Courseiva

AWS Certified Database Specialty DBS-C01 (DBS-C01) — Questions 11261200

1663 questions total · 23pages · All types, answers revealed

Page 15

Page 16 of 23

Page 17
1126
MCQmedium

A company runs an OLTP application on Amazon RDS for PostgreSQL. The database stores customer orders. The application frequently queries orders by customer_id and order_date. The orders table has 100 million rows. The query performance has degraded over time. The database has a single index on customer_id. The company needs to improve query performance without changing the application code. Which design change should be made?

A.Partition the table by order_date using PostgreSQL declarative partitioning.
B.Upgrade to a larger RDS instance type.
C.Enable RDS Performance Insights to identify bottlenecks.
D.Create a composite index on (customer_id, order_date).
AnswerD

A composite index supports queries filtering by both columns efficiently.

Why this answer

The query performance has degraded because the existing single-column index on customer_id can filter by customer but still requires a full sort or scan within that customer's rows to satisfy the order_date condition. Creating a composite index on (customer_id, order_date) allows the database to use a single index seek to locate the exact rows matching both columns, eliminating the need for an additional sort or filter pass. This directly addresses the query pattern without any application code changes.

Exam trap

The trap here is that candidates often choose partitioning (Option A) because they think it automatically speeds up queries, but without changing the query to leverage partition pruning, partitioning alone does not improve index-based lookups; the correct solution is to add a covering composite index that matches the query filter order.

How to eliminate wrong answers

Option A is wrong because partitioning by order_date would require rewriting queries to include partition pruning hints or rely on the query planner to eliminate partitions, which does not change the application code requirement and would not improve performance for queries filtering by customer_id without also including order_date in the index. Option B is wrong because upgrading to a larger instance type only adds more CPU and memory, which may mask the symptom but does not fix the root cause of missing index coverage for the query pattern. Option C is wrong because enabling Performance Insights only helps identify bottlenecks after they occur; it does not make any design change to improve query performance.

1127
MCQmedium

A company stores sensitive data in an Amazon RDS for PostgreSQL DB instance. The security team requires that all data at rest be encrypted. The instance is currently unencrypted. What is the simplest way to enable encryption with minimal downtime?

A.Create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the snapshot to a new encrypted DB instance.
B.Use the AWS CLI to modify the DB instance and enable encryption.
C.Migrate the data to an Amazon RDS for PostgreSQL DB instance using RDS Custom.
D.Modify the DB instance and enable encryption in the console.
AnswerA

This is the standard procedure to enable encryption with minimal downtime.

Why this answer

An existing unencrypted Amazon RDS instance cannot be directly encrypted. The standard approach to enable encryption with minimal downtime is to create a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the snapshot to a new encrypted DB instance. This process typically involves a brief outage during the restore but is simpler than other methods.

Option B is incorrect because the AWS CLI does not support enabling encryption on an existing instance. Option C is incorrect because migrating to RDS Custom adds unnecessary complexity and does not directly enable encryption on the current instance. Option D is incorrect because the AWS Management Console also does not allow enabling encryption on an existing instance.

1128
MCQeasy

An administrator is troubleshooting an Amazon RDS for PostgreSQL instance that is experiencing high CPU utilization. The administrator has enabled Performance Insights. Which metric should be examined first to identify the queries consuming the most CPU?

A.db.sessions
B.db.cpu.avg
C.db.load.avg
D.db.bytes_sent
AnswerC

This metric shows the average number of active sessions and is key for identifying high-load queries.

Why this answer

The correct metric to examine first is 'db.load.avg' (Option C). In Amazon RDS Performance Insights, 'db.load.avg' represents the average number of active sessions, which directly correlates with CPU utilization. A high value indicates queries that are consuming significant CPU resources.

Option A ('db.sessions') is not a standard Performance Insights metric. Option B ('db.cpu.avg') does not exist in Performance Insights. Option D ('db.bytes_sent') is a network metric unrelated to CPU usage.

1129
MCQhard

A company uses Amazon DynamoDB with on-demand capacity for a gaming leaderboard. During a promotional event, write traffic spikes 10x, causing occasional 'ProvisionedThroughputExceededException' errors. The application retries with exponential backoff, but latency increases. The team notices that the 'ThrottledWriteRequests' metric spikes. What is the MOST cost-effective solution to handle these unpredictable spikes?

A.Continue using on-demand capacity but ensure the table has no throttling.
B.Implement DynamoDB Accelerator (DAX) to reduce read load.
C.Switch to provisioned capacity with auto scaling configured for the expected peak.
D.Use an Amazon SQS queue to buffer write requests before DynamoDB.
AnswerC

Correct. Switching to provisioned capacity with auto scaling allows the table to scale based on actual traffic patterns, handling spikes cost-effectively without manual intervention. This directly addresses the throughput exception.

Why this answer

The scenario describes a DynamoDB table using on-demand capacity but experiencing 'ProvisionedThroughputExceededException', which is an error specific to provisioned capacity. This inconsistency suggests the table is actually using provisioned capacity. Therefore, the best solution is to switch to provisioned capacity with auto scaling properly configured to handle the peak traffic, ensuring cost-effectiveness by scaling only when needed.

Option A is invalid because on-demand tables do not throw this error. Option B (DAX) addresses read latency, not write throttling. Option D (SQS) adds complexity and latency and is not the most cost-effective for unpredictable write spikes.

Exam trap

The question contains an inconsistency: on-demand capacity is stated, but the error 'ProvisionedThroughputExceededException' is only relevant to provisioned capacity. Recognize that the best solution addresses the underlying provisioning model.

1130
Multi-Selecteasy

A company is migrating a 2 TB MongoDB database to Amazon DocumentDB. Which TWO factors should be considered when planning the migration?

Select 2 answers
A.DocumentDB stores backups in Amazon S3 automatically.
B.DocumentDB requires LDAP for authentication.
C.DocumentDB does not support encryption in transit.
D.Source MongoDB version compatibility with DocumentDB.
E.Network bandwidth and latency between source and target.
AnswersD, E

DocumentDB may not support all MongoDB versions.

Why this answer

Amazon DocumentDB is wire-protocol-compatible with MongoDB 3.6 and 4.0, but not with all MongoDB versions. If the source MongoDB version is older or newer than these supported versions, you may need to upgrade or downgrade the source before migration. Compatibility also affects features like indexes, aggregation pipelines, and data types, which can cause migration failures if not addressed.

Option E is correct because network bandwidth and latency directly impact the time required to transfer a 2 TB dataset. Insufficient bandwidth can lead to prolonged migration windows or failures. Additionally, high latency can degrade performance of replication-based tools. Therefore, assessing network capacity and optimizing the transfer path is a critical planning factor.

Exam trap

The trap here is that candidates often focus on operational features of DocumentDB (like automated backups or authentication) as migration planning factors, when the actual critical considerations are source version compatibility and network constraints that directly affect the feasibility and duration of the migration.

1131
Multi-Selectmedium

A company is experiencing slow query performance on an Amazon RDS for MySQL database. The DBA wants to identify the most time-consuming queries. Which TWO actions should the DBA take? (Choose two.)

Select 2 answers
A.Enable the audit log.
B.Enable the general log and review it.
C.Use Amazon RDS Enhanced Monitoring.
D.Use Amazon RDS Performance Insights.
E.Enable the slow query log and monitor it in CloudWatch Logs.
AnswersD, E

Performance Insights identifies top SQL by load.

Why this answer

Amazon RDS Performance Insights (Option D) provides a database performance tuning and monitoring feature that visualizes database load and identifies the most time-consuming queries by breaking down wait events, SQL statements, and hosts. It directly helps the DBA pinpoint the specific queries causing performance degradation without additional configuration or overhead.

Exam trap

The trap here is that candidates often confuse general logging (Option B) with slow query logging, or assume Enhanced Monitoring (Option C) provides query-level insights, when in fact only Performance Insights and the slow query log directly identify the most time-consuming queries.

1132
Multi-Selecthard

A company uses Amazon Aurora MySQL for its e-commerce platform. The DB cluster has one writer and two readers. Recently, the application started showing occasional deadlock errors during order processing. The error logs show: 'Transaction (Process ID 123) was deadlocked on lock resources with another process and has been chosen as the deadlock victim. Rerun the transaction.' The application retries three times before failing. The development team wants to reduce the likelihood of deadlocks. Which three actions should the team take? (Choose three.)

Select 3 answers
A.Shorten the duration of transactions by committing frequently.
B.Switch to READ UNCOMMITTED isolation level to reduce locking.
C.Use READ COMMITTED isolation level instead of REPEATABLE READ.
D.Increase the number of retry attempts to 10.
E.Ensure that transactions access tables in the same order.
AnswersA, C, E

Shorter transactions hold locks for less time, reducing the chance of conflicts.

Why this answer

Reduces the time locks are held, decreasing contention. Option C uses a weaker isolation level (READ COMMITTED) that reduces locking overhead compared to REPEATABLE READ. Option E ensures transactions request locks in a consistent order, preventing cycle dependencies.

Option B is incorrect because READ UNCOMMITTED can cause dirty reads and is not suitable for e-commerce order processing. Option D is incorrect because increasing retry attempts does not reduce the likelihood of deadlocks; it only allows more retries after a deadlock occurs.

1133
MCQmedium

An IAM policy is attached to a role used by an RDS instance. The RDS instance is in VPC with a VPC endpoint to KMS. What is the effect of this policy?

A.Allows all KMS actions on the key only when the request comes from RDS.
B.Allows all KMS actions on the specified key from any source.
C.Allows the specified KMS actions on all KMS keys in the account.
D.Allows only the specified KMS actions on the key when the request originates from the RDS service via the specific VPC endpoint.
AnswerD

The policy has conditions limiting to RDS and VPC endpoint.

Why this answer

An IAM policy attached to a role used by an RDS instance, combined with a VPC endpoint to KMS, restricts the allowed KMS actions to only those specified and requires that the request originate from the RDS service via that specific VPC endpoint. Option A is incorrect because it suggests all KMS actions are allowed, which is not the case; only specified actions are allowed. Option B is incorrect because it mistakenly implies the policy allows actions from any source, ignoring the VPC endpoint restriction.

Option C is incorrect because it states the policy applies to all KMS keys, whereas it is typically scoped to a specific key.

1134
Multi-Selecteasy

Which TWO CloudWatch metrics should be monitored to determine if an Amazon Aurora MySQL DB cluster has sufficient I/O capacity?

Select 2 answers
A.ReadIOPS
B.WriteIOPS
C.FreeableMemory
D.CPUUtilization
E.DatabaseConnections
AnswersA, B

ReadIOPS shows the number of read I/O operations per second.

Why this answer

The correct metrics to monitor for sufficient I/O capacity are ReadIOPS (Option A) and WriteIOPS (Option B). These metrics represent the actual number of read and write I/O operations per second. If the cluster is approaching the maximum IOPS limit of the underlying storage, increasing I/O capacity may be needed.

Option C (FreeableMemory) is related to memory, not I/O. Option D (CPUUtilization) measures CPU usage, not I/O. Option E (DatabaseConnections) tracks connections, not I/O capacity.

1135
MCQeasy

A company is migrating a MySQL database from on-premises to Amazon RDS for MySQL. They want to use native MySQL replication to minimize downtime. Which configuration is required in the on-premises MySQL server?

A.Enable the slow query log
B.Enable binary logging with binlog_format = ROW
C.Enable the audit log
D.Enable the error log
AnswerB

Binary logging is required for MySQL replication.

Why this answer

Native MySQL replication requires binary logging on the source server to capture all changes. Setting binlog_format = ROW ensures that row-level changes are logged, which is the recommended format for cross-version replication and is required by Amazon RDS for MySQL to support replication from an external source. Without binary logging enabled, the on-premises MySQL server cannot act as a replication master.

Exam trap

The trap here is that candidates may confuse logging features (slow query log, audit log, error log) with the binary log, which is the only log that provides the change data stream required for native MySQL replication.

How to eliminate wrong answers

Option A is wrong because enabling the slow query log is used for performance troubleshooting and does not provide the change data stream needed for replication. Option C is wrong because the audit log records user activity for security compliance and does not capture the binary log events required for replication. Option D is wrong because the error log records server errors and warnings, not the transactional changes needed to replicate data to RDS.

1136
MCQhard

A company runs an Amazon Aurora MySQL database cluster with one writer and two readers. The application suddenly fails with 'Too many connections' error. The writer instance's maximum connections is set to 1000. Which configuration change would best resolve the issue while maintaining high availability?

A.Enable Amazon RDS Proxy for the database cluster.
B.Increase the max_connections parameter on the writer instance to 5000.
C.Redirect all write requests to one of the read replicas.
D.Manually kill idle connections from the database.
AnswerA

Correct. RDS Proxy efficiently manages database connections, reducing the number of open connections.

Why this answer

Amazon RDS Proxy acts as a connection pooler that manages database connections efficiently. By reducing connection churn and reusing connections, it prevents the 'Too many connections' error without overloading the instance. Option B is incorrect because simply increasing max_connections could lead to resource exhaustion and degradation of performance.

Option C is incorrect because read replicas cannot accept write traffic; they are read-only. Option D is incorrect because manually killing idle connections is a temporary fix and not a configuration change; it does not prevent the issue from recurring.

1137
MCQhard

A company has an Amazon RDS for Oracle DB instance that needs to be encrypted at rest. The instance currently uses Oracle Transparent Data Encryption (TDE) with a key stored in the database. The company wants to use AWS KMS for key management. What is the correct migration path?

A.Take a snapshot of the DB instance, copy the snapshot with KMS encryption, and restore from the encrypted snapshot.
B.Enable KMS encryption directly on the existing DB instance using the AWS CLI.
C.Create a read replica with KMS encryption.
D.Modify the DB instance and select the KMS key.
AnswerA

To change the encryption key from Oracle TDE to AWS KMS, you must take a snapshot of the DB instance, copy the snapshot with KMS encryption, and restore from the encrypted snapshot. This process enables encryption at rest with KMS.

Why this answer

To change the encryption key from Oracle TDE to AWS KMS, you must take a snapshot of the DB instance, copy the snapshot with KMS encryption, and restore from the encrypted snapshot. This process enables encryption at rest with KMS. Option B is incorrect because you cannot directly enable KMS encryption on an existing TDE instance; this is not supported.

Option C is incorrect because creating a read replica does not allow changing the encryption key; read replicas inherit the source instance's encryption. Option D is incorrect because you cannot modify the encryption key in place on an existing instance.

1138
MCQmedium

An e-learning platform uses Amazon Aurora MySQL for its database. The application runs reporting queries that scan large portions of the database, causing high CPU utilization on the primary instance. The primary instance is a db.r5.2xlarge with 64 GB memory. The reporting queries are not time-sensitive but need to return results within 5 minutes. The operations team wants to reduce the impact on the primary instance without increasing costs significantly. Which action should be taken?

A.Modify the DB cluster parameter group to enable result set caching
B.Create an Aurora Replica and configure the reporting application to connect to the replica endpoint
C.Use Amazon ElastiCache to cache the reporting results
D.Increase the primary instance to db.r5.4xlarge
AnswerB

Creating an Aurora Replica allows reporting queries to run on a separate read-only instance, reducing CPU on the primary. It is cost-effective because you only pay for the replica instance.

Why this answer

To create an Aurora Replica and direct reporting traffic to it. This offloads the heavy reporting queries from the primary instance, reducing CPU impact without significant cost increase. Aurora Replicas share the same storage and are cost-effective for read-heavy workloads.

1139
MCQhard

A company is migrating a 10 TB Amazon RDS for MySQL database to Amazon Aurora MySQL. The migration must have minimal downtime and must support point-in-time recovery for the source during migration. Which approach meets these requirements?

A.Create a read replica of the source RDS instance, use AWS DMS with CDC from the read replica to Aurora, then promote Aurora.
B.Use mysqldump to export the database, import into Aurora, and point DNS to Aurora.
C.Use AWS DMS with CDC directly from the source RDS instance to Aurora.
D.Take a snapshot of the source RDS instance, restore to Aurora, and point DNS to Aurora.
AnswerA

Read replica minimizes source impact, CDC allows minimal downtime, PITR on source remains.

Why this answer

Creating a read replica of the source RDS for MySQL instance and using AWS DMS with Change Data Capture (CDC) from that replica allows the migration to proceed with minimal downtime. The read replica offloads the CDC overhead from the source, and CDC captures ongoing changes after the full load, enabling a near-zero-downtime cutover. Additionally, the source RDS instance remains fully available for point-in-time recovery (PITR) throughout the migration, as the read replica does not interfere with the source's backup or transaction log retention.

Exam trap

The trap here is that candidates often assume DMS CDC must be run directly from the source for simplicity, overlooking that a read replica isolates the migration workload and preserves the source's point-in-time recovery capabilities, which is a key requirement in this question.

How to eliminate wrong answers

Option B is wrong because using mysqldump for a 10 TB database would require an extended period of downtime to export and import the data, and it does not support ongoing replication (CDC), so it cannot achieve minimal downtime. Option C is wrong because using AWS DMS with CDC directly from the source RDS instance can impact source performance and may interfere with the source's transaction logs needed for point-in-time recovery, especially under heavy write loads; the recommended best practice is to use a read replica to isolate the CDC load. Option D is wrong because taking a snapshot and restoring to Aurora is a one-time, offline migration that does not capture ongoing changes during the migration process, resulting in significant downtime and no support for point-in-time recovery of the source during the migration.

1140
MCQmedium

A company is migrating a MySQL database to Amazon Aurora MySQL. The database has several stored procedures and triggers. During the migration, some stored procedures fail to execute. What is the most likely cause?

A.Aurora does not support stored procedures.
B.The stored procedures exceed the maximum size limit in Aurora.
C.The stored procedures use features that are not compatible with Aurora MySQL.
D.The stored procedures use MyISAM tables, which are not supported by Aurora.
AnswerC

Aurora MySQL has some differences; stored procedures may need modifications.

Why this answer

Aurora MySQL is designed to be compatible with MySQL 5.6, 5.7, and 8.0, but it does not support all MySQL features. Stored procedures that rely on deprecated or non-standard MySQL features, such as certain SQL modes, storage engine-specific syntax, or unsupported functions, will fail to execute after migration. This is the most common cause of stored procedure failures during a migration to Aurora MySQL.

Exam trap

The trap here is that candidates may assume Aurora MySQL is a drop-in replacement for all MySQL features, but the exam tests awareness of specific incompatibilities in stored procedures, triggers, and functions that are not supported or behave differently in Aurora.

How to eliminate wrong answers

Option A is wrong because Aurora MySQL fully supports stored procedures, including triggers and functions, as part of its MySQL compatibility. Option B is wrong because Aurora MySQL does not impose a specific maximum size limit on stored procedures beyond the general MySQL limits (e.g., max_allowed_packet), which are typically not the cause of migration failures. Option D is wrong because while MyISAM tables are not supported by Aurora MySQL (which uses InnoDB only), the question specifically states that stored procedures are failing, not table operations; stored procedures themselves do not depend on MyISAM tables for execution.

1141
MCQmedium

A company is designing a database for a ride-sharing application that needs to store real-time driver locations and trip history. The application requires low-latency updates to driver locations (every few seconds) and the ability to query nearby drivers within a radius. The company expects millions of drivers and trips. Which AWS database service should the database specialist recommend for storing real-time driver locations and supporting proximity queries?

A.Amazon RDS for PostgreSQL with PostGIS extension
B.Amazon ElastiCache for Redis with geospatial data types
C.Amazon DynamoDB with a Geohash-based partition key and a Global Secondary Index
D.Amazon Timestream
AnswerC

DynamoDB can handle high throughput and geospatial queries via Geohash.

Why this answer

Amazon DynamoDB with a Geohash-based partition key and a Global Secondary Index is the correct choice because it provides the low-latency writes (single-digit milliseconds) required for updating driver locations every few seconds, while the Geohash-based key enables efficient proximity queries by grouping nearby drivers into the same partition. The Global Secondary Index allows querying by geohash prefix to find drivers within a radius, scaling to millions of drivers and trips with DynamoDB's auto-scaling and fully managed infrastructure.

Exam trap

The trap here is that candidates often choose Amazon ElastiCache for Redis because of its built-in geospatial commands (GEOADD/GEORADIUS), overlooking the requirement for durable trip history storage and the scalability limits of Redis when handling millions of concurrent updates and queries.

How to eliminate wrong answers

Option A is wrong because Amazon RDS for PostgreSQL with PostGIS, while capable of geospatial queries, cannot achieve the required low-latency writes at millions of updates per second due to its single-master architecture and ACID transaction overhead, making it unsuitable for real-time location updates every few seconds at scale. Option B is wrong because Amazon ElastiCache for Redis with geospatial data types is an in-memory cache, not a durable database; it lacks built-in persistence and durability guarantees for trip history, and its geospatial commands (GEOADD, GEORADIUS) are designed for smaller datasets and cannot reliably handle millions of drivers with consistent query performance. Option D is wrong because Amazon Timestream is a time-series database optimized for analyzing sequential data over time, not for low-latency point updates or geospatial proximity queries, and it does not support indexing or querying by geographic coordinates.

1142
MCQhard

A social media application stores user posts in an Amazon RDS for PostgreSQL instance. The application experiences a sudden spike in read traffic during peak hours, causing database bottlenecks. The team needs to improve read scalability without changing the application code. Which solution is MOST cost-effective?

A.Migrate to Amazon DynamoDB with DAX
B.Enable Multi-AZ on the RDS instance
C.Use Amazon RDS for PostgreSQL Read Replicas
D.Use Amazon ElastiCache to cache query results
AnswerC

Read Replicas offload read traffic; requires minor configuration but no application code changes.

Why this answer

Amazon RDS for PostgreSQL Read Replicas allow you to offload read traffic from the primary DB instance to one or more read-only replicas, improving read scalability without any application code changes. This is the most cost-effective solution as it leverages the existing PostgreSQL engine and requires only minimal additional compute and storage costs for the replicas.

Exam trap

The trap here is that candidates often confuse Multi-AZ with read scalability, but Multi-AZ only provides failover redundancy and does not allow the standby to serve read traffic, whereas Read Replicas are specifically designed for read offloading.

How to eliminate wrong answers

Option A is wrong because migrating to Amazon DynamoDB with DAX would require significant application code changes to switch from a relational to a NoSQL data model, which violates the requirement of not changing the application code. Option B is wrong because enabling Multi-AZ on the RDS instance provides high availability and automatic failover, but it does not improve read scalability; the standby replica is not used for read traffic. Option D is wrong because using Amazon ElastiCache to cache query results would require application code modifications to implement caching logic, which contradicts the requirement of no application code changes.

1143
MCQhard

A company runs an online auction platform on AWS. The application uses Amazon DynamoDB as the primary database, with a table 'Auctions' that has a partition key 'auction_id' (String) and sort key 'end_time' (Number). The table also has a global secondary index (GSI) on 'status' (String) and 'current_bid' (Number). The application frequently queries for active auctions sorted by current bid. Recently, the team noticed that queries on the GSI for active auctions with a high current_bid are returning results slowly. The DynamoDB table has 10,000 write capacity units (WCU) and 30,000 read capacity units (RCU) provisioned. The GSI has 5,000 RCU provisioned. The team suspects throttling on the GSI. What is the most likely cause of the slow queries?

A.The GSI's provisioned RCU is insufficient due to hot partitions.
B.The GSI key schema is inefficient for the query pattern.
C.The table's WCU is too low, causing throttling on writes that affects reads.
D.The table's RCU is too low for the application's read load.
AnswerA

Hot partitions can throttle even if total RCU is not fully used.

Why this answer

The GSI has 5,000 RCU provisioned, but if the GSI's partition key (status) and sort key (current_bid) lead to a hot partition—for example, many active auctions have the same status and similar current_bid—that single partition can throttle even if the total RCU is not fully utilized. This is because DynamoDB distributes RCU evenly across partitions, and a hot partition can exceed its allocated RCU, causing throttling on that partition. Option B is incorrect because the index key schema (status, current_bid) is actually appropriate for querying active auctions sorted by current bid; the issue is hot partitions, not inefficiency.

Option C is incorrect because WCU throttling does not directly affect read performance on the GSI. Option D is incorrect because the table's RCU is separate from the index's RCU, and the index's RCU is the relevant factor.

1144
MCQeasy

A developer is troubleshooting an issue where an IAM user cannot perform a 'DescribeTable' action on a DynamoDB table. The IAM policy attached to the user is: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["dynamodb:GetItem","dynamodb:PutItem"],"Resource":"*"}]}. What is the most likely reason for the failure?

A.The policy uses lowercase 'dynamodb' but the action is case-sensitive.
B.There is an implicit Deny for DescribeTable due to a service control policy.
C.The policy does not include the 'dynamodb:DescribeTable' action.
D.The resource specified in the policy is '*' which does not include the table.
AnswerC

The policy only allows GetItem and PutItem.

Why this answer

The IAM policy only includes the actions 'dynamodb:GetItem' and 'dynamodb:PutItem', but does not include 'dynamodb:DescribeTable'. Therefore, the IAM user is denied the DescribeTable action by default. Option A is incorrect because although action names are case-sensitive, the policy uses the correct lowercase 'dynamodb' and the actions are properly cased.

Option B is incorrect because there is no implicit Deny; the policy grants access to GetItem and PutItem, and DescribeTable is simply not allowed. Service control policies could apply, but they are not the most likely reason given the policy's explicit lack of the required action. Option D is incorrect because the resource '*' does include all tables; the problem is the missing action, not the resource specification.

1145
MCQmedium

A company is experiencing increased latency on their RDS for PostgreSQL instance. The CloudWatch metrics show high ReadIOPS but low CPU utilization. Which action is MOST likely to resolve the issue?

A.Migrate the database to Amazon Aurora PostgreSQL
B.Increase the instance size or switch to a gp3 volume
C.Enable Multi-AZ deployment
D.Enable storage auto-scaling
AnswerB

More memory and I/O capacity reduces wait events.

Why this answer

High ReadIOPS with low CPU indicates an I/O bottleneck. Increasing the instance size provides more dedicated IOPS, and switching to gp3 volume offers better baseline performance and throughput compared to gp2. Option A is incorrect because migrating to Aurora does not directly address the I/O bottleneck and involves additional considerations.

Option C is incorrect because Multi-AZ provides high availability, not improved performance. Option D is incorrect because storage auto-scaling only increases storage capacity, not IOPS or throughput.

1146
MCQeasy

A developer is troubleshooting an issue where an application using Amazon DynamoDB is receiving occasional 'ThrottlingException' errors. The application uses eventually consistent reads. What is the MOST likely cause of this error?

A.The application is using an incorrect table name
B.The read capacity units are set too low for the current traffic pattern
C.The application is using eventually consistent reads instead of strongly consistent reads
D.There is a network connectivity issue between the application and DynamoDB
AnswerB

Throttling happens when traffic exceeds provisioned capacity.

Why this answer

ThrottlingException occurs when the request rate exceeds the provisioned throughput capacity. Option A is incorrect because an incorrect table name would result in a ResourceNotFoundException, not a ThrottlingException. Option C is incorrect because eventually consistent reads consume half the read capacity units compared to strongly consistent reads, making them less likely to cause throttling.

Option D is incorrect because network connectivity issues would typically cause timeout or connection errors, not ThrottlingException.

1147
MCQmedium

A developer sees the above key schema for the ProductCatalog table. Which query will be most efficient for retrieving a single item?

A.Query with Category = 'Books'
B.GetItem with ProductId = '123'
C.Scan the table and filter by ProductId
D.GetItem with ProductId = '123' and Category = 'Books'
AnswerD

Providing both keys uniquely identifies the item.

Why this answer

The ProductCatalog table's primary key is a composite key of Category (partition key) and ProductId (sort key). A GetItem operation with both the partition key and sort key provides the most efficient direct access to a single item, as it uses the primary key to retrieve the item with exactly one read operation, without any filtering or scanning.

Exam trap

The trap here is that candidates often assume GetItem only needs the partition key, forgetting that for tables with a composite primary key (partition key and sort key), both are required to uniquely identify and retrieve a single item.

How to eliminate wrong answers

Option A is wrong because a Query with only Category='Books' would retrieve all items in that partition, requiring additional filtering to find a single item, and is less efficient than a direct GetItem. Option B is wrong because GetItem with only ProductId='123' is invalid without the partition key (Category); DynamoDB requires the full primary key (partition key and sort key) for a GetItem operation on a table with a composite key. Option C is wrong because scanning the entire table and filtering by ProductId is the least efficient approach, as it reads every item in the table and incurs high read capacity consumption, especially on large tables.

1148
MCQhard

A company is migrating a 10 TB MongoDB database to Amazon DocumentDB. The migration must have minimal downtime. Which strategy should be used?

A.Use mongodump to export the database and mongorestore to import into DocumentDB.
B.Use AWS CloudEndure to replicate the MongoDB server to DocumentDB.
C.Copy the database files to Amazon S3 and restore to DocumentDB.
D.Use AWS DMS with MongoDB as source and DocumentDB as target, with change data capture.
AnswerD

AWS DMS supports MongoDB as a source and can perform continuous replication.

Why this answer

AWS DMS with MongoDB as source and DocumentDB as target, using change data capture (CDC), is the correct strategy because it enables a live migration with minimal downtime. DMS performs an initial full load of the 10 TB database and then continuously replicates ongoing changes from the MongoDB oplog, allowing you to cut over to DocumentDB with only a brief pause.

Exam trap

The trap here is that candidates may assume a simple dump-and-restore or file-copy approach is sufficient for large databases, overlooking the need for change data capture to achieve minimal downtime, or they may confuse CloudEndure's server replication capabilities with database-specific migration tools.

How to eliminate wrong answers

Option A is wrong because mongodump/mongorestore is a logical backup and restore method that requires the source database to be quiesced or taken offline during the dump, causing significant downtime for a 10 TB database. Option B is wrong because AWS CloudEndure is designed for block-level replication of entire servers (e.g., physical or virtual machines) to EC2, not for replicating database schemas or data to DocumentDB, which is a managed document database service. Option C is wrong because copying raw MongoDB database files to Amazon S3 and restoring to DocumentDB is not supported; DocumentDB uses its own storage engine and does not accept raw file imports, and this method would also require taking the source offline to ensure file consistency.

1149
MCQhard

A financial services company runs a critical PostgreSQL database on Amazon RDS. The database stores transaction records and requires point-in-time recovery (PITR) with a recovery window of 35 days. The database size is 500 GB and grows at 10 GB per day. The team wants to minimize storage costs while meeting the recovery SLA. Which backup strategy should they use?

A.Take manual snapshots every hour and retain for 35 days
B.Enable automated backups with a retention period of 35 days
C.Disable automated backups and use pg_dump to S3 daily
D.Use AWS Backup to copy snapshots to another region daily
AnswerB

Automated backups provide PITR and are cost-effective; RDS manages log storage.

Why this answer

Amazon RDS automated backups provide point-in-time recovery within the retention period (up to 35 days) by storing daily snapshots and transaction logs, allowing recovery to any second. Option A is incorrect because manual snapshots every hour would be costly and provide less granular recovery compared to automated backups with transaction logs. Option C is incorrect because pg_dump to S3 only provides daily full backups, not point-in-time recovery to an arbitrary second.

Option D is incorrect because AWS Backup cross-region copies are for disaster recovery, not for local PITR, and would incur additional costs.

1150
Multi-Selecteasy

A company uses Amazon DynamoDB Global Tables for a multi-region application. The table is configured with on-demand capacity. The application writes data in the us-east-1 region and reads from us-west-2. Users in us-west-2 report that data written in us-east-1 is not appearing in us-west-2 within the expected replication latency of under 5 seconds. Instead, replication sometimes takes up to 30 seconds. Which two factors could be causing this increased replication latency? (Choose two.)

Select 2 answers
A.The application is reading from the us-west-2 table before replication completes.
B.High network latency or packet loss between us-east-1 and us-west-2.
C.The read capacity in us-west-2 is insufficient, causing read throttling.
D.The on-demand capacity mode is causing write throttling in us-east-1.
E.A large volume of writes to the table creates a backlog in the replication stream.
AnswersB, E

Replication relies on network connectivity; latency increases replication time.

Why this answer

Options B and E are correct. Option B: High network latency or packet loss between the two regions directly increases replication time. Option E: A large volume of writes creates a backlog in the Global Tables replication stream, causing delays.

Option A is incorrect because reading before replication completes is a symptom, not a cause of increased latency. Option C is incorrect because read capacity in a replica region does not affect replication latency; replication uses write capacity. Option D is incorrect because on-demand capacity automatically scales and does not cause write throttling.

1151
MCQmedium

A company is running an Amazon RDS for SQL Server DB instance. The database administrator needs to perform a major version upgrade. What is the recommended approach to minimize downtime?

A.Use AWS Database Migration Service (DMS) to migrate the database to a new instance with the new version.
B.Create a Read Replica of the DB instance with the new version, promote it to a standalone instance, and then redirect application traffic.
C.Take a snapshot of the DB instance and restore it with the new version.
D.Modify the DB instance directly and apply the new version during the maintenance window.
AnswerA

Correct. AWS DMS can migrate to a new RDS instance with a new major version while minimizing downtime through continuous replication and a cutover.

Why this answer

For Amazon RDS for SQL Server, creating a Read Replica with a different major version is not supported. Therefore, the recommended approach to minimize downtime is to use AWS Database Migration Service (DMS) to migrate the database to a new instance with the new version. DMS allows for minimal downtime by continuously replicating data and then switching over.

Options C and D cause significant downtime during the snapshot/restore or direct upgrade process.

Exam trap

Candidates may assume that Read Replicas can be used for major version upgrades on all RDS engines, but SQL Server does not support cross-version Read Replicas.

1152
MCQeasy

A company has an Amazon Redshift cluster that contains sensitive data. The security team wants to ensure that all data is encrypted at rest and that the encryption keys are managed by AWS. Which configuration should be used?

A.Use AWS CloudHSM to generate and store encryption keys.
B.Use server-side encryption with S3-managed keys (SSE-S3) for the Redshift cluster.
C.Enable encryption at rest using the default AWS-managed KMS key for Redshift.
D.Use client-side encryption with the AWS Encryption SDK.
AnswerC

This encryption is managed by AWS and uses KMS.

Why this answer

Amazon Redshift supports encryption at rest using AWS KMS. When you enable encryption, you can choose to use the default AWS-managed key (aws/redshift) or a customer-managed key. The default key is managed by AWS, meeting the requirement that keys are managed by AWS.

Option A is incorrect because CloudHSM is used for customer-managed keys, not AWS-managed keys. Option B is incorrect because SSE-S3 is for S3 objects, not Redshift clusters. Option D is incorrect because client-side encryption is not supported for Redshift at rest.

1153
MCQhard

A company is migrating a 5 TB PostgreSQL database to Amazon Aurora PostgreSQL. The database has complex stored procedures and triggers. The migration must be completed within a 30-minute downtime window. Which approach would meet the requirement?

A.Use Database Migration Service (DMS) with validation only.
B.Use AWS DMS with full load and ongoing replication, then perform a cutover.
C.Use AWS SCT to convert the schema and then use pg_dump/pg_restore.
D.Set up an Aurora read replica from the source PostgreSQL.
AnswerB

Ongoing replication allows a fast cutover.

Why this answer

AWS DMS with full load and ongoing replication allows you to migrate the 5 TB database with minimal downtime by continuously replicating changes from the source PostgreSQL to the target Aurora PostgreSQL. When you are ready, you perform a cutover, which typically takes only a few minutes, meeting the 30-minute downtime window. The complex stored procedures and triggers are handled because DMS supports ongoing replication for PostgreSQL, capturing DML and DDL changes.

Exam trap

The trap here is that candidates often assume a full dump and restore (pg_dump/pg_restore) is the fastest method for large databases, but they overlook the need for ongoing replication to achieve a short downtime window, and they may incorrectly think Aurora read replicas can be created from external PostgreSQL sources.

How to eliminate wrong answers

Option A is wrong because DMS with validation only does not perform any data migration; it only validates the source and target schemas, so it cannot move the 5 TB database. Option C is wrong because AWS SCT is used for schema conversion, but pg_dump/pg_restore would require a full dump and restore, which for 5 TB would take far longer than 30 minutes and would not support ongoing replication to minimize downtime. Option D is wrong because setting up an Aurora read replica from a source PostgreSQL database is not supported; Aurora read replicas can only be created from an existing Aurora DB cluster, not from an external PostgreSQL instance.

1154
MCQmedium

A company is using Amazon Neptune and notices that some queries are slow. The DBA wants to identify which queries consume the most time. Which feature should be used?

A.Database audit log
B.Query profiler
C.Slow query log
D.Performance Insights
AnswerB

Query profiler captures execution details of queries.

Why this answer

Neptune's query profiler provides detailed information about query execution time. The slow query log only logs queries that exceed a threshold. The audit log is for security events.

The performance insights is for RDS, not Neptune.

1155
MCQeasy

An organization wants to migrate a 200 GB MySQL database from an on-premises server to Amazon Aurora MySQL. They have a 50 Mbps network connection. The database is 8 hours of downtime. The migration must be completed within 24 hours and costs must be minimized. The team decides to use AWS Database Migration Service (DMS). Which approach best meets the requirements?

A.Create a mysqldump and transfer it over the network to S3, then restore to Aurora.
B.Use AWS DMS with a full load and ongoing replication to minimize downtime.
C.Use AWS Snowball Edge to transfer the data physically.
D.Provision a large EC2 instance to run a parallel export and import.
AnswerB

DMS can handle full load and CDC within constraints.

Why this answer

Using a DMS full load with ongoing replication minimizes downtime and works within the network constraints. Option A is wrong because taking a dump over the network would take too long. Option C is wrong because using Snowball is overkill for 200 GB and shipping would take too long.

Option D is wrong because using a larger instance is unnecessary and costly.

1156
MCQmedium

An IAM user has the policy shown. The user is trying to restore a DB instance from a manual snapshot using the AWS CLI. The restore fails with an access denied error. What is the most likely reason?

A.The policy does not grant the rds:RestoreDBInstanceFromDBSnapshot action on the DB instance resource.
B.The rds:RestoreDBInstanceFromDBSnapshot action is misspelled.
C.The snapshot is encrypted and the user does not have permission to use the KMS key.
D.The snapshot resource ARN does not include the specific snapshot ID.
AnswerA

The restore action requires permission on both the snapshot and the DB instance.

Why this answer

The restore operation (rds:RestoreDBInstanceFromDBSnapshot) requires permission on both the snapshot resource and the DB instance resource. The IAM policy grants the action on snapshot resources (as indicated by the snapshot resource ARN), but does not grant it on the DB instance resource (the DB instance resource ARN is missing or not included for the restore action). Therefore, the restore fails with access denied even though the user can list snapshots.

Option A correctly identifies this issue. Option B is incorrect because the action is spelled correctly (the policy allows the action on snapshots). Option C is incorrect because there is no mention of encryption or KMS key in the scenario.

Option D is incorrect because the snapshot resource ARN can use a wildcard; the lack of a specific snapshot ID is not the issue.

1157
Multi-Selectmedium

A company is migrating its on-premises Oracle database to Amazon RDS for Oracle. The database is 2 TB in size and the network bandwidth is 100 Mbps. The migration must have minimal downtime. Which TWO approaches should be used together to achieve this?

Select 2 answers
A.Take a full backup of the source database and restore it to Amazon RDS.
B.Increase the network bandwidth to 1 Gbps to speed up the transfer.
C.Use AWS Schema Conversion Tool (SCT) to convert the schema before migration.
D.Use AWS Database Migration Service (DMS) with ongoing replication to keep the target in sync.
E.Use AWS Snowball to transfer the initial data load to Amazon S3, then use DMS to migrate the remaining changes.
AnswersD, E

AWS DMS with ongoing replication allows continuous data replication with minimal downtime, making it suitable for this requirement.

Why this answer

AWS DMS with ongoing replication allows continuous data replication with minimal downtime. AWS Snowball can be used for the initial large data transfer to avoid prolonged network transfer. Option A (taking a full backup and restoring) would cause downtime; Option B (increasing bandwidth) is not feasible quickly; Option C (SCT) is for schema conversion, not data migration; Option D (DMS with ongoing replication) is correct; Option E (Snowball for initial load then DMS for ongoing changes) minimizes network transfer time.

1158
MCQhard

A company is migrating an on-premises Oracle database to Amazon Aurora PostgreSQL. The database has several stored procedures that use Oracle-specific PL/SQL. The team needs to minimize manual code changes. Which AWS service or tool should be used to automate the conversion of the stored procedures?

A.AWS Schema Conversion Tool (AWS SCT)
B.Amazon Aurora PostgreSQL native compatibility
C.AWS Database Migration Service (AWS DMS)
D.Manual rewrite using PostgreSQL PL/pgSQL
AnswerA

AWS SCT automates the conversion of database schemas and code, including PL/SQL, to target database engines.

Why this answer

The AWS Schema Conversion Tool (AWS SCT) is the correct choice because it automates the conversion of Oracle PL/SQL stored procedures to PostgreSQL PL/pgSQL, minimizing manual code changes. Option B (Amazon Aurora PostgreSQL native compatibility) does not automatically convert Oracle PL/SQL; it only supports some PostgreSQL features. Option C (AWS DMS) handles data migration, not schema or code conversion.

Option D (manual rewrite) is not automated and contradicts the requirement to minimize manual changes.

1159
Multi-Selecteasy

Which TWO of the following are methods to encrypt data at rest for an Amazon RDS for Oracle DB instance? (Select TWO.)

Select 2 answers
A.Enable encryption at rest using AWS KMS when creating the DB instance.
B.Use Oracle Transparent Data Encryption (TDE) with the Oracle wallet.
C.Enable SSL/TLS for the DB instance.
D.Configure Amazon S3 server-side encryption on the DB instance's storage.
E.Use client-side encryption in the application before sending data to RDS.
AnswersA, B

RDS can be launched with KMS encryption.

Why this answer

Options A and B are correct. Amazon RDS for Oracle supports encryption at rest via two methods: enabling encryption using AWS KMS when creating the DB instance (Option A) or using Oracle Transparent Data Encryption (TDE) with a customer-managed Oracle wallet (Option B). Option C (SSL/TLS) encrypts data in transit, not at rest.

Option D (S3 SSE) is irrelevant as S3 is not used for RDS storage. Option E (client-side encryption) is an application-level approach and not a native RDS encryption method.

1160
Multi-Selecthard

A company is migrating a 3 TB Oracle database to Amazon Aurora PostgreSQL. The database has a heavy OLTP workload with many small transactions. The migration must have minimal downtime. Which TWO strategies should the company use? (Choose two.)

Select 2 answers
A.Convert the database to Amazon Aurora MySQL instead.
B.Create an Aurora read replica from the Oracle database.
C.Use AWS DMS with ongoing replication to capture and apply changes.
D.Use AWS Schema Conversion Tool (SCT) to convert the schema.
E.Set the target database to Amazon Aurora PostgreSQL.
AnswersC, E

Provides minimal downtime by replicating changes continuously.

Why this answer

AWS DMS with ongoing replication (CDC) is the correct strategy because it allows continuous capture and application of changes from the source Oracle database to the target Aurora PostgreSQL, enabling minimal downtime during migration. The heavy OLTP workload with many small transactions is well-suited for DMS's change data capture, which can handle high-volume transactional changes efficiently.

Exam trap

The trap here is that candidates often confuse schema conversion tools (SCT) with data migration tools (DMS), or mistakenly think that creating a read replica from a non-Aurora source is possible, leading them to select options that do not address the minimal downtime requirement.

1161
MCQhard

A database administrator is using AWS DMS to migrate an on-premises Oracle database to Amazon RDS for PostgreSQL. The migration has been running for several hours, but the full load phase is taking much longer than expected. The CPU utilization on the DMS replication instance is consistently below 10%. What is the MOST likely cause of the slow performance?

A.The source database has large LOBs that are being transferred in full LOB mode.
B.The target database engine is not compatible with DMS.
C.The DMS task is not configured to use parallel tables.
D.The target RDS instance is throttling write operations due to low IOPS.
AnswerD

Low IOPS on the target can cause DMS to wait, leading to low CPU on the replication instance.

Why this answer

When the target RDS instance has insufficient IOPS, write operations are throttled, causing a bottleneck that slows down the full load phase. Even though the DMS replication instance's CPU is low (below 10%), the target database cannot keep up with the incoming data, leading to increased latency and reduced throughput. This is a common performance issue in DMS migrations where the target's provisioned IOPS are exhausted, especially during large data loads.

Exam trap

The trap here is that candidates often assume slow migration is due to DMS configuration (like LOB mode or parallelism) or source-side issues, but the low CPU on the replication instance is a key indicator that the bottleneck is on the target side, specifically I/O throttling.

How to eliminate wrong answers

Option A is wrong because large LOBs transferred in full LOB mode can slow down migration, but this would typically cause high CPU or memory usage on the DMS instance, not consistently low CPU. Option B is wrong because Amazon RDS for PostgreSQL is a fully compatible target for AWS DMS; DMS supports Oracle-to-PostgreSQL migrations natively. Option C is wrong because not using parallel tables can reduce throughput, but the DMS task would still utilize the replication instance's resources more heavily; the low CPU indicates the bottleneck is elsewhere, not in parallelism.

1162
MCQeasy

A company uses Amazon RDS for PostgreSQL with a single-AZ deployment. The operations team needs to ensure that the database is available during a planned maintenance event that requires a reboot. The maintenance window is set for 30 minutes. The database size is 200 GB and the application can tolerate a few minutes of downtime. Which action should the team take to minimize downtime during the reboot?

A.Take a manual snapshot before the maintenance window and restore it if needed
B.Create a read replica and promote it to primary after the reboot
C.Schedule the reboot during a low-traffic period
D.Modify the DB instance to be Multi-AZ
AnswerD

Multi-AZ provides automatic failover with minimal downtime during maintenance.

Why this answer

Enabling Multi-AZ on the RDS instance creates a standby in a different Availability Zone. During planned maintenance, Amazon RDS automatically performs a failover to the standby, resulting in minimal downtime (typically under a minute), which meets the requirement of a few minutes of downtime. Option A is incorrect because restoring from a manual snapshot takes much longer than a few minutes and is not an automated failover.

Option B is incorrect because promoting a read replica requires manual intervention and the replica may not be fully synchronized, leading to potential data loss and longer downtime. Option C merely schedules the reboot during low traffic but does not reduce the downtime of the reboot itself; the instance still becomes unavailable during the reboot.

1163
MCQhard

A company is using an Amazon RDS for MySQL database and needs to audit all database login events. The audit logs must be stored in Amazon S3 for long-term retention. Which steps should be taken to accomplish this?

A.Enable the 'general_log' parameter and set 'log_output' to 'FILE', then copy the log file to S3 manually.
B.Enable CloudTrail data events for RDS to capture login events and store in S3.
C.Enable the 'audit_log' plugin and configure RDS to publish logs to an S3 bucket.
D.Enable the 'audit_log' plugin, publish logs to CloudWatch Logs, and create an export task to S3.
AnswerD

This is the standard method to get audit logs into S3.

Why this answer

Amazon RDS for MySQL supports the audit_log plugin, which captures login events. These logs can be published to CloudWatch Logs, and then an export task can be created to move them to Amazon S3 for long-term retention. Option A is incorrect because RDS does not allow direct log file copying to S3 via manual methods.

Option B is incorrect because CloudTrail data events for RDS capture API calls, not database-level login events. Option C is incorrect because RDS does not natively publish audit logs directly to an S3 bucket; they must go through CloudWatch Logs first.

1164
MCQmedium

A company uses Amazon ElastiCache for Redis as a caching layer for a web application. They observe a sudden increase in CPU utilization on the cache cluster, and the application experiences higher latency. Which action should be taken to diagnose the issue?

A.Enable query profiling on the ElastiCache cluster.
B.Monitor Amazon CloudWatch metrics for the ElastiCache cluster to identify the cause.
C.Disable persistence to reduce CPU overhead.
D.Immediately scale up to a larger node type.
AnswerB

Correct. CloudWatch metrics provide insight into CPU usage, cache hits/misses, and other performance indicators.

Why this answer

The first step in diagnosing a sudden CPU utilization increase and latency in ElastiCache is to monitor CloudWatch metrics such as CPUUtilization, CacheHits, CacheMisses, and EngineCPUUtilization to identify patterns or bottlenecks. Option A is incorrect because ElastiCache for Redis does not support query profiling; that feature is for RDS. Option C is incorrect because disabling persistence (e.g., AOF or RDB) reduces durability but is not a diagnostic action and may not address CPU issues.

Option D is incorrect because scaling up should only be considered after analyzing metrics to determine if capacity is the actual problem.

1165
Multi-Selecteasy

A company uses Amazon DynamoDB and wants to audit access to a table. Which TWO services can be used together to log and monitor data plane operations? (Choose TWO.)

Select 2 answers
A.Amazon CloudWatch Logs
B.S3 access logs
C.AWS CloudTrail
D.VPC Flow Logs
E.AWS Config
AnswersA, C

CloudWatch Logs can store and monitor CloudTrail logs.

Why this answer

AWS CloudTrail (option C) can be configured to log data plane operations for DynamoDB, such as GetItem, PutItem, or Query. Amazon CloudWatch Logs (option A) can then be used to store, monitor, and alarm on these logs. Together they provide auditing of data plane access.

Options B, D, and E are incorrect: S3 access logs only apply to S3, VPC Flow Logs capture network traffic, and AWS Config records configuration changes, not data operations.

1166
MCQeasy

A developer wants to grant an IAM user read-only access to an Amazon DynamoDB table named 'Orders' in the 'us-east-1' region. Which IAM policy should be attached to the user?

A.{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["dynamodb:GetItem","dynamodb:Query","dynamodb:Scan"],"Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/Orders"}]}
B.{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["dynamodb:*"],"Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/Orders"}]}
C.{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["dynamodb:GetItem","dynamodb:PutItem","dynamodb:UpdateItem"],"Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/Orders"}]}
D.{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":["dynamodb:PutItem","dynamodb:UpdateItem","dynamodb:DeleteItem"],"Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/Orders"}]}
AnswerA

This allows read-only actions on the table.

Why this answer

It grants only the read-only actions GetItem, Query, and Scan on the specified DynamoDB table. Option B is incorrect because it grants full DynamoDB access (dynamodb:*) to the table, allowing write and delete operations. Option C is incorrect because it includes PutItem and UpdateItem, which are write operations.

Option D is incorrect because it uses a Deny effect for write operations, but an explicit deny is not necessary and could conflict with other policies; additionally, it does not explicitly allow read actions, so the user would have no access.

1167
MCQeasy

A company is using Amazon DynamoDB to store session data for a web application. The session data expires after 24 hours. Which DynamoDB feature should the company use to automatically delete expired items?

A.A retention policy on the DynamoDB table
B.DynamoDB Time to Live (TTL)
C.DynamoDB Streams
D.A scheduled AWS Lambda function that scans and deletes expired items
AnswerB

TTL automatically deletes expired items based on a timestamp attribute.

Why this answer

DynamoDB Time to Live (TTL) is the correct choice because it provides a cost-effective, fully managed mechanism to automatically delete expired items based on a timestamp attribute in the table. TTL works by comparing the current time to the epoch time value stored in the designated TTL attribute; when the value is in the past, DynamoDB marks the item for deletion, typically within 48 hours. This eliminates the need for custom code or additional AWS services, directly addressing the requirement to remove session data after 24 hours.

Exam trap

The trap here is that candidates may overcomplicate the solution by choosing a custom Lambda-based approach (Option D) or misidentifying Streams (Option C) as a deletion mechanism, when DynamoDB's native TTL feature is the simplest, most cost-effective, and fully managed answer.

How to eliminate wrong answers

Option A is wrong because DynamoDB does not support a native 'retention policy' on tables; retention policies are a feature of services like Amazon S3 or CloudWatch Logs, not DynamoDB. Option C is wrong because DynamoDB Streams capture item-level changes (inserts, updates, deletes) in near-real-time but do not themselves delete items; they are a notification mechanism, not a data lifecycle management feature. Option D is wrong because while a scheduled Lambda function that scans and deletes expired items could technically work, it is an inefficient, custom solution that consumes read/write capacity and incurs additional cost and complexity, whereas TTL provides the same functionality natively and at no extra cost.

1168
Multi-Selectmedium

A company is running an Amazon RDS for MySQL instance with Multi-AZ. The primary instance in us-east-1a fails, and the standby in us-east-1b is promoted. The application cannot connect after failover. Which TWO steps should the database administrator take to restore connectivity?

Select 2 answers
A.Update the application's connection string to point to the new writer endpoint.
B.Reboot the new primary instance to reset connections.
C.Update the security group to allow inbound traffic from the application.
D.Wait for DNS propagation and flush the application's DNS cache.
E.Create a read replica and promote it to a new primary.
AnswersA, D

Explicitly updating the endpoint ensures immediate connectivity.

Why this answer

After failover, the application may be connecting to the old primary instance endpoint. Updating the connection string to the DNS writer endpoint (which automatically points to the new primary) ensures connectivity. Option D is correct because after failover, the writer endpoint's DNS record updates to the new primary's IP.

Waiting for propagation and flushing the DNS cache ensures the application resolves the updated IP. Option B is incorrect because rebooting is not required and would cause further disruption. Option C is incorrect because the security group already permits traffic from the application; the issue is DNS resolution, not network access.

Option E is incorrect because creating a read replica does not solve the connectivity issue and is unnecessary for a Multi-AZ failover.

1169
MCQeasy

A company has an Amazon RDS for MySQL database that contains sensitive data. The security team requires that all data be encrypted at rest using a customer-managed key stored in AWS KMS. Which action should be taken to meet this requirement?

A.Enable encryption on the existing RDS instance by modifying the instance.
B.Create a new RDS instance with encryption enabled using the KMS key, migrate data, and delete the old instance.
C.Configure the DB parameter group to require encryption at rest.
D.Create a snapshot of the unencrypted database and restore it as an encrypted database.
AnswerB

This is the only way to achieve encryption at rest with a customer-managed KMS key for an existing database.

Why this answer

Amazon RDS encryption at rest with a customer-managed KMS key can only be enabled when the DB instance is created. You cannot enable encryption on an existing unencrypted instance (option A is incorrect). Once you create a new encrypted instance using the desired KMS key, you can migrate the data from the old instance and then delete it.

Option D is incorrect because restoring a snapshot of an unencrypted database without modifying encryption settings will result in an unencrypted instance; you would need to create an encrypted copy of the snapshot first, which is not described. Option C is incorrect because DB parameter groups do not control encryption at rest.

1170
MCQhard

A company is migrating a 4 TB Oracle database to Amazon Aurora PostgreSQL using AWS DMS. The migration completes successfully but the application experiences high latency on the Aurora cluster. The DMS task used LOB mode 'full LOB mode'. What is the most likely cause of the latency?

A.The Aurora cluster was underprovisioned for parallel load
B.Full LOB mode caused large LOBs to be stored in the Aurora cluster, leading to increased I/O
C.The DMS task was configured with 'ongoing replication' causing continuous write load
D.The DMS task replicated data to a different region, causing network latency
AnswerB

Full LOB mode stores LOBs inline, which can cause write amplification and high latency.

Why this answer

Full LOB mode in AWS DMS loads entire LOBs into memory before writing them to the target, which can cause large LOBs to be stored in the Aurora cluster. This increases I/O and storage overhead, leading to high latency on the Aurora cluster, especially if the LOBs are significantly larger than the default chunk size or if the cluster's I/O capacity is exceeded.

Exam trap

The trap here is that candidates often assume 'full LOB mode' is always safe or that latency must be due to ongoing replication or network issues, but the real cause is the I/O impact of storing large LOBs in Aurora's storage engine.

How to eliminate wrong answers

Option A is wrong because underprovisioning for parallel load would cause general performance issues during migration, but the migration completed successfully, and the latency is specifically tied to LOB handling post-migration. Option C is wrong because ongoing replication adds continuous write load, but the question states the migration completed successfully and latency is on the Aurora cluster, not that DMS is still writing; ongoing replication would cause latency during replication, not after. Option D is wrong because replicating to a different region would introduce network latency, but the question does not mention cross-region replication, and the latency is on the Aurora cluster itself, not on the network path.

1171
MCQhard

A company has an Amazon Redshift cluster that stores sensitive financial data. The security team requires that all data be encrypted at rest and that the encryption keys be rotated annually. Which solution meets these requirements?

A.Use AWS KMS with automatic key rotation to encrypt the Redshift cluster.
B.Create the cluster with AWS CloudHSM-backed encryption and rotate the key annually.
C.Enable encryption on the existing cluster by modifying the cluster settings.
D.Create a new encrypted cluster with a KMS key and configure automatic key rotation.
AnswerD

Correct. You create a new encrypted cluster using a KMS key with automatic key rotation. This ensures encryption at rest and automatic annual rotation.

Why this answer

The security requirements are to have encryption at rest and automatic annual key rotation. Amazon Redshift clusters can only be encrypted at creation time; you cannot enable encryption on an existing unencrypted cluster. Therefore, the only way to meet the requirements is to create a new encrypted cluster using a KMS key with automatic rotation enabled. The existing cluster must be replaced by restoring from an encrypted snapshot or by creating a new cluster and migrating data. Option D precisely describes this solution: 'Create a new encrypted cluster with a KMS key and configure automatic key rotation.' Automatic rotation can be enabled on the KMS key, and Redshift will use the new key material automatically for re-encryption.

Option A is ambiguous: 'Use AWS KMS with automatic key rotation to encrypt the Redshift cluster' – this could be interpreted as enabling encryption on an existing cluster, which is not possible. Option D clearly states the correct procedure. Hence D is the best answer.

Option B is wrong because CloudHSM-backed encryption does not support automatic key rotation; rotation must be done manually.

Option C is wrong because encryption cannot be enabled on an existing cluster; a new encrypted cluster must be created.

1172
MCQhard

A company is designing a multi-tenant SaaS application using Amazon Aurora PostgreSQL. Each tenant's data must be isolated for security and compliance. The application has a few large tenants and many small tenants. Queries must be able to access data across tenants for reporting, but with strict access controls. Which design best meets these requirements?

A.Use a single Aurora cluster with a separate schema per tenant and implement row-level security policies.
B.Create a separate database per tenant in the same Aurora cluster.
C.Create a separate Aurora cluster per tenant.
D.Use a single Aurora cluster with a single schema but add a tenant_id column to every table.
AnswerA

Schemas provide logical isolation and RLS enforces access controls per tenant.

Why this answer

It uses a single Aurora cluster with a separate schema per tenant and row-level security (RLS) policies. This design provides strong tenant isolation at the schema level while allowing cross-tenant reporting queries with strict access controls enforced by RLS policies, which automatically filter rows based on the current session's tenant context. It balances security, compliance, and operational efficiency for a mix of large and small tenants.

Exam trap

The trap here is that candidates often assume that physical separation (separate clusters or databases) is always required for compliance, but Aurora PostgreSQL's row-level security can provide logical isolation that meets security requirements while enabling efficient cross-tenant reporting.

How to eliminate wrong answers

Option B is wrong because creating a separate database per tenant in the same Aurora cluster does not provide sufficient isolation for security and compliance; databases in the same cluster share the same underlying storage and can be accessed by any user with appropriate privileges, and cross-database queries are cumbersome and less secure. Option C is wrong because creating a separate Aurora cluster per tenant introduces significant operational overhead, cost, and complexity, especially for many small tenants, and makes cross-tenant reporting queries extremely difficult without complex federated query mechanisms. Option D is wrong because using a single schema with a tenant_id column on every table lacks native isolation; it requires application-level filtering that can be bypassed, does not enforce strict access controls at the database level, and makes it harder to manage tenant-specific data lifecycle and compliance requirements.

1173
MCQmedium

A company is deploying a new DynamoDB table for a global application. The table must have low latency reads and writes across multiple AWS regions. Which configuration should be used?

A.Enable DynamoDB Accelerator (DAX) in each region.
B.Use DynamoDB Accelerator (DAX) with cross-region replication.
C.Use DynamoDB global tables with replicate streams.
D.Create a single table in the primary region and use Amazon CloudFront for reads.
AnswerC

Global tables automatically replicate data across regions for low latency access.

Why this answer

DynamoDB global tables provide a fully managed, multi-region, multi-master solution that automatically replicates data across selected AWS Regions, enabling low-latency reads and writes globally. By enabling DynamoDB Streams on the table, global tables use the streams to capture item-level changes and replicate them to other regions, ensuring eventual consistency and high availability for global applications.

Exam trap

The trap here is that candidates often confuse DynamoDB Accelerator (DAX) as a solution for global low-latency reads and writes, overlooking that DAX is single-region and does not replicate data, while global tables are purpose-built for multi-region active-active scenarios.

How to eliminate wrong answers

Option A is wrong because DynamoDB Accelerator (DAX) is an in-memory cache that improves read performance within a single region but does not replicate data across regions, so it cannot provide low-latency writes globally. Option B is wrong because DAX does not support cross-region replication; it is a regional service and cannot be configured to replicate data between regions. Option D is wrong because a single table in one region with CloudFront for reads only accelerates read requests via edge caching, but writes still go to the primary region, causing high latency for writes from other regions, and CloudFront does not handle write operations.

1174
MCQeasy

A company needs to deploy a globally distributed application with a database that supports multi-region writes and automatic conflict resolution. Which AWS database service should be used?

A.Amazon DynamoDB Global Tables
B.Amazon Aurora Global Database
C.Amazon RDS for MySQL with Multi-AZ
D.Amazon ElastiCache for Redis
AnswerA

DynamoDB Global Tables support multi-region active-active writes with conflict resolution.

Why this answer

Amazon DynamoDB Global Tables is the correct choice because it provides a fully managed, multi-Region, multi-active database that replicates data across AWS Regions with automatic conflict resolution using last-writer-wins (LWW) or application-defined conflict resolution. This directly meets the requirement for multi-region writes and automatic conflict resolution without requiring custom replication logic.

Exam trap

The trap here is that candidates often confuse Amazon Aurora Global Database (which is read-only in secondary Regions) with a multi-write solution, but DynamoDB Global Tables is the only AWS database service that natively supports multi-region writes and automatic conflict resolution.

How to eliminate wrong answers

Option B (Amazon Aurora Global Database) is wrong because it supports only one primary Region for writes; secondary Regions are read-only, so it does not support multi-region writes. Option C (Amazon RDS for MySQL with Multi-AZ) is wrong because Multi-AZ provides high availability within a single Region, not multi-region writes or automatic conflict resolution. Option D (Amazon ElastiCache for Redis) is wrong because it is an in-memory cache, not a durable database, and does not support multi-region writes or conflict resolution.

1175
MCQeasy

A database specialist is troubleshooting a connectivity issue with an Amazon RDS for PostgreSQL instance. The instance is in a VPC with a public subnet. The security group allows inbound traffic on port 5432 from the application server's IP address. The application server is in the same VPC but in a private subnet. Despite the security group configuration, the application cannot connect. Which action should the specialist take to resolve the issue?

A.Launch the RDS instance in the default VPC.
B.Change the DB subnet group to include the application server's subnet.
C.Add a network ACL rule allowing inbound traffic on port 5432 from the application server's public IP.
D.Modify the RDS instance to be publicly accessible.
E.Update the security group inbound rule to allow traffic from the application server's private IP address.
AnswerE

The application connects from its private IP within the VPC, so the security group should allow that private IP.

Why this answer

The application server is in a private subnet, so it communicates with the RDS instance using its private IP address. The security group inbound rule must allow traffic from the application server's private IP (or the security group of the application server) on port 5432. The current rule only allows the application server's public IP, which is not used for traffic within the VPC, causing the connection failure.

Exam trap

The trap here is that candidates may confuse public and private IP addressing within a VPC, assuming that allowing the application server's public IP in the security group is sufficient, when in fact traffic between instances in the same VPC always uses private IPs.

How to eliminate wrong answers

Option A is wrong because launching the RDS instance in the default VPC does not resolve the IP mismatch; the application server's private IP would still need to be allowed in the security group. Option B is wrong because the DB subnet group defines which subnets the RDS instance can be placed in, not which subnets can connect to it; the application server's subnet is irrelevant for connectivity rules. Option C is wrong because network ACLs are stateless and apply at the subnet level, but the issue is that the security group is allowing the wrong IP (public instead of private); additionally, the application server's public IP is not used for VPC-internal traffic.

Option D is wrong because making the RDS instance publicly accessible would expose it to the internet, which is unnecessary and less secure; the application server is in the same VPC, so private connectivity should be used.

1176
MCQhard

A company uses Amazon RDS for MySQL with Multi-AZ and read replicas. The database has a table storing user sessions with 50 million rows. The application team reports that queries using 'SELECT * FROM sessions WHERE user_id = ? ORDER BY login_time DESC LIMIT 10' are slow. The EXPLAIN plan shows a full table scan. Which design change would BEST improve query performance?

A.Implement an application-level cache using ElastiCache
B.Create a composite index on (user_id, login_time)
C.Partition the table by user_id
D.Upgrade to a larger instance type with more memory
AnswerB

This index covers both the WHERE and ORDER BY clauses.

Why this answer

The query filters on user_id and orders by login_time, which is a classic case for a composite index. A B-Tree index on (user_id, login_time) allows MySQL to locate all rows for the given user_id via the index's leading column and then retrieve the rows in sorted order using the second column, avoiding a full table scan and a filesort operation. This directly addresses the root cause — the lack of an index to support both the WHERE and ORDER BY clauses efficiently.

Exam trap

The DBS-C01 exam often tests the misconception that adding more resources (Option D) or partitioning (Option C) can substitute for proper indexing, when in fact the most efficient fix for a query with a WHERE and ORDER BY on different columns is a composite index that covers both.

How to eliminate wrong answers

Option A is wrong because an application-level cache would reduce repeated query load but does not fix the underlying full table scan for cache misses; the query would still be slow when the data is not cached. Option C is wrong because partitioning by user_id would not inherently improve query performance without an appropriate index; MySQL would still need to scan all partitions unless a local index is present, and partitioning alone does not provide sorted access. Option D is wrong because upgrading to a larger instance type with more memory only adds resources to handle the full table scan faster but does not eliminate the scan itself; the query would remain inefficient and scale poorly as data grows.

1177
MCQhard

A gaming company uses Amazon DynamoDB to store player scores. The table has a partition key of 'game_id' and a sort key of 'player_id'. They notice that during peak hours, write requests for a popular game 'g123' are throttled, while other games are unaffected. What is the most likely cause and solution?

A.Enable DynamoDB Accelerator (DAX) to cache writes.
B.The write capacity is too low; increase the table's write capacity units.
C.Use a composite partition key with a random suffix to distribute writes.
D.Enable auto-scaling on the table to handle burst write traffic.
AnswerC

Write sharding spreads writes across partitions, avoiding a hot key.

Why this answer

The throttling is caused by a hot partition: all writes for the popular game 'g123' target the same partition key, exceeding the 1,000 WCU per partition limit. Adding a random suffix to the partition key (e.g., 'g123-1', 'g123-2') distributes writes across multiple partitions, eliminating the bottleneck without changing the access pattern.

Exam trap

The trap here is that candidates confuse total table capacity with per-partition capacity, assuming increasing WCU or enabling auto-scaling will fix a hot partition, when the real solution is to redesign the partition key to avoid skew.

How to eliminate wrong answers

Option A is wrong because DAX is a read cache, not a write cache; it does not absorb write throttling. Option B is wrong because increasing the table's total write capacity does not resolve a hot partition; DynamoDB distributes capacity evenly across partitions, so a single partition still caps at 1,000 WCU. Option D is wrong because auto-scaling adjusts total table capacity, not per-partition distribution; it cannot prevent throttling on a single hot key.

1178
Multi-Selectmedium

A company is deploying a new application on Amazon RDS for PostgreSQL. The security policy requires that all data be encrypted at rest and in transit. Which TWO actions should the company take to meet these requirements?

Select 2 answers
A.Use a client-side encryption library to encrypt data before sending to the database.
B.Enable encryption for automated backups separately.
C.Enable encryption at rest by specifying a KMS key when creating the DB instance.
D.Create an encrypted read replica and promote it to master.
E.Set the parameter rds.force_ssl to 1 in the DB parameter group.
AnswersC, E

This encrypts the data at rest.

Why this answer

To encrypt data at rest, you must enable encryption when creating the DB instance by specifying a KMS key (Option C). RDS automatically encrypts automated backups for encrypted instances, so Option B is unnecessary. To encrypt data in transit, you must enforce SSL/TLS connections by setting the parameter rds.force_ssl to 1 in the DB parameter group (Option E).

Option A is incorrect because client-side encryption is not required when using RDS encryption and SSL; the requirement is to use RDS features. Option D is incorrect because creating an encrypted read replica does not encrypt the original master instance; you need to enable encryption on the master from the start.

1179
MCQhard

A company's DynamoDB table uses provisioned capacity and has a global table for disaster recovery. Write requests to the replica region are failing with ProvisionedThroughputExceededException even though the replica table shows low consumed capacity. What is the MOST likely cause?

A.Auto-scaling is disabled on the replica table
B.The replica table is exhausting its burst capacity
C.The replica table's write capacity is insufficient for replication writes
D.DAX is enabled on the replica table
AnswerC

The replica table's write capacity is insufficient for replication writes. This is correct because global table replication consumes write capacity on the replica, and if that capacity is insufficient, writes are throttled.

Why this answer

In DynamoDB global tables, writes to the replica region consume write capacity units (WCUs) on the replica table. If the provisioned write capacity on the replica table is insufficient to handle the replication traffic, the replica will throttle incoming write requests with a ProvisionedThroughputExceededException, even if the consumed capacity appears low because throttling occurs before the write is counted. Option C correctly identifies this cause.

Option A is incorrect because auto-scaling adjusts capacity over time but does not directly cause throttling. Option B is incorrect because burst capacity provides short-term flexibility; sustained throttling is due to insufficient capacity, not burst exhaustion. Option D is incorrect because DAX is an in-memory cache for reads and does not affect write operations.

1180
Multi-Selecthard

Which TWO are best practices for designing a DynamoDB table for high-traffic e-commerce application? (Select TWO.)

Select 2 answers
A.Create Global Secondary Indexes to support different access patterns.
B.Use a constantly increasing value (e.g., timestamp) as the partition key.
C.Design the table to use scan operations for most queries.
D.Use a composite primary key (partition key and sort key) to organize data.
E.Use a single attribute as the partition key with low cardinality.
AnswersA, D

GSIs allow querying on non-key attributes.

Why this answer

Global Secondary Indexes (GSIs) allow you to support multiple query patterns without duplicating data or redesigning the base table. In a high-traffic e-commerce application, you might need to query orders by customer ID, by status, or by date; GSIs provide alternative access patterns with their own partition and sort keys, enabling efficient queries without full table scans.

Exam trap

The trap here is that candidates often think a monotonically increasing partition key (like a timestamp) is acceptable for time-series data, but in DynamoDB it creates a hot partition, whereas in other databases it might be fine; AWS tests your understanding of DynamoDB's partitioning model and the importance of high-cardinality, evenly distributed partition keys.

1181
MCQmedium

A company is using Amazon Aurora MySQL. The database performance has degraded, and the DBA wants to identify the queries that are waiting for locks. Which system table should be queried to find information about locking conflicts?

A.information_schema.TABLES
B.information_schema.PROCESSLIST
C.performance_schema.events_waits_current
D.information_schema.INNODB_LOCKS
AnswerD

INNODB_LOCKS shows current InnoDB locks.

Why this answer

Information_schema.INNODB_LOCKS. This table shows current locks held by InnoDB transactions, including lock type, mode, and which transactions are waiting for locks. Option A (information_schema.TABLES) provides metadata about tables, not locks.

Option B (information_schema.PROCESSLIST) shows current running processes but not lock details. Option C (performance_schema.events_waits_current) shows current wait events but is not specific to InnoDB lock conflicts; INNODB_LOCKS is the correct source for identifying locking conflicts in Aurora MySQL.

1182
Multi-Selecteasy

Which TWO use cases are best suited for Amazon RDS Multi-AZ deployments? (Choose 2.)

Select 2 answers
A.Offloading read traffic from the primary database
B.Disaster recovery across AWS Regions
C.Improving write performance for a write-intensive workload
D.Scaling read capacity for a read-heavy application
E.Ensuring database availability during an Availability Zone outage
AnswersB, E

Correct. Multi-AZ provides automatic failover to a standby in a different AZ, enabling disaster recovery within the same region. Although the option says 'across AWS Regions', the intended use case is disaster recovery at the AZ level.

Why this answer

Amazon RDS Multi-AZ deployments automatically provision and maintain a synchronous standby replica in a different Availability Zone (AZ), ensuring automatic failover and high availability during an AZ outage. Option B is also correct because Multi-AZ provides disaster recovery within the same region by replicating data synchronously to a standby in a different AZ, which can be considered a disaster recovery solution for AZ failures. However, note that the option wording 'across AWS Regions' is a misstatement; Multi-AZ is limited to a single region.

Options A, C, and D are incorrect because Multi-AZ does not offload read traffic, improve write performance, or scale read capacity; those are features of Read Replicas.

Exam trap

Candidates often confuse Multi-AZ (synchronous replication for high availability and disaster recovery within a region) with Read Replicas (asynchronous replication for read scaling and cross-region disaster recovery). Here, option B's 'across AWS Regions' is a trap; the correct disaster recovery role of Multi-AZ is within the same region, not across regions.

1183
MCQmedium

A company is running an Amazon RDS for SQL Server Multi-AZ DB instance. During a recent failover test, the application experienced a timeout of 60 seconds. The application uses a connection string that points to the CNAME of the DB instance. Which configuration change would reduce the failover time?

A.Create a read replica and promote it to a standalone instance during failover.
B.Modify the application to use the IP address of the DB instance instead of the CNAME.
C.Enable TDS Keep-Alive on the client side to detect and recover from connection drops faster.
D.Disable Multi-AZ and use a single-AZ instance to avoid failover overhead.
AnswerC

TDS Keep-Alive helps the client detect a broken connection sooner and reconnect to the new primary, reducing perceived downtime.

Why this answer

Enable TDS Keep-Alive on the client side. This allows the client to detect connection drops faster and reconnect to the new primary during failover, reducing the timeout experienced. Option A (Create a read replica and promote it) is a manual process and does not reduce failover time; it is used for read scaling or disaster recovery.

Option B (Using the IP address) is not recommended because the IP changes after failover; the CNAME automatically updates to point to the new primary, so using IP would cause longer outages. Option D (Disable Multi-AZ) would eliminate automatic failover, increasing downtime during failures.

Exam trap

Candidates may think that modifying the connection string to use IP address or disabling Multi-AZ would reduce failover time, but these are incorrect because they either prevent automatic failover or cause connection failures.

1184
MCQeasy

A company needs to ensure that all changes to an Amazon RDS DB instance are logged for auditing purposes. Which AWS service should be enabled?

A.AWS CloudTrail
B.AWS Config
C.Amazon GuardDuty
D.Amazon Inspector
AnswerA

CloudTrail records all RDS API calls for auditing.

Why this answer

AWS CloudTrail is the correct service because it records API activity for Amazon RDS, including calls to create, modify, or delete DB instances, as well as changes to security groups, parameter groups, and automated backups. CloudTrail logs these events to an S3 bucket or CloudWatch Logs, providing a durable audit trail for all management-plane operations on the RDS DB instance. This directly meets the requirement to log all changes for auditing purposes.

Exam trap

The trap here is that candidates often confuse AWS Config (which tracks configuration changes) with CloudTrail (which tracks API calls), but Config only records the state of resources after a change, not the who, what, or when of the API action that caused it.

How to eliminate wrong answers

Option B (AWS Config) is wrong because it evaluates resource configurations against desired policies and tracks configuration changes over time, but it does not log API-level actions or provide an audit trail of who made the change and when; it focuses on compliance and configuration drift, not operational auditing. Option C (Amazon GuardDuty) is wrong because it is a threat detection service that monitors for malicious activity using VPC Flow Logs, DNS logs, and CloudTrail events, but it does not itself log changes to RDS instances; it consumes logs for security analysis. Option D (Amazon Inspector) is wrong because it is a vulnerability assessment service that scans EC2 instances and container images for software vulnerabilities and unintended network exposure; it has no capability to log or audit changes to RDS DB instances.

1185
MCQeasy

A database administrator notices that an Amazon RDS for Oracle instance has a high number of connections, causing performance degradation. Which tool can be used to identify the active sessions and their queries?

A.Amazon Inspector
B.Performance Insights
C.RDS Enhanced Monitoring
D.AWS CloudTrail
AnswerB

Performance Insights shows active sessions and their queries.

Why this answer

Performance Insights provides a dashboard to monitor active sessions and the queries they are running. Option A is incorrect because Amazon Inspector is a security assessment tool, not a monitoring tool for database sessions. Option C is incorrect because RDS Enhanced Monitoring provides OS-level metrics like CPU and memory, not database session details.

Option D is incorrect because AWS CloudTrail logs API calls, not database sessions or queries.

1186
Multi-Selecthard

Which TWO techniques can reduce read latency for frequently accessed data in Amazon DynamoDB? (Choose 2.)

Select 2 answers
A.Use strongly consistent reads
B.Increase write capacity units
C.Decrease read capacity units
D.Add Global Secondary Indexes (GSI) for common query patterns
E.Enable DynamoDB Accelerator (DAX)
AnswersD, E

GSIs can provide efficient access to data.

Why this answer

Adding Global Secondary Indexes (GSI) allows you to pre-materialize alternative query patterns, enabling efficient lookups on non-key attributes without scanning the entire table. This reduces read latency for frequently accessed data by providing a pre-sorted and partitioned index that DynamoDB can query directly, avoiding expensive full-table scans.

Exam trap

The trap here is that candidates often confuse strongly consistent reads with performance optimization, not realizing that consistency guarantees come at the cost of higher latency, not lower.

1187
MCQeasy

A company is migrating an on-premises MySQL database to Amazon RDS. The database is used for a critical e-commerce application that requires high availability with automatic failover. Which RDS deployment option should the company choose to meet these requirements?

A.Multi-Region deployment with Read Replicas
B.Single-AZ instance with a standby in the same AZ
C.Multi-AZ deployment with a standby in a different AZ
D.Single-AZ instance with a Read Replica
AnswerC

Multi-AZ provides automatic failover to a standby in a different AZ.

Why this answer

A Multi-AZ deployment for Amazon RDS MySQL automatically provisions and maintains a synchronous standby replica in a different Availability Zone (AZ). In the event of an AZ failure or primary instance failure, Amazon RDS automatically fails over to the standby, providing high availability with minimal downtime. This meets the requirement for automatic failover without manual intervention.

Exam trap

The trap here is that candidates often confuse Multi-AZ with Read Replicas, assuming that a Read Replica can provide automatic failover, but in RDS MySQL, Read Replicas require manual promotion and do not offer synchronous replication or automatic failover.

How to eliminate wrong answers

Option A is wrong because Multi-Region deployment with Read Replicas is designed for disaster recovery across regions and does not provide automatic failover within a single region; failover would require manual promotion of a read replica. Option B is wrong because a Single-AZ instance with a standby in the same AZ is not supported by RDS; Multi-AZ requires the standby to be in a different AZ to protect against AZ-level failures. Option D is wrong because a Single-AZ instance with a Read Replica provides read scaling and can be manually promoted for disaster recovery, but it does not offer automatic failover or synchronous replication, which are required for high availability.

1188
MCQeasy

A database administrator notices that the /var/log/mysql/error.log file on an Amazon RDS for MySQL DB instance is growing rapidly. The administrator wants to monitor the log file size and receive alerts when it exceeds a certain threshold. Which AWS service should be used to set up this monitoring?

A.AWS CloudTrail
B.Amazon S3
C.Amazon RDS Enhanced Monitoring
D.Amazon CloudWatch Logs
AnswerD

CloudWatch Logs can monitor log file size and trigger alarms.

Why this answer

CloudWatch Logs can monitor log file sizes and trigger alarms based on metric filters. Option A is wrong because CloudTrail does not monitor log file sizes. Option B is wrong because S3 is a storage service, not a monitoring service.

Option C is wrong because RDS Enhanced Monitoring provides OS-level metrics, not log file metrics.

1189
Multi-Selecthard

A company is running a production Amazon DynamoDB table with on-demand capacity. The table experiences occasional throttling during traffic spikes. The table's partition key is a timestamp, and the workload is write-heavy. The operations team needs to reduce throttling. Which THREE actions should the team take? (Choose three.)

Select 3 answers
A.Add a random suffix to the partition key to distribute writes evenly.
B.Increase the read capacity units for the table.
C.Use DynamoDB Accelerator (DAX) to cache read-heavy queries.
D.Switch to provisioned capacity mode with auto scaling.
E.Enable DynamoDB global tables to distribute write traffic.
AnswersA, C, D

This prevents hot partitions.

Why this answer

Adding a random suffix to the timestamp partition key breaks the sequential write pattern, distributing writes evenly across all partitions. This prevents hot partitions, which are the root cause of throttling in a write-heavy workload with a monotonically increasing partition key.

Exam trap

The trap here is that candidates assume on-demand capacity eliminates all throttling, but they overlook that throttling can still occur at the partition level due to uneven access patterns, which requires application-level key design changes to resolve.

1190
MCQhard

A company is running an Amazon DynamoDB table with on-demand capacity mode. The table experiences occasional throttling during peak hours. The application team wants to understand the read/write patterns to optimize the table design. Which approach should the database specialist take to analyze the throttling events?

A.Enable DynamoDB Accelerator (DAX) to cache reads and reduce throttling.
B.Use AWS CloudTrail to log all DynamoDB API calls and analyze the logs.
C.Switch to provisioned capacity mode with auto scaling to handle the spikes.
D.Enable CloudWatch Contributor Insights for DynamoDB to identify throttled requests.
AnswerD

Contributor Insights analyzes throttled requests and helps identify the top contributors, such as specific partition keys.

Why this answer

CloudWatch Contributor Insights analyzes high-cardinality attributes and provides detailed information about throttling requests, such as which items or partitions are causing throttling.

1191
MCQeasy

A developer accidentally deleted a critical table from an Amazon RDS for MySQL DB instance. Automated backups are enabled with a retention period of 7 days. The deletion occurred 3 hours ago. Which action can restore the table with minimal data loss?

A.Perform a point-in-time restore to a time just before the deletion.
B.Use AWS Database Migration Service to replicate the table from another source.
C.Restore the DB instance from the latest automated snapshot.
D.Use the MySQL binary log to replay transactions up to the deletion.
AnswerA

Point-in-time recovery allows restoring to any second within the retention period.

Why this answer

Amazon RDS point-in-time recovery (PITR) allows restoring a DB instance to any second within the backup retention period, enabling recovery to just before the table deletion, minimizing data loss. Option B is incorrect because AWS DMS is a migration tool, not a recovery mechanism for deleted data. Option C is incorrect because restoring from the latest automated snapshot would lose all changes made after that snapshot, including the 3 hours of data before deletion.

Option D is incorrect because while MySQL binary logs can be used for point-in-time recovery, RDS manages this through its automated PITR feature; manually replaying binary logs is not a supported operation in RDS.

1192
Multi-Selectmedium

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all connections to the database be encrypted in transit. Which TWO steps should be taken to enforce this requirement?

Select 2 answers
A.Set the rds.force_ssl parameter to 1 in the DB parameter group.
B.Configure the database to require a client-side SSL/TLS certificate.
C.Enable Oracle native network encryption (NNE) in the sqlnet.ora file.
D.Use AWS Secrets Manager to store database credentials and enable Kerberos authentication.
E.Use AWS Direct Connect or a VPN to connect to the VPC.
AnswersA, B

Setting the rds.force_ssl parameter to 1 in the DB parameter group forces all connections to the Oracle RDS instance to use SSL/TLS encryption. This is the direct method to enforce encryption in transit for Amazon RDS for Oracle, as it rejects any non-SSL connections at the database level.

Why this answer

The correct steps are A and B. Setting the rds.force_ssl parameter to 1 in the DB parameter group forces all connections to use SSL/TLS on the server side. Additionally, configuring the database to require a client-side SSL/TLS certificate provides mutual authentication and ensures that only clients with valid certificates can connect, thereby enforcing encryption in transit from both ends.

Exam trap

The trap here is that candidates may confuse Oracle Native Network Encryption (NNE) with SSL/TLS, but RDS for Oracle does not support NNE; only SSL/TLS is available for encryption in transit.

1193
MCQeasy

A company is deploying a new web application on Amazon RDS for MySQL and expects read-heavy traffic. The database must be highly available. Which deployment approach meets these requirements?

A.Deploy a Multi-AZ instance without read replicas.
B.Deploy a Multi-AZ instance and create read replicas.
C.Deploy a Single-AZ instance with a Multi-AZ read replica.
D.Deploy a Single-AZ instance and use ElastiCache for caching.
AnswerB

Multi-AZ for HA, read replicas for read scaling.

Why this answer

Deploying a Multi-AZ RDS for MySQL instance provides automatic failover for high availability, while adding read replicas offloads read-heavy traffic from the primary instance, improving read scalability. Read replicas can be placed in different Availability Zones to further enhance resilience and read performance.

Exam trap

The trap here is that candidates often confuse Multi-AZ standby replicas with read replicas, not realizing that Multi-AZ standby instances cannot serve read traffic, so they fail to address the read-heavy requirement without additional read replicas.

How to eliminate wrong answers

Option A is wrong because a Multi-AZ instance alone provides high availability through synchronous standby replication but does not address read-heavy traffic, as the standby replica cannot serve read queries. Option C is wrong because a Single-AZ instance lacks high availability, and a Multi-AZ read replica does not provide automatic failover for the primary instance; read replicas are for read scaling, not failover. Option D is wrong because while ElastiCache can reduce database read load, it does not provide high availability for the database itself, and a Single-AZ instance remains a single point of failure.

1194
Multi-Selecthard

A company is using Amazon DynamoDB with global tables. The application is experiencing high write latency in one region. Which THREE factors could contribute to this issue? (Choose three.)

Select 3 answers
A.Replication lag from global tables causing write conflicts.
B.Insufficient read capacity units provisioned for the table.
C.High network latency between the application and the DynamoDB endpoint.
D.The table's auto scaling configuration is set to increase write capacity too aggressively.
E.Insufficient write capacity units provisioned for the table.
AnswersA, C, E

Global tables replicate asynchronously, and conflicts can increase latency.

Why this answer

Replication lag in global tables can lead to write conflicts and increased latency. Option C is correct because high network latency between the application and the DynamoDB endpoint directly impacts write latency. Option E is correct because insufficient write capacity units provisioned can cause throttling, resulting in higher write latency.

Option B is incorrect because read capacity units do not affect write throughput. Option D is incorrect because aggressive auto scaling increases capacity, which would reduce latency, not increase it.

1195
MCQeasy

A developer accidentally exposed an Amazon RDS snapshot to the public. What is the quickest way to remediate this issue?

A.Delete the snapshot and create a new one from the source DB instance.
B.Copy the snapshot to a new snapshot and delete the original.
C.Share the snapshot with only the required AWS account.
D.Modify the snapshot permissions to set it to private.
AnswerD

Modifying the snapshot permissions to private immediately revokes public access. This is the quickest remediation.

Why this answer

The quickest remediation is to modify the snapshot permissions to make it private. This immediately revokes public access. Option A is incorrect because deleting the snapshot would remove the backup entirely, which is unnecessary and could risk data loss if no other backup exists.

Option B is incorrect because copying the snapshot does not change the original's permissions; the original remains public. Option C is incorrect because sharing with a specific account does not revoke public access; it only adds an additional permission. Therefore, modifying the snapshot to private is the direct and fastest fix.

1196
MCQhard

A company runs a critical e-commerce application on Amazon RDS for PostgreSQL with a db.r5.2xlarge instance and 500 GB of gp2 storage. The application experiences periodic write spikes during flash sales. During these events, the WriteIOPS metric exceeds the provisioned baseline IOPS of 1,500, and the database becomes unresponsive for several seconds. The DBA has configured a CloudWatch alarm on WriteIOPS, but the alarm triggers after the performance issue occurs. The company needs to ensure that the database can handle these spikes without downtime. The budget allows for moderate cost increases. What should the DBA do?

A.Increase the allocated storage to 1,000 GB to increase baseline IOPS to 3,000.
B.Modify the DB instance to use gp3 storage with provisioned IOPS of 5,000.
C.Enable Performance Insights to identify the problematic queries and tune them.
D.Add a read replica and redirect read traffic to it to reduce write contention.
AnswerB

gp3 provides a baseline of 3,000 IOPS for any storage size and allows provisioning additional IOPS up to 16,000, independent of storage. This handles write spikes cost-effectively.

Why this answer

Gp3 storage provides a baseline of 3,000 IOPS regardless of storage size, and allows provisioning up to 16,000 IOPS independently. By setting provisioned IOPS to 5,000, the database can handle write spikes without exceeding the IOPS limit, preventing unresponsiveness. This solution fits the moderate cost increase budget, as gp3 is typically 20% cheaper than gp2 for equivalent performance.

Exam trap

The trap here is that candidates assume increasing gp2 storage (Option A) is the only way to raise baseline IOPS, overlooking gp3's ability to provision higher IOPS independently without massive storage growth.

How to eliminate wrong answers

Option A is wrong because increasing gp2 storage to 1,000 GB only raises baseline IOPS to 3,000 (3 IOPS per GB), which may still be insufficient for severe write spikes and incurs higher storage costs without addressing burst balance depletion. Option C is wrong because Performance Insights identifies query performance issues but does not resolve IOPS bottlenecks; tuning queries cannot increase the underlying storage IOPS limit. Option D is wrong because read replicas handle read traffic only and do not reduce write IOPS on the primary instance; write spikes still affect the primary database.

1197
Multi-Selecteasy

A company is troubleshooting an Amazon DynamoDB table that is experiencing high latency. The table uses on-demand capacity. Which TWO steps should be taken to diagnose the issue?

Select 2 answers
A.Increase the provisioned read capacity
B.Examine CloudWatch metrics for throttling and latency patterns
C.Consider using DynamoDB Accelerator (DAX) for caching
D.Disable TTL to reduce write overhead
E.Split the table into multiple partitions manually
AnswersB, C

CloudWatch metrics provide insights into throttling, latency, and consumed capacity, which are essential for diagnosing performance issues.

Why this answer

CloudWatch metrics for DynamoDB can show throttling events, latency patterns, and consumed throughput, which help diagnose high latency issues. Option C is correct because DynamoDB Accelerator (DAX) provides an in-memory cache that can significantly reduce read latency for frequently accessed items. Option A is incorrect because the table uses on-demand capacity, so adjusting provisioned capacity is not applicable.

Option D is incorrect because disabling TTL does not directly reduce write overhead or latency. Option E is incorrect because DynamoDB handles partitions automatically and manual splitting is not supported.

1198
MCQmedium

Refer to the exhibit. A database specialist is investigating performance degradation on an Amazon RDS for MySQL DB instance. The BurstBalance metric shows the values above. What does this indicate, and what action should be taken?

A.The instance has exhausted its I/O burst credits; scale up the allocated storage to increase baseline I/O.
B.The instance is experiencing high read load; add a read replica to offload reads.
C.The instance's compute capacity is insufficient; change the instance class to a larger size.
D.The instance is experiencing a memory bottleneck; enable Performance Insights to analyze query performance.
AnswerA

Larger storage volumes have higher baseline I/O and accumulate burst credits faster.

Why this answer

The BurstBalance metric dropping to 0 indicates that the instance has exhausted its I/O burst credits, resulting in I/O throttling. Scaling up the allocated storage increases the baseline I/O performance, which in turn increases the burst credit earning rate and raises the burst balance. Option B is incorrect because adding a read replica offloads read traffic but does not increase I/O credits.

Option C is incorrect because changing the instance class does not affect I/O credits; it only increases compute capacity. Option D is incorrect because enabling Performance Insights helps with diagnosis but does not resolve I/O credit exhaustion.

1199
MCQeasy

A company is designing a new application that requires a relational database with strong consistency and support for transactions. The application will be accessed by users worldwide, and the database must provide low-latency reads in multiple regions. The company expects the workload to be unpredictable, with periods of very low activity followed by sudden spikes. They want to minimize operational overhead and only pay for the resources they use. Which AWS database solution should they choose?

A.Amazon Redshift with cross-Region snapshots.
B.Amazon Aurora Serverless v2 with Aurora Global Database.
C.Amazon RDS for PostgreSQL with read replicas in multiple regions.
D.Amazon DynamoDB with Global Tables.
AnswerB

Aurora Serverless v2 automatically scales capacity, supports ACID transactions, and Global Database provides low-latency multi-region reads.

Why this answer

Amazon Aurora Serverless v2 is a good choice for unpredictable workloads because it auto-scales capacity based on demand and you pay only for what you use. It also supports Aurora Global Database for low-latency reads in multiple regions. RDS does not have serverless capability.

DynamoDB is serverless but not relational. Redshift is for analytics. So the best is Aurora Serverless v2 with Global Database.

1200
MCQhard

A company has an Amazon RDS for MySQL DB instance with automated backups enabled. The database is 500 GB in size. The company wants to create a new test database from the current state with minimal impact on production. Which approach meets these requirements?

A.Take a snapshot of the DB instance and restore it to a new instance.
B.Create a read replica and promote it to a standalone instance.
C.Use mysqldump to export the database and import into a new instance.
D.Create a manual DB snapshot from the automated backup and restore.
AnswerA

Snapshots are taken asynchronously with minimal performance impact, and restore creates a new instance.

Why this answer

Taking a snapshot of the RDS DB instance and restoring it to a new instance creates an independent copy of the database with minimal performance impact on the source. Snapshots are asynchronous and capture a consistent state without blocking writes, making this the most efficient method for creating a test database from the current production state.

Exam trap

The trap here is that candidates may confuse the ability to create a manual snapshot from an automated backup (which is not supported) with the valid option of taking a new manual snapshot directly from the DB instance, leading them to choose option D incorrectly.

How to eliminate wrong answers

Option B is wrong because promoting a read replica to a standalone instance requires the replica to first catch up with the source, which introduces replication lag and potential disruption; additionally, the read replica consumes resources on the source instance and is not designed for creating a point-in-time copy without affecting production. Option C is wrong because using mysqldump to export a 500 GB database would cause significant I/O and CPU load on the production instance, potentially impacting performance and requiring a long export time. Option D is wrong because creating a manual DB snapshot from an automated backup is not directly supported; automated backups are used for point-in-time recovery, but you cannot create a manual snapshot from an automated backup — you must either take a new manual snapshot or restore from an automated backup to a new instance.

Page 15

Page 16 of 23

Page 17