS Key Management Service (KMS)
C.IAM database authentication
D.AWS Systems Manager Parameter Store
E.AWS CloudHSM
AnswersA, D

AWS Secrets Manager can store and automatically rotate RDS credentials.

Why this answer

Options A and D are correct. AWS Secrets Manager provides native automated rotation for RDS credentials, while AWS Systems Manager Parameter Store (SecureString) can centrally store encrypted credentials and support automated rotation when combined with a custom AWS Lambda function. Both services allow centralized management of database credentials, and with additional configuration, both can automate rotation.

Option B (AWS KMS) is incorrect because KMS manages encryption keys, not secrets. Option C (IAM database authentication) is incorrect because it eliminates the need for stored credentials but does not centrally manage or rotate them. Option E (AWS CloudHSM) is incorrect because it provides hardware security modules for key storage, not secret management.

Exam trap

A common trap is assuming only AWS Secrets Manager can support automated rotation. However, AWS Systems Manager Parameter Store can also achieve rotation through custom automation (e.g., Lambda), making it a valid answer for this question.

Full explanation →
1052
Multi-Selectmedium

A company is migrating a 500 GB SQL Server database to Amazon RDS for SQL Server. The migration must minimize downtime and support ongoing replication. Which TWO AWS services should be used together?

Select 2 answers
A.AWS Lambda
B.AWS Snowball Edge
C.AWS RDS SQL Server native backup and restore
D.AWS Database Migration Service (DMS)
E.AWS Schema Conversion Tool (SCT)
AnswersD, E

DMS supports ongoing replication with change data capture.

Why this answer

AWS Database Migration Service (DMS) is the correct choice because it supports ongoing replication (change data capture) from a source SQL Server database to Amazon RDS for SQL Server with minimal downtime. DMS can perform a full load followed by continuous replication of changes, allowing the source to remain operational during migration.

Exam trap

The DBS-C01 exam often tests the misconception that native backup and restore (Option C) is sufficient for minimal-downtime migrations, but it requires a full outage for the final restore, whereas DMS with ongoing replication allows near-zero downtime.

Full explanation →
1053
Multi-Selectmedium

Which THREE factors should be considered when choosing between Amazon RDS and Amazon DynamoDB for a new application? (Choose THREE.)

Select 3 answers
A.The requirement for encryption at rest.
B.The need for multi-AZ high availability.
C.The query patterns and access methods required by the application.
D.The need for complex transactions and joins.
E.The expected scalability and throughput requirements.
AnswersC, D, E

RDS supports SQL queries, while DynamoDB is NoSQL with key-value and document queries.

Why this answer

The choice between Amazon RDS (relational) and DynamoDB (NoSQL) hinges on the application's data access patterns. RDS supports complex SQL queries with joins, aggregations, and secondary indexes, while DynamoDB is optimized for key-value and document queries with predictable, low-latency access patterns. If the application requires flexible querying with ad-hoc filters, RDS is appropriate; if it needs high-throughput, single-key lookups or simple query patterns, DynamoDB is better suited.

Exam trap

The trap here is that candidates assume encryption at rest or multi-AZ HA are exclusive to one service, but both RDS and DynamoDB fully support these features, making them irrelevant for choosing between the two.

Full explanation →
1054
MCQmedium

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database has a large table with a BLOB column storing PDF files. Which migration approach minimizes downtime?

A.Use Oracle Data Pump to export the table and import into RDS.
B.Use Oracle RMAN to back up the database and restore to RDS.
C.Export the table without the BLOB column, then import the BLOBs separately.
D.Use AWS Database Migration Service (DMS) with ongoing replication.
AnswerD

DMS can perform a full load and then continuously replicate changes to minimize downtime.

Why this answer

AWS DMS with ongoing replication (change data capture) allows you to perform an initial full load of the database while continuously capturing and applying changes from the source Oracle database to the target RDS for Oracle instance. This minimizes downtime because you can cut over to the new database after the initial load and replication lag is near zero, rather than taking the source offline for the entire migration.

Exam trap

The trap here is that candidates often assume traditional Oracle tools like Data Pump or RMAN are the best for minimizing downtime, but they fail to recognize that AWS DMS with ongoing replication is specifically designed for near-zero downtime migrations by continuously synchronizing changes.

How to eliminate wrong answers

Option A is wrong because Oracle Data Pump is a logical export/import tool that requires the source database to be in a consistent state during export, and it does not support ongoing replication, so the database must be taken offline for the entire duration of the export and import. Option B is wrong because RMAN backups are physical backups that cannot be directly restored to Amazon RDS for Oracle, as RDS does not provide access to the underlying file system or allow RMAN restore operations. Option C is wrong because exporting the table without the BLOB column and then importing the BLOBs separately introduces complexity and still requires a period of downtime to ensure consistency between the table and the BLOB data, and it does not provide ongoing replication to minimize cutover time.

Full explanation →
1055
MCQhard

A database specialist is troubleshooting a degraded Amazon Aurora MySQL database cluster. The primary instance is showing elevated read latency and the replica lag is increasing. The DB cluster has one writer and one reader instance. The writer instance is using 90% of its allocated memory, and the reader instance is using 70%. Which action is most likely to reduce read latency and replica lag?

A.Increase the allocated storage for the cluster to improve I/O throughput.
B.Increase the writer instance size to provide more memory for write operations.
C.Increase the reader instance size to provide more buffer pool memory.
D.Add a second reader instance to distribute the read load.
AnswerC

More memory on the reader allows a larger buffer pool, reducing read latency and helping catch up replication.

Why this answer

Increasing the reader instance size provides more memory for the buffer pool, which improves read performance and can reduce replica lag. The reader is using 70% memory, so adding more buffer pool memory allows it to cache more data and handle read requests faster. Option A is incorrect because increasing storage improves I/O throughput but does not directly address memory constraints or replica lag.

Option B is incorrect because the writer instance is already under memory pressure, but the issue is read latency on the reader, not write performance. Option D is incorrect because adding a second reader distributes the read load but does not resolve the memory bottleneck on the existing reader; a larger instance is more effective in this scenario.

Full explanation →
1056
MCQeasy

A company needs to store JSON documents that are up to 10 KB in size. The documents are accessed by a primary key, and the company requires single-digit millisecond latency. Which database service should be used?

A.Amazon Neptune
B.Amazon DynamoDB
C.Amazon S3
D.Amazon RDS for MySQL with JSON data type
AnswerB

Provides single-digit ms latency for key-value access.

Why this answer

Amazon DynamoDB is the correct choice because it is a fully managed NoSQL key-value and document database that delivers single-digit millisecond latency at any scale. It natively supports JSON documents up to 400 KB in size (well above the 10 KB requirement) and provides primary key access with consistent low-latency performance, making it ideal for this workload.

Exam trap

The trap here is that candidates may choose Amazon RDS for MySQL with JSON data type because they assume a relational database can handle JSON efficiently, but they overlook the inherent latency overhead of relational engines and the fact that DynamoDB is purpose-built for single-digit millisecond key-value access at any scale.

How to eliminate wrong answers

Option A is wrong because Amazon Neptune is a graph database designed for highly connected data and complex graph queries (e.g., social networks, fraud detection), not for simple key-value access to JSON documents, and it does not guarantee single-digit millisecond latency for primary key lookups. Option C is wrong because Amazon S3 is an object storage service with higher latency (typically tens to hundreds of milliseconds) and does not support single-digit millisecond latency for primary key-based access; it is optimized for throughput and durability, not low-latency queries. Option D is wrong because Amazon RDS for MySQL with the JSON data type introduces overhead from relational indexing and query parsing, and even with optimized indexes, it cannot consistently achieve single-digit millisecond latency for primary key lookups at scale, especially under high concurrency.

Full explanation →
1057
MCQhard

A company is using Amazon DynamoDB with auto scaling. The application is experiencing increased read latency. The monitoring shows that the ReadThrottleEvents metric is high. Which action should the company take to reduce read throttling?

A.Implement DynamoDB Accelerator (DAX) for caching.
B.Switch the table to on-demand capacity mode.
C.Enable DynamoDB Streams on the table.
D.Increase the write capacity units.
AnswerA

DAX caches reads, reducing pressure on the table.

Why this answer

DynamoDB Accelerator (DAX) provides an in-memory cache that reduces read latency and alleviates read throttling by serving frequently accessed items from cache, reducing the load on the underlying table. Option B is incorrect because switching to on-demand capacity mode may help with unpredictable traffic patterns but does not specifically address read throttling caused by high read demand; it can also increase costs. Option C is incorrect because enabling DynamoDB Streams does not directly reduce read throttling and may add overhead.

Option D is incorrect because increasing write capacity units does not affect read throttling since read and write capacities are separate.

Full explanation →
1058
MCQmedium

A company needs to audit access to an Amazon DynamoDB table. The audit should capture which IAM user or role performed each action. Which AWS service should be used?

A.VPC Flow Logs
B.AWS CloudTrail
C.Amazon GuardDuty
D.AWS Config
AnswerB

CloudTrail logs all API calls and identifies the principal making the call.

Why this answer

AWS CloudTrail is the correct service because it records API calls made to DynamoDB and captures the IAM user or role that performed each action. VPC Flow Logs (Option A) capture network traffic metadata, not API calls. Amazon GuardDuty (Option C) is a threat detection service that monitors for malicious activity, not API auditing.

AWS Config (Option D) tracks resource configuration changes, not API call details.

Full explanation →
1059
MCQhard

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all connections to the database use Oracle Native Network Encryption (NNE). How should this be configured?

A.Enable IAM database authentication.
B.Modify the sqlnet.ora file on the RDS instance to require encryption.
C.Create a custom DB parameter group with the encryption parameters set to REQUIRED.
D.Enable encryption at rest using Oracle TDE.
AnswerC

Correct. A custom DB parameter group allows setting the SQLNET.ENCRYPTION_SERVER and SQLNET.ENCRYPTION_TYPES parameters to enforce NNE for all connections.

Why this answer

RDS for Oracle supports Oracle Native Network Encryption (NNE) through custom DB parameter groups. You must set the SQLNET.ENCRYPTION_SERVER parameter to REQUIRED and optionally specify encryption types. Option A (IAM database authentication) does not encrypt the network connection.

Option B is incorrect because RDS does not allow direct editing of sqlnet.ora files; parameter groups are the correct method. Option D (encryption at rest) protects stored data, not data in transit.

Full explanation →
1060
MCQmedium

A financial services company uses Amazon DynamoDB to store transaction records. Each transaction has a partition key of customer_id and a sort key of transaction_timestamp. The application queries transactions for a specific customer within a date range. Recently, the query latency increased significantly for customers with a large number of transactions. The company needs to improve query performance without changing the application code. The table is provisioned with 5000 RCUs and 2000 WCUs. Which design change should be made to optimize for this workload?

A.Create a global secondary index with customer_id as partition key and transaction_timestamp as sort key.
B.Enable DynamoDB Accelerator (DAX) on the table.
C.Increase the provisioned RCUs to 10000.
D.Change the sort key to a composite key including a tenant identifier.
AnswerA

A GSI with the same key structure allows efficient querying without impacting the base table.

Why this answer

Creating a global secondary index (GSI) with customer_id as the partition key and transaction_timestamp as the sort key allows efficient querying of transactions for a specific customer within a date range. The existing table's sort key is transaction_timestamp, but the GSI provides a separate index optimized for this access pattern, avoiding full table scans on large customer partitions. This improves query performance without requiring application code changes, as the application can query the GSI directly.

Exam trap

The trap here is that candidates often confuse caching (DAX) with query optimization, or assume that increasing RCUs alone will solve latency issues, when the real bottleneck is the inefficient scan of large partitions due to the lack of an appropriate index.

How to eliminate wrong answers

Option B is wrong because DynamoDB Accelerator (DAX) is an in-memory cache that reduces read latency for frequently accessed items, but it does not address the underlying issue of inefficient querying on large partitions; it would only cache results after the first slow query and does not optimize the query pattern itself. Option C is wrong because increasing RCUs to 10000 only adds more read capacity, which does not solve the problem of scanning through many items in a large partition; the query still has to read all items matching the partition key and filter by sort key, leading to high latency regardless of RCU allocation. Option D is wrong because changing the sort key to a composite key including a tenant identifier would require application code changes and does not directly optimize the existing query pattern; it also introduces unnecessary complexity and potential data modeling issues.

Full explanation →
1061
MCQhard

Refer to the exhibit. A security engineer has applied this key policy to a customer managed KMS key used to encrypt a Secrets Manager secret containing database credentials. An application running on an Amazon EC2 instance in the same account and region is unable to decrypt the secret. What is the MOST likely cause?

A.The condition kms:ViaService restricts the decryption to requests made via Secrets Manager, but the application is calling KMS directly.
B.The KMS key ARN in the resource field is incorrect.
C.The policy is missing an encryption context that matches the secret's encryption context.
D.The policy only allows Decrypt, but the application needs Encrypt permission.
AnswerA

The `kms:ViaService` condition restricts the `Decrypt` permission to only requests that originate from Secrets Manager. Since the application calls KMS directly, the condition is not satisfied, causing denial.

Why this answer

The condition `kms:ViaService` in the key policy restricts the `Decrypt` permission to requests that originate specifically from the AWS Secrets Manager service. When the application on the EC2 instance calls KMS directly (e.g., via the `Decrypt` API) to decrypt the secret, the request does not come through Secrets Manager, so the condition is not satisfied and the request is denied. This is the most likely cause of the decryption failure.

Exam trap

The trap here is that candidates often overlook the `kms:ViaService` condition and assume the policy is correct, focusing instead on encryption contexts or permissions, when the real issue is that the condition restricts the source of the request to a specific AWS service.

How to eliminate wrong answers

Option B is wrong because the KMS key ARN in the `Resource` field is used to identify the key itself, and if it were incorrect, the policy would not apply to the key at all, but the issue is a conditional denial, not a misidentification. Option C is wrong because encryption contexts are used in cryptographic operations (e.g., `kms:EncryptionContext:context_name`) and are not required in the key policy unless explicitly enforced via a condition; the policy shown does not include an encryption context condition, so missing one would not cause a denial. Option D is wrong because the application is trying to decrypt the secret, not encrypt it; the `Decrypt` permission is exactly what is needed, and the error is due to the `kms:ViaService` condition, not a missing `Encrypt` permission.

Full explanation →
1062
MCQmedium

A company is designing a database for a real-time leaderboard in a mobile game. The leaderboard updates thousands of times per second and must return the top 100 scores with minimal latency. Which AWS database service is most suitable for this workload?

A.Amazon Neptune
B.Amazon ElastiCache for Redis
C.Amazon DynamoDB
D.Amazon Aurora
AnswerB

Redis sorted sets provide efficient leaderboard operations.

Why this answer

Amazon ElastiCache for Redis is the most suitable choice because Redis provides an in-memory data structure server with a Sorted Set data type (ZADD and ZRANGE commands) that natively supports real-time leaderboard operations. It can handle thousands of writes per second with sub-millisecond latency and efficiently retrieve the top 100 scores using ZREVRANGE with a time complexity of O(log(N)+M), where M is the number of returned elements.

Exam trap

The trap here is that candidates often choose DynamoDB because of its fast key-value lookups, overlooking that leaderboard ranking requires sorted range queries across all items, which DynamoDB cannot perform efficiently without expensive full table scans or custom sharding logic.

How to eliminate wrong answers

Option A is wrong because Amazon Neptune is a graph database designed for highly connected data (e.g., social networks, recommendation engines) and lacks the sorted set data structure needed for efficient real-time leaderboard ranking. Option C is wrong because Amazon DynamoDB, while fast for key-value and document workloads, does not natively support sorted set operations; implementing a leaderboard would require scanning and sorting all items or using a global secondary index with limited ordering, leading to higher latency and cost at scale. Option D is wrong because Amazon Aurora is a relational database optimized for OLTP workloads with ACID transactions, but its disk-based storage and SQL query overhead cannot match the sub-millisecond latency and throughput required for thousands of updates per second in a real-time leaderboard scenario.

Full explanation →
1063
MCQeasy

A developer reports that an Amazon RDS for PostgreSQL database instance's storage is full and the instance is in 'storage-full' state. The team wants to resolve this without downtime. Which action should be taken?

A.Create a read replica and promote it
B.Modify the DB instance to increase allocated storage
C.Delete old automated snapshots
D.Reboot the DB instance
AnswerB

RDS supports dynamic storage scaling without downtime for most engines.

Why this answer

Modifying the allocated storage for an RDS instance is a dynamic operation that can increase storage without downtime. Option A is wrong because creating a read replica requires the source to have available storage and does not resolve the storage issue on the primary instance. Option C is wrong because deleting old automated snapshots does not free up storage on the instance; snapshots are stored separately.

Option D is wrong because rebooting does not free storage; it only restarts the instance.

Full explanation →
1064
MCQmedium

A company is deploying a new web application that requires a highly available MariaDB database. The application is read-heavy and needs to scale read traffic. Which deployment approach meets these requirements?

A.Deploy Amazon Aurora MySQL with a read replica.
B.Deploy a Multi-AZ RDS for MariaDB with one or more read replicas.
C.Deploy a Multi-AZ RDS for MariaDB instance.
D.Deploy a single-AZ RDS for MariaDB with a read replica.
AnswerB

Combines HA and read scaling.

Why this answer

Deploying a Multi-AZ RDS for MariaDB provides high availability through automatic failover to a standby in a different Availability Zone, while adding one or more read replicas offloads read traffic from the primary instance, meeting the read-heavy scaling requirement. This combination ensures both fault tolerance and read scalability for a MariaDB database.

Exam trap

The trap here is that candidates often confuse Amazon Aurora MySQL with MariaDB, or assume that Multi-AZ alone provides read scaling, when in fact read replicas are required for read-heavy workloads.

How to eliminate wrong answers

Option A is wrong because Amazon Aurora MySQL is not MariaDB; it uses a MySQL-compatible engine but is not the same as MariaDB, and the question explicitly requires a MariaDB database. Option C is wrong because a Multi-AZ RDS for MariaDB instance alone provides high availability but does not scale read traffic; read replicas are needed to handle read-heavy workloads. Option D is wrong because a single-AZ RDS for MariaDB with a read replica can scale reads but lacks high availability, as a failure in the primary instance's Availability Zone would cause downtime until manual recovery or a read replica promotion.

Full explanation →
1065
MCQeasy

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all connections to the database use SSL/TLS encryption. Which step is necessary to enforce SSL connections?

A.Configure the security group to only allow traffic on port 443.
B.Modify the DB subnet group to use a private subnet.
C.Add the SSL option to the option group.
D.Set the 'rds.force_ssl' parameter to 1 in the DB parameter group.
AnswerD

This parameter forces SSL connections to the Oracle database.

Why this answer

To enforce SSL/TLS connections to an Amazon RDS for Oracle instance, you must set the 'rds.force_ssl' parameter to 1 in the DB parameter group. This requires all connections to use SSL. Option A is incorrect because security groups control network-level access, not encryption.

Option B is incorrect because the DB subnet group defines the subnets for the instance, not encryption. Option C is incorrect because the option group is used to enable additional features like Oracle Enterprise Manager or timezone, not SSL enforcement. Therefore, Option D is the correct step.

Full explanation →
1066
Multi-Selectmedium

A database administrator notices that an Amazon RDS for MySQL DB instance is experiencing high CPU utilization and increased latency during peak hours. The administrator wants to identify the queries causing the issue. Which TWO actions should be taken to diagnose the problem? (Select TWO.)

Select 2 answers
A.Enable Performance Insights on the DB instance.
B.Enable Amazon DevOps Guru for RDS.
C.Enable the slow query log and set a threshold for query duration.
D.Use RDS Proxy to manage connections.
E.Enable RDS Enhanced Monitoring.
AnswersA, C

Performance Insights provides detailed performance metrics and top SQL queries.

Why this answer

Enabling Performance Insights provides database performance metrics including wait events and SQL query details, allowing identification of queries causing high CPU and latency. Option C: Enabling the slow query log captures queries that exceed a specified duration threshold, helping to pinpoint slow-running queries. Option B (Amazon DevOps Guru for RDS) is an automated service for anomaly detection and performance insights, not a direct method to identify specific queries.

Option D (RDS Proxy) manages connection pooling and improves scalability, but does not identify problematic queries. Option E (RDS Enhanced Monitoring) provides OS-level metrics, not query-level details.

Full explanation →
1067
MCQhard

A financial services company runs a critical application on Amazon RDS for MySQL. The database stores transaction data that must be retained for 7 years for regulatory compliance. The current retention policy stores all data in the same table, causing performance degradation on the main transactional table. The company needs to archive data older than 1 year while keeping it queryable. Which design should they implement?

A.Migrate to Amazon Redshift and use workload management to prioritize transactions.
B.Use Amazon ElastiCache for Redis to cache recent data and move old data to S3.
C.Use Amazon RDS for MySQL with a read replica for reporting, and set up a Lambda function to export partitions older than 1 year to Amazon S3 in Parquet format, queryable via Amazon Athena.
D.Migrate to Amazon DynamoDB with TTL to automatically expire old data.
AnswerC

Preserves relational structure for recent data, archives to S3 for cost-effective storage, and allows querying via Athena.

Why this answer

It uses RDS for MySQL read replicas to offload reporting traffic, while a Lambda function archives partitions older than 1 year to Amazon S3 in Parquet format. This keeps the main transactional table lean, improves performance, and retains data for 7 years in a cost-effective, queryable format via Amazon Athena, meeting both compliance and queryability requirements.

Exam trap

The trap here is that candidates may think DynamoDB TTL is suitable for archiving, but TTL only deletes data, not retains it, and they may overlook the need for a queryable archive solution like Athena on S3.

How to eliminate wrong answers

Option A is wrong because migrating to Amazon Redshift is designed for analytical workloads, not for transactional OLTP operations, and would introduce unnecessary complexity and latency for the primary application. Option B is wrong because ElastiCache for Redis is an in-memory cache, not a persistent storage solution; moving old data to S3 without a query engine like Athena or Glue makes it non-queryable for compliance needs. Option D is wrong because DynamoDB TTL automatically deletes expired data, which violates the 7-year retention requirement since data older than 1 year must be retained, not deleted.

Full explanation →
1068
Multi-Selecthard

A company uses Amazon DynamoDB for a high-traffic gaming leaderboard. The table has a partition key of 'game_id' and a sort key of 'score'. During a tournament, the application experiences throttling on a single partition. The application uses strongly consistent reads. Which TWO actions should be taken to resolve the throttling and maintain performance?

Select 2 answers
A.Redesign the partition key to include a random suffix to distribute writes across partitions.
B.Enable DynamoDB Accelerator (DAX) to cache the most frequently read items.
C.Increase the provisioned read capacity units (RCU) for the table.
D.Use eventually consistent reads for the leaderboard queries where possible.
E.Create a global secondary index (GSI) with a different partition key.
AnswersA, D

A write-sharding pattern ensures even distribution of write traffic and avoids hot partitions.

Why this answer

The correct actions are A and D. Option A: Redesigning the partition key to include a random suffix (e.g., appending a shard number) distributes write traffic across multiple partitions, preventing a single hot partition from throttling. Option D: For a leaderboard, eventually consistent reads are sufficient for non-critical queries, reducing read capacity consumption and alleviating read-side throttling.

Option B (DAX) only caches reads and does not help with write throttling. Option C (increasing RCU) addresses read capacity, not write distribution to fix the hot partition. Option E (GSI) creates a separate index but does not redistribute writes on the base table's primary partition.

Full explanation →
1069
Multi-Selectmedium

Which TWO of the following are valid ways to encrypt data at rest in Amazon DynamoDB? (Select TWO.)

Select 2 answers
A.Use AWS owned CMK for server-side encryption.
B.Enable Transparent Data Encryption (TDE).
C.Enable EBS encryption on the underlying storage.
D.Implement client-side encryption before sending data to DynamoDB.
E.Use a customer managed CMK from AWS KMS.
AnswersA, E

DynamoDB encrypts at rest by default using AWS owned keys.

Why this answer

Options A and E are correct. DynamoDB offers server-side encryption at rest using AWS owned CMK (A) or customer managed CMK from AWS KMS (E). Option B is incorrect because Transparent Data Encryption (TDE) is not supported by DynamoDB—it is used for relational databases.

Option C is incorrect because DynamoDB is serverless and does not provision EBS volumes; its encryption is handled internally. Option D is incorrect because client-side encryption is applied before data is sent to DynamoDB, not encryption at rest of the DynamoDB service itself.

Full explanation →
1070
MCQeasy

A developer is connecting to an RDS for MySQL instance. What is the endpoint address that should be used in the database connection string?

A.mydb
B.mydb.123456789012.us-east-1.rds.amazonaws.com
C.3306
D.Z1R2S3V4X5Y6Z7
AnswerB

This is the DNS endpoint address.

Why this answer

When connecting to an Amazon RDS for MySQL instance, the endpoint is a fully qualified domain name (FQDN) that resolves to the underlying database host. Option B provides the correct FQDN format: a DB instance identifier followed by a randomly generated alphanumeric string, the AWS region, and the rds.amazonaws.com domain. This endpoint is found in the RDS console under the instance's 'Connectivity & security' tab and is required by MySQL clients to establish a TCP connection.

Exam trap

The trap here is that candidates confuse the DB instance identifier (a simple name like 'mydb') with the full endpoint, or they mistake the port number (3306) for the address, because MySQL connection strings often list the host and port together, leading to the misconception that the port is part of the endpoint.

How to eliminate wrong answers

Option A is wrong because 'mydb' is only the DB instance identifier, not the full endpoint; a MySQL client cannot resolve a bare name to an RDS host without the full FQDN. Option C is wrong because 3306 is the default MySQL port number, not an endpoint address; the port is specified separately in the connection string (e.g., after a colon). Option D is wrong because 'Z1R2S3V4X5Y6Z7' resembles a DNS resolver ID or a random string, not the RDS endpoint format which always includes the region and 'rds.amazonaws.com'.

Full explanation →
1071
MCQmedium

A company is migrating a self-hosted MongoDB database to Amazon DocumentDB. They need to ensure that indexes are created after the data load to improve migration performance. Which migration strategy should they use?

A.Use AWS Schema Conversion Tool (SCT) to convert the schema and then load data with DMS.
B.Use AWS DMS with 'create indexes before data load' option enabled.
C.Use AWS Database Migration Service (DMS) with the 'lob' mode set to 'Don't include LOB columns' and create indexes after the full load.
D.Use mongodump and mongorestore with the --writeConcern option set to 0.
AnswerC

Deferring index creation speeds up data migration; DMS can handle data transfer.

Why this answer

AWS DMS can be configured to skip LOB columns during the full load, which significantly improves migration performance by reducing data transfer overhead. After the full load completes, indexes can be created on the target DocumentDB database, avoiding the performance penalty of maintaining indexes during the bulk data ingestion. This approach aligns with the requirement to defer index creation until after the data load.

Exam trap

The trap here is that candidates may assume DMS has a built-in option to defer index creation (like some relational database migration tools), but DMS for DocumentDB requires manually configuring LOB handling and creating indexes post-load, and they might confuse the 'create indexes before data load' misconception with a real DMS feature.

How to eliminate wrong answers

Option A is wrong because AWS Schema Conversion Tool (SCT) is used for schema conversion of relational databases, not for MongoDB to DocumentDB migrations, and it does not control index creation timing during data load. Option B is wrong because DMS does not have a 'create indexes before data load' option; in fact, creating indexes before loading data would degrade migration performance due to index maintenance overhead during the load. Option D is wrong because mongodump and mongorestore are native MongoDB tools, not AWS DMS, and the --writeConcern option set to 0 reduces durability but does not address index creation timing for migration performance.

Full explanation →
1072
MCQhard

A company uses Amazon DynamoDB with auto scaling enabled. The application experiences increased latency during peak hours. The DynamoDB table has a read capacity of 10,000 RCU and write capacity of 5,000 WCU. The auto scaling target utilization is 70%. During peak hours, the consumed read capacity reaches 8,000 RCU, but auto scaling does not increase capacity. What is the most likely reason?

A.The consumed capacity is still below the provisioned capacity, so no throttling occurs, and auto scaling does not trigger.
B.The auto scaling configuration has a maximum capacity that prevents scaling beyond a certain limit.
C.Auto scaling for DynamoDB does not support increasing read capacity; it only decreases capacity.
D.Auto scaling only scales out when the consumed capacity exceeds the provisioned capacity.
AnswerB

If the maximum capacity is set to 10,000 RCU, auto scaling cannot increase further.

Why this answer

Auto scaling in DynamoDB adjusts capacity based on consumed capacity relative to provisioned capacity. With a target utilization of 70%, the expected consumed capacity for 10,000 RCU is 7,000 RCU. However, the actual consumed capacity is 8,000 RCU, which is 80% utilization, above the target.

Auto scaling should normally increase capacity to bring utilization back to 70%. But if the auto scaling configuration has a maximum read capacity limit (e.g., 8,000 RCU), scaling cannot exceed that limit, explaining why capacity does not increase. Option A is incorrect because auto scaling can trigger even before throttling occurs.

Option C is incorrect because auto scaling can increase both read and write capacity. Option D is incorrect because auto scaling scales based on sustained consumption above target utilization, not necessarily exceeding provisioned capacity.

Full explanation →
1073
MCQmedium

A company is migrating a PostgreSQL database to Amazon Aurora PostgreSQL. They have set up AWS DMS with change data capture (CDC). However, after the initial load, the CDC replication is experiencing high latency. What is the MOST likely cause?

A.The target Aurora instance has insufficient storage.
B.The DMS instance is using an older engine version.
C.The source database has large transactions that are not committed quickly.
D.The network bandwidth is too low.
AnswerC

Large uncommitted transactions delay CDC.

Why this answer

Large uncommitted transactions on the source database cause DMS CDC to buffer changes until the transaction commits, leading to high latency. DMS must wait for the commit record before applying changes to the target Aurora instance, and during this time, CDC replication stalls, accumulating a backlog of changes.

Exam trap

The trap here is that candidates often assume network or infrastructure issues (like bandwidth or storage) are the primary cause of CDC latency, overlooking the fundamental constraint that DMS must wait for transaction commits before applying changes.

How to eliminate wrong answers

Option A is wrong because insufficient storage on the target Aurora instance would cause write failures or replication errors, not high latency in CDC replication. Option B is wrong because while older DMS engine versions may lack performance improvements, the most likely cause of CDC latency is source-side transaction behavior, not the DMS version. Option D is wrong because low network bandwidth would cause throughput issues or timeouts, but DMS CDC latency is primarily driven by transaction commit patterns on the source, not network speed.

Full explanation →
1074
MCQhard

A company is migrating a PostgreSQL database to Amazon Aurora PostgreSQL. The current database has complex queries that join multiple tables and performs well. After migration, the same queries are slower on Aurora. What is the most likely cause?

A.The DB instance class does not have enough memory for the buffer cache.
B.Aurora PostgreSQL does not support complex joins; the queries must be rewritten.
C.Aurora PostgreSQL does not support indexes on joined columns.
D.The default DB parameter group is optimized for write-heavy workloads, not read-heavy.
AnswerA

Aurora's buffer cache is in memory; insufficient memory leads to more disk reads.

Why this answer

After migrating to Aurora PostgreSQL, the same complex queries are slower, which often indicates that the buffer cache is too small to hold the working set of data. Aurora uses a distributed storage system where the buffer cache is managed by the DB instance's memory; if the instance class lacks sufficient memory, frequently accessed data pages must be read from storage more often, increasing I/O latency. This is a common performance bottleneck when migrating from on-premises PostgreSQL, where the buffer cache might have been larger or the working set fit entirely in memory.

Exam trap

The trap here is that candidates may assume Aurora PostgreSQL has inherent limitations with joins or indexes (options B and C), when in fact the most common post-migration performance issue is insufficient memory for the buffer cache, not a missing feature.

How to eliminate wrong answers

Option B is wrong because Aurora PostgreSQL fully supports complex joins, including hash joins, merge joins, and nested loop joins, just like standard PostgreSQL; no query rewriting is required. Option C is wrong because Aurora PostgreSQL supports indexes on joined columns, including B-tree, GiST, GIN, and BRIN indexes, and indexes are critical for join performance. Option D is wrong because the default DB parameter group in Aurora PostgreSQL is not optimized specifically for write-heavy workloads; it provides balanced settings, and performance issues with complex queries are more likely due to memory or configuration of the buffer cache, not a default parameter group bias.

Full explanation →
1075
MCQeasy

A company needs to encrypt an existing unencrypted Amazon RDS for Oracle DB instance. Which set of steps should be followed?

A.Enable encryption using the AWS Management Console by selecting the instance and choosing 'Enable Encryption'.
B.Modify the DB instance and set the KMS key ID to enable encryption.
C.Copy the snapshot to an encrypted snapshot and then restore.
D.Take a snapshot of the instance, copy the snapshot with encryption enabled, and restore from the encrypted snapshot.
AnswerD

This is the standard method.

Why this answer

The correct procedure. To encrypt an existing unencrypted RDS DB instance, you must create a manual snapshot of the instance, then copy that snapshot with encryption enabled (specifying a KMS key), and finally restore a new DB instance from the encrypted snapshot. Option A is wrong because the console does not provide a direct 'Enable Encryption' action on an existing instance.

Option B is wrong because you cannot modify an existing unencrypted instance to enable encryption directly; there is no such modification parameter. Option C is wrong because while it mentions copying the snapshot to an encrypted one, it does not clarify that encryption is applied during the copy operation, and the correct process explicitly requires taking the initial snapshot, copying with encryption, and then restoring; Option D includes all three steps.

Full explanation →
1076
MCQmedium

A company is using Amazon Redshift for data warehousing. The users report that queries are slow, and the CloudWatch metric 'CPUUtilization' shows high usage. The cluster has 4 dc2.large nodes. The administrator runs the following query: SELECT * FROM stl_query WHERE starttime > '2023-12-01' ORDER BY duration DESC LIMIT 10; This shows that the longest query runs for over 5 minutes. Which of the following is the MOST effective way to improve query performance?

A.Increase the size of the cluster volume by adding more storage
B.Add more nodes to the cluster (scale out)
C.Run the VACUUM command to reclaim space and improve query performance
D.Modify the workload management (WLM) queue to increase concurrency
AnswerB

Adding nodes increases compute capacity and parallelism.

Why this answer

Adding more nodes to the cluster (scale out) distributes the workload across additional compute resources, increasing parallelism and CPU capacity. This directly addresses the high CPU utilization and reduces query execution time. Option A is incorrect because the issue is CPU, not storage; increasing storage volume does not improve CPU performance.

Option C is incorrect: VACUUM reclaims disk space and sorts data but does not directly improve query performance when the bottleneck is CPU. Option D is incorrect: increasing WLM concurrency allows more queries to run simultaneously but may actually increase contention and not improve the performance of individual long-running queries.

Full explanation →
1077
Multi-Selectmedium

A company runs an Amazon RDS for MySQL DB instance with Multi-AZ. The application team reports that a recent schema change caused a significant increase in replication lag. The instance has a read replica in a different AWS Region. Which THREE actions should be taken to reduce replication lag?

Select 3 answers
A.Identify and optimize any long-running transactions or DDL statements that may be blocking replication.
B.Increase the DB instance class for both the primary and read replica to improve performance.
C.Monitor the ReplicaLag metric in Amazon CloudWatch to understand the trend and set alarms.
D.Set the transaction isolation level to READ COMMITTED to reduce locking.
E.Disable binary logging on the primary instance to reduce I/O overhead.
AnswersA, C, D

Long-running transactions can cause replication lag by holding locks or delaying binary log events.

Why this answer

Options A, C, and D are correct actions to reduce replication lag. A: Optimizing long-running transactions or DDL statements helps prevent blocking on the primary that can cause lag. C: Monitoring the ReplicaLag metric in CloudWatch allows you to identify trends and set alarms for proactive management.

D: Setting the transaction isolation level to READ COMMITTED reduces locking on the primary, which can decrease replication lag. Option B is not the best action: increasing the instance class may improve performance but does not directly address the root cause of lag from schema changes. Option E is incorrect because disabling binary logging would stop replication entirely, not reduce lag.

Full explanation →
1078
Multi-Selectmedium

A company runs an Amazon RDS for SQL Server database. The database size is 500 GB. The company needs to create a test environment with a copy of the production database that refreshes daily. Which THREE steps should be taken to automate this? (Choose THREE.)

Select 3 answers
A.Use AWS Backup or AWS Lambda to take a manual snapshot of the production DB instance daily.
B.Update the test application's connection string to point to the new test instance.
C.Create a read replica of the production instance and promote it to the test environment.
D.Restore the snapshot to a new DB instance in the test environment.
E.Enable automated backups on the test instance after restoration.
AnswersA, B, D

Creates a consistent snapshot.

Why this answer

Creates a manual snapshot of the production DB instance daily using AWS Backup or Lambda. Option D restores that snapshot to a new DB instance in the test environment. Option B updates the test application's connection string to point to the new test instance.

Option C is incorrect because a read replica is not a full copy and promoting it would disrupt replication, not provide a daily refreshed copy. Option E is unnecessary because the restored instance can have automated backups enabled, but it is not a required step for the daily refresh process.

Full explanation →
1079
Multi-Selecteasy

A company is deploying a new Amazon RDS for MySQL database in a VPC. The database must be accessible only from an application server running in the same VPC. The security team also wants to ensure that the database is not accessible from the internet. Which TWO configurations are required? (Choose TWO.)

Select 2 answers
A.Place the DB instance in a public subnet.
B.Modify the DB parameter group to restrict network access.
C.Configure the security group to allow inbound traffic only from the application server's security group.
D.Set the DB instance to be not publicly accessible.
E.Configure a network ACL to deny inbound traffic from 0.0.0.0/0.
AnswersC, D

This restricts access to the specific application server.

Why this answer

To meet the requirements, two configurations are needed. First, the DB instance must be set to not publicly accessible (Option D) to ensure it cannot be reached from the internet. Second, the security group associated with the DB instance must allow inbound traffic only from the application server's security group (Option C), which restricts access to resources within the VPC.

Option A is incorrect because placing the DB instance in a public subnet would expose it to the internet. Option B is incorrect because the DB parameter group controls database engine settings, not network access. Option E is incorrect because network ACLs are stateless and a rule denying all inbound traffic would block legitimate traffic as well; security groups are the appropriate mechanism for this scenario.

Full explanation →
1080
MCQeasy

A company is using Amazon RDS for PostgreSQL for its transactional database. The application generates reports that query millions of rows, causing high CPU on the primary instance. The reports are not time-sensitive. What is the MOST cost-effective way to offload the reporting queries without affecting write performance?

A.Create an Amazon RDS Read Replica and direct reporting queries to the replica.
B.Use Amazon ElastiCache to cache report results.
C.Enable Multi-AZ to distribute reads to the standby instance.
D.Migrate reporting to Amazon Redshift.
AnswerA

Read Replicas can handle read traffic without impacting the primary.

Why this answer

Creating an Amazon RDS Read Replica offloads reporting queries to a separate read-only instance, preventing CPU contention on the primary. Since the reports are not time-sensitive, the replica can handle the large queries without impacting write performance, and it is cost-effective because you only pay for the replica's compute and storage.

Exam trap

The trap here is that candidates may confuse Multi-AZ standby instances with Read Replicas, mistakenly believing that the standby can serve read traffic, but AWS explicitly does not allow reads from the standby in a Multi-AZ deployment.

How to eliminate wrong answers

Option B is wrong because ElastiCache caches query results, but it does not offload the actual query processing from the primary instance; the initial query still runs on the primary, causing CPU spikes. Option C is wrong because Multi-AZ standby instances are not used for read traffic; they are only for failover and do not serve read requests. Option D is wrong because migrating to Amazon Redshift is overkill and more expensive for this use case; a Read Replica is simpler and more cost-effective for offloading reporting queries from RDS.

Full explanation →
1081
Multi-Selectmedium

A company is using Amazon RDS for PostgreSQL with Multi-AZ deployment. The database administrator needs to perform a minor version upgrade with minimal downtime. Which TWO actions should the administrator take? (Choose TWO.)

Select 2 answers
A.Disable Multi-AZ before the upgrade to reduce complexity.
B.Test the upgrade on a separate non-production environment first.
C.Modify the DB parameter group to set the new version parameters.
D.Schedule the upgrade during the maintenance window.
E.Take a snapshot of the DB instance before the upgrade.
AnswersB, D

Testing ensures compatibility and reduces risk of issues during the production upgrade.

Why this answer

Options B and D are correct. Testing the upgrade on a separate non-production environment first (B) is a best practice to verify compatibility and avoid issues. Scheduling the upgrade during the maintenance window (D) allows Amazon RDS to perform the upgrade automatically with a failover, minimizing downtime.

Option A is incorrect because disabling Multi-AZ would eliminate the failover benefit and cause downtime. Option C is incorrect because minor version upgrades do not require modifying the DB parameter group; AWS RDS handles parameter compatibility automatically. Option E is incorrect because taking a snapshot is a good practice for recovery but does not reduce downtime during the upgrade.

Full explanation →
1082
Multi-Selecteasy

A company is using Amazon RDS for MariaDB. The database administrator wants to monitor the database for slow queries. Which TWO services can be used to achieve this? (Choose TWO.)

Select 2 answers
A.Amazon RDS Performance Insights
B.AWS Config
C.Amazon CloudWatch Logs
D.Amazon RDS Enhanced Monitoring
E.AWS CloudTrail
AnswersA, C

Performance Insights helps identify and analyze slow queries.

Why this answer

Amazon RDS Performance Insights (Option A) is correct because it provides a database performance tuning and monitoring feature that visualizes database load and allows you to identify and analyze slow queries by filtering on SQL statements, waits, and hosts. Amazon CloudWatch Logs (Option C) is correct because you can enable the slow query log for MariaDB and publish those logs to CloudWatch Logs, then use CloudWatch Logs Insights to query and filter for slow queries based on execution time.

Exam trap

The trap here is that candidates often confuse Enhanced Monitoring (OS-level metrics) with Performance Insights (database-level query analysis) or assume CloudTrail can capture database queries, when in fact CloudTrail only records AWS API calls, not SQL statements.

Full explanation →
1083
MCQhard

A company's Amazon RDS for PostgreSQL instance is experiencing high CPU utilization. The DB instance is a db.r5.xlarge with 500 GB of General Purpose SSD (gp2) storage. The application team reports that write-intensive batch jobs are causing latency. The DBA notices that the ReadIOPS metric is low but WriteIOPS is consistently near the instance's maximum. Which action would most effectively reduce write latency?

A.Change the storage type to Provisioned IOPS (io1) with the same IOPS.
B.Increase the allocated storage to 1,000 GB to increase baseline IOPS.
C.Add a read replica to distribute read traffic.
D.Enable Multi-AZ deployment to offload writes to a standby instance.
AnswerB

For gp2 volumes, baseline IOPS is 3 per GB, up to 16,000 IOPS. Increasing storage size increases baseline IOPS and burst balance duration, reducing write latency.

Why this answer

Increasing the allocated storage for a gp2 volume from 500 GB to 1,000 GB doubles the baseline IOPS from 1,500 to 3,000 (gp2 baseline is 3 IOPS per GB). Since the write-intensive workload is hitting the maximum IOPS of the current volume, this increase directly raises the IOPS ceiling, reducing write latency without changing storage type.

Exam trap

The trap here is that candidates often assume Provisioned IOPS (io1) is always the answer for high IOPS workloads, but the question specifies that WriteIOPS is 'consistently near the instance's maximum' — increasing gp2 storage is a simpler, cost-effective way to raise the IOPS ceiling without changing storage type.

How to eliminate wrong answers

Option A is wrong because changing to io1 with the same IOPS (e.g., 1,500) does not increase the IOPS ceiling; it only provides consistent performance, but the bottleneck remains. Option C is wrong because a read replica offloads read traffic, not write traffic; writes still go to the primary instance, so write latency is unaffected. Option D is wrong because Multi-AZ deployment provides a standby for failover and offloads read traffic for the synchronous standby, but writes are still committed on the primary and replicated synchronously; it does not reduce write latency on the primary.

Full explanation →
1084
MCQeasy

Refer to the exhibit. A database specialist is investigating an application outage that occurred at 14:25 UTC. The RDS event log shows the events above. What is the most likely cause of the outage?

A.A maintenance window update was applied, causing the instance to become unavailable.
B.The DB instance ran out of storage and became read-only.
C.A Multi-AZ failover occurred at 14:25 UTC, causing a brief outage.
D.The DB instance restarted at 14:30 UTC due to a manual reboot.
AnswerC

Failover involves promoting the standby, which causes a momentary outage.

Why this answer

The RDS event log shows 'Multi-AZ failover completed' at 14:25 UTC, which would cause a brief outage during the DNS switchover. The subsequent restart at 14:30 UTC is likely a result of the failover (e.g., instance recovery). Option A is wrong because there is no event indicating a maintenance window.

Option B is wrong because storage-full events would show before the outage, not a failover event. Option D is wrong because a manual reboot would not show a Multi-AZ failover event; the restart at 14:30 is after the failover.

Full explanation →
1085
MCQhard

A database specialist sees the above error log entries from an Amazon RDS for MySQL DB instance. Which action should be taken to resolve the issue?

A.Increase the allocated storage for the DB instance.
B.Restore the DB instance from the latest automated snapshot.
C.Reboot the DB instance to clear the error.
D.Run the mysqlcheck command to repair the corrupted tables.
AnswerB

Correct: Restoring from a clean snapshot is the standard recovery method for page corruption.

Why this answer

The error log entries indicate corruption in the InnoDB tablespace, likely due to a crash or hardware failure. Restoring from the latest automated snapshot is the correct action because it provides a consistent, point-in-time recovery of the entire database, including all table structures and data, without relying on potentially corrupted files. This approach ensures data integrity and avoids further damage that could occur from attempting repairs on a corrupted instance.

Exam trap

The trap here is that candidates often confuse table-level repair commands (like mysqlcheck or REPAIR TABLE) with the need for a full database restore, not realizing that InnoDB corruption typically requires point-in-time recovery from a backup rather than a simple repair operation.

How to eliminate wrong answers

Option A is wrong because increasing allocated storage addresses disk space issues, not data corruption; the error logs point to logical corruption, not a full filesystem. Option C is wrong because rebooting the DB instance will not repair corrupted tables; it may even cause the instance to fail to start if the corruption is severe, and it does not fix underlying data integrity problems. Option D is wrong because mysqlcheck is designed for MyISAM tables and does not repair InnoDB tables; InnoDB corruption requires recovery from a backup or using the innodb_force_recovery parameter, not a simple command-line repair tool.

Full explanation →
1086
MCQhard

A database specialist runs the CLI command shown. The output indicates the instance is Multi-AZ and available. The application, however, is experiencing intermittent connection timeouts to the database endpoint. What is the most likely cause?

A.A failover occurred due to a Multi-AZ event.
B.The MySQL engine version is not supported.
C.The DB instance class is not available in the current region.
D.The database storage is full.
AnswerA

Failover causes transient connection timeouts until DNS updates.

Why this answer

A Multi-AZ failover can cause transient connection timeouts if the application does not have proper retry logic. The instance status shows 'available', so storage is not full (eliminating D). MySQL 8.0.28 is a supported version (eliminating B).

The instance class db.r5.xlarge is current generation and available in the region (eliminating C). Therefore, the intermittent timeouts are most likely due to a failover event.

Full explanation →
1087
MCQeasy

A company is deploying a new web application that uses Amazon RDS for MySQL. To meet high availability requirements, the database must automatically failover to a standby in a different Availability Zone with minimal downtime. Which deployment configuration should be used?

A.Multi-AZ deployment with automatic failover
B.Single-AZ deployment with enhanced monitoring
C.Multi-AZ cluster deployment
D.Single-AZ deployment with a read replica
AnswerA

Multi-AZ provides a standby in a different AZ and automatic failover.

Why this answer

A Multi-AZ deployment for Amazon RDS automatically provisions and maintains a synchronous standby replica in a different Availability Zone. If the primary DB instance fails, Amazon RDS automatically fails over to the standby, typically within 60–120 seconds, without requiring manual intervention. This meets the high availability requirement with minimal downtime.

Exam trap

The trap here is that candidates often confuse Multi-AZ deployments (synchronous, automatic failover) with read replicas (asynchronous, manual promotion) or assume that a Multi-AZ cluster deployment applies to standard RDS MySQL, when it is actually an Aurora-specific feature.

How to eliminate wrong answers

Option B is wrong because a Single-AZ deployment with enhanced monitoring provides performance metrics and logs but does not include a standby instance or automatic failover, so it cannot meet the high availability requirement. Option C is wrong because a Multi-AZ cluster deployment is specific to Amazon Aurora, not RDS for MySQL, and uses a different architecture (writer and reader nodes) that is not applicable to standard RDS MySQL. Option D is wrong because a Single-AZ deployment with a read replica provides asynchronous replication and can be manually promoted for failover, but it does not support automatic failover and may incur data loss due to replication lag.

Full explanation →
1088
MCQhard

A company runs a financial application on Amazon RDS for PostgreSQL that requires point-in-time recovery (PITR) with a recovery point objective (RPO) of 1 second and recovery time objective (RTO) of 5 minutes. Which configuration meets these requirements at the lowest cost?

A.Multi-AZ RDS with synchronous standby.
B.Single-AZ RDS with automated backups and manual snapshot restore.
C.Single-AZ RDS with a read replica and promote on failure.
D.Single-AZ RDS with cross-region snapshot copy.
AnswerA

Automatic failover within minutes, minimal data loss.

Why this answer

Multi-AZ RDS for PostgreSQL with synchronous standby replication provides automatic failover to a standby in a different Availability Zone, enabling an RTO of typically 1–2 minutes, well within the 5-minute requirement. Automated backups and transaction logs allow PITR with an RPO of 1 second by restoring to any point within the retention period, and the synchronous standby ensures zero data loss during failover, meeting the strict RPO at the lowest cost for this high-availability need.

Exam trap

The trap here is that candidates often assume a read replica can provide fast failover and low RPO, but they overlook that read replicas use asynchronous replication, which introduces lag and requires manual promotion, failing both the RPO and RTO requirements.

How to eliminate wrong answers

Option B is wrong because Single-AZ RDS with automated backups and manual snapshot restore cannot achieve an RTO of 5 minutes; restoring from a snapshot or automated backup takes significantly longer (often 15–60 minutes depending on database size) and does not provide automatic failover. Option C is wrong because Single-AZ RDS with a read replica and promote on failure does not guarantee an RPO of 1 second; read replicas use asynchronous replication, which can lag by seconds to minutes, and promotion is a manual or scripted process that increases RTO beyond 5 minutes. Option D is wrong because Single-AZ RDS with cross-region snapshot copy cannot meet the RTO of 5 minutes; restoring from a cross-region snapshot requires copying the snapshot to the target region and then restoring, which takes much longer than 5 minutes, and the RPO is limited by the snapshot schedule (e.g., every 5–30 minutes), not 1 second.

Full explanation →
1089
Multi-Selecthard

A company's Amazon Redshift cluster is experiencing slow query performance. Which THREE diagnostic steps should be taken to identify the bottleneck?

Select 3 answers
A.Query STL_LOAD_ERRORS to check for data load errors
B.Query SVL_QUERY_REPORT to see step-level performance
C.Query STL_QUERY to analyze query execution times
D.Query STL_WLM_QUERY to check for queue waits
E.Query STV_BLOCKLIST to check disk allocation
AnswersB, C, D

Shows time spent per step.

Why this answer

To diagnose slow query performance in Amazon Redshift, you should query SVL_QUERY_REPORT to view step-level execution details (Option B), STL_QUERY to analyze query execution times (Option C), and STL_WLM_QUERY to check for WLM queue waits (Option D). Option A is incorrect because STL_LOAD_ERRORS is used for data load errors, not performance. Option E is incorrect because STV_BLOCKLIST shows disk block allocation, which is not directly related to query performance.

Full explanation →
1090
MCQhard

A company is migrating a 2 TB Oracle database to Amazon Aurora PostgreSQL using AWS DMS. The migration is taking longer than expected, and the ongoing replication lag is increasing. Which action would MOST likely improve the migration speed?

A.Enable parallel load on the DMS task.
B.Decrease the DMS task's batch size and commit interval.
C.Increase the DMS replication instance size.
D.Disable the DMS task's logging to reduce overhead.
AnswerC

More resources improve replication performance.

Why this answer

Increasing the replication instance size (Option C) directly addresses the root cause of slow migration and increasing replication lag: insufficient compute or network resources on the DMS instance. A larger instance provides more CPU, memory, and network bandwidth, enabling faster full-load processing and more efficient ongoing replication. This is the most effective action when the instance is resource-constrained, which is common with a 2 TB database.

Exam trap

The trap here is that candidates often assume tuning batch sizes or parallel load settings will fix performance issues, but the question explicitly states the migration is taking longer than expected and replication lag is increasing, which points to an under-provisioned replication instance rather than suboptimal task configuration.

How to eliminate wrong answers

Option A is wrong because enabling parallel load on the DMS task can improve full-load speed but does not address ongoing replication lag; in fact, it can increase resource contention and worsen lag if the instance is already overloaded. Option B is wrong because decreasing batch size and commit interval reduces the number of rows per transaction and increases commit frequency, which actually slows down replication by adding more overhead and reducing throughput. Option D is wrong because disabling logging to reduce overhead is not a recommended practice for troubleshooting or performance tuning; DMS logging is lightweight and disabling it would remove critical diagnostic information without meaningfully improving migration speed.

Full explanation →
1091
MCQhard

A financial services company uses Amazon DynamoDB to store transaction data. The table is encrypted with an AWS managed KMS key. The compliance team requires that the encryption key be rotated every 90 days. The current key was created 6 months ago and has not been rotated. The company also needs to ensure that all access to the table is logged for audit purposes. The security engineer proposes to enable DynamoDB Streams and AWS CloudTrail. However, the compliance team notes that CloudTrail only logs management plane events (e.g., CreateTable) and not data plane events (e.g., GetItem, PutItem). What should the engineer do to meet both requirements?

A.Use AWS CloudTrail data events to capture DynamoDB data plane operations and store the logs in S3.
B.Switch to an AWS managed KMS key and enable automatic rotation.
C.Enable DynamoDB Streams and stream write events to CloudWatch Logs for auditing.
D.Create a customer managed KMS key, enable automatic key rotation, and configure CloudTrail to log data events for the DynamoDB table.
AnswerD

Customer managed keys support rotation; CloudTrail data events log data plane operations.

Why this answer

To meet both requirements, the engineer should create a customer managed KMS key, enable automatic key rotation (which rotates the key annually, but for 90-day rotation, the engineer can create a new key every 90 days and update the table), and configure CloudTrail to log data events for the DynamoDB table. CloudTrail data events capture data plane operations like GetItem and PutItem, which addresses the logging requirement. Option A is incorrect because AWS managed keys do not support automatic rotation; also, CloudTrail data events are not tied to key type.

Option B is incorrect because switching to a customer managed key alone does not enable data event logging. Option C is incorrect because DynamoDB Streams are used for change data capture and streaming to other services, not for audit logging of data plane operations; CloudWatch Logs from Streams do not capture all API calls.

Full explanation →
1092
Multi-Selecteasy

Which TWO Amazon RDS features can be used to increase the availability of a production database?

Select 2 answers
A.Enhanced Monitoring and Performance Insights.
B.Cross-Region read replicas with automatic promotion.
C.Manual DB snapshot taken every hour.
D.Multi-AZ deployment with automatic failover.
E.Automated backups with a retention period of 35 days.
AnswersB, D

Read replicas can be promoted to primary if the source fails.

Why this answer

Cross-Region read replicas provide a secondary copy of the database in a different AWS Region, which can be manually promoted to a standalone primary instance in the event of a regional outage. This feature increases availability by enabling a disaster recovery strategy that goes beyond a single AWS Region, ensuring business continuity even if the entire primary Region becomes unavailable.

Exam trap

The trap here is that candidates often confuse monitoring features (Enhanced Monitoring, Performance Insights) or backup mechanisms (snapshots, automated backups) with high-availability features, failing to recognize that only Multi-AZ deployments and cross-Region read replicas (with promotion) provide actual failover capabilities to increase availability.

Full explanation →
1093
MCQmedium

A database administrator runs the above command. The database is currently in a healthy state. Which statement is true about this database?

A.The database engine is Amazon Aurora
B.The database uses a burstable instance class
C.The database is deployed in a Multi-AZ configuration
D.The database has a read replica in another region
AnswerC

MultiAZ is true, so it has a standby in another AZ.

Why this answer

The command output shows the database is in the 'creating' state with 'multi-az': True. This explicitly indicates that the database is being deployed in a Multi-AZ configuration, which provides high availability by synchronously replicating data to a standby instance in a different Availability Zone.

Exam trap

AWS often tests the distinction between Multi-AZ and read replicas, where candidates mistakenly think 'multi-az': True implies a read replica or cross-region setup, but Multi-AZ is solely for high availability within a single region, not for read scaling or disaster recovery across regions.

How to eliminate wrong answers

Option A is wrong because the command output does not specify the engine name; it only shows 'engine': 'mysql', which could be Amazon RDS for MySQL or Aurora MySQL, but without 'aurora' in the engine field or a cluster identifier, it is not confirmed as Aurora. Option B is wrong because the instance class 'db.t3.medium' is a burstable instance class, but the question asks for a true statement about the database state, and the command output shows 'multi-az': True, not the instance class type; the burstable nature is not directly indicated in the output. Option D is wrong because the output shows 'multi-az': True and 'read_replica': False, with no 'source_region' or 'replica_of' field; a cross-region read replica would require a different configuration and would not be indicated by the Multi-AZ setting.

Full explanation →
1094
MCQhard

A company's RDS for SQL Server instance has been running for 3 years. The DBA notices that the DB instance's allocated storage (500 GB) is 80% full. The application is write-heavy. The DBA needs to increase storage without downtime. What is the most efficient way to achieve this?

A.Attach an additional EBS volume to the DB instance.
B.Create a new DB instance with larger storage and migrate data.
C.Take a snapshot and restore a new instance with larger storage.
D.Use the Modify DB Instance API to increase allocated storage.
AnswerD

RDS allows storage modification online for SQL Server.

Why this answer

RDS for SQL Server supports modifying storage online using the Modify DB Instance API without downtime. Option A is incorrect because you cannot attach additional EBS volumes directly to an RDS instance; RDS manages its own storage. Option B is incorrect because creating a new instance and migrating data would require downtime.

Option C is incorrect because taking a snapshot and restoring a new instance also incurs downtime and is less efficient than modifying storage in place.

Full explanation →
1095
MCQeasy

A company is migrating a 1 TB SQL Server database to Amazon RDS for SQL Server. They want to use the native backup and restore feature. What must they do first?

A.Upload the backup file to an Amazon S3 bucket.
B.Store the backup file on an EBS volume attached to the RDS instance.
C.Use FTP to transfer the backup file directly to the RDS instance.
D.Use the AWS Management Console to upload the backup file to the RDS instance.
AnswerA

Native restore in RDS SQL Server requires the backup file to be in S3.

Why this answer

To use the native backup and restore feature for migrating a SQL Server database to Amazon RDS, you must first upload the backup file to an Amazon S3 bucket. RDS for SQL Server supports restoring from backup files stored in S3 via the `RESTORE DATABASE` command, using the `FROM URL` option that references the S3 bucket. This is the only supported method for native restore, as RDS does not allow direct file system access or FTP transfers.

Exam trap

The trap here is that candidates assume they can directly upload files to an RDS instance via the console or FTP, similar to an on-premises SQL Server, but RDS abstracts the underlying infrastructure and only supports S3 as the staging location for native backups.

How to eliminate wrong answers

Option B is wrong because you cannot attach an EBS volume to an RDS instance; RDS manages its own storage and does not expose underlying EBS volumes for direct file uploads. Option C is wrong because RDS instances do not support FTP or any direct file transfer protocols; the only way to provide a backup file is through S3. Option D is wrong because the AWS Management Console does not provide a mechanism to upload backup files directly to an RDS instance; the console can be used to initiate a restore from S3, but the file must already reside in S3.

Full explanation →
1096
MCQmedium

A company runs an Amazon ElastiCache for Redis cluster as a caching layer for a high-traffic web application. The cluster has one primary and two replica nodes. Recently, the application experienced increased latency. Monitoring shows that the CPU utilization of the primary node is consistently above 80%, while replicas are below 40%. The application uses the cluster mode disabled. The operations team needs to reduce the CPU load on the primary node. Which solution should they implement?

A.Implement a read-through cache pattern using DynamoDB Accelerator (DAX).
B.Upgrade the primary node to a larger instance type.
C.Configure the application to use read replicas for read queries by using the reader endpoint.
D.Add more replica nodes to the cluster.
AnswerC

Replicas can serve read traffic, lowering primary CPU.

Why this answer

Offloading read traffic to replicas reduces CPU load on the primary node. Configuring the application to use the reader endpoint for read queries distributes read operations across replicas, lowering the primary's CPU utilization. Option A (DAX) is unrelated to ElastiCache Redis.

Option B (vertical scaling) may help but is often more expensive and does not leverage replicas. Option D (adding replicas) does not reduce primary CPU unless reads are directed to them.

Full explanation →
1097
MCQhard

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database contains sensitive data that must be encrypted at rest using a customer-managed KMS key. The company also needs to ensure that the database is automatically patched by AWS. Which DB instance configuration should be used?

A.Single-AZ, encryption at rest enabled with a customer-managed KMS key, auto minor version upgrade disabled.
B.Multi-AZ, encryption at rest enabled with a customer-managed KMS key, auto minor version upgrade enabled.
C.Single-AZ, encryption at rest enabled with a customer-managed KMS key, auto minor version upgrade enabled.
D.Multi-AZ, encryption at rest enabled with an AWS-managed KMS key, auto minor version upgrade enabled.
AnswerB, C

Correct because it enables encryption at rest with a customer-managed KMS key and enables auto minor version upgrade. Multi-AZ provides high availability but is not required.

Why this answer

The requirements are encryption at rest with a customer-managed KMS key and automatic patching via auto minor version upgrade. Both B (Multi-AZ) and C (Single-AZ) meet these requirements. A fails because auto minor version upgrade is disabled.

D fails because it uses an AWS-managed KMS key, not a customer-managed key. High availability is not a requirement in the stem, so both B and C are correct.

Full explanation →
1098
MCQmedium

A company is using Amazon ElastiCache for Redis as a caching layer for a web application. Users report that some cached data is missing, causing slower responses. Which ElastiCache feature should be checked first to understand key evictions?

A.ReplicationLag metric
B.CPUUtilization metric
C.Evictions metric in CloudWatch
D.CacheHits metric in CloudWatch
AnswerC

High evictions indicate memory pressure causing key removal.

Why this answer

The Evictions metric in CloudWatch directly shows the number of keys evicted from ElastiCache for Redis due to memory pressure. This is the first metric to check when cached data is missing, as evictions indicate that the cache is full and items are being removed to make space for new ones. Option A (ReplicationLag) measures replication delay between primary and replica nodes, not related to evictions.

Option B (CPUUtilization) shows CPU usage but does not indicate evictions. Option D (CacheHits) shows how often requested keys are found in the cache, but does not show evictions. Therefore, option C is correct.

Full explanation →
1099
MCQmedium

Refer to the exhibit. An IAM policy is attached to a user who needs to deploy an RDS MySQL instance. After creating the instance, the user tries to modify it to enable deletion protection, but the action fails. What is the most likely reason?

A.The user does not have permission to describe instances.
B.The resource ARN is not specified in the policy.
C.The user does not have permission to enable deletion protection.
D.The user does not have permission to create the instance.
AnswerC

Missing ModifyDBInstance action.

Why this answer

The IAM policy shown in the exhibit grants `rds:CreateDBInstance` but does not include `rds:ModifyDBInstance` or the specific action required to enable deletion protection (`rds:ModifyDBInstance` with the `DeletionProtection` parameter). Enabling deletion protection is a modification action, not part of the creation process, so the user lacks the necessary IAM permission for that operation.

Exam trap

The trap here is that candidates assume the `rds:CreateDBInstance` permission includes the ability to modify any instance property after creation, but AWS IAM separates create and modify actions, and deletion protection specifically requires the `ModifyDBInstance` action.

How to eliminate wrong answers

Option A is wrong because the policy includes `rds:DescribeDBInstances` (implied by `rds:*` or explicitly listed), so the user does have permission to describe instances. Option B is wrong because the policy uses a wildcard `*` for the resource ARN, which covers all RDS resources, so the lack of a specific ARN is not the issue. Option D is wrong because the user successfully created the instance, indicating they have `rds:CreateDBInstance` permission; the failure occurs only when trying to modify the instance to enable deletion protection.

Full explanation →
1100
MCQmedium

Refer to the exhibit. An IAM policy is attached to a role used by an application running on Amazon EC2. The application needs to read items from a DynamoDB table named 'MyTable' and create manual snapshots of an RDS instance. What is the issue with the policy?

A.The policy does not grant any DynamoDB read actions (e.g., GetItem, Query, Scan) required for the application.
B.The policy allows 'DescribeDBInstances' on all resources, which is too permissive.
C.The policy uses 'Resource': '*' for DynamoDB, which should be the table ARN.
D.The policy grants 'CreateDBSnapshot' on all resources, which is insufficient; it should be scoped to the specific DB instance.
AnswerA

The application needs to read items, but the policy only allows PutItem and DeleteItem.

Why this answer

The policy only grants 'PutItem' and 'DeleteItem' actions on the DynamoDB table, but the application needs to read items (e.g., 'GetItem' or 'Scan'). The missing DynamoDB read actions are the primary issue. Option B is incorrect because 'DescribeDBInstances' on all resources is not inherently too permissive for this use case; the key issue is the missing read permissions.

Option C is incorrect because using 'Resource': '*' for DynamoDB is acceptable for read actions if the table ARN is not specified; it is not a policy structure problem. Option D is incorrect because 'CreateDBSnapshot' on '*' is allowed, but the policy correctly scopes RDS actions to 'Resource': '*' which includes all DB instances; the critical flaw remains the missing DynamoDB read actions.

Full explanation →
1101
MCQhard

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The primary instance fails and the database administrator notices that the failover did not happen automatically. What is the MOST likely cause?

A.The DB instance is in a public subnet.
B.Enhanced Monitoring is disabled.
C.The standby instance is in a different VPC.
D.The DB instance is configured as a read replica.
AnswerD

Read replicas do not have automatic failover.

Why this answer

A read replica in Amazon RDS for MySQL is a separate DB instance that asynchronously replicates from a source instance. It does not support automatic failover; if the source instance fails, the read replica remains a standalone read-only instance and does not become the primary. Multi-AZ failover only occurs between a primary and its standby in the same region, not to a read replica.

Exam trap

The trap here is that candidates confuse read replicas with Multi-AZ standby instances, assuming a read replica can automatically take over during a failure, when in fact only a Multi-AZ standby provides automatic failover.

How to eliminate wrong answers

Option A is wrong because a public subnet does not affect Multi-AZ automatic failover; failover is a DNS and network-level mechanism that works regardless of subnet type. Option B is wrong because Enhanced Monitoring is a performance metrics feature and has no role in triggering or blocking automatic failover. Option C is wrong because Multi-AZ requires the standby to be in a different Availability Zone but within the same VPC; a standby in a different VPC would not be part of the same RDS deployment and would not be configured as a Multi-AZ standby.

Full explanation →
1102
Multi-Selectmedium

A company is using Amazon DynamoDB with a global table for a multi-region application. The application is deployed in us-east-1 and eu-west-1. The company notices that write latency to eu-west-1 is higher than expected. Which TWO actions can reduce write latency? (Choose TWO.)

Select 2 answers
A.Use DynamoDB Accelerator (DAX) for write caching.
B.Write data to the local Region and let global tables replicate to other Regions.
C.Use strongly consistent reads in the application.
D.Use a single-region table in eu-west-1 and replicate data manually.
E.Increase the write capacity of the table in eu-west-1.
AnswersA, B

DAX can be configured as a write-through cache, which reduces write latency by caching writes locally and flushing them asynchronously to DynamoDB.

Why this answer

DAX can be used as a write-through cache for DynamoDB, reducing write latency by caching writes locally and asynchronously flushing to the primary table. Option B is correct because writing to the local region (e.g., us-east-1) and allowing global tables replication to eu-west-1 reduces the latency for the local write operation; the replication happens asynchronously. Option C is incorrect because strongly consistent reads do not affect write operations.

Option D is incorrect because using a single-region table in eu-west-1 would eliminate the multi-region capability and manual replication adds complexity and potential latency. Option E is incorrect because increasing write capacity does not reduce latency; it increases throughput but not speed.

Exam trap

A common mistake is to think that increasing write capacity reduces write latency, but capacity is about throughput, not latency.

Full explanation →
1103
MCQmedium

A company has an Amazon RDS for SQL Server database that stores customer orders. The database is running on a db.m5.large instance. Recently, the DBA noticed that the 'Write IOPS' metric is consistently high during business hours, and the 'Write Latency' metric is also elevated. The application is experiencing slow order placement. The DBA checks the disk queue depth and finds it to be high. The database uses General Purpose SSD (gp2) storage with 500 GB. What should the DBA do to improve write performance?

A.Enable Multi-AZ to offload writes to standby.
B.Change the storage type to gp3 and increase the IOPS.
C.Increase the storage size to 1000 GB to get more baseline IOPS.
D.Migrate to Provisioned IOPS (io2) storage with appropriate IOPS.
AnswerD

Provisioned IOPS provides consistent low latency for write-heavy workloads.

Why this answer

Provisioned IOPS (io2) storage provides consistent, high IOPS performance with low latency, which is needed when the workload exceeds the baseline IOPS of gp2 storage. The current gp2 volume at 500 GB provides only 1,500 baseline IOPS (3 IOPS per GB), which is insufficient for the high write IOPS during business hours, causing high write latency and disk queue depth. Option A is incorrect because Multi-AZ does not offload writes; it only provides high availability and may increase write latency due to synchronous replication.

Option B is incorrect because while gp3 offers baseline performance with the ability to provision additional IOPS independently of storage size, it is still a general-purpose SSD; for consistent low latency under sustained high IOPS, io2 is more suitable. Option C is incorrect because increasing gp2 storage to 1,000 GB would increase baseline IOPS to 3,000, but this may not be enough, and it is more cost-effective to use io2 with the required IOPS rather than over-provisioning storage.

Full explanation →
1104
Multi-Selectmedium

A company is designing a global e-commerce platform using Amazon DynamoDB. The platform must support strong consistency for inventory updates and eventual consistency for product catalog reads. Which TWO design patterns should the company implement to meet these consistency requirements?

Select 2 answers
A.Configure DynamoDB Accelerator (DAX) for product catalog queries with eventual consistency.
B.Use Amazon ElastiCache for Redis to cache inventory data with strong consistency.
C.Use DynamoDB transactions for all inventory operations.
D.Use DynamoDB Streams to replicate inventory changes to a separate table for reads.
E.Enable DynamoDB global tables and use strongly consistent reads for inventory queries.
AnswersA, E

DAX provides low-latency eventually consistent reads for the catalog.

Why this answer

DynamoDB Accelerator (DAX) is an in-memory cache that can be configured to return eventually consistent results for read-heavy workloads like product catalog queries, reducing read latency and cost while meeting the eventual consistency requirement. Option E is correct because DynamoDB global tables replicate data across regions, and using strongly consistent reads for inventory queries ensures that the most recent write is returned, which is critical for inventory accuracy.

Exam trap

The trap here is that candidates often assume DynamoDB transactions or Streams can provide strong consistency for reads, but transactions only guarantee atomic writes, and Streams are asynchronous, so neither meets the requirement for strongly consistent inventory reads.

Full explanation →
1105
Multi-Selecthard

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The migration uses AWS DMS with ongoing replication (CDC). Which TWO tasks must be completed before starting the migration?

Select 2 answers
A.Enable supplemental logging in the Oracle source database
B.Create an Oracle user with required privileges for DMS
C.Configure DMS to use only full load without CDC
D.Disable archive logging on the Oracle source
E.Enable binary logging on the Oracle source
AnswersA, B

Supplemental logging is required for DMS to capture changes.

Why this answer

AWS DMS requires supplemental logging to be enabled on the Oracle source database for ongoing replication (CDC). Supplemental logging ensures that the redo logs contain sufficient information (e.g., primary key, unique key, or all column values) to reconstruct the changes for DMS to capture and apply to the target. Without it, DMS cannot generate the necessary log-based change data for CDC.

Exam trap

The trap here is that candidates may confuse Oracle's redo logging with MySQL's binary logging, leading them to incorrectly select 'Enable binary logging on the Oracle source' (Option E) instead of understanding that Oracle requires supplemental logging for CDC.

Full explanation →
1106
MCQhard

A database administrator runs the AWS CLI command shown in the exhibit. The administrator wants to enable encryption at rest for the RDS instance. What should the administrator do?

A.Modify the DB instance and set StorageEncrypted to true.
B.Create a new KMS key and associate it with the DB instance.
C.Create a new DB parameter group with encryption enabled.
D.Take a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore a new instance.
AnswerD

Correct. You must take a snapshot, copy it with encryption enabled, and restore a new instance.

Why this answer

To enable encryption on an unencrypted RDS instance, you must take a snapshot, copy the snapshot with encryption enabled, and restore a new encrypted instance. You cannot enable encryption on an existing instance (Option A is incorrect). Creating a new KMS key does not enable encryption on the existing instance (Option B is incorrect).

Encryption is not controlled by a DB parameter group (Option C is incorrect). Only D is correct.

Full explanation →
1107
MCQhard

A database administrator runs the 'describe-db-clusters' CLI command and sees the above output. The earliest restorable time is December 1, 2023. However, the backup retention period is 7 days. Why is the earliest restorable time earlier than 7 days from now (assuming today is December 5, 2023)?

A.The backup retention period is misconfigured; it should be 30 days.
B.The cluster was created on December 1, so that is the earliest point available.
C.Automated backups are only kept for 7 days, but manual snapshots extend the recovery window.
D.The 'earliestRestorableTime' is calculated based on the latest transaction log, not backup retention.
AnswerC

Manual snapshots, when taken, can extend the earliest restorable time beyond the automated backup retention period.

Why this answer

The earliest restorable time shown is December 1, 2023, which is earlier than the 7-day backup retention period (which would be November 28, 2023 from today December 5, 2023). This discrepancy occurs because manual snapshots taken prior to the automated backup window extend the restorable range. While automated backups are retained for only 7 days, manual snapshots persist independently and can provide restore points further back in time, effectively making the earliest restorable time earlier than the automated retention period alone would allow.

Full explanation →
1108
Multi-Selectmedium

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database is 2 TB and has a high number of small transactions. The company needs to minimize downtime during the migration. Which TWO strategies should be used together? (Choose two.)

Select 2 answers
A.Use Oracle Data Pump to export the database and import into RDS.
B.Set up a VPN connection between on-premises and AWS for direct database link.
C.Create a manual snapshot of the RDS instance during the migration.
D.Use AWS Database Migration Service (DMS) to perform a full load and ongoing replication.
E.Configure change data capture (CDC) on the source database and apply to RDS.
AnswersD, E

DMS can migrate data with minimal downtime by using continuous replication after the full load.

Why this answer

AWS DMS with ongoing replication (CDC) is the correct choice because it allows a full load of the 2 TB database followed by continuous replication of changes, minimizing downtime by keeping the target RDS instance nearly synchronized with the source until cutover. This approach is specifically designed for large databases with high transaction volumes, as it reduces the final outage window to seconds or minutes.

Exam trap

The trap here is that candidates often confuse 'minimizing downtime' with 'zero downtime' and select Data Pump (A) because it is a familiar Oracle tool, failing to recognize that DMS with CDC is the only option that provides near-continuous replication and a short cutover window.

Full explanation →
1109
Multi-Selectmedium

Which TWO options are valid methods to migrate an on-premises Microsoft SQL Server database to Amazon RDS for SQL Server with minimal downtime? (Choose 2.)

Select 2 answers
A.Use AWS Snowball Edge
B.Use SQL Server Integration Services (SSIS)
C.Use AWS DMS with ongoing replication
D.Use native backup and restore to Amazon S3
E.Use AWS Direct Connect
AnswersC, D

DMS provides CDC for minimal downtime.

Why this answer

AWS DMS with ongoing replication (change data capture) is a valid method for migrating SQL Server to Amazon RDS with minimal downtime because it allows a full load of the source database followed by continuous replication of incremental changes. This keeps the target database nearly synchronized with the source, enabling a short cutover window. The ongoing replication feature uses SQL Server's transaction logs to capture changes without requiring application downtime.

Exam trap

The trap here is that candidates confuse supporting services (Direct Connect, Snowball) with actual migration methods, or mistake batch ETL tools (SSIS) for real-time replication solutions, leading them to select options that do not achieve minimal downtime.

Full explanation →
1110
MCQhard

An e-commerce application uses Amazon Aurora MySQL. During a flash sale, the database experiences a surge in write operations, and the application reports 'Lock wait timeout exceeded' errors. The DBA suspects a long-running transaction is blocking others. Which AWS tool or feature should the DBA use to identify the blocking transaction?

A.Amazon Aurora Performance Insights with the 'Wait for lock' dimension
B.Amazon Inspector
C.CloudWatch Logs Insights
D.Amazon RDS Enhanced Monitoring
AnswerA

Performance Insights can display blocking sessions and wait events.

Why this answer

Amazon Aurora Performance Insights with the 'Wait for lock' dimension can identify blocking sessions by showing which sessions are waiting on locks and which session holds the lock. Option B (Amazon Inspector) is a security assessment tool and does not provide database lock information. Option C (CloudWatch Logs Insights) can analyze logs but does not directly identify blocking transactions.

Option D (Amazon RDS Enhanced Monitoring) provides OS-level metrics, not database-level lock information.

Full explanation →
1111
MCQmedium

A company's production RDS for PostgreSQL instance experienced a failover to the standby replica. After the failover, the application team reports that writes are failing with 'ReadOnlyException: Connection is read-only'. The DB instance status in the RDS console shows 'available'. Which action should the database administrator take to resolve the issue?

A.Update the application connection string to use the new writer endpoint from the RDS console.
B.Create a read replica and promote it to a new primary.
C.Reboot the DB instance to force a failover back to the original primary.
D.Modify the DB instance to enable Multi-AZ again.
AnswerA

The application must connect to the writer endpoint after failover.

Why this answer

After a Multi-AZ failover, the standby becomes the primary, and the old primary becomes a read-only standby. The application must update its connection string to use the new writer endpoint (which automatically points to the new primary) to perform writes. Option B is incorrect because creating a read replica and promoting it is unnecessary; Multi-AZ already provides a standby.

Option C is incorrect because rebooting would force another failover but does not change the endpoint. Option D is incorrect because Multi-AZ is already enabled; modifying it again does not resolve the issue.

Full explanation →
1112
MCQeasy

A company is using Amazon DynamoDB with on-demand capacity mode. The company notices that during a flash sale, the write requests are throttled. What is the most likely cause of the throttling?

A.The table has reached its maximum throughput limit for on-demand mode.
B.The table is not configured for auto scaling.
C.A hot partition is causing throttling even though the table uses on-demand capacity.
D.The provisioned write capacity units (WCUs) are set too low.
AnswerC

On-demand tables can still throttle if a single partition receives more writes than its limit (1000 writes/sec).

Why this answer

For a DynamoDB table in on-demand capacity mode, throttling is typically caused by a hot partition. On-demand mode automatically scales table-level throughput, but if a single partition key is heavily accessed (e.g., during a flash sale), that partition can exceed its individual capacity limit, resulting in throttled write requests. This is the most likely cause, making option C correct.

Option A (maximum throughput limit) does not apply because on-demand has no fixed maximum; option B (auto scaling) is irrelevant since on-demand manages scaling automatically; option D (provisioned WCUs) is not used in on-demand mode.

Full explanation →
1113
MCQmedium

A company runs a financial application that requires ACID transactions on a relational database. The workload has a high volume of writes and reads, and the team wants to minimize operational overhead. Which AWS database service should they choose?

A.Amazon RDS for Oracle
B.Amazon DynamoDB with transactions enabled
C.Amazon ElastiCache for Memcached
D.Amazon Aurora (MySQL-compatible)
AnswerD

Aurora offers ACID transactions, high performance, and managed service.

Why this answer

Amazon Aurora (MySQL-compatible) is the correct choice because it provides full ACID transaction support required for a financial application, while delivering high throughput for both reads and writes through its distributed, SSD-backed storage architecture. Aurora also minimizes operational overhead by automating tasks like replication, backups, and failover, and it offers up to 5x the throughput of standard MySQL without requiring manual sharding or tuning.

Exam trap

The trap here is that candidates may choose Amazon DynamoDB with transactions enabled because it offers ACID transactions, but they overlook the requirement for a relational database, which DynamoDB does not provide, making Aurora the only option that combines relational ACID support with low operational overhead.

How to eliminate wrong answers

Option A is wrong because Amazon RDS for Oracle, while supporting ACID transactions, incurs higher licensing costs and operational overhead compared to Aurora, and does not provide the same level of write throughput optimization for high-volume workloads. Option B is wrong because Amazon DynamoDB with transactions enabled is a NoSQL database that supports ACID transactions only for items within a single AWS account and region, but it is not a relational database and lacks the relational model (e.g., joins, foreign keys) required for the financial application's ACID transactions on a relational database. Option C is wrong because Amazon ElastiCache for Memcached is an in-memory caching service that does not support ACID transactions, durability, or a relational data model; it is designed for ephemeral key-value storage, not persistent database workloads.

Full explanation →
1114
MCQmedium

A company manages multiple RDS for PostgreSQL instances in different AWS accounts. The security team requires that all DB instances have automated backups enabled with a retention period of at least 14 days. How can the company enforce this policy across all accounts?

A.Use AWS CloudTrail to monitor backup settings and alert on non-compliance.
B.Apply a service control policy (SCP) that requires backup retention.
C.Create an IAM policy that denies creating DB instances without backup retention.
D.Use AWS Config rules to evaluate and auto-remediate non-compliant instances.
AnswerD

AWS Config rules can evaluate RDS instances for backup retention and trigger auto-remediation to fix non-compliant resources.

Why this answer

AWS Config with managed rules can evaluate RDS instances and enforce backup settings. Option A is wrong because CloudTrail only logs API calls for auditing, it does not enforce configuration. Option B is wrong because Service Control Policies (SCPs) restrict permissions at the organization level but cannot directly require backup retention on resources.

Option C is wrong because IAM policies can control permissions to create instances but cannot enforce backup retention settings on existing instances; they can deny creation if certain conditions are not met, but that is not as comprehensive as AWS Config auto-remediation.

Full explanation →
1115
MCQmedium

A company is using Amazon RDS for SQL Server with Multi-AZ. The application experiences a brief interruption during a planned maintenance window. The DBA wants to verify that the failover occurred correctly. Which set of metrics should the DBA examine?

A.FreeStorageSpace on the primary instance
B.DatabaseConnections and ReplicaLag
C.WriteIOPS and ReadIOPS for both instances
D.NetworkThroughput on the replica instance
AnswerB

Connections drop to zero during failover, and ReplicaLag becomes zero after failover.

Why this answer

During a Multi-AZ failover, DatabaseConnections drop to zero as existing connections are terminated, then rise again as applications reconnect. ReplicaLag, which measures the delay between primary and standby, becomes zero after failover because the former standby is now the primary. Monitoring these two metrics together provides clear evidence of a failover event.

Option A (FreeStorageSpace) does not change during failover. Option C (WriteIOPS and ReadIOPS) may fluctuate but are not direct indicators of failover. Option D (NetworkThroughput) may also vary but is not a specific failover indicator.

Full explanation →
1116
Multi-Selectmedium

A company is designing a database for an analytics workload that requires storing 5 TB of data and running complex SQL queries with joins. The workload is read-heavy and requires high concurrency. Which TWO services are suitable for this workload? (Choose two.)

Select 2 answers
A.Amazon RDS for MySQL with read replicas
B.Amazon Redshift
C.Amazon ElastiCache for Redis
D.Amazon DynamoDB
E.Amazon S3
AnswersA, B

Supports joins and read replicas for concurrency.

Why this answer

Amazon RDS for MySQL with read replicas is suitable because the workload is read-heavy and requires high concurrency. Read replicas offload SELECT traffic from the primary instance, allowing complex SQL queries with joins to scale horizontally while maintaining ACID compliance for the 5 TB dataset.

Exam trap

The trap here is that candidates often confuse read-heavy OLTP workloads with analytical workloads, assuming ElastiCache or DynamoDB can handle complex SQL joins, when in fact they lack relational query capabilities and are designed for different access patterns.

Full explanation →
1117
Multi-Selectmedium

Which TWO actions should be taken to protect sensitive data in an Amazon RDS for Oracle DB instance? (Choose two.)

Select 2 answers
A.Store database credentials in the application configuration file.
B.Disable automated backups to reduce storage costs.
C.Use Oracle Transparent Data Encryption (TDE) for sensitive columns.
D.Assign a public IP address to the DB instance for easier access.
E.Enable encryption at rest using AWS KMS.
AnswersC, E

TDE provides column-level encryption.

Why this answer

The correct answers are C and E. Option C, using Oracle Transparent Data Encryption (TDE), encrypts sensitive data at the column level within the database. Option E, enabling encryption at rest using AWS KMS, protects data stored on disk.

Option A is incorrect because storing credentials in application configuration files is insecure. Option B is incorrect because disabling automated backups does not enhance security. Option D is incorrect because assigning a public IP increases exposure to attacks.

Full explanation →
1118
Multi-Selectmedium

A company is using Amazon Redshift and has a query that is running slowly. The DBA wants to identify if the query is I/O-bound. Which TWO metrics from Amazon CloudWatch can indicate I/O-bound queries?

Select 2 answers
A.NetworkReceiveThroughput
B.ReadIOPS
C.CPUUtilization
D.WriteIOPS
E.ReadLatency
AnswersB, E

High ReadIOPS indicates many I/O operations.

Why this answer

Options B and E are correct. ReadIOPS measures the number of read I/O operations per second, and ReadLatency measures the average time per read I/O operation. High values for these metrics indicate that the query is I/O-bound.

Option A (NetworkReceiveThroughput) measures network throughput, not I/O. Option C (CPUUtilization) indicates CPU-bound workloads. Option D (WriteIOPS) measures write I/O, which is less likely to be the primary indicator for a slow query, and the question asks for the two metrics that can indicate I/O-bound queries; ReadIOPS and ReadLatency are the most direct I/O metrics.

Full explanation →
1119
Multi-Selecteasy

A company is designing a disaster recovery strategy for an Amazon Aurora MySQL database with a recovery point objective (RPO) of 1 second and a recovery time objective (RTO) of 1 minute. Which TWO solutions meet these requirements? (Choose TWO.)

Select 2 answers
A.Use a Multi-AZ DB cluster deployment.
B.Take manual snapshots every hour and copy to another region.
C.Enable automated backups and perform point-in-time recovery in another region.
D.Deploy an Aurora Global Database with a secondary region.
E.Configure cross-Region read replicas and promote in disaster.
AnswersD, E

Global Database offers low RPO/RTO.

Why this answer

(Aurora Global Database) provides cross-region replication with an RPO of typically less than 1 second and RTO of approximately 1 minute, meeting the requirements. Option E (cross-Region read replicas) can be promoted to a standalone primary in under a minute, and replication lag is sub-second, achieving RPO of 1 second. Option A (Multi-AZ DB cluster) is confined to a single region and does not provide DR across regions.

Option B (manual snapshots every hour) results in an RPO of up to 1 hour, far exceeding the 1-second requirement. Option C (automated backups) has a default backup interval of 5 minutes, resulting in an RPO of at least 5 minutes, and point-in-time recovery typically takes longer than 1 minute.

Full explanation →
1120
Multi-Selectmedium

A company is using Amazon DynamoDB for a session management application. The application is experiencing higher latency during peak hours. The DynamoDB table uses on-demand capacity. Which TWO steps should a database specialist take to diagnose the issue?

Select 2 answers
A.Review the table's ReadCapacityUnits and WriteCapacityUnits to ensure they are sufficient.
B.Examine the CloudWatch metric for UserErrors to identify client-side issues.
C.Check the CloudWatch metric for ThrottledRequests to see if any requests are being throttled.
D.Enable DynamoDB Streams to capture all write events for analysis.
E.Analyze the PartitionKey metrics to detect if a single partition is receiving a disproportionate amount of traffic.
AnswersC, E

Throttling can cause increased latency.

Why this answer

Checking ThrottledRequests helps identify if requests are being throttled, even with on-demand. Reviewing PartitionKey metrics helps detect hot partitions. ReadCapacityUnits and WriteCapacityUnits are not applicable for on-demand.

Latency metrics show end-to-end performance but are less diagnostic.

Full explanation →
1121
MCQmedium

A company is migrating an on-premises Oracle data warehouse to AWS. The warehouse contains 50 TB of data and runs complex queries that involve joins and aggregations. The team wants to minimize migration effort and cost while maintaining query performance. Which AWS service should they use?

A.Amazon RDS for Oracle
B.Amazon ElastiCache for Redis
C.Amazon Redshift
D.Amazon DynamoDB
AnswerC

Redshift is purpose-built for large-scale data warehousing and analytics.

Why this answer

Amazon Redshift is purpose-built for large-scale data warehousing, supporting up to petabytes of data with massively parallel processing (MPP) architecture that efficiently handles complex joins and aggregations. It minimizes migration effort by supporting automated schema conversion from Oracle via the AWS Schema Conversion Tool (SCT) and cost-effective columnar storage with compression, making it the optimal choice for a 50 TB Oracle data warehouse migration.

Exam trap

The trap here is that candidates often choose Amazon RDS for Oracle because it seems like a direct lift-and-shift, but they overlook that RDS is not designed for analytical workloads at this scale, whereas Redshift is the only AWS service built specifically for petabyte-scale data warehousing with MPP and columnar storage.

How to eliminate wrong answers

Option A is wrong because Amazon RDS for Oracle is a transactional (OLTP) database service that lacks the MPP architecture and columnar storage needed for high-performance complex queries on 50 TB of data, leading to poor query performance and higher costs. Option B is wrong because Amazon ElastiCache for Redis is an in-memory key-value store designed for caching and real-time workloads, not for persistent data warehousing or running complex SQL joins and aggregations on 50 TB. Option D is wrong because Amazon DynamoDB is a NoSQL key-value and document database optimized for high-throughput, low-latency access patterns at scale, but it does not support complex SQL joins, aggregations, or the relational query model required for a data warehouse migration.

Full explanation →
1122
MCQeasy

A company wants to migrate a 10 TB Microsoft SQL Server database from on-premises to Amazon RDS for SQL Server. The migration must be completed within a week and minimize network bandwidth usage. Which approach is most suitable?

A.Back up the database to Amazon S3 using AWS CLI
B.Set up AWS Direct Connect and use DMS
C.Use AWS DMS over the internet
D.Use AWS Snowball Edge to transfer backup files, then restore to RDS
AnswerD

Snowball Edge bypasses network bandwidth constraints.

Why this answer

AWS Snowball Edge is the most suitable approach because it allows you to transfer the 10 TB database backup files physically, bypassing the internet entirely. This eliminates network bandwidth constraints and ensures the migration can be completed within a week, as the data is shipped to AWS and then restored to Amazon RDS for SQL Server using native restore operations.

Exam trap

The trap here is that candidates often overlook the physical transfer option (Snowball) for large migrations, mistakenly assuming that AWS DMS or Direct Connect can handle multi-terabyte datasets within tight deadlines without considering provisioning times or bandwidth constraints.

How to eliminate wrong answers

Option A is wrong because backing up directly to Amazon S3 using AWS CLI over the internet would consume significant bandwidth and likely exceed the one-week timeline for a 10 TB database, especially with limited on-premises upload speeds. Option B is wrong because setting up AWS Direct Connect requires weeks to months for provisioning and is not feasible for a one-week migration, plus it still relies on network bandwidth for the data transfer. Option C is wrong because using AWS DMS over the internet for a 10 TB database would be too slow due to bandwidth limitations and potential network congestion, making it impossible to complete within a week.

Full explanation →
1123
Multi-Selecthard

Which THREE methods can be used to authenticate users to an Amazon RDS for MySQL DB instance? (Choose three.)

Select 3 answers
A.AWS Managed Microsoft AD authentication.
B.MySQL native password authentication.
C.AWS Lambda function authentication.
D.Kerberos authentication.
E.IAM database authentication.
AnswersB, D, E

Standard MySQL authentication.

Why this answer

Options B, D, and E are correct. MySQL native password authentication (B) is the standard method. Kerberos authentication (D) is supported for RDS for MySQL.

IAM database authentication (E) allows IAM users and roles to authenticate to the DB instance using an authentication token. Option A is incorrect because AWS Managed Microsoft AD authentication is not supported for RDS for MySQL; it is supported for RDS for SQL Server and Oracle. Option C is incorrect because Lambda is not an authentication method; it is a compute service that cannot directly authenticate users to a database.

Full explanation →
1124
MCQhard

A company uses Amazon DynamoDB with AWS KMS-managed encryption at rest. The security team requires that all access to a particular DynamoDB table be logged for audit purposes. Which solution meets this requirement?

A.Enable VPC Flow Logs for the VPC where the DynamoDB endpoint is accessed.
B.Enable AWS Config rules for DynamoDB.
C.Enable CloudTrail data events for the DynamoDB table.
D.Enable Amazon GuardDuty with DynamoDB protection.
AnswerC

CloudTrail data events log DynamoDB data plane operations.

Why this answer

AWS CloudTrail logs all DynamoDB API calls, including data plane operations, when data events are enabled. Option A is wrong because VPC Flow Logs capture network traffic, not API calls. Option B is wrong because AWS Config records resource configuration changes, not API calls.

Option D is wrong because Amazon GuardDuty is a threat detection service, not a logging service.

Full explanation →
1125
MCQhard

Refer to the exhibit. A database specialist is troubleshooting an automation script that fails when trying to create a snapshot of the RDS DB instance 'mydb' using an IAM role with the attached policy. The error message indicates that the user is not authorized to perform the operation. Which statement best explains the failure?

A.The resource ARN for the snapshot is incorrect; it should specify the DB instance ID.
B.The policy does not allow the rds:DescribeDBInstances action on the snapshot resource.
C.The policy does not allow the rds:CreateDBSnapshot action on the specific snapshot name.
D.The policy does not grant the rds:CreateDBSnapshot permission on the DB instance resource.
AnswerD

CreateDBSnapshot requires permission on the DB instance.

Why this answer

The rds:CreateDBSnapshot action requires permission on the DB instance resource (arn:aws:rds:region:account:db:instance-name). The IAM policy in the exhibit only grants this action on the snapshot resource (arn:aws:rds:region:account:snapshot:*), not on the DB instance, causing the authorization failure. Options A and B are incorrect because they either mention an irrelevant action or misidentify the resource.

Option C is incorrect because the policy does allow rds:CreateDBSnapshot on the snapshot resource, but the missing permission on the DB instance is the actual issue.

Full explanation →
Page 14

Page 15 of 23

Page 16

All pages

1234567891011121314151617181920212223

Practice DBS-C01 by domain

Target a specific domain to shore up weak areas.

Workload-Specific Database DesignDeployment and MigrationManagement and OperationsMonitoring and TroubleshootingDatabase Security
See all domains with question counts →