Knowledge + Practice

AWS Certified Database Specialty DBS-C01 (DBS-C01) — Questions 1501–1575

1663 questions total · 23pages · All types, answers revealed

Take a mock exam Exam hub

Page 21 of 23

1501

Multi-Selectmedium

Which THREE factors should be considered when choosing between Amazon RDS and Amazon DynamoDB for a new application? (Choose 3.)

Select 3 answers

A.Cost of storage

B.Need for encryption at rest

C.Access patterns (predictable vs. ad-hoc)

D.Scalability requirements (horizontal vs. vertical)

E.Query complexity (joins, aggregations)

AnswersC, D, E

DynamoDB suits predictable patterns; RDS for complex queries.

Why this answer

Amazon RDS is a relational database service that excels at complex queries involving joins and aggregations, while DynamoDB is a NoSQL key-value and document database optimized for predictable, high-scale access patterns. The choice between them hinges on whether the application requires relational features (RDS) or can tolerate denormalized schemas for low-latency, horizontal scaling (DynamoDB). Option C is correct because DynamoDB is designed for ad-hoc, single-key lookups and simple queries, whereas RDS supports complex, ad-hoc SQL queries with joins.

Exam trap

The trap here is that candidates often assume encryption at rest is exclusive to one service, but both RDS and DynamoDB support it via AWS KMS, making it a non-differentiating factor.

Full explanation →

1502

Multi-Selectmedium

Which THREE factors should be considered when choosing between a native database migration tool (e.g., pg_dump) and AWS DMS for migrating a database to Amazon RDS? (Choose three.)

Select 3 answers

A.Whether the target database is in a different AWS region

B.Downtime tolerance during migration

C.Requirement for ongoing replication to keep the target in sync

D.Need to perform complex data transformations during migration

E.Total size of the database and network bandwidth

AnswersB, C, E

Native tools typically require full downtime; DMS can minimize downtime with ongoing replication.

Why this answer

Downtime tolerance directly influences the choice between a one-time logical dump (pg_dump) and AWS DMS, which supports minimal-downtime migrations via ongoing replication. pg_dump requires the source database to be read-consistent during the dump, often necessitating a read-only or quiesced state, whereas DMS can perform a full load followed by continuous change data capture (CDC) to keep the target nearly in sync with minimal application downtime.

Exam trap

The trap here is that candidates often assume AWS DMS can perform complex data transformations like an ETL tool, when in fact DMS only supports simple column mappings and transformations, not multi-table joins or business logic rewrites.

Full explanation →

1503

MCQeasy

A company has an Amazon DynamoDB table that stores IoT sensor data. The table has a partition key of device_id and a sort key of timestamp. The team wants to efficiently retrieve the latest reading for each device. Which query pattern should be used?

A.Scan with FilterExpression to get the latest timestamp for each device

B.Query with ScanIndexForward=true and Limit=1

C.GetItem with the device_id and timestamp values

D.Query with ScanIndexForward=false and Limit=1

AnswerD

This retrieves the most recent item for a given partition key by ordering the sort key in descending order and limiting to one result.

Why this answer

Setting ScanIndexForward=false on a Query returns items in descending sort-key order. By querying with the device_id as the partition key and limiting results to 1, you retrieve the most recent timestamp for that device efficiently without scanning the entire table.

Exam trap

The trap here is confusing ScanIndexForward=true with false, leading candidates to pick Option B, which retrieves the oldest rather than the latest record.

How to eliminate wrong answers

Option A is wrong because a Scan reads every item in the table, which is expensive and slow for large datasets; FilterExpression is applied after the scan, so it does not reduce the read cost. Option B is wrong because ScanIndexForward=true returns items in ascending order, so Limit=1 would give the oldest timestamp, not the latest. Option C is wrong because GetItem requires both the partition key and sort key to retrieve a specific item, but the team does not know the exact timestamp of the latest reading in advance.

Full explanation →

1504

MCQmedium

A company is experiencing increased latency on their Amazon RDS for PostgreSQL instance. The application team reports that queries are taking longer than usual. The database metrics show high CPU utilization and a spike in write operations. Which initial step should the database specialist take to diagnose the issue?

A.Enable Performance Insights on the DB instance to analyze the workload.

B.Create a read replica to offload read traffic from the primary instance.

C.Modify the DB instance to a larger instance class to handle the load.

D.Enable enhanced monitoring to get OS-level metrics of the DB instance.

AnswerA

Performance Insights provides a comprehensive view of database performance and helps pinpoint the bottleneck.

Why this answer

Enabling Performance Insights provides a detailed performance analysis and helps identify the root cause of the latency. It is the recommended first step for diagnosing database performance issues.

Full explanation →

1505

Multi-Selecteasy

A company uses Amazon RDS for PostgreSQL for its CRM application. The application experiences intermittent spikes in read traffic. Which TWO actions can the company take to improve read scalability with minimal application changes?

Select 2 answers

A.Enable Multi-AZ deployment for automatic failover.

B.Migrate to Amazon Aurora and enable Auto Scaling.

C.Create one or more read replicas in the same region.

D.Upgrade to a larger DB instance class.

E.Enable Amazon RDS Proxy to manage database connections.

AnswersC, E

Read replicas handle read traffic without application changes.

Why this answer

Creating read replicas in Amazon RDS for PostgreSQL offloads read traffic from the primary DB instance, directly addressing intermittent read spikes with minimal application changes. Read replicas are asynchronous replicas that can serve read queries, and the application only needs to update its connection string to point to the replica endpoint for read operations.

Exam trap

The trap here is that candidates often confuse Multi-AZ (which provides failover but no read scaling) with read replicas, or assume that scaling up the instance class is the only way to handle read spikes, ignoring the horizontal scaling benefit of read replicas with minimal application changes.

Full explanation →

1506

MCQmedium

A database administrator is creating an IAM policy to allow a DevOps engineer to manage production RDS instances. The policy above is attached to the engineer's IAM role. The engineer reports that they cannot create a new DB instance with the identifier 'prod-analytics'. What is the most likely reason?

A.The policy does not allow the 'rds:CreateDBInstance' action on the required resource because the resource ARN pattern is incorrect.

B.The policy does not include the 'rds:CreateDBSecurityGroup' action.

C.The engineer does not have permissions to pass an IAM role to the DB instance if one is specified.

D.The policy does not include the 'rds:CreateDBInstance' action for all regions.

AnswerC

When creating a DB instance with an IAM role, the 'iam:PassRole' permission is required. This is a common missing permission.

Why this answer

The most likely reason is that when creating the DB instance, the engineer specified an IAM role to be associated with the instance (e.g., for backup or monitoring). The attached policy does not include an 'iam:PassRole' action, which is required to pass the role to RDS. Without it, the CreateDBInstance call fails due to insufficient permissions to pass the specified role.

Full explanation →

1507

MCQmedium

A company is investigating a performance issue with an Amazon Aurora MySQL database. The output of the describe-db-instances command is shown. The application experiences intermittent slowdowns during write-heavy periods. Which change would MOST likely improve write performance?

A.Add an Aurora Replica to distribute read traffic and reduce load on the writer

B.Increase the provisioned IOPS to 10000

C.Change StorageType to gp2 and increase AllocatedStorage to 200 GB

D.Set StorageEncrypted to false to reduce encryption overhead

AnswerB

Correct. Increasing provisioned IOPS directly addresses I/O bottlenecks during write-heavy periods, thereby improving write throughput.

Why this answer

Increasing provisioned IOPS directly improves write throughput by reducing I/O latency. In this scenario, write-heavy periods cause intermittent slowdowns, which are often due to hitting the IOPS limit of the current instance configuration. Option A is incorrect because Aurora Replicas only offload reads and have no effect on write performance.

The writer instance still handles all writes regardless of replicas.

Exam trap

The trap is that candidates may assume adding Aurora Replicas helps write performance by reducing load, but replicas only serve reads. Write performance is not improved by offloading reads; it requires addressing I/O capacity directly.

How to eliminate wrong answers

Option A is wrong because Aurora Replicas only offload read traffic and do not reduce write load on the primary instance; write performance is bottlenecked by the writer's CPU, memory, and storage I/O, not by read traffic. Option B is wrong because increasing provisioned IOPS to 10000 may help if the current IOPS are exhausted, but the question does not indicate an IOPS limit issue; the intermittent slowdowns during write-heavy periods suggest a different bottleneck, such as CPU or lock contention. Option C is wrong because changing StorageType to gp2 and increasing AllocatedStorage to 200 GB does not guarantee improved write performance; gp2 has burst credits that can be exhausted, and Aurora uses a shared distributed storage system where storage type and size are managed automatically, not by the user.

Option D is wrong because setting StorageEncrypted to false does not reduce encryption overhead in Aurora; encryption is handled at the storage layer with minimal performance impact, and disabling it would violate security best practices without addressing the write performance issue.

Full explanation →

1508

MCQmedium

A company uses Amazon DynamoDB with on-demand capacity. Users report increased latency during peak hours. The application uses the DynamoDB API. Which monitoring metric should be examined first to identify throttling issues?

A.ThrottledRequests

B.SuccessfulRequestLatency

C.ReadThrottleEvents

D.ConsumedWriteCapacityUnits

AnswerA

ThrottledRequests directly indicates requests that were throttled.

Why this answer

(ThrottledRequests). ThrottledRequests is a CloudWatch metric that directly indicates the number of requests that were throttled due to exceeding provisioned throughput limits or the instantaneous capacity of on-demand mode. For on-demand capacity, while DynamoDB scales automatically, sudden spikes can still cause throttling.

Examining ThrottledRequests first provides the most direct indication of throttling issues. Option B (SuccessfulRequestLatency) is incorrect because it measures latency of successful requests, not throttling. Option C (ReadThrottleEvents) is incorrect because it only counts throttled read events, whereas ThrottledRequests includes both reads and writes.

Option D (ConsumedWriteCapacityUnits) is incorrect because it shows the amount of write capacity consumed, not throttled requests.

Full explanation →

1509

MCQhard

Refer to the exhibit. You run the command and get the output shown. The database is an RDS for MySQL instance. You need to connect to it from an EC2 instance in the same VPC. Which connection string should be used?

A.mysql -h mydb.123456789012.us-east-1.rds.amazonaws.com -P 3306 -u admin -p

B.psql -h mydb.123456789012.us-east-1.rds.amazonaws.com -p 5432 -U admin

C.mysql -h mydb.us-east-1.rds.amazonaws.com -P 3306 -u admin -p

D.mysql -h mydb.123456789012.us-east-1.rds.amazonaws.com -P 5432 -u admin -p

AnswerA

Correct endpoint and port.

Why this answer

The command uses the MySQL client (`mysql`) with the correct fully qualified domain name (FQDN) of the RDS instance, which includes the AWS account ID and region, and the default MySQL port 3306. The `-u admin -p` flags specify the master username and prompt for a password, which is the standard way to connect to an RDS for MySQL instance from an EC2 instance in the same VPC.

Exam trap

The trap here is that candidates may confuse the default ports for MySQL (3306) and PostgreSQL (5432) or omit the account ID from the RDS endpoint, leading them to choose an option with an incorrect port or an incomplete hostname.

How to eliminate wrong answers

Option B is wrong because it uses `psql`, which is the PostgreSQL client, not the MySQL client, and port 5432 is the default PostgreSQL port, not MySQL. Option C is wrong because the hostname `mydb.us-east-1.rds.amazonaws.com` is missing the AWS account ID (`123456789012`), which is required in the FQDN for RDS instances; without it, DNS resolution will fail. Option D is wrong because it uses port 5432, which is the PostgreSQL default port, not the MySQL default port 3306.

Full explanation →

1510

MCQeasy

A company needs to encrypt data at rest for their Amazon Aurora PostgreSQL database. Which solution is the MOST secure and requires the least operational overhead?

A.Enable encryption at rest using AWS KMS when creating the Aurora cluster.

B.Use Amazon EBS encryption on the underlying volumes.

C.Encrypt the database after creation by modifying the DB instance.

D.Use client-side encryption in the application.

AnswerA

Enabling encryption at rest using AWS KMS during database creation is the simplest and most secure approach. Aurora handles encryption transparently.

Why this answer

Enabling encryption at rest using AWS KMS during database creation is the simplest and most secure approach. Option A is correct. Option B is wrong because EBS encryption only protects the underlying storage, not the Aurora database engine layer, and it adds operational overhead.

Option C is wrong because you cannot encrypt an existing unencrypted Aurora cluster directly; you must perform a manual snapshot and restore to a new encrypted cluster, which increases complexity. Option D is wrong because client-side encryption requires managing encryption keys in the application, increasing complexity and operational overhead.

Full explanation →

1511

MCQmedium

A database administrator notices that an Amazon RDS for MySQL instance's CPU utilization is consistently above 80% during peak hours. The DB instance is a db.r5.large with 16 GB memory and 500 GB gp2 storage. The application is a read-intensive web application. Which action is MOST effective to reduce CPU load without significant cost increase?

A.Increase the instance size to db.r5.xlarge

B.Create a read replica and redirect read traffic to it

C.Enable Performance Insights to identify slow queries and optimize them

D.Increase the allocated storage to 1000 GB to improve I/O performance

AnswerB

Offloads read queries, reducing CPU on the primary instance.

Why this answer

Creating a read replica offloads read traffic from the primary instance, reducing CPU utilization without requiring a larger instance or more storage. Option A increases cost significantly. Option C may not help if the issue is CPU, not I/O.

Option D increases storage but does not directly reduce CPU.

Full explanation →

1512

MCQmedium

A company needs to run complex analytical queries on structured data in Amazon S3 without loading data into a database. The queries must execute quickly and support standard SQL. Which service should they use?

A.Amazon QuickSight

B.AWS Glue ETL jobs

C.Amazon Redshift Spectrum

D.Amazon Athena

AnswerD

Serverless, queries S3 directly with SQL.

Why this answer

Amazon Athena is a serverless interactive query service that allows you to run standard SQL directly on data stored in Amazon S3 without loading or transforming it. It uses Presto under the hood and supports complex analytical queries on structured data with fast execution, making it the ideal choice for this use case.

Exam trap

The trap here is that candidates often confuse Amazon Redshift Spectrum with Athena, but Spectrum requires an existing Redshift cluster (provisioned infrastructure), whereas Athena is truly serverless and directly queries S3 without any database setup.

How to eliminate wrong answers

Option A is wrong because Amazon QuickSight is a business intelligence (BI) visualization and dashboarding tool, not a query engine for running complex analytical SQL directly on S3 data. Option B is wrong because AWS Glue ETL jobs are designed for extract, transform, and load (ETL) processes, not for ad-hoc interactive querying; they require defining jobs and incur runtime costs even for simple queries. Option C is wrong because Amazon Redshift Spectrum extends Redshift to query data in S3, but it requires an active Redshift cluster to be provisioned and running, which adds cost and complexity that Athena avoids with its serverless model.

Full explanation →

1513

MCQhard

A company is migrating a 5 TB PostgreSQL database from on-premises to Amazon RDS for PostgreSQL. The database has a 24/7 uptime requirement and must be migrated with minimal downtime. The on-premises network bandwidth is 100 Mbps. The migration must be completed within 48 hours. The team has chosen to use AWS Database Migration Service (DMS) with ongoing replication from a change data capture (CDC) source. After setting up the source endpoint, target endpoint, and replication instance, the initial full load takes 30 hours. However, during the CDC phase, the target falls behind by over 2 hours and continues to lag. The replication instance is a dms.c5.large (2 vCPUs, 4 GB memory). The source database is heavily utilized with frequent updates. What should the team do to reduce the CDC lag and meet the migration deadline?

A.Increase the replication instance size to dms.c5.2xlarge.

B.Enable Multi-AZ on the replication instance for better performance.

C.Split the migration into multiple DMS tasks for parallel processing.

D.Disable ongoing replication and use a one-time full load migration.

AnswerA

Increasing the replication instance size provides more CPU and memory, allowing it to process CDC changes faster and reduce lag.

Why this answer

Increasing the replication instance size to dms.c5.2xlarge provides more CPU and memory, which can handle higher transaction throughput, reducing CDC lag. Option B is wrong because enabling Multi-AZ on a replication instance does not directly improve performance; it adds redundancy and can even introduce latency. Option C is wrong because splitting the migration into multiple tasks for a single source database adds overhead and may cause conflicts, and it does not necessarily reduce lag.

Option D is wrong because disabling ongoing replication would result in data loss and does not meet the minimal downtime requirement.

Full explanation →

1514

Multi-Selectmedium

A company is migrating a 1 TB Oracle database to Amazon Aurora PostgreSQL using AWS DMS. They need to ensure minimal downtime and data consistency. Which TWO actions should the company take?

Select 2 answers

A.Increase the target Aurora storage to 2 TB to avoid storage issues

B.Enable change data capture (CDC) on the source Oracle database

C.Enable data validation on the DMS task

D.Disable foreign key constraints on the target during migration

E.Use AWS Schema Conversion Tool to convert the schema

AnswersB, C

CDC captures ongoing changes to minimize downtime.

Why this answer

Enabling Change Data Capture (CDC) on the source Oracle database allows AWS DMS to capture ongoing changes after the full load, enabling a near-zero downtime migration by continuously replicating transactions to the target Aurora PostgreSQL. Option C is correct because enabling data validation on the DMS task ensures that the data migrated is consistent between the source and target, verifying that no data loss or corruption occurred during the migration process.

Exam trap

The trap here is that candidates often confuse the AWS Schema Conversion Tool (SCT) with DMS, thinking it is part of the migration process for minimizing downtime, when in fact SCT is used for schema assessment and conversion before migration, not for ongoing replication or consistency checks.

Full explanation →

1515

MCQeasy

A company runs an application that requires a relational database with high availability across multiple Availability Zones. The database must automatically failover with minimal downtime. Which AWS service meets these requirements?

A.Amazon RDS for MySQL with Multi-AZ deployment.

B.Amazon DynamoDB with global tables.

C.Amazon Redshift with cross-Region snapshots.

D.Amazon RDS for MySQL with a single instance.

AnswerA

Automatic failover to standby in different AZ.

Why this answer

Amazon RDS for MySQL with Multi-AZ deployment automatically provisions and maintains a synchronous standby replica in a different Availability Zone. If the primary instance fails, Amazon RDS automatically fails over to the standby, typically within 60–120 seconds, providing high availability with minimal downtime. This meets the requirement for a relational database with automatic failover across multiple Availability Zones.

Exam trap

The trap here is that candidates may confuse DynamoDB global tables (multi-Region replication) with Multi-AZ failover, or assume that a single RDS instance with automated backups provides the same availability as Multi-AZ, but automated backups do not provide automatic failover or synchronous replication.

How to eliminate wrong answers

Option B is wrong because Amazon DynamoDB is a NoSQL key-value and document database, not a relational database, and global tables provide multi-Region replication, not the Multi-AZ failover required. Option C is wrong because Amazon Redshift is a data warehouse, not a transactional relational database, and cross-Region snapshots are manual or scheduled backups, not automatic failover. Option D is wrong because a single-instance Amazon RDS for MySQL deployment does not provide Multi-AZ redundancy or automatic failover; it runs in a single Availability Zone and requires manual recovery if the instance fails.

Full explanation →

1516

MCQmedium

A company uses Amazon CloudWatch to monitor an RDS for Oracle instance. They want to receive an alert when the database connection count exceeds 90% of the maximum connections. Which CloudWatch metric should be used to create the alarm?

A.ActiveTransactions

B.DatabaseConnections

C.ReadIOPS

D.NetworkThroughput

AnswerB

Correct. This metric directly reflects the number of connections.

Why this answer

(DatabaseConnections) is correct because this metric tracks the number of client connections to the database instance, which directly reflects the connection count. To alert when connections exceed 90% of maximum connections, you would monitor DatabaseConnections and compare it to the instance's MaxConnections parameter. Option A (ActiveTransactions) is incorrect because it measures the number of concurrent transactions, not connections.

Option C (ReadIOPS) and Option D (NetworkThroughput) are unrelated metrics for disk I/O and network traffic, respectively.

Full explanation →

1517

Multi-Selecteasy

A company is using Amazon DynamoDB with provisioned capacity. The table's read capacity is consistently underutilized, but the write capacity is frequently maxed out. The team wants to optimize costs while maintaining performance. Which TWO actions should be taken?

Select 2 answers

A.Switch the table to on-demand capacity mode.

B.Enable DynamoDB Accelerator (DAX) to offload reads.

C.Use DynamoDB Auto Scaling for write capacity.

D.Increase the provisioned write capacity to handle spikes.

E.Reduce the provisioned read capacity to match actual usage.

AnswersC, E

Auto Scaling adjusts write capacity to match demand, reducing throttling and cost.

Why this answer

The correct answers are C and E. DynamoDB Auto Scaling for write capacity (C) dynamically adjusts the provisioned write capacity based on traffic, preventing throttling during spikes without over-provisioning. Reducing provisioned read capacity (E) to match actual usage saves costs because reads are underutilized.

Option A (on-demand) can be more expensive for predictable workloads, and Auto Scaling is often more cost-effective. Option B (DAX) offloads reads, not writes, so it does not address the write bottleneck. Option D (increasing provisioned writes) would raise costs without dynamic scaling, as capacity would remain high even when not needed.

Full explanation →

1518

MCQeasy

A company wants to automate the creation of a new Amazon RDS for SQL Server instance with specific configurations, including VPC, subnet, and security group settings. Which AWS service should be used to deploy this infrastructure as code?

A.AWS CodeDeploy

B.AWS Elastic Beanstalk

C.AWS CloudFormation

D.AWS OpsWorks

AnswerC

CloudFormation templates can define RDS instances along with VPC, subnets, and security groups.

Why this answer

AWS CloudFormation is the correct service because it allows you to define your entire infrastructure, including Amazon RDS for SQL Server instances, VPCs, subnets, and security groups, as code using a JSON or YAML template. This enables automated, repeatable deployments and version control of your infrastructure, which is the core requirement for infrastructure as code (IaC).

Exam trap

The trap here is that candidates often confuse AWS CloudFormation with AWS Elastic Beanstalk, thinking Elastic Beanstalk can also deploy infrastructure as code, but Elastic Beanstalk is a higher-level service that manages the environment automatically and does not give you fine-grained control over VPC and subnet configurations via code.

How to eliminate wrong answers

Option A is wrong because AWS CodeDeploy is a service for automating code deployments to running instances (e.g., EC2, Lambda), not for provisioning infrastructure like RDS or VPCs. Option B is wrong because AWS Elastic Beanstalk is a PaaS service that abstracts underlying infrastructure management and does not provide direct control over specific VPC, subnet, and security group configurations as code. Option D is wrong because AWS OpsWorks is a configuration management service based on Chef and Puppet, designed for managing application configurations and server states, not for declaratively provisioning infrastructure resources like RDS instances or network components.

Full explanation →

1519

MCQhard

A company is using Amazon ElastiCache for Redis as a caching layer for a high-traffic web application. The cache hit ratio has dropped from 95% to 70% after a recent deployment that changed the cache key structure. The application team wants to improve the hit ratio without increasing the cache memory. Which action should they take?

A.Disable Cluster Mode and use a single node.

B.Implement a consistent hashing algorithm for key distribution.

C.Increase the TTL (time-to-live) for all cache keys.

D.Use random TTLs to spread out expiration times.

AnswerB

Consistent hashing minimizes key redistribution when nodes change and ensures even distribution, reducing evictions and improving hit ratio.

Why this answer

A drop in cache hit ratio after changing the key structure indicates that the new keys are not being distributed evenly across the cluster nodes, causing some nodes to be overloaded with misses. Implementing a consistent hashing algorithm (e.g., using the Redis Cluster hash slot mechanism or a client-side library like libketama) ensures that keys are distributed uniformly across shards, minimizing cache misses and improving the hit ratio without adding memory.

Exam trap

The trap here is that candidates often confuse TTL management (options C and D) with key distribution issues, mistakenly believing that extending or randomizing expiration times will fix a hit ratio drop caused by poor key placement across cluster nodes.

How to eliminate wrong answers

Option A is wrong because disabling Cluster Mode and using a single node would remove the ability to scale horizontally and could lead to memory exhaustion, but it does not address the root cause of poor key distribution; in fact, a single node would still have the same key structure issue. Option C is wrong because increasing the TTL for all cache keys would only keep stale data longer, not improve the hit ratio caused by key distribution problems; it could also increase memory pressure by holding onto unused keys. Option D is wrong because using random TTLs to spread out expiration times helps avoid thundering herd problems but does not fix the uneven key distribution that leads to a low hit ratio; random TTLs do not affect how keys are mapped to nodes.

Full explanation →

1520

MCQeasy

A company is using Amazon RDS for SQL Server with Multi-AZ and automated backups enabled. The database administrator needs to restore the database to a specific point in time that is within the retention period. What is the correct procedure?

A.Use the RDS console to perform a point-in-time recovery to the desired time

B.Restore from a manual snapshot taken at the desired time

C.Use the native SQL Server backup and restore functionality

D.Restore from the latest automated snapshot

AnswerA

Correct. Point-in-time recovery via the RDS console or API allows restoring to any time within the backup retention period.

Why this answer

The correct procedure for performing a point-in-time recovery within the retention period for an Amazon RDS for SQL Server instance with Multi-AZ and automated backups is to use the RDS console or API to specify the desired point in time. This restores the database to the specified time using the automated backup logs. Option B is incorrect because manual snapshots capture a specific point and cannot be used for arbitrary point-in-time recovery.

Option C is incorrect because native SQL Server backup is not supported for RDS instances; AWS manages backups. Option D is incorrect because restoring from the latest automated snapshot does not give a specific point in time.

Full explanation →

1521

MCQhard

A company has a production Amazon DynamoDB table with on-demand capacity. The table experiences occasional throttling due to hot partitions. The operations team wants to implement a solution to identify the specific partition keys causing the throttling. What is the MOST efficient approach?

A.Enable AWS X-Ray tracing on the application and analyze traces.

B.Enable VPC Flow Logs and use CloudWatch Logs Insights to query the logs.

C.Enable Amazon CloudWatch Contributor Insights for DynamoDB.

D.Enable DynamoDB Streams and process the stream records to identify hot keys.

AnswerC

Contributor Insights analyzes access patterns and identifies top partition keys.

Why this answer

Amazon CloudWatch Contributor Insights for DynamoDB is the most efficient solution because it automatically analyzes DynamoDB request metadata to identify the most frequently accessed partition keys, including those causing throttling. It provides near real-time top-N contributor reports without requiring application changes, custom logging, or additional stream processing, making it purpose-built for diagnosing hot partition issues.

Exam trap

The trap here is that candidates often confuse DynamoDB Streams (which capture change data) with a tool for monitoring read traffic or access patterns, leading them to choose Option D despite Streams being designed for event-driven processing, not diagnostic analysis of hot partitions.

How to eliminate wrong answers

Option A is wrong because AWS X-Ray traces application-level requests but does not directly identify DynamoDB partition keys causing throttling; it focuses on end-to-end latency and service maps, not per-key access patterns. Option B is wrong because VPC Flow Logs capture network traffic metadata (IP addresses, ports, protocols) and cannot reveal DynamoDB partition keys or item-level access patterns, as DynamoDB uses HTTPS and the partition key is embedded in the request payload, not in network headers. Option D is wrong because DynamoDB Streams capture item-level changes (inserts, updates, deletes) but do not provide read request data or access frequency per partition key; processing streams to infer hot keys would require complex custom logic and still miss read-heavy hot partitions.

Full explanation →

1522

MCQhard

A company is migrating a 10 TB Oracle data warehouse to Amazon Redshift. They want to use AWS DMS for continuous replication. However, the migration is taking longer than expected due to LOB columns. What optimization should be applied?

A.Use AWS SCT to compress LOBs.

B.Enable FullLobMode to transfer all LOBs.

C.Set MaxLobSize to a value like 64 KB to limit inline LOB transfer.

D.Increase the number of DMS tasks.

AnswerC

This optimizes performance.

Why this answer

Setting MaxLobSize to a value like 64 KB instructs AWS DMS to treat LOBs smaller than that threshold as inline data, which is transferred more efficiently in the batch stream. This avoids the performance penalty of using FullLobMode, which transfers each LOB individually and can dramatically slow down continuous replication for large tables with many LOB columns.

Exam trap

The trap here is that candidates assume FullLobMode is always the safest or fastest choice, not realizing that its per-LOB API call overhead is the very cause of the slowdown, while LimitedLobMode with a properly tuned MaxLobSize dramatically improves throughput for LOB columns.

How to eliminate wrong answers

Option A is wrong because AWS SCT (Schema Conversion Tool) does not compress LOBs; it converts schema and can assess migration complexity, but data compression during transfer is handled by DMS settings, not SCT. Option B is wrong because enabling FullLobMode forces DMS to transfer every LOB in its entirety using a separate API call per LOB, which is the default behavior that causes the slow performance described in the scenario. Option D is wrong because simply increasing the number of DMS tasks does not address the root cause of LOB transfer overhead; it may lead to resource contention or task conflicts without improving per-LOB throughput.

Full explanation →

1523

MCQmedium

A company is migrating its on-premises MySQL database to Amazon Aurora MySQL. The current database has a table of 500 GB that is accessed by a nightly batch job that updates 80% of the rows. The company wants to minimize downtime during migration. Which migration strategy is MOST appropriate?

A.Use AWS Database Migration Service (DMS) with Aurora as the target.

B.Create an Aurora read replica from the on-premises database.

C.Export the data to Amazon S3 and load it into Aurora using the LOAD DATA FROM S3 command.

D.Use mysqldump to export the database and import it into Aurora.

AnswerA

DMS allows ongoing replication, minimizing downtime.

Why this answer

AWS DMS supports ongoing replication from an on-premises MySQL source to Amazon Aurora MySQL, allowing the nightly batch job to continue running during the initial full load. After the full load completes, DMS captures incremental changes and applies them to Aurora, enabling a cutover with minimal downtime. This approach is ideal for large tables (500 GB) with high update volumes because it avoids a lengthy offline export/import process.

Exam trap

The trap here is that candidates often assume mysqldump or S3 export are faster for large datasets, but they overlook the need for minimal downtime and the ability to keep the batch job running, which DMS’s CDC capability uniquely addresses.

How to eliminate wrong answers

Option B is wrong because Aurora read replicas can only be created from an existing Aurora cluster, not from an on-premises MySQL database; they are a feature within the Aurora ecosystem, not a migration tool. Option C is wrong because exporting the table to Amazon S3 and using LOAD DATA FROM S3 requires the database to be offline during the export, and the batch job would need to be stopped, causing significant downtime. Option D is wrong because mysqldump performs a logical backup that locks tables or requires a read lock, and importing 500 GB would take hours or days, during which the nightly batch job cannot run, leading to unacceptable downtime.

Full explanation →

1524

MCQmedium

A data analyst reports that a nightly ETL job to Amazon Redshift is failing with timeout errors shown in the exhibit. The cluster is a dc2.large with 2 nodes. The ETL job inserts large volumes of data. What is the most likely cause?

A.The cluster has reached the maximum number of connections.

B.The workload manager (WLM) queue timeout is too low.

C.The security group is blocking inbound traffic from the ETL server.

D.The cluster has insufficient disk space for the data load.

AnswerD

dc2 nodes use local SSD; full disk causes write failures.

Why this answer

The dc2.large node type has a fixed storage limit of 160 GB per node (320 GB total for 2 nodes). When an ETL job inserts large volumes of data and the cluster runs out of disk space, Redshift cannot write new rows, causing the load to hang and eventually time out. Insufficient disk space is a common cause of timeout errors during bulk inserts because the database cannot complete the write operations.

Exam trap

The trap here is that candidates often attribute timeout errors to network or WLM configuration issues, overlooking the fact that Redshift's fixed storage per node can be silently exhausted during large data loads, leading to apparent timeouts rather than explicit 'disk full' errors.

How to eliminate wrong answers

Option A is wrong because the maximum number of connections for a dc2.large cluster is 500 per node (1,000 total), and connection limits typically produce 'too many connections' errors, not timeout errors during data load. Option B is wrong because WLM queue timeout controls how long a query waits in a queue before being rejected or queued, not the execution timeout of an ongoing INSERT operation; a low WLM timeout would produce a 'queue timeout' error, not a generic timeout during data insertion. Option C is wrong because security group rules blocking inbound traffic would cause connection failures (e.g., 'connection refused' or 'no route to host'), not timeout errors after the ETL job has already started inserting data.

Full explanation →

1525

MCQhard

A database specialist is troubleshooting an Amazon RDS for PostgreSQL instance that is experiencing intermittent connection timeouts. The application logs show errors like 'FATAL: remaining connection slots are reserved for non-replication superuser connections'. The max_connections parameter is set to 100. What should the specialist do to resolve this issue?

A.Modify the 'max_connections' parameter to a higher value and reboot the instance.

B.Increase the 'max_replication_slots' parameter to allow more replication connections.

C.Increase the value of the 'superuser_reserved_connections' parameter.

D.Enable RDS Proxy to manage database connections efficiently.

AnswerA

Increasing max_connections allows more concurrent connections and resolves the error.

Why this answer

The error indicates that the maximum number of connections has been reached. Increasing the max_connections parameter allows more concurrent connections, resolving the issue. Option B is incorrect because the error is about regular connections, not replication slots.

Option C is incorrect because the superuser_reserved_connections parameter reserves slots for superusers; the error is about all connection slots being exhausted. Option D is incorrect because RDS Proxy manages connection pooling but does not increase the connection limit.

Full explanation →

1526

MCQmedium

A company is migrating a 500 GB MongoDB database to Amazon DocumentDB. The migration must have minimal impact on the source database. Which approach should the company take?

A.Use mongodump to export the data, then use mongorestore to import into DocumentDB.

B.Use mongoexport to export CSV, then use the DocumentDB import tool.

C.Use AWS Database Migration Service (DMS) with MongoDB as source and DocumentDB as target.

D.Use AWS Schema Conversion Tool (SCT) to convert schema, then copy data.

AnswerC

DMS allows online migration with minimal impact.

Why this answer

AWS DMS supports ongoing replication from MongoDB to Amazon DocumentDB, enabling a live migration with minimal impact on the source database. DMS uses the MongoDB oplog to capture changes continuously, so the source is only read during the initial load and then tailed for CDC, avoiding heavy locks or performance degradation.

Exam trap

The trap here is that candidates assume native MongoDB tools (mongodump/mongoexport) are always the best for migration, but they fail to consider the requirement for minimal impact and the need for ongoing replication, which only AWS DMS provides for DocumentDB.

How to eliminate wrong answers

Option A is wrong because mongodump/mongorestore performs a full dump that can cause significant read load and locking on the source MongoDB, and it does not support ongoing replication, requiring downtime for the cutover. Option B is wrong because mongoexport to CSV is a single-threaded export that cannot capture the full BSON data types (e.g., ObjectId, ISODate) and does not support continuous change data capture, making it unsuitable for a minimal-impact migration. Option D is wrong because AWS SCT is designed for schema conversion between relational databases (e.g., Oracle to Aurora) and does not support MongoDB or DocumentDB; it cannot handle NoSQL document models or migrate data.

Full explanation →

1527

MCQeasy

A database specialist needs to capture SQL queries executed against an Amazon Aurora MySQL DB cluster for performance analysis. The capture should have minimal performance impact and be stored in Amazon CloudWatch Logs. Which feature should the specialist use?

A.Enable Performance Insights and configure the Performance Insights log export to CloudWatch Logs.

B.Enable the slow query log and export to CloudWatch Logs.

C.Enable database audit logs and export to CloudWatch Logs.

D.Enable the general log and publish to CloudWatch Logs.

AnswerA

Performance Insights captures SQL queries with minimal impact.

Why this answer

Performance Insights captures SQL queries with minimal overhead by sampling the database engine's internal wait states and query activity, then exports this data to CloudWatch Logs for analysis. This approach is designed for performance monitoring without the significant performance impact of enabling full logging (like the general log), making it ideal for capturing queries for performance analysis.

Exam trap

The trap here is that candidates often confuse the purpose of the general log (capturing all queries) with performance analysis, overlooking that Performance Insights provides a low-overhead alternative specifically designed for this task.

How to eliminate wrong answers

Option B is wrong because the slow query log only captures queries that exceed a specified execution time threshold, not all SQL queries, and enabling it can still add overhead. Option C is wrong because database audit logs are designed for compliance and security auditing (e.g., tracking login attempts, schema changes), not for capturing all SQL queries for performance analysis, and they can generate high volume. Option D is wrong because the general log captures all SQL queries but has a high performance impact on the database, especially under heavy load, and is not recommended for production use.

Full explanation →

1528

MCQmedium

A company is running an Amazon RDS for MySQL DB instance. The database performance has degraded over time. The DBA suspects that the issue is due to a high number of connections that are in a 'sleep' state from a legacy application. What is the MOST effective solution to automatically terminate idle connections?

A.Modify the 'wait_timeout' parameter in the DB parameter group to a lower value.

B.Increase the 'max_connections' parameter to accommodate more idle connections.

C.Enable Amazon RDS Proxy to manage connection pooling and automatically close idle connections.

D.Use a script to run 'SHOW PROCESSLIST' and manually kill idle connections.

AnswerA

This parameter controls how long the server waits for activity on a non-interactive connection before closing it.

Why this answer

The 'wait_timeout' parameter in MySQL automatically closes idle connections after the specified number of seconds. Reducing this value from the default (28800 seconds) will terminate sleeping connections sooner and free up resources. Option B is incorrect because increasing 'max_connections' does not terminate idle connections; it only allows more connections, which could worsen the problem.

Option C is incorrect because Amazon RDS Proxy manages connection pooling and reduces connection overhead but does not automatically terminate idle connections; it reuses connections but does not kill them. Option D is incorrect because running 'SHOW PROCESSLIST' and manually killing connections is not automated and requires human intervention, so it is not the most effective solution.

Full explanation →

1529

MCQmedium

A company uses Amazon DynamoDB with AWS KMS customer managed keys for encryption at rest. The security team wants to audit who is using the KMS key to encrypt and decrypt data. Which AWS service should be used?

A.Amazon S3 access logs

B.AWS Config

C.AWS CloudTrail

D.Amazon CloudWatch Logs

AnswerC

AWS CloudTrail logs all KMS API calls, including Encrypt and Decrypt, enabling auditing of who used the KMS key.

Why this answer

AWS CloudTrail logs all KMS API calls, including Encrypt and Decrypt, enabling auditing of who used the KMS key. Amazon S3 access logs (option A) are for S3 bucket access, not KMS. AWS Config (option B) tracks resource configuration changes, not API calls.

Amazon CloudWatch Logs (option D) can store logs but does not capture KMS API calls by itself.

Full explanation →

1530

MCQhard

A company uses Amazon Aurora MySQL-Compatible Edition. The database specialist notices that the DB cluster's failover time is longer than expected. The primary instance is using a db.r5.large instance class. Which change would most likely reduce the failover time?

A.Enable Backtrack on the DB cluster.

B.Use a larger instance class for the Aurora Replicas.

C.Increase the number of Aurora Replicas.

D.Enable Multi-AZ deployment for the DB cluster.

AnswerB

Larger replicas can process transactions faster during promotion, reducing failover time.

Why this answer

Using a larger instance class for Aurora replicas ensures they can handle the workload after failover, potentially reducing failover time. However, the key factor is that Aurora failover is typically fast, but if replicas are undersized, the time to promote and become fully operational increases. Using a larger instance class for the replicas (or all instances) can help.

Full explanation →

1531

MCQhard

A company runs an e-commerce platform using Amazon DynamoDB as the database. The table has a provisioned capacity of 5000 WCU and 3000 RCU. During a flash sale, the write traffic spikes to 8000 WCU for 10 minutes, causing significant throttling. The operations team notices that the table's WriteCapacityUnits metric shows 5000, but the ConsumedWriteCapacityUnits metric peaks at 4500. The application is experiencing errors and slow response times. The team wants to handle such spikes automatically without manual intervention and without over-provisioning. Which solution should be implemented?

A.Enable DynamoDB Auto Scaling with a target utilization of 70% and a minimum capacity of 5000 WCU

B.Increase the provisioned WCU to 8000 permanently

C.Implement an Amazon SQS queue to buffer write requests and process them asynchronously

D.Switch the table to on-demand capacity mode

AnswerA

Auto Scaling dynamically adjusts capacity to handle spikes while minimizing cost.

Why this answer

DynamoDB Auto Scaling can adjust capacity based on demand, and setting a target utilization of 70% allows headroom for spikes. Option B is wrong because increasing provisioned WCU to 8000 permanently would be costly and result in over-provisioning during normal traffic. Option C is wrong because while SQS can buffer requests, it adds latency and does not solve the real-time throttling issue; it changes the architecture to async processing, which may not be acceptable for an e-commerce platform.

Option D is wrong because switching to on-demand capacity mode would handle the spikes automatically but can be significantly more expensive for a workload with a predictable baseline, and the team wants to avoid over-provisioning costs.

Full explanation →

1532

MCQmedium

A company uses Amazon DynamoDB to store IoT sensor data. Each sensor writes a record every second. The table has a partition key of 'sensor_id' and a sort key of 'timestamp'. Over time, the team notices that write performance degrades for certain sensors that generate more data. The table uses provisioned capacity with auto scaling enabled. The application uses eventual consistency. The team needs to ensure consistent write performance without throttling. Which action should be taken?

A.Modify the partition key to include a random number or prefix to distribute writes evenly.

B.Increase the provisioned write capacity units (WCU) to a higher value.

C.Switch the table to on-demand capacity mode.

D.Create a global secondary index (GSI) with a different partition key to handle writes.

AnswerA

Write sharding evens out the load across partitions, preventing any single partition from being overloaded.

Why this answer

Adding a random number or prefix to the partition key distributes writes across multiple partitions, preventing hot partitions that cause throttling. Option B (increasing WCU) does not resolve the underlying hot partition issue, as each partition still has a maximum write capacity. Option C (on-demand mode) still has per-partition throughput limits and does not fix uneven write distribution.

Option D (creating a GSI) does not affect the base table's write distribution; GSIs are for read efficiency, not write distribution.

Full explanation →

1533

MCQeasy

A company runs a PostgreSQL database on an Amazon RDS DB instance (db.t3.medium) with 100 GB of General Purpose SSD (gp2) storage. The database is used by a web application that experiences occasional slowdowns. CloudWatch metrics show that the BurstBalance metric for the storage volume drops to 0% during peak usage and then recovers. The average IOPS during peak is 600, and the baseline IOPS for the volume is 300. The team needs a cost-effective solution to eliminate the performance issues. What should the team do?

A.Upgrade the DB instance to db.t3.large.

B.Increase the gp2 volume size to 200 GB.

C.Migrate the storage to gp3 with 3000 baseline IOPS.

D.Enable Performance Insights to monitor database load.

AnswerC

gp3 provides a consistent baseline of 3000 IOPS (or 3000 if using the default) without burst credits, eliminating the burst balance issue and providing headroom.

Why this answer

To migrate to gp3 storage. gp3 provides a consistent baseline of 3000 IOPS regardless of volume size, eliminating the need for burst credits. This directly addresses the BurstBalance dropping to 0% during peak usage. Option A (upgrade instance) does not affect storage performance.

Option B (increase gp2 to 200 GB) would raise the baseline IOPS to 600 and add more burst credits, but the workload still depends on credits and may not be as cost-effective as gp3. Option D (Performance Insights) is a monitoring tool and does not improve performance.

Full explanation →

1534

MCQmedium

A company is migrating a 1 TB SQL Server database to Amazon RDS for SQL Server using backup and restore. The database has high transaction volume. Which backup type should be used to minimize downtime?

A.Perform a full backup, then transaction log backups, and restore the full backup with the last log backup.

B.Perform only transaction log backups and restore them to RDS.

C.Perform a differential backup and restore it to RDS.

D.Perform a full backup and restore it to RDS.

AnswerA

Allows point-in-time recovery, minimizing data loss.

Why this answer

A full backup followed by transaction log backups allows point-in-time recovery and minimizes downtime during migration. You restore the full backup to RDS, then apply the latest transaction log backup to capture all changes up to the migration cutover, ensuring data consistency without requiring the database to be offline for the entire duration.

Exam trap

The trap here is that candidates assume a full backup alone is sufficient for migration, overlooking the need for transaction log backups to capture ongoing changes and minimize downtime in a high-transaction environment.

How to eliminate wrong answers

Option B is wrong because transaction log backups alone cannot be restored without a prior full backup; SQL Server requires a full backup as the base for log chain restoration. Option C is wrong because a differential backup only captures changes since the last full backup, but without the full backup it cannot be restored, and it does not provide point-in-time recovery to minimize downtime. Option D is wrong because a full backup alone would require the database to be offline for the entire backup duration, and any transactions after the backup would be lost, increasing downtime and data loss risk.

Full explanation →

1535

MCQhard

A database engineer is troubleshooting a production Amazon Aurora MySQL DB cluster. The application is experiencing high latency on write operations. The engineer checks the Amazon CloudWatch metrics and sees that the 'AuroraBinlogReplicaLag' metric is high. What is the most likely cause of the write latency?

A.The DB cluster has insufficient storage capacity for the binlog files

B.The DB cluster has a high CPU utilization that is causing replication lag

C.The binlog replication to a downstream MySQL instance is falling behind

D.A recent failover event caused the binlog to be replayed from the last checkpoint

AnswerC

High binlog lag means the downstream replica cannot keep up, causing write delays if the source waits for acknowledgment.

Why this answer

The 'AuroraBinlogReplicaLag' metric specifically measures the lag between the Aurora MySQL cluster and an external MySQL instance that is replicating from Aurora using binary log (binlog) replication. When this lag is high, it indicates that the downstream MySQL instance is falling behind in applying binlog events, which can cause write operations on the Aurora cluster to stall or slow down due to the synchronous nature of binlog generation and the need to retain binlogs until they are consumed by the replica.

Exam trap

The trap here is that candidates often confuse 'AuroraBinlogReplicaLag' with Aurora's internal replication lag (e.g., ReplicaLag for Aurora Replicas) or with general performance metrics like CPU or storage, leading them to select incorrect options that do not address the specific binlog replication context.

How to eliminate wrong answers

Option A is wrong because insufficient storage capacity for binlog files would cause binlog file retention issues or storage full errors, but it does not directly cause high binlog replication lag; the 'AuroraBinlogReplicaLag' metric is about replication delay, not storage capacity. Option B is wrong because high CPU utilization on the DB cluster can cause general performance degradation, but the 'AuroraBinlogReplicaLag' metric is specific to the lag of binlog replication to an external MySQL instance, not to internal replication or CPU-related delays. Option D is wrong because a failover event would cause a brief interruption and replay of binlog from the last checkpoint, but this would not result in a persistently high 'AuroraBinlogReplicaLag' metric; the lag would typically be transient and recover quickly.

Full explanation →

1536

Multi-Selecteasy

Which TWO tools can be used to monitor query performance in Amazon Aurora MySQL? (Choose 2.)

Select 2 answers

A.Amazon RDS Performance Insights

B.AWS Config

C.Amazon RDS Enhanced Monitoring

D.VPC Flow Logs

E.AWS CloudTrail

AnswersA, C

Shows database load and SQL queries.

Why this answer

A is correct: Amazon RDS Performance Insights provides a visualization of database performance, including metrics like average active sessions, which helps identify query performance issues. C is correct: Amazon RDS Enhanced Monitoring provides OS-level metrics such as CPU, memory, and disk I/O, which can help correlate with query performance. B is incorrect: AWS Config is a service for configuration audit and compliance, not for real-time performance monitoring.

D is incorrect: VPC Flow Logs capture network traffic metadata and are not specific to query performance. E is incorrect: AWS CloudTrail logs API calls for governance and compliance, not database query performance.

Full explanation →

1537

MCQhard

A company runs a document management system using Amazon DocumentDB (with MongoDB compatibility). The application stores large documents (up to 5 MB each) and frequently fetches them by document ID. The team notices increased latency during peak hours. They need to reduce read latency. Which action is MOST effective?

A.Add read replicas to the cluster

B.Shard the collection across multiple DocumentDB clusters

C.Implement Amazon ElastiCache for Redis in front of DocumentDB

D.Increase the instance class of the primary instance

AnswerA

Read replicas offload read traffic and reduce latency.

Why this answer

Adding read replicas to the DocumentDB cluster is the most effective action because it offloads read traffic from the primary instance, directly reducing read latency during peak hours. DocumentDB supports up to 15 read replicas that are kept in sync via the cluster's replication mechanism, and the application's frequent fetches by document ID are read-heavy operations that benefit from distributing the load across multiple replicas.

Exam trap

AWS often tests the misconception that scaling up the primary instance (Option D) is equivalent to scaling out read capacity, but in DocumentDB, read replicas are the correct solution for read-heavy workloads because they provide horizontal read scaling without overloading the primary.

How to eliminate wrong answers

Option B is wrong because sharding across multiple DocumentDB clusters is not a native feature of DocumentDB; DocumentDB does not support horizontal sharding like MongoDB, and managing multiple clusters manually would introduce complexity without reducing read latency for individual document fetches. Option C is wrong because implementing Amazon ElastiCache for Redis in front of DocumentDB adds an additional caching layer that, while potentially beneficial for repeated queries, introduces cache management overhead and does not address the root cause of increased latency during peak hours for direct document ID lookups. Option D is wrong because increasing the instance class of the primary instance only scales the compute and memory resources of a single node, which does not distribute the read load and may still result in latency under high concurrent read traffic.

Full explanation →

1538

MCQmedium

A company is running a production Amazon RDS for PostgreSQL database. The database has experienced a sudden spike in CPU utilization, causing application timeouts. The monitoring team needs to identify the root cause. Which AWS service or feature should be used to analyze the database load and identify the specific queries causing the high CPU?

A.Enhanced Monitoring

B.Amazon CloudWatch Logs

C.Amazon RDS Performance Insights

D.AWS Trusted Advisor

AnswerC

Performance Insights offers a database performance tuning feature that visualizes database load and identifies the specific SQL queries causing high CPU utilization.

Why this answer

(Amazon RDS Performance Insights) is correct because it provides a database performance tuning and monitoring feature that helps quickly assess the load on your database and identify specific queries causing high CPU utilization. Option A (Enhanced Monitoring) is wrong because it provides OS-level metrics, not database query details. Option B (Amazon CloudWatch Logs) is wrong because it captures database logs, not real-time performance data.

Option D (AWS Trusted Advisor) is wrong because it provides best practice checks but not query-level analysis.

Full explanation →

1539

MCQmedium

A company uses Amazon RDS for Oracle for an OLTP application. The database experiences high CPU utilization during peak hours. The application is read-heavy and can tolerate eventually consistent reads. Which solution reduces CPU load on the primary database with minimal application changes?

A.Implement Amazon ElastiCache to cache frequent queries

B.Upgrade to a larger instance type

C.Create an RDS read replica and direct read traffic to it

D.Use DynamoDB Accelerator (DAX) as a cache layer

AnswerC

Read replicas offload read traffic from the primary, reducing CPU load with minimal application changes.

Why this answer

Creating an RDS Read Replica offloads read traffic from the primary Oracle instance, directly reducing CPU utilization on the primary. Since the application is read-heavy and tolerates eventually consistent reads, the replica’s asynchronous replication lag is acceptable. This solution requires minimal application changes—only modifying the connection string to route SELECT queries to the replica endpoint.

Exam trap

The trap here is that candidates assume caching (ElastiCache or DAX) is the only way to reduce read load, but they overlook that RDS Read Replicas directly offload the database engine’s CPU without requiring application caching logic or a different database service.

How to eliminate wrong answers

Option A is wrong because Amazon ElastiCache caches query results in memory, but it requires application code changes to implement cache-aside or lazy loading patterns, and it does not offload database CPU for queries that miss the cache. Option B is wrong because upgrading to a larger instance type increases capacity but does not reduce CPU load; it only postpones the issue and incurs higher cost without addressing the root cause of read-heavy traffic. Option D is wrong because DynamoDB Accelerator (DAX) is an in-memory cache for Amazon DynamoDB, not for Amazon RDS for Oracle; it cannot be used to cache Oracle queries or reduce CPU on an RDS instance.

Full explanation →

1540

MCQhard

A team is setting up a DMS migration task. The IAM policy above is attached to the DMS replication instance's IAM role. The team is unable to modify the target RDS instance's maintenance window during the migration. Which additional permission is missing?

A.Add 'rds:ModifyDBInstance' permission for the target RDS instance.

B.Add 'rds:ModifyOptionGroup' permission for the target RDS instance.

C.Add 'dms:ModifyReplicationInstance' permission for the DMS replication instance.

D.Add 'ec2:DescribeVpcs' permission to the policy.

AnswerA

The DMS replication instance's IAM role needs the `rds:ModifyDBInstance` permission on the target RDS instance to change its maintenance window. Without this permission, the migration task cannot adjust the window.

Why this answer

Modifying the target RDS instance's maintenance window requires the `rds:ModifyDBInstance` permission. The DMS replication instance's IAM role must have this permission for the target RDS instance to allow the migration task to adjust the maintenance window, which is necessary to prevent conflicts during ongoing replication. Without this permission, the DMS task cannot alter the maintenance window, even if the IAM role has other RDS permissions.

Exam trap

The trap here is that candidates may confuse the permissions needed for modifying the target RDS instance's maintenance window with permissions for modifying the DMS replication instance or RDS option groups, leading them to select options B or C instead of the correct `rds:ModifyDBInstance` permission.

How to eliminate wrong answers

Option B is wrong because `rds:ModifyOptionGroup` is used to modify option groups (e.g., enabling Oracle TDE or SQL Server native backup/restore), not the maintenance window of an RDS instance. Option C is wrong because `dms:ModifyReplicationInstance` is an action on the DMS replication instance itself, not on the target RDS instance, and does not grant the ability to modify the RDS maintenance window. Option D is wrong because `ec2:DescribeVpcs` is a read-only permission for describing VPCs, which is unrelated to modifying RDS instance maintenance windows.

Full explanation →

1541

MCQhard

A company uses Amazon DynamoDB with a global secondary index (GSI) on a table that contains sensitive data. The security team requires that the GSI be encrypted with a different AWS KMS key than the base table. Can this be achieved, and if so, how?

A.Yes, by using a custom KMS key policy that differentiates between table and index.

B.Yes, by specifying a different KMS key ID when creating the GSI.

C.No, DynamoDB encrypts the entire table and all its indexes with the same KMS key.

D.No, but you can use a different KMS key for the table and then the GSI will automatically use a different key.

AnswerC

DynamoDB uses one KMS key for the table and all associated indexes.

Why this answer

DynamoDB encrypts all data at rest using a single KMS key per table. The base table and all of its GSIs are encrypted with the same key. It is not possible to use a different KMS key for a GSI.

Option A is wrong because the GSI cannot have a separate key. Option B is wrong because KMS key policies do not allow per-index encryption. Option D is wrong because the table and its GSIs always use the same key.

Full explanation →

1542

MCQmedium

A company is using Amazon DynamoDB to store sensitive customer data. They need to ensure that all data is encrypted at rest using a customer-managed AWS KMS key. The company also wants to rotate the KMS key every year. What is the simplest way to achieve key rotation?

A.Create a new KMS key every year and update the DynamoDB table to use the new key.

B.Manually rotate the key by deleting and recreating the KMS key each year.

C.Enable automatic key rotation in AWS KMS for the customer-managed key.

D.Import new key material into the existing KMS key every year.

AnswerC

Automatic rotation rotates the key material annually without manual intervention.

Why this answer

The simplest way to achieve annual key rotation for a customer-managed AWS KMS key used with DynamoDB is to enable automatic key rotation on the existing key. AWS KMS supports automatic rotation of customer-managed keys once per year when enabled, which can be done through the KMS console or API without any manual intervention or table modification. Option A is incorrect because creating a new key and updating the DynamoDB table requires manual effort and is more complex than enabling automatic rotation.

Option B is incorrect because deleting and recreating the key is disruptive and not simpler. Option D is incorrect because importing new key material does not provide automatic rotation and is not the simplest method.

Full explanation →

1543

Multi-Selectmedium

A company is using Amazon RDS for PostgreSQL and needs to monitor the database for performance issues. Which TWO metrics in Amazon CloudWatch are most useful for identifying I/O bottlenecks?

Select 2 answers

A.ReadIOPS

B.FreeStorageSpace

C.DiskQueueDepth

D.DatabaseConnections

E.CPUUtilization

AnswersA, C

ReadIOPS and WriteIOPS show I/O operations.

Why this answer

Options A and C are correct. ReadIOPS (Option A) shows the actual number of read I/O operations per second, which is a direct indicator of I/O load. DiskQueueDepth (Option C) measures the number of pending I/O requests, indicating I/O contention or bottlenecks when the queue depth is high.

Option B (FreeStorageSpace) is about storage capacity, not performance. Option D (DatabaseConnections) reflects connection count, not I/O. Option E (CPUUtilization) relates to compute, not I/O.

Full explanation →

1544

Multi-Selecteasy

A company needs to choose a database for a real-time analytics workload that requires sub-second query latency on streaming data. Which TWO AWS services are most suitable?

Select 2 answers

A.Amazon Neptune.

B.Amazon RDS for PostgreSQL with materialized views.

C.Amazon Redshift with streaming ingestion from Kinesis.

D.Amazon Timestream.

E.Amazon DynamoDB Accelerator (DAX).

AnswersC, D

Supports near-real-time analytics.

Why this answer

Amazon Timestream is purpose-built for time-series data and provides sub-second query latency on streaming data via its dedicated query engine and automatic tiering between in-memory and magnetic stores. Amazon Redshift with streaming ingestion from Kinesis enables real-time analytics by directly consuming Kinesis data streams into Redshift materialized views, allowing sub-second queries on fresh data without batch loading.

Exam trap

The trap here is that candidates often confuse low-latency caching services like DAX or traditional databases with materialized views as suitable for real-time streaming analytics, overlooking that only purpose-built time-series databases or services with native streaming ingestion can guarantee sub-second query latency on continuous data streams.

Full explanation →

1545

MCQmedium

A database administrator is troubleshooting a slow-performing query on an Amazon RDS for MySQL instance. The slow query log shows the above entry. Based on the exhibit, which index would most improve the query performance?

A.Index on `created_at` only.

B.Index on `status` only.

C.Full-text index on `status` and `created_at`.

D.Composite index on (`status`, `created_at`).

AnswerD

Covers both filter and sort, avoiding a full table scan.

Why this answer

The query filters on `status` and then sorts or filters on `created_at`. A composite index on (`status`, `created_at`) allows MySQL to use the index for both the equality condition on `status` and the range or sort on `created_at`, avoiding a filesort and reducing row scans. This is the most efficient index for this query pattern.

Exam trap

The trap here is that candidates often pick a single-column index on `status` (Option B) thinking it will help the filter, but they overlook the need to also optimize the sort or range on `created_at`, which requires a composite index to avoid a filesort.

How to eliminate wrong answers

Option A is wrong because an index on `created_at` only would not help with the `status` filter, forcing a full table scan or inefficient index scan. Option B is wrong because an index on `status` only would filter by status but then require a separate sort or additional filtering on `created_at`, leading to a filesort and poor performance. Option C is wrong because a full-text index is designed for text search (e.g., MATCH AGAINST) and is not suitable for equality or range comparisons on `status` and `created_at`; it would be ignored by the optimizer for this query.

Full explanation →

1546

MCQmedium

A company is migrating a 100 GB Oracle database to Amazon RDS for Oracle. They want to use AWS DMS. The source database is in a different AWS account. What is required to allow DMS to connect to the source?

A.Establish VPC peering or VPN between the source and target VPCs, and configure security group rules.

B.Assign an IAM role to the source database to allow DMS access.

C.Configure an S3 VPC gateway endpoint for the source VPC.

D.Create a VPC endpoint for DMS in the source account.

AnswerA

DMS requires network connectivity between the replication instance and the source database.

Why this answer

AWS DMS requires network connectivity between the replication instance and the source database. Since the source is in a different AWS account, VPC peering or a VPN connection must be established to route traffic between the VPCs. Additionally, security group rules in both VPCs must allow inbound/outbound traffic on the Oracle listener port (default 1521) from the DMS replication instance's IP or security group.

Exam trap

The trap here is that candidates confuse IAM roles (which handle authorization for AWS services) with network connectivity requirements, assuming a role can grant DMS access to a database in another account, when in fact DMS needs direct network layer access via VPC peering or VPN.

How to eliminate wrong answers

Option B is wrong because IAM roles are used to grant AWS services (like DMS) permissions to access other AWS resources (e.g., S3, RDS), not to authenticate a database user or provide network connectivity to a source database in a different account. Option C is wrong because an S3 VPC gateway endpoint is used for private connectivity to S3, not for connecting DMS to an Oracle database; it does not solve cross-account network routing. Option D is wrong because a VPC endpoint for DMS (a DMS VPC endpoint) is not a valid AWS resource; DMS uses a replication instance within a VPC, and cross-account connectivity requires VPC peering or VPN, not a VPC endpoint.

Full explanation →

1547

MCQmedium

A database administrator runs the described command. What does the output indicate about the RDS instance?

A.The DB instance is not encrypted at rest.

B.The DB instance is in a failed state.

C.The DB instance is running PostgreSQL.

D.The DB instance is encrypted at rest using a KMS key.

AnswerA

StorageEncrypted is false.

Why this answer

The output shows 'StorageEncrypted: false' and 'KmsKeyId: null', which indicates the DB instance is not encrypted at rest. Option B is incorrect because the output does not indicate any failed state; it's a valid status showing encryption configuration. Option C is incorrect because the output does not mention the database engine type.

Option D is incorrect because an encrypted instance would show 'StorageEncrypted: true' and a non-null KmsKeyId.

Full explanation →

1548

Drag & Dropmedium

Arrange the steps to restore an Amazon RDS for MySQL DB instance to a new instance from a manual snapshot in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Restoring from a manual snapshot involves selecting the snapshot, configuring the new instance, and waiting for completion.

Full explanation →

1549

MCQmedium

A company runs a document management system using Amazon S3 and Amazon DynamoDB. The application writes document metadata to DynamoDB and stores the document in S3. Recently, users report that occasionally documents are saved in S3 but the corresponding metadata is missing in DynamoDB. The application writes to DynamoDB first, then to S3. If the S3 upload fails, the application retries. The database specialist suspects a transaction consistency issue. The application is running on multiple EC2 instances behind an Application Load Balancer. What should the specialist recommend to ensure that both the metadata and document are stored consistently?

A.Use DynamoDB transactions to write metadata and initiate S3 upload within the same transaction.

B.Use DynamoDB Streams to trigger an AWS Lambda function that performs the S3 upload.

C.Reverse the order: upload to S3 first, then write to DynamoDB.

D.Implement an idempotency key in the application to retry the entire operation.

AnswerA

Transactions provide atomicity across multiple items.

Why this answer

Using DynamoDB transactions ensures atomicity; if the S3 upload fails, the transaction can be rolled back. Option B is wrong because DynamoDB Streams with Lambda introduces eventual consistency and possible duplicates. Option C is wrong because writing to S3 first still leaves inconsistency if DynamoDB fails.

Option D is wrong because idempotency tokens help with duplicates but not atomicity.

Full explanation →

1550

Multi-Selecthard

A company is migrating a large Oracle database to Amazon Aurora PostgreSQL. They need to minimize downtime and validate data consistency after migration. Which THREE steps should they include in their migration plan? (Choose THREE.)

Select 3 answers

A.Create multiple Aurora Replicas for read scaling during migration.

B.Perform a homogeneous migration directly from Oracle to Aurora.

C.Use AWS Database Migration Service (DMS) with ongoing replication to keep the target in sync.

D.Use AWS DMS data validation to compare source and target data.

E.Use AWS Schema Conversion Tool (SCT) to convert the Oracle schema to PostgreSQL.

AnswersC, D, E

Ongoing replication reduces downtime.

Why this answer

AWS DMS supports ongoing replication (change data capture) from Oracle to Aurora PostgreSQL, allowing the target database to stay synchronized with the source during the migration. This minimizes downtime by enabling a cutover after the initial load, rather than requiring a full outage for the entire migration.

Exam trap

The trap here is that candidates may confuse read replicas (Option A) as a migration tool, or mistakenly think a homogeneous migration (Option B) applies to cross-engine migrations, when in fact heterogeneous migrations require schema conversion and DMS for data transfer.

Full explanation →

1551

Multi-Selectmedium

A company is designing a disaster recovery plan for an Amazon RDS for MySQL database. The database must have a Recovery Point Objective (RPO) of less than 5 minutes and a Recovery Time Objective (RTO) of less than 1 hour. Which TWO actions should be taken? (Choose two.)

Select 2 answers

A.Use a single-AZ instance with automated backups to S3.

B.Deploy the database in a Multi-AZ configuration.

C.Create a cross-region read replica with automated backups enabled.

D.Take daily manual snapshots and copy them to another region.

E.Use AWS DMS for continuous replication to a standby instance.

AnswersB, C

Multi-AZ configuration provides automatic synchronous replication to a standby instance in a different Availability Zone. Automatic failover occurs within minutes, achieving RTO < 1 hour and RPO near zero.

Why this answer

(Multi-AZ configuration) provides automatic synchronous replication to a standby instance in a different Availability Zone. In the event of a failure, automatic failover occurs within minutes, achieving an RTO of less than 1 hour and an RPO of effectively zero. Option C (cross-region read replica with automated backups enabled) replicates data asynchronously to another AWS region, allowing promotion to a standalone database for disaster recovery. With continuous replication, the RPO can be less than 5 minutes, and promotion time is typically under 1 hour, meeting both objectives.

Option A is incorrect because a single-AZ instance with automated backups requires restoring from a backup, which takes longer than 1 hour, failing the RTO requirement. Option D is incorrect because daily manual snapshots have an RPO of up to 24 hours, exceeding the 5-minute requirement. Option E is incorrect because AWS DMS is primarily a migration service and is not optimized for continuous replication for DR; it adds complexity and does not provide the same RTO/RPO guarantees as native RDS replication features.

Full explanation →

1552

Multi-Selectmedium

A company is migrating an on-premises MongoDB workload to Amazon DocumentDB. The workload includes aggregation pipelines with $lookup and $group operations. The team wants to ensure minimal performance impact. Which THREE steps should they take?

Select 3 answers

A.Disable journaling to reduce I/O overhead

B.Create appropriate indexes on fields used in $lookup and $group

C.Enable TLS for all connections

D.Use parallel scan operations where possible

E.Choose a larger instance size to accommodate the workload

AnswersB, D, E

Indexes improve aggregation performance significantly.

Why this answer

Creating appropriate indexes on fields used in $lookup (local and foreign fields) and $group (the _id field and any sort fields) allows Amazon DocumentDB to avoid full collection scans, significantly reducing query latency and resource consumption during aggregation pipeline execution.

Exam trap

The trap here is that candidates may confuse security measures (TLS) or storage settings (journaling) with performance optimization, when in fact the correct performance levers are indexing, instance sizing, and parallel execution.

Full explanation →

1553

MCQeasy

A developer is troubleshooting an application that uses Amazon DynamoDB. The application is experiencing throttled requests (ProvisionedThroughputExceededException). Which CloudWatch metric should be monitored to troubleshoot this issue?

A.ThrottledRequests

B.SuccessfulRequestLatency

C.UserErrors

D.ConsumedWriteCapacityUnits

AnswerA

ThrottledRequests is a CloudWatch metric that directly counts the number of requests that were throttled due to exceeding provisioned throughput. Monitoring this metric helps identify when throttling is occurring.

Why this answer

ThrottledRequests is a CloudWatch metric that directly counts the number of requests that were throttled due to exceeding provisioned throughput. For troubleshooting throttling issues, this metric provides immediate visibility into when throttling occurs. ConsumedWriteCapacityUnits (option D) shows capacity usage but does not directly indicate throttling; high consumption may lead to throttling but is not a direct measure.

SuccessfulRequestLatency (option B) measures latency, not throttling, and UserErrors (option C) tracks client-side errors like invalid parameters, not capacity-related throttling.

Full explanation →

1554

MCQmedium

A company is migrating a 2 TB Oracle database to Amazon Aurora PostgreSQL. They need to minimize downtime. Which AWS service should they use?

A.AWS Database Migration Service (DMS)

B.AWS Schema Conversion Tool (SCT)

C.AWS Data Pipeline

D.AWS Snowball

AnswerA

DMS supports heterogeneous migrations and ongoing replication to minimize downtime.

Why this answer

AWS DMS can perform a live migration from Oracle to Aurora PostgreSQL with minimal downtime by continuously replicating ongoing changes from the source database to the target using Change Data Capture (CDC). For a 2 TB database, DMS supports full-load plus CDC, allowing the source to remain operational during the initial load and then switching over with only a brief outage to apply final changes.

Exam trap

The trap here is that candidates often confuse AWS SCT (schema conversion) with DMS (data migration), assuming SCT handles the actual data transfer, or they overestimate Snowball's suitability for minimizing downtime when the database is still being actively written to.

How to eliminate wrong answers

Option B is wrong because AWS Schema Conversion Tool (SCT) is used for converting the database schema and code objects (like stored procedures) from Oracle to PostgreSQL, but it does not perform the actual data migration or handle ongoing replication to minimize downtime. Option C is wrong because AWS Data Pipeline is a workflow orchestration service for moving and transforming data between AWS services and on-premises sources, but it lacks native support for continuous CDC replication from Oracle to Aurora PostgreSQL and is not designed for near-zero-downtime database migrations. Option D is wrong because AWS Snowball is a physical data transfer device intended for large-scale offline data movement (typically 10 TB or more) when network bandwidth is limited, but it cannot provide minimal downtime since it requires stopping writes to the source, shipping the device, and then loading data—resulting in significant downtime.

Full explanation →

1555

MCQmedium

A company is migrating a 500 GB MongoDB database to Amazon DocumentDB. The migration is done using AWS DMS with full load and ongoing replication. The full load completes successfully, but during CDC, the DMS task logs show 'Memory limit exceeded' errors and the task fails repeatedly. The DMS replication instance is a dms.r5.large. The source MongoDB has a write-heavy workload with many small updates. The DBA needs to fix the migration without restarting from scratch. Which action should the DBA take?

A.Increase the DMS replication instance size to a larger instance class with more memory.

B.Reduce the DMS task's 'BatchApplyEnabled' setting to apply transactions individually.

C.Stop and restart the DMS task to clear the cache.

D.Enable Multi-AZ on the DMS replication instance to distribute the load.

AnswerA

More memory allows DMS to buffer more changes and handle the workload.

Why this answer

The 'Memory limit exceeded' error during CDC with a write-heavy workload indicates the replication instance lacks sufficient memory to buffer the changes. Increasing the instance size (e.g., to dms.r5.xlarge) provides more memory. Option B is wrong because reducing BatchApplyEnabled may slow down apply but does not increase memory; it could even worsen the backlog.

Option C is wrong because restarting just clears cache temporarily; the error will recur. Option D is wrong because Multi-AZ provides high availability, not additional memory.

Full explanation →

1556

MCQmedium

A social media startup is designing a database for user activity feeds. Each user follows up to 5,000 other users. The feed must show the latest 100 posts from followed users with latency under 200ms. Reads are 10x writes. Which database design best meets these requirements?

A.Use Amazon RDS for PostgreSQL with read replicas and materialized views refreshed every minute

B.Use Amazon ElastiCache for Redis as a primary data store with sorted sets per user

C.Use a single DynamoDB table with a global secondary index on user_id and timestamp

D.Use Amazon DynamoDB with a fan-out on write pattern, storing each user's feed in a separate partition

AnswerD

Fan-out on write ensures feeds are pre-computed for fast reads, meeting latency and throughput requirements.

Why this answer

The fan-out on write pattern with DynamoDB ensures each user's feed is pre-computed and stored in a separate partition, allowing reads to fetch the latest 100 posts with sub-200ms latency by querying a single item collection. This pattern optimizes for the 10:1 read-to-write ratio by shifting work to writes, which are less frequent, and avoids expensive joins or scans at read time.

Exam trap

The trap here is that candidates often choose Option C (GSI on user_id and timestamp) thinking it enables efficient querying, but they overlook the need to query across multiple followed users and merge results, which DynamoDB cannot do without application-level sorting and pagination, violating the 200ms latency SLA.

How to eliminate wrong answers

Option A is wrong because materialized views refreshed every minute cannot meet the 200ms latency requirement for reads, as they introduce up to 60 seconds of staleness, and PostgreSQL read replicas do not reduce write amplification for a high-fan-out social feed. Option B is wrong because using ElastiCache for Redis as a primary data store lacks durability guarantees (no built-in persistence for critical data) and sorted sets per user would require expensive range queries and re-sorting for 5,000 followed users, failing to scale for the 10:1 read ratio. Option C is wrong because a single DynamoDB table with a GSI on user_id and timestamp would require a scan or query across all followed users' posts, leading to high read costs and latency exceeding 200ms due to the need to merge and sort results from multiple partitions.

Full explanation →

1557

Multi-Selectmedium

A company is deploying a DynamoDB table for a global application that requires low-latency reads and writes in multiple AWS Regions. Which THREE features should be enabled? (Choose three.)

Select 3 answers

A.DynamoDB Accelerator (DAX).

B.On-demand capacity mode.

C.DynamoDB Streams.

D.Time to Live (TTL).

E.DynamoDB global tables.

AnswersA, B, E

Provides in-memory caching for low-latency reads.

Why this answer

DynamoDB Accelerator (DAX) is correct because it provides an in-memory cache for DynamoDB tables, delivering microsecond latency for read-heavy workloads. For a global application requiring low-latency reads across multiple AWS Regions, DAX reduces response times by offloading read traffic from the DynamoDB table to a distributed cache, which is essential for meeting strict performance SLAs.

Exam trap

The trap here is that candidates often confuse DynamoDB Streams (a change-data-capture feature) with a performance optimization tool, when in fact Streams are for replication and event processing, not for reducing latency.

Full explanation →

1558

Multi-Selectmedium

Which TWO metrics should be monitored together to detect a memory leak in an Amazon RDS for Oracle DB instance? (Choose TWO.)

Select 2 answers

A.FreeableMemory

B.SwapUsage

C.ReadIOPS

D.DatabaseConnections

E.NetworkThroughput

AnswersA, B

Declining freeable memory may indicate a memory leak.

Why this answer

Options A and B are correct. FreeableMemory shows the amount of available memory, and SwapUsage indicates the amount of swap space used. A memory leak causes increasing memory consumption, leading to swapping when free memory is exhausted.

Monitoring both metrics together helps detect this pattern. Option C (ReadIOPS) is an I/O metric, not directly memory-related. Option D (DatabaseConnections) is a connection metric, unrelated to memory leak detection.

Option E (NetworkThroughput) is a network metric, also not relevant.

Full explanation →

1559

MCQmedium

A financial services company runs a critical application on Amazon RDS for MySQL that processes transactions. The database must maintain ACID compliance and support point-in-time recovery (PITR) with a recovery point objective (RPO) of 5 seconds and recovery time objective (RTO) of 1 minute. The current setup uses a single db.r5.large instance with automated backups enabled (retention period 7 days) and Multi-AZ deployment. During a recent failover test, the failover took 2 minutes, exceeding the RTO. What should the database specialist recommend to meet the RTO requirement?

A.Remove Multi-AZ and rely on automated backups for recovery.

B.Migrate to a Multi-AZ DB Cluster deployment for RDS for MySQL.

C.Configure a cross-Region read replica and promote it during a failure.

D.Increase the instance size to db.r5.xlarge to improve failover speed.

AnswerB

Multi-AZ DB Cluster provides faster failover (<1 minute).

Why this answer

Amazon RDS Multi-AZ DB Cluster for MySQL provides fast failover (typically under 1 minute) because it uses synchronous replication to two standby instances in different Availability Zones, ensuring automatic failover meets the 1-minute RTO. Option A (Remove Multi-AZ and rely on automated backups) would require restoring from backup, which takes much longer than 1 minute. Option C (Configure a cross-Region read replica and promote it during failure) involves manual promotion and is not automatic, so it cannot guarantee the RTO.

Option D (Increase the instance size to db.r5.xlarge) does not affect failover speed, as failover time is determined by the Multi-AZ configuration, not instance size.

Full explanation →

1560

MCQhard

A data analytics company runs Amazon Redshift clusters. A user reports that a complex query is taking much longer than expected. The DBA uses the STL_QUERY view to check the query execution. Which column in STL_QUERY should the DBA examine to identify if the query is waiting for resources?

A.aborted

B.query

C.starttime

D.service_class

AnswerD

Service class indicates the WLM queue; a high queue time suggests waiting for resources.

Why this answer

The 'service_class' column indicates the workload management (WLM) queue assigned to the query, which can help identify if the query was queued or waiting for resources. Option A is wrong because 'aborted' indicates whether the query was aborted, not waiting. Option B is wrong because 'query' is just the query ID.

Option C is wrong because 'starttime' shows when the query started, not waiting status.

Full explanation →

1561

MCQeasy

A database administrator notices that an Amazon RDS for MySQL DB instance is using more storage than expected. Which metric should be monitored to troubleshoot storage usage?

A.FreeStorageSpace

B.DatabaseConnections

C.ReadIOPS

D.NetworkThroughput

AnswerA

FreeStorageSpace shows remaining storage, helping identify usage trends.

Why this answer

FreeStorageSpace directly indicates the available storage remaining on the DB instance, which is key to troubleshooting storage usage. Option B is incorrect because DatabaseConnections measures the number of client connections, not storage. Option C is incorrect because ReadIOPS measures input/output operations per second, not storage capacity.

Option D is incorrect because NetworkThroughput measures data transfer rates, not storage.

Full explanation →

1562

MCQhard

A developer is configuring IAM permissions for a Lambda function that accesses a DynamoDB table named 'Orders'. The policy shown is attached to the Lambda execution role. The function needs to delete items but only if the item contains only 'order_id' and 'status' attributes. Which statement about this policy is correct?

A.The function can delete any item in the Orders table because the condition is on the resource

B.The function cannot delete any items because the DeleteItem action is not allowed

C.The function cannot call Query on the table because it is not listed in the actions

D.The function can only delete items that contain exactly the attributes 'order_id' and 'status'

AnswerD

The condition ensures only items with those attributes can be deleted.

Why this answer

The IAM policy includes a condition key `dynamodb:Attributes` that restricts the `DeleteItem` action to items containing exactly the attributes 'order_id' and 'status'. This condition ensures the function can only delete items that match the specified attribute set, enforcing a fine-grained access control at the item attribute level.

Exam trap

The DBS-C01 exam often tests the misconception that a condition on `dynamodb:Attributes` applies to the resource ARN rather than the item's attributes, leading candidates to incorrectly assume the condition is on the table itself.

How to eliminate wrong answers

Option A is wrong because the condition is on the `dynamodb:Attributes` key, not on the resource; the resource ARN only specifies the table, but the condition restricts which items can be deleted based on their attributes. Option B is wrong because the policy explicitly includes the `DeleteItem` action in the `Action` list, so the action is allowed. Option C is wrong because the policy only grants permissions for `DeleteItem` and `GetItem`, not `Query`; however, the question asks about deleting items, and the policy does not need to include `Query` for the delete operation to work.

Full explanation →

1563

MCQeasy

A company is designing a document storage system using Amazon DynamoDB. Each document is up to 400 KB and is identified by a unique 'document_id'. The access pattern is to retrieve a document by its ID. Which DynamoDB table design is MOST efficient?

A.Use 'document_id' as the partition key and create a GSI on 'document_id'.

B.Use 'document_id' as the primary partition key (only).

C.Store documents in Amazon S3 and use DynamoDB to store metadata with a reference to S3.

D.Use a composite key: partition key 'document_id' and sort key 'version'.

AnswerB

Direct GetItem by partition key is most efficient.

Why this answer

DynamoDB can store items up to 400 KB in a single table, and using 'document_id' as the sole partition key directly supports the access pattern of retrieving a document by its ID with a single GetItem call, which is the most efficient operation. No secondary index or composite key is needed, as the primary key alone provides O(1) lookup performance for this use case.

Exam trap

The trap here is that candidates often overcomplicate the design by adding GSIs or composite keys, or default to S3 for large objects, when the item size is within DynamoDB's limit and the access pattern is simple key-value lookup.

How to eliminate wrong answers

Option A is wrong because creating a GSI on 'document_id' is redundant and adds unnecessary cost and complexity; the base table already supports direct access by partition key. Option C is wrong because storing documents in S3 with DynamoDB metadata is a valid pattern for items larger than 400 KB, but the question states each document is up to 400 KB, which fits within DynamoDB's item size limit, making the S3 approach less efficient due to additional latency and management overhead. Option D is wrong because using a composite key with a sort key 'version' is unnecessary when the access pattern only requires retrieval by document ID; it adds complexity without benefit and may lead to unintended multiple items per document_id.

Full explanation →

1564

MCQmedium

A company has an Aurora MySQL cluster with three instances. The current writer instance is 'mycluster-instance-1'. The company wants to failover to 'mycluster-instance-2' for maintenance. What is the most direct way to achieve this?

A.Change the cluster's endpoint to point to instance-2.

B.Modify 'mycluster-instance-2' to promote it to writer.

C.Reboot 'mycluster-instance-1' to trigger a failover.

D.Use the AWS CLI: aws rds failover-db-cluster --db-cluster-identifier mycluster --target-db-instance-identifier mycluster-instance-2

AnswerD

This command initiates failover to the specified instance.

Why this answer

The AWS CLI command `aws rds failover-db-cluster` with the `--target-db-instance-identifier` parameter allows you to explicitly specify which Aurora replica should become the new writer instance. This is the most direct and supported method to initiate a controlled failover to 'mycluster-instance-2' without rebooting the current writer or manually modifying endpoints.

Exam trap

The trap here is that candidates confuse rebooting an instance with triggering a failover, or assume that modifying an instance's settings can promote it, when in fact only the cluster-level failover command can explicitly designate a target replica as the new writer.

How to eliminate wrong answers

Option A is wrong because the cluster endpoint is a DNS name that automatically points to the current writer; you cannot manually change it to point to a specific instance. Option B is wrong because Aurora does not support manually promoting a replica to writer via a 'promote' action; failover is controlled by the cluster, not by modifying the instance. Option C is wrong because rebooting the writer instance does not trigger a failover; a reboot simply restarts the instance in place, and the cluster remains with the same writer unless the instance becomes unavailable.

Full explanation →

1565

MCQeasy

An IAM policy is attached to a user who needs to restore an Amazon RDS DB instance from a DB snapshot. The user attempts to restore and receives an 'Access Denied' error. Which missing permission is MOST likely causing the failure?

A.rds:DescribeDBSnapshots

B.rds:DescribeDBInstances

C.rds:CreateDBInstance

D.rds:CreateDBSubnetGroup

AnswerC

Restoring from snapshot creates a new DB instance, requiring CreateDBInstance.

Why this answer

To restore an Amazon RDS DB instance from a DB snapshot, the user must have the `rds:CreateDBInstance` permission. This is because the restore operation internally calls the CreateDBInstance API to create a new DB instance from the specified snapshot. Without this permission, the request fails with an 'Access Denied' error, even if the user has permissions to describe snapshots or instances.

Exam trap

The trap here is that candidates often assume describing snapshots is sufficient for restoration, but AWS requires the write-level `CreateDBInstance` permission because restoring creates a new DB instance, not just reads existing data.

How to eliminate wrong answers

Option A is wrong because `rds:DescribeDBSnapshots` only allows listing or viewing snapshot metadata, not performing the restore action. Option B is wrong because `rds:DescribeDBInstances` only allows viewing existing DB instance details, which is unrelated to creating a new instance from a snapshot. Option D is wrong because `rds:CreateDBSubnetGroup` is needed only if a custom subnet group must be created; the restore can use an existing subnet group, and the missing permission is the core CreateDBInstance action.

Full explanation →

1566

MCQeasy

Refer to the exhibit. A developer wants to connect to the database. Which database engine is most likely being used?

A.Oracle

B.SQL Server

C.MySQL

D.PostgreSQL

AnswerC

Port 3306 is default for MySQL.

Why this answer

The exhibit shows a connection string using the format `jdbc:mysql://...`, which is the standard JDBC URL prefix for MySQL databases. This indicates the developer is connecting to a MySQL database engine, as Oracle, SQL Server, and PostgreSQL use different JDBC URL prefixes (`jdbc:oracle:thin:`, `jdbc:sqlserver://`, and `jdbc:postgresql://` respectively).

Exam trap

The DBS-C01 exam often tests the ability to identify database engines by their JDBC connection string prefixes, and the trap here is that candidates may confuse MySQL with PostgreSQL or Oracle because all are relational databases, but each has a distinct JDBC URL format that must be matched exactly.

How to eliminate wrong answers

Option A is wrong because Oracle uses the JDBC URL prefix `jdbc:oracle:thin:@//host:port/service_name` or `jdbc:oracle:oci:@...`, not `jdbc:mysql://`. Option B is wrong because SQL Server uses `jdbc:sqlserver://host:port;databaseName=dbname`, not `jdbc:mysql://`. Option D is wrong because PostgreSQL uses `jdbc:postgresql://host:port/dbname`, not `jdbc:mysql://`.

Full explanation →

1567

Multi-Selecthard

A database specialist is troubleshooting a slow-running query on an Amazon Aurora MySQL DB cluster. The query performs a large table scan. Which THREE actions would likely improve query performance?

Select 3 answers

A.Increase the size of the DB instance to provide more memory and CPU.

B.Change the transaction isolation level to SERIALIZABLE.

C.Enable the query cache feature to cache the results of the query.

D.Enable Aurora Parallel Query to parallelize the table scan.

E.Create an index on columns used in WHERE and JOIN clauses.

AnswersA, C, E

More resources can speed up query execution.

Why this answer

Creating appropriate indexes can speed up queries by avoiding table scans. Increasing the instance size provides more memory and CPU for query execution. Enabling query caching can store results of repeated queries.

Changing isolation level and enabling parallel query may not help in all cases and may have side effects.

Full explanation →

1568

MCQhard

A company is migrating a self-managed Oracle database to Amazon Aurora PostgreSQL using AWS DMS. The source database has a large number of tables with foreign key constraints. During the full load phase, some tables fail to load due to foreign key violations. What is the most efficient way to resolve this?

A.Increase the DMS task memory and parallel load threads

B.Use the table preparation mode 'Do nothing' and load tables in dependency order

C.Disable foreign key constraints on the target before migration and re-enable after

D.Pre-create all target tables with the same constraints and use 'Truncate' mode

AnswerC

This allows flexible loading order and avoids violations.

Why this answer

Disabling foreign key constraints on the target Aurora PostgreSQL database before the migration allows DMS to load tables in any order without violating referential integrity. After the full load completes, re-enabling the constraints ensures data consistency. This approach is the most efficient as it avoids complex dependency ordering and reduces migration failures.

Exam trap

The trap here is that candidates may think increasing resources (Option A) or pre-creating tables (Option D) will solve the issue, but they overlook that foreign key violations are a logical dependency problem, not a performance or schema creation issue.

How to eliminate wrong answers

Option A is wrong because increasing DMS task memory and parallel load threads addresses performance bottlenecks, not foreign key constraint violations; the root cause is referential integrity, not resource contention. Option B is wrong because using 'Do nothing' table preparation mode and loading in dependency order is impractical for a large number of tables with foreign keys, as it requires manual analysis and ordering, and DMS does not automatically resolve dependencies; this approach is error-prone and time-consuming. Option D is wrong because pre-creating target tables with the same constraints and using 'Truncate' mode would still cause foreign key violations during the full load, as DMS does not guarantee insertion order; truncate mode only clears data before reloading, not resolving the dependency issue.

Full explanation →

1569

MCQhard

A financial services company uses Amazon RDS for MySQL to store sensitive customer data. The compliance team requires that all database administrators (DBAs) must authenticate using IAM database authentication, and no static database passwords should be used. A junior DBA has been granted the rds_iam role in the database. However, the junior DBA is unable to connect using the AWS CLI command: aws rds generate-db-auth-token --hostname mydb.xyz.us-east-1.rds.amazonaws.com --port 3306 --username jdba. The error message says 'Access denied'. What is the most likely cause?

A.The RDS instance does not have a resource-based policy that grants the junior DBA access.

B.The junior DBA is not using an SSL connection to the database.

C.The security group does not allow inbound traffic on port 3306 from the junior DBA's IP address.

D.The RDS instance does not have IAM database authentication enabled.

AnswerD

Without IAM DB auth enabled on the instance, the authentication token is not accepted.

Why this answer

For IAM database authentication to work, the RDS instance must have the 'IAM DB authentication' setting enabled. If it is not enabled, the authentication token generated by `generate-db-auth-token` will be rejected with an 'Access denied' error. Option A is incorrect because RDS does not use resource-based policies; IAM policies are attached to users/roles.

Option B is incorrect because SSL is required for IAM auth, but a missing SSL connection would result in a different error (e.g., 'SSL required'). Option C is incorrect because network issues would typically cause a timeout or connection refused, not an authentication error.

Full explanation →

1570

Multi-Selectmedium

A company has an Amazon DynamoDB table that stores user sessions. The security team wants to ensure that only authorized applications can read and write to the table, and that all access is logged. Which THREE steps should the company take to meet these requirements?

Select 3 answers

A.Enable AWS CloudTrail to log DynamoDB API calls.

B.Create an IAM role with a policy that allows only the required DynamoDB actions.

C.Use an interface VPC endpoint for DynamoDB with a VPC endpoint policy.

D.Encrypt the table using a customer-managed KMS key.

E.Enable DynamoDB Streams and process events with Lambda.

AnswersA, B, C

Logs all data plane and control plane operations.

Why this answer

Options A, B, and C are correct. IAM roles with least privilege restrict access. AWS CloudTrail logs API calls for auditing.

VPC endpoints ensure traffic stays within the AWS network and can be controlled via endpoint policies. Option D (encryption with KMS) is for data at rest encryption, not access control or logging. Option E (DynamoDB Streams) is for change data capture, not access control or logging.

Full explanation →

1571

MCQmedium

A company uses Amazon DynamoDB with a table that has a partition key of 'user_id' (string) and sort key of 'timestamp' (number). The application queries for recent items for a specific user using the query API with KeyConditionExpression. The query returns items in descending order. Occasionally, the query returns items that are not the most recent. What is the most likely cause?

A.The query is using eventually consistent reads, which may not reflect the latest writes.

B.The query is not using the ScanIndexForward parameter set to false.

C.The query results are paginated and the application is not iterating through all pages.

D.The query is using a global secondary index (GSI) that has a different sort key.

AnswerA

Eventually consistent reads may return stale data.

Why this answer

DynamoDB queries by default use eventually consistent reads, which may not reflect the latest writes. In this scenario, the query is likely using eventually consistent reads, causing it to return stale data. Option A is correct.

Option B is incorrect because ScanIndexForward set to false returns items in descending order, which is what the application expects. Option C is incorrect because pagination would result in missing items, not stale data. Option D is incorrect because the query is on the base table, not a GSI.

Full explanation →

1572

Multi-Selectmedium

Which TWO actions can help protect an RDS database from SQL injection attacks? (Choose 2.)

Select 2 answers

A.Enable Multi-AZ for the RDS instance.

B.Enable encryption at rest using KMS.

C.Use parameterized SQL statements in the application.

D.Restrict network access using security groups.

E.Implement input validation and sanitization.

AnswersC, E

Parameterized queries separate SQL logic from data.

Why this answer

Parameterized SQL statements (also known as prepared statements) ensure that user input is treated strictly as data, not executable code, preventing SQL injection at the application layer. Option E is correct because input validation and sanitization filter out malicious characters or patterns before they reach the database, adding an extra layer of defense. Both measures are essential; network controls (security groups) and encryption do not prevent injection attacks.

Exam trap

The trap here is that candidates often confuse network-level controls (security groups) or encryption features with application-layer input validation, mistakenly believing that restricting access or encrypting data can prevent SQL injection, when in fact only proper query construction and input handling can stop the attack.

Full explanation →

1573

MCQeasy

A startup is using Amazon ElastiCache for Redis to cache session data. They deployed a single Redis node (cache.t3.micro) in us-west-2. The application reports high latency when reading session data. CloudWatch metrics show CPUUtilization at 90% and Evictions at 100 per minute. The cache hit ratio is 80%. The database specialist suspects the node is overloaded. What should the specialist do to improve performance?

A.Scale up to a larger node type, such as cache.m5.large.

B.Add a read replica to offload read traffic.

C.Enable cluster mode and add more shards.

D.Decrease the TTL for session keys to reduce memory usage.

AnswerA

More resources reduce CPU and evictions.

Why this answer

Scale up to a larger node type, such as cache.m5.large. The current node (cache.t3.micro) is overloaded, as indicated by high CPU utilization (90%) and frequent evictions (100/min). Scaling up provides more CPU and memory resources, reducing evictions and lowering latency.

Option B (add a read replica) does not help because the issue is on the primary node; read replicas are for scaling read-heavy workloads on a primary, but here the primary is overloaded. Option C (enable cluster mode) is not suitable for a single-node setup and adds complexity; it is intended for partitioning data across multiple shards. Option D (decrease TTL) would reduce memory usage but may increase cache misses and does not address the CPU bottleneck; it could actually worsen performance by requiring more database reads.

Full explanation →

1574

Multi-Selecthard

A company is designing a disaster recovery strategy for an Amazon RDS for SQL Server DB instance that contains sensitive financial data. The database must be encrypted at rest using a customer-managed AWS KMS key. The recovery point objective (RPO) is 5 minutes, and the recovery time objective (RTO) is 1 hour. Which THREE steps should be taken to meet these requirements?

Select 3 answers

A.Take a manual DB snapshot every hour.

B.Enable Multi-AZ deployment for automatic failover.

C.Store the KMS key in the secondary Region by creating a cross-Region KMS key replica.

D.Configure automated backups with a 5-minute backup interval.

E.Create a cross-Region read replica in a different AWS Region.

AnswersC, D, E

A cross-Region KMS key replica ensures the KMS key is available in the secondary region to encrypt the cross-region read replica, making this step necessary.

Why this answer

To achieve an RPO of 5 minutes and RTO of 1 hour across regions, you need automated backups with a 5-minute interval (D) so that transaction logs are backed up frequently. A cross-Region read replica (E) can be promoted quickly in the secondary region to meet the RTO. Since the database uses a customer-managed KMS key, you must create a cross-Region KMS key replica (C) in the secondary region so that the replica can be encrypted.

Multi-AZ (B) only provides high availability within a single region and does not support cross-region disaster recovery, so it does not help meet these RPO/RTO requirements.

Exam trap

Candidates often think Multi-AZ is required for disaster recovery across regions, but it only handles failure within a single region.

Full explanation →

1575

MCQeasy

A company is running a MongoDB database on Amazon EC2. The database is experiencing high disk I/O latency. Which AWS service can be used to monitor the disk I/O metrics at the instance level?

A.Amazon RDS

B.Amazon CloudWatch

C.Amazon DynamoDB

D.Amazon S3

AnswerB

CloudWatch provides metrics like DiskReadBytes, DiskWriteBytes.

Why this answer

Amazon CloudWatch provides disk I/O metrics for EC2 instances. Option A is wrong because Amazon RDS is a managed database service. Option C is wrong because Amazon DynamoDB is a NoSQL database service.

Option D is wrong because Amazon S3 is an object storage service.

Full explanation →

Page 21 of 23

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23

Practice DBS-C01 by domain

Target a specific domain to shore up weak areas.

Workload-Specific Database Design Deployment and Migration Management and Operations Monitoring and Troubleshooting Database Security

See all domains with question counts →