Courseiva

AWS Certified Database Specialty DBS-C01 (DBS-C01) — Questions 151–225

1663 questions total · 23pages · All types, answers revealed

Take a mock examExam hub
Page 2

Page 3 of 23

Page 4
151
MCQhard

A media company stores video metadata in Amazon Aurora MySQL. The application performs frequent range queries on a 'creation_date' column. The table has 10 million rows. The team notices that queries filtering on 'creation_date' are slow despite an index on that column. The query pattern is: SELECT * FROM videos WHERE creation_date BETWEEN '2023-01-01' AND '2023-01-31' ORDER BY creation_date LIMIT 100. The execution plan shows a full index scan. What is the MOST likely cause?

A.The index should be a composite index on (creation_date, id)
B.The table is not partitioned by creation_date
C.The index on creation_date is not being used
D.The query selects all columns, causing excessive table access
AnswerD

SELECT * forces the database to fetch full rows; a covering index could avoid that.

Why this answer

The query uses SELECT *, which forces the database engine to retrieve all columns from the table. Even though the index on creation_date is used for sorting and filtering, the query optimizer may choose a full index scan because it still needs to access the table rows for the non-indexed columns. This is often more efficient than random lookups for a large range, but it still results in scanning many index entries and performing table lookups, causing the observed slowness.

Exam trap

The trap here is that candidates assume an index is not being used (Option C) when the execution plan shows a full index scan, but the real issue is the overhead of retrieving all columns from the table, which is a common performance pitfall with SELECT * queries.

How to eliminate wrong answers

Option A is wrong because a composite index on (creation_date, id) would not significantly improve this query; the query already uses the creation_date index for range filtering, and adding id does not reduce the need to access the table for other columns. Option B is wrong because partitioning by creation_date could help with partition pruning, but the question states the index is already being used (full index scan), and the slowness is due to table access, not partition elimination. Option C is wrong because the execution plan explicitly shows a full index scan, meaning the index on creation_date is being used; the problem is not index non-use but the overhead of fetching all columns from the table.

Full explanation →
152
MCQeasy

A developer is troubleshooting an application that is unable to write to a DynamoDB table. The above IAM policy is attached to the IAM role used by the application. What is the likely cause?

A.The Deny statement overrides the Allow statement, blocking all DynamoDB actions.
B.The table name in the Resource ARN is incorrect.
C.The IAM user does not exist.
D.The role is not correctly assumed by the application.
AnswerA

Correct. The Deny statement overrides the Allow, blocking all DynamoDB actions.

Why this answer

The Deny statement for all DynamoDB actions overrides the Allow for PutItem. Deny statements always take precedence over Allow statements. Option B is incorrect because the table name in the Resource ARN is correct.

Option C is incorrect because the IAM user does exist. Option D is incorrect because the role is assumed correctly.

Full explanation →
153
MCQhard

A healthcare company stores patient records in Amazon DynamoDB. Each record includes a 'patient_id' (partition key) and 'visit_date' (sort key). The company needs to run ad-hoc queries to find all patients seen by a specific doctor within a date range. Which design approach minimizes cost and latency for this query pattern?

A.Query the base table using a filter expression on doctor_id.
B.Create a local secondary index (LSI) with doctor_id as sort key.
C.Create a global secondary index (GSI) with doctor_id as partition key and visit_date as sort key.
D.Use a Scan operation with a filter expression for doctor_id and visit_date.
AnswerC

GSI enables efficient query by doctor and date range.

Why this answer

A Global Secondary Index (GSI) with doctor_id as the partition key and visit_date as the sort key allows efficient key-based queries for all patients seen by a specific doctor within a date range. This avoids full table scans and filter operations, minimizing both cost (read capacity units) and latency. DynamoDB can directly retrieve the indexed items without scanning the base table.

Exam trap

The trap here is that candidates often confuse LSIs and GSIs, assuming an LSI can support queries on any attribute, but LSIs are restricted to the same partition key as the base table, making them unsuitable for querying by doctor_id across all patients.

How to eliminate wrong answers

Option A is wrong because querying the base table with a filter expression on doctor_id still requires a full table scan if doctor_id is not a key attribute; the base table's partition key is patient_id, so you cannot query by doctor_id without scanning all items, which is costly and slow. Option B is wrong because a Local Secondary Index (LSI) must have the same partition key as the base table (patient_id), so it cannot be used to query by doctor_id alone; it would only help for queries within a specific patient. Option D is wrong because a Scan operation reads every item in the table, incurring maximum read capacity and latency, even with a filter expression; it is the least efficient approach for ad-hoc queries.

Full explanation →
154
MCQeasy

A developer runs the AWS CLI command shown in the exhibit. What is the output indicating?

A.The secret value is not accessible.
B.The secret is not encrypted.
C.The secret has been rotated.
D.The secret contains a username and password in JSON format.
AnswerD

The output displays the secret value in JSON format containing both a username and password, which is the expected result of retrieving a secret.

Why this answer

The `aws secretsmanager get-secret-value` command returns the secret's value in the `SecretString` field, which typically contains a JSON object with the username and password. Option A is incorrect because the command succeeded, indicating the secret is accessible. Option B is incorrect because secrets are encrypted at rest by default.

Option C is incorrect because the output includes the version ID but does not indicate rotation.

Full explanation →
155
MCQeasy

A company is storing sensitive customer data in an Amazon RDS for MySQL DB instance. They need to ensure that data is encrypted at rest. What is the simplest way to achieve this?

A.Enable encryption on the existing DB instance by modifying the DB instance settings.
B.Enable Transparent Data Encryption (TDE) on the MySQL instance.
C.Launch a new encrypted DB instance and migrate the data.
D.Use client-side encryption with AWS KMS to encrypt data before inserting into the database.
AnswerC

Launching a new RDS instance with encryption enabled is the simplest method, as encryption is specified at launch time.

Why this answer

Amazon RDS for MySQL does not allow enabling encryption at rest on an existing unencrypted DB instance. The simplest way to achieve encryption at rest is to launch a new encrypted DB instance and migrate the data. Option A is incorrect because encryption cannot be enabled on an existing DB instance via modification; it requires creating a new instance.

Option B is incorrect because RDS for MySQL does not support Transparent Data Encryption (TDE). Option D is incorrect because client-side encryption with AWS KMS is more complex and not the simplest approach.

Full explanation →
156
Multi-Selectmedium

A company uses Amazon RDS for PostgreSQL and wants to audit all database login attempts. Which TWO services can be used together to achieve this?

Select 2 answers
A.Enable AWS CloudTrail.
B.Enable VPC Flow Logs.
C.Enable S3 access logs to capture API calls.
D.Enable RDS Enhanced Monitoring.
E.Enable RDS for PostgreSQL to log to CloudWatch Logs.
AnswersA, E

Correct. CloudTrail captures management API calls, including those that modify the DB parameter group to enable audit logging, which is part of the auditing process.

Why this answer

To audit all database login attempts in RDS for PostgreSQL, you need to capture both the configuration changes (e.g., enabling audit logging) and the actual login events. AWS CloudTrail (Option A) records management API calls, such as modifying the DB parameter group to enable logging to CloudWatch Logs. Option E enables RDS for PostgreSQL to log login attempts directly to CloudWatch Logs.

Together, they provide complete auditing: CloudTrail for the administrative actions and CloudWatch Logs for the login events. The other options do not capture login attempts.

Full explanation →
157
MCQmedium

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The compliance team requires that all database connections use SSL/TLS and that users authenticate using IAM database authentication. The database migration is completed, but the application team reports that connections using IAM authentication are failing. The company has already enabled IAM database authentication on the RDS instance. What is the most likely cause of the failure?

A.The application is using an outdated root CA certificate for SSL.
B.The Security Group does not allow inbound traffic from the application.
C.The database user has not been granted the necessary privileges for IAM authentication.
D.The RDS instance is using a different KMS key for encryption.
AnswerC

Database users must be created with 'IDENTIFIED WITH AWS_AUTHENTICATION' and granted 'rds_iam' role to use IAM authentication.

Why this answer

IAM database authentication requires that the database user be created with the `IDENTIFIED WITH AWS_AUTHENTICATION` clause in Oracle. Without this privilege, the RDS instance will reject IAM-authenticated connections even if IAM authentication is enabled at the instance level. The application team must ensure the database user has been granted the `AWS_ORACLE_EXTENSIONS` role and that the user is mapped to an IAM policy allowing `rds-db:connect`.

Exam trap

The trap here is that candidates often assume enabling IAM authentication on the RDS instance is sufficient, overlooking the mandatory step of creating the database user with the `IDENTIFIED WITH AWS_AUTHENTICATION` clause and granting the necessary privileges.

How to eliminate wrong answers

Option A is wrong because an outdated root CA certificate would cause SSL/TLS handshake failures, not IAM authentication failures; IAM authentication relies on a valid authentication token, not the CA certificate chain. Option B is wrong because security group inbound rules control network-layer access, not authentication; if the security group blocked traffic, the application would receive a timeout or connection refused error, not an IAM authentication failure. Option D is wrong because the KMS key used for encryption at rest is unrelated to IAM authentication; IAM authentication uses the AWS Signature Version 4 signing process and does not involve KMS keys.

Full explanation →
158
MCQhard

A database specialist is monitoring an Amazon DynamoDB global table with two replicas in separate regions. The specialist notices that the 'ReplicatedWriteConflictCount' metric is increasing. What is the MOST likely cause?

A.Insufficient write capacity in one of the regions
B.High network latency between the regions
C.The application is using strongly consistent reads
D.The same item is being written concurrently in multiple regions
AnswerD

Global tables use last-writer-wins; concurrent writes increase conflict count.

Why this answer

Concurrent writes to the same item in different regions cause conflicts. Option A is wrong because provisioned throughput affects throttling, not conflicts. Option B is wrong because network latency does not cause conflicts.

Option C is wrong because eventual consistency does not cause conflicts.

Full explanation →
159
MCQhard

A company is designing a time-series database for IoT sensor data using Amazon DynamoDB. Each sensor sends a reading every second. The table uses 'sensor_id' as partition key and 'timestamp' as sort key. The application queries for the last hour of data for a specific sensor. The query uses 'KeyConditionExpression' with 'timestamp' between start and end time. The table has auto-scaling enabled. However, the query latency is high. What is the MOST likely cause?

A.Enable DynamoDB Accelerator (DAX) to cache the query results.
B.The sort key should be 'sensor_id' and partition key should be 'timestamp'.
C.The query is scanning from the beginning of time; use 'ScanIndexForward: false' and a 'Limit' parameter.
D.The table does not have enough read capacity units; increase the base capacity.
AnswerC

Reverses the sort order to retrieve recent items first, reducing scanned data.

Why this answer

The high query latency is most likely due to the query scanning all historical data for the sensor before applying the filter on the sort key. By default, DynamoDB queries return results in ascending order of the sort key, and without `ScanIndexForward: false` and a `Limit` parameter, the query may process many irrelevant items before reaching the last hour of data. Setting `ScanIndexForward: false` returns the most recent items first, and adding a `Limit` reduces the number of items scanned, significantly improving latency.

Exam trap

The trap here is that candidates assume high query latency is always due to insufficient read capacity or caching, rather than recognizing that inefficient query design—specifically scanning too many items—is the most common cause in time-series patterns.

How to eliminate wrong answers

Option A is wrong because DynamoDB Accelerator (DAX) is an in-memory cache that reduces read latency for frequently accessed items, but it does not address the root cause of scanning excessive historical data; the query pattern itself needs optimization. Option B is wrong because swapping the partition key and sort key would break the access pattern of querying all data for a specific sensor over a time range; with 'sensor_id' as sort key, you could not efficiently query by sensor and time range. Option D is wrong because auto-scaling is enabled, and the issue is not insufficient read capacity units; increasing base capacity would not fix the latency caused by scanning unnecessary data.

Full explanation →
160
MCQeasy

An IAM policy is attached to a user. What does this policy allow the user to do?

A.Update an item in the Orders table.
B.Scan the entire Orders table and return all attributes.
C.Delete an item from the Orders table.
D.Get an item from the Orders table but only return the order_id, customer_id, and status attributes.
AnswerD

The policy allows GetItem with attribute restriction.

Why this answer

The IAM policy allows the GetItem action on the Orders table, with a condition that restricts the returned attributes to order_id, customer_id, and status. This matches option D. Option A is incorrect because the policy does not allow UpdateItem.

Option B is incorrect because the policy does not allow Scan (it only allows GetItem). Option C is incorrect because the policy does not allow DeleteItem.

Full explanation →
161
Multi-Selecthard

A company runs a time-series application on Amazon DynamoDB. The data has a pattern of frequent writes for recent data and rare reads for older data. They want to optimize storage costs and query performance for the time-series data. Which THREE strategies should they implement? (Choose THREE.)

Select 3 answers
A.Use DynamoDB Time to Live (TTL) to automatically delete old data after a certain period
B.Store historical data in Amazon S3 and query with Amazon Athena
C.Increase DynamoDB read capacity units to improve query performance
D.Archive old data to Amazon S3 Glacier using AWS Lambda and DynamoDB Streams
E.Decrease DynamoDB write capacity units to reduce cost
AnswersA, B, D

TTL removes items without consuming WCU and reduces storage costs.

Why this answer

DynamoDB Time to Live (TTL) automatically expires and deletes old items after a defined timestamp, reducing storage costs without manual intervention. This is ideal for time-series data where older records are rarely accessed, as TTL offloads the deletion process to DynamoDB in the background, freeing up provisioned throughput.

Exam trap

The trap here is that candidates may confuse increasing read capacity (Option C) as a performance fix for older data, but the question specifically targets cost optimization and query performance for rarely accessed historical data, where offloading to S3 and using TTL are the correct strategies.

Full explanation →
162
MCQeasy

A company runs an Amazon RDS for SQL Server DB instance in a VPC. The security group for the DB instance allows inbound traffic on port 1433 from the application servers' security group. The application servers can connect to the database, but a database administrator cannot connect from their workstation using SQL Server Management Studio (SSMS). What is the MOST likely cause?

A.The security group does not allow inbound traffic from the DBA workstation's IP address.
B.The DBA is using an incompatible version of SSMS.
C.The DB instance is configured as Multi-AZ, which restricts direct connections.
D.The DB instance has encryption enabled, which blocks non-encrypted connections.
AnswerA

The security group only allows traffic from the app servers; the DBA's IP is not allowed.

Why this answer

The DBA's workstation is not within the VPC, so it needs a public IP and the security group must allow inbound traffic from the workstation's IP. Option A (DBA's IP not in security group) is correct. Option B (SSMS version) is unlikely; Option C (Multi-AZ) irrelevant; Option D (encryption) does not prevent connection.

Full explanation →
163
MCQmedium

A company has an Amazon DynamoDB table with on-demand capacity mode. The table experiences a sudden spike in traffic, and the application starts receiving ProvisionedThroughputExceededException errors. What is the most likely cause?

A.The provisioned read capacity units are insufficient
B.The table has reached the maximum number of read capacity units
C.The traffic spike exceeded the previous peak traffic by more than double in a short period
D.Auto Scaling is not configured to increase capacity
AnswerC

DynamoDB on-demand mode uses a token bucket algorithm; sudden huge spikes can cause throttling.

Why this answer

DynamoDB on-demand capacity mode can throttle requests if the traffic spike exceeds the previous peak traffic by more than double within a short period. This is due to the adaptive capacity mechanism that requires time to scale. Option A is wrong because on-demand mode does not have provisioned read/write capacity units.

Option B is wrong because on-demand mode does not have a maximum number of capacity units; it scales automatically but with a ramp-up limit. Option D is wrong because Auto Scaling is not applicable to on-demand mode; it uses a different scaling model.

Full explanation →
164
Multi-Selectmedium

A company is designing an Amazon RDS for MySQL database for an e-commerce application. Which TWO design strategies will help ensure high availability and automatic failover in the event of a primary instance failure?

Select 2 answers
A.Use Amazon Aurora instead of RDS MySQL.
B.Create a read replica in the same Availability Zone.
C.Enable Multi-AZ deployment.
D.Provision read replicas in different Availability Zones.
E.Enable automatic backups.
AnswersA, C

Using Amazon Aurora instead of RDS MySQL provides built-in high availability with automatic failover across multiple Availability Zones, making it a valid design strategy.

Why this answer

Amazon Aurora is a MySQL-compatible database engine that provides built-in high availability and automatic failover across multiple Availability Zones, with up to 15 low-latency read replicas. Option C is correct because enabling Multi-AZ deployment for Amazon RDS MySQL provisions a synchronous standby replica in a different Availability Zone, and Amazon RDS automatically fails over to the standby in the event of a primary instance failure. Both strategies ensure automatic failover without manual intervention.

Options B and D involve read replicas, which are for read scaling and require manual promotion for failover, not automatic. Option E (automatic backups) provides point-in-time recovery, not high availability or failover.

Exam trap

The trap here is that candidates often confuse read replicas (which are for read scaling and require manual promotion) with Multi-AZ standby replicas (which provide automatic failover), leading them to select options B or D incorrectly. Additionally, some candidates may overlook that using Amazon Aurora (option A) is a valid high-availability strategy for MySQL-compatible workloads.

Full explanation →
165
MCQeasy

A developer is troubleshooting a slow query on Amazon RDS for MySQL. The query joins three large tables and runs frequently. What is the most effective way to identify the bottleneck?

A.Check the RDS Events for any maintenance notifications
B.Review Amazon CloudWatch CPU and memory metrics
C.Enable the slow query log and analyze the output
D.Use AWS Database Migration Service to migrate to a larger instance
AnswerC

Slow query log records queries that take longer than a set time.

Why this answer

Enabling the slow query log on RDS for MySQL captures queries that exceed a specified execution time, allowing the developer to identify which queries are slow and analyze their execution plan to find bottlenecks. Option A is wrong because RDS Events are for maintenance and operational notifications, not query performance. Option B is wrong because CloudWatch CPU and memory metrics show overall resource utilization but do not pinpoint specific slow queries.

Option D is wrong because migrating to a larger instance may help but does not directly identify the bottleneck; it addresses symptoms rather than root cause analysis.

Full explanation →
166
MCQeasy

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. After migration, the application team reports that queries are slower than before. Which metric in CloudWatch should the DBA review first to check if the instance is resource-constrained?

A.SwapUsage
B.CPUUtilization
C.FreeableMemory
D.DatabaseConnections
AnswerB

High CPU could indicate resource contention affecting query performance.

Why this answer

(CPUUtilization). When migrating an on-premises Oracle database to Amazon RDS for Oracle, slower queries can indicate resource constraints. CPUUtilization is the primary metric to review first because high CPU usage directly impacts query performance.

Option A (SwapUsage) is more relevant for memory pressure but not the first indicator. Option C (FreeableMemory) is important but CPU is typically the first bottleneck. Option D (DatabaseConnections) shows concurrent connections but does not directly measure resource saturation.

Full explanation →
167
MCQmedium

A company is deploying a new application that uses Amazon RDS for PostgreSQL. The application must be highly available with automatic failover in the event of a database failure. Which configuration should be used?

A.Deploy a Multi-AZ RDS instance with a standby in a different Availability Zone
B.Use a read replica in a different Availability Zone
C.Deploy the RDS instance in a single Availability Zone with automated backups
D.Deploy the RDS instance in a Cross-Region replication configuration
AnswerA

Multi-AZ provides automatic failover for high availability.

Why this answer

Multi-AZ RDS for PostgreSQL provides synchronous replication to a standby instance in a different Availability Zone, ensuring automatic failover with minimal data loss. This configuration meets the requirement for high availability and automatic failover without manual intervention, as the RDS service handles the DNS change and standby promotion.

Exam trap

The trap here is that candidates often confuse read replicas with Multi-AZ, assuming a read replica can serve as a failover target, but AWS explicitly requires manual promotion for read replicas and does not provide automatic failover.

How to eliminate wrong answers

Option B is wrong because a read replica is designed for read scaling and does not support automatic failover; promoting a read replica requires manual action and can result in data loss if replication lag exists. Option C is wrong because a single-AZ deployment lacks a standby instance, so any database failure leads to downtime until a new instance is restored from backups, which is not automatic failover. Option D is wrong because Cross-Region replication is for disaster recovery across AWS regions, not for automatic failover within a region, and it involves asynchronous replication with potential data loss and higher latency.

Full explanation →
168
MCQhard

A company runs a critical e-commerce application on Amazon Aurora MySQL with a single DB instance. The database has 8 TB of data and uses the default writer endpoint. Recently, the application experienced a 10-minute outage during a primary instance failover. The failover was triggered by an underlying hardware issue. The database specialist needs to minimize downtime during future failovers. The application team is unwilling to modify the application code to handle connection retries. The company has a 99.99% SLA requirement. Which solution should the database specialist implement to meet the SLA with minimal application changes?

A.Increase the DB instance class to a larger size to improve performance and reduce failover time
B.Enable Multi-AZ deployment with automatic failover
C.Create an Amazon RDS Proxy and configure the application to connect to the proxy endpoint
D.Create a cross-Region read replica and promote it to primary during failover
AnswerC

RDS Proxy handles failover seamlessly by preserving connections and reducing downtime.

Why this answer

Amazon RDS Proxy sits between the application and the database, pooling and reusing database connections. During a failover, RDS Proxy maintains the client connections and transparently reconnects to the new primary instance, so the application does not experience a connection loss and does not need to implement retry logic. This directly addresses the 10-minute outage by reducing failover downtime to seconds, meeting the 99.99% SLA without application code changes.

Exam trap

The trap here is that candidates often assume Multi-AZ (Option B) is sufficient for zero-downtime failover, but they overlook that the application must handle connection retries, which the question explicitly prohibits, making RDS Proxy the only solution that provides transparent failover without code changes.

How to eliminate wrong answers

Option A is wrong because increasing the DB instance class does not reduce failover time; failover duration is determined by the time to detect the failure, promote a replica, and flush transactions, not by instance size. Option B is wrong because while Multi-AZ with automatic failover provides a standby in a different Availability Zone, the application still experiences a connection break during failover and must handle retries, which the team is unwilling to do; the outage would still be several minutes. Option D is wrong because a cross-Region read replica requires manual promotion and DNS changes, leading to significantly longer downtime than 10 minutes, and it does not provide automatic failover or transparent reconnection without application changes.

Full explanation →
169
MCQhard

A company runs a production Amazon DynamoDB table with on-demand capacity. The security team requires that all access to the table be logged for compliance. What is the most cost-effective way to log every DynamoDB API call?

A.Enable DynamoDB Streams on the table and process the stream with AWS Lambda.
B.Enable Amazon CloudWatch Logs to capture DynamoDB API calls.
C.Enable VPC Flow Logs and analyze them with Amazon Athena.
D.Enable AWS CloudTrail and create a trail that delivers logs to Amazon CloudWatch Logs.
AnswerD

AWS CloudTrail logs all DynamoDB API calls (e.g., GetItem, PutItem, Query) and can deliver these logs to CloudWatch Logs for monitoring and compliance.

Why this answer

AWS CloudTrail logs all DynamoDB API calls (e.g., GetItem, PutItem, Query) and can deliver these logs to CloudWatch Logs for monitoring and compliance. Option A is incorrect because DynamoDB Streams capture data modifications (INSERT, MODIFY, DELETE), not the API calls themselves. Option B is incorrect because CloudWatch Logs is a destination for logs, not a service that captures API calls directly; it relies on CloudTrail or other sources to send logs.

Option C is incorrect because VPC Flow Logs record network traffic metadata (IP addresses, ports), not API-level calls.

Full explanation →
170
MCQmedium

A company is designing a database for a real-time bidding system that requires sub-millisecond read and write latency for ad impressions. The workload is heavily write-intensive with occasional reads by campaign IDs. Which AWS database service is most suitable?

A.Amazon DynamoDB with DAX
B.Amazon ElastiCache for Redis
C.Amazon DocumentDB
D.Amazon Aurora MySQL
AnswerA

DynamoDB with DAX provides microsecond to single-digit millisecond latency for high-throughput workloads.

Why this answer

Amazon DynamoDB with DAX is the most suitable choice because DynamoDB provides single-digit millisecond latency for read and write operations at any scale, and DAX (DynamoDB Accelerator) is an in-memory cache that reduces read latency to microseconds for frequently accessed items. This combination meets the sub-millisecond read and write latency requirements for a heavily write-intensive real-time bidding system, while supporting occasional reads by campaign IDs via efficient query patterns.

Exam trap

The trap here is that candidates may choose ElastiCache for Redis because of its sub-millisecond latency, overlooking that it is not designed as a primary database for write-heavy, durable workloads, and that DynamoDB with DAX provides the same latency with built-in durability and auto-scaling for writes.

How to eliminate wrong answers

Option B (Amazon ElastiCache for Redis) is wrong because while it offers sub-millisecond latency, it is primarily an in-memory data store that is not optimized for heavy write-intensive workloads with persistence requirements; it lacks the native write scaling and durability features of DynamoDB, and using it as a primary database for ad impressions would risk data loss on node failure without complex replication. Option C (Amazon DocumentDB) is wrong because it is a document database that provides millisecond latency but not sub-millisecond performance for writes, and its write throughput is limited by instance size and storage IOPS, making it unsuitable for the extreme write volume of a real-time bidding system. Option D (Amazon Aurora MySQL) is wrong because it is a relational database that offers low latency but typically in the single-digit millisecond range for writes, and its write performance is constrained by the underlying storage and replication architecture, failing to meet the sub-millisecond write latency requirement for a heavily write-intensive workload.

Full explanation →
171
MCQmedium

A company is using Amazon RDS for PostgreSQL with read replicas to offload read traffic. The company wants to ensure that the read replicas are always in sync with the primary instance. Which metric should the company monitor to detect replication lag?

A.DiskQueueDepth
B.ReplicaLag
C.TransactionLogsDiskUsage
D.ReadLatency
AnswerB

This metric shows the time difference between the primary and replica in seconds.

Why this answer

The correct metric to monitor for replication lag in Amazon RDS for PostgreSQL read replicas is ReplicaLag. This metric is available in CloudWatch and directly indicates the time difference between the primary instance and the read replica. Option A (DiskQueueDepth) measures the number of pending I/O requests, not replication lag.

Option C (TransactionLogsDiskUsage) measures the amount of transaction logs, which is related but not a direct lag metric. Option D (ReadLatency) measures the latency of read operations, not the synchronization delay.

Full explanation →
172
MCQhard

A company uses Amazon RDS for PostgreSQL with Multi-AZ deployment. They experience increased write latency during peak hours. The DB instance size is db.r5.large. Which action would MOST effectively reduce write latency?

A.Switch to a db.r5.xlarge instance type.
B.Disable the Multi-AZ feature and use asynchronous replication with a read replica for failover.
C.Enable the synchronous_commit parameter to 'off'.
D.Enable Multi-AZ with two standby replicas.
AnswerB

Asynchronous replication reduces write latency; read replica can be promoted for failover.

Why this answer

Multi-AZ deployments maintain a synchronous standby replica, which adds write latency because the primary must wait for the standby to acknowledge writes. Disabling Multi-AZ and using asynchronous replication to a read replica eliminates this synchronous overhead, allowing writes to complete faster. Option A increases instance size but doesn't address synchronous replication overhead; option C (synchronous_commit off) risks data loss and is not recommended; option D adds another standby, increasing overhead.

Full explanation →
173
MCQhard

A company has a multi-AZ RDS for PostgreSQL DB instance. The security team wants to ensure that database audit logs are stored in CloudWatch Logs for real-time monitoring. The team enabled the 'pgaudit.log' parameter and set 'log_destination' to 'csvlog'. However, logs are not appearing in CloudWatch. What is the most likely cause?

A.The DB instance is multi-AZ, which prevents log delivery to CloudWatch.
B.AWS CloudTrail is not enabled for the RDS instance.
C.The DB parameter group is not associated with the DB instance.
D.The 'rds.logs_to_cloudwatch' parameter is not set to 1.
AnswerD

This parameter must be enabled for logs to be published to CloudWatch.

Why this answer

RDS publishes logs to CloudWatch only if the 'rds.logs_to_cloudwatch' parameter is set to 1. Option A is wrong because multi-AZ does not prevent log delivery. Option B is wrong because CloudTrail is not involved in log delivery to CloudWatch; it's about API activity logging.

Option C is wrong because the DB parameter group is associated; the issue is that the specific parameter 'rds.logs_to_cloudwatch' is not set.

Full explanation →
174
MCQmedium

A company is deploying a new application on Amazon RDS for PostgreSQL. The application requires a database with a specific parameter group that sets 'max_connections' to 500 and 'shared_buffers' to 25% of the instance memory. The company uses CloudFormation to deploy the RDS instance. The CloudFormation template creates a DBInstance with a DBParameterGroup. The deployment fails because the parameter group cannot be associated with the DB instance. What is the most likely cause?

A.The parameter group uses an invalid value for 'shared_buffers' because it must be an integer, not a percentage.
B.The 'max_connections' value of 500 exceeds the allowed maximum for the instance class.
C.The CloudFormation template does not include a DependsOn clause linking the DBParameterGroup to the DBInstance.
D.The DBParameterGroup is not in the same region as the DBInstance.
AnswerA

RDS requires absolute values for 'shared_buffers', not percentages.

Why this answer

In Amazon RDS for PostgreSQL, the 'shared_buffers' parameter must be specified as an integer value (in 8 KB blocks) or a string ending with 'kB', 'MB', or 'GB', not as a percentage of instance memory. Using a percentage like '25%' is invalid and causes the parameter group association to fail. Option B is incorrect because 'max_connections' can be set to 500 as long as it does not exceed the instance class limits, but that is not the issue here.

Option C is incorrect because CloudFormation automatically handles dependencies when resources are referenced; explicit DependsOn is not required. Option D is incorrect because CloudFormation templates can reference resources across regions only if explicitly designed, but the region mismatch would cause a different error, not parameter group association failure.

Full explanation →
175
Multi-Selecteasy

A company uses Amazon RDS for PostgreSQL with Multi-AZ. The primary instance fails and a failover occurs. After failover, the application reports elevated write latency. Which TWO are possible causes?

Select 2 answers
A.A read replica is now promoting to primary
B.The buffer pool is not warm on the new primary
C.The new primary has a smaller instance size
D.Automated backups are running on the new primary
E.Application DNS cache still points to the old primary IP
AnswersB, E

Cold buffer pool increases read I/O.

Why this answer

After a Multi-AZ failover, the new primary instance starts with a cold buffer pool (no cached data blocks). PostgreSQL relies on shared buffers to cache frequently accessed data; without a warm cache, every read request must fetch data from disk, which increases I/O and write latency because writes often require reading the affected pages first. This is a known behavior in RDS for PostgreSQL after failover, and it resolves as the buffer pool warms up over time.

Exam trap

The trap here is that candidates often confuse Multi-AZ failover with read replica promotion, or assume that automated backups cause performance degradation, when in fact the cold buffer pool is the primary culprit for elevated write latency after failover.

Full explanation →
176
MCQmedium

A company has an Amazon RDS for MySQL DB instance that stores sensitive customer data. The security team requires that all data at rest be encrypted using a customer-managed AWS KMS key. The DB instance was originally launched without encryption. Which combination of steps will meet the requirement with the least downtime?

A.Create a read replica of the DB instance with encryption enabled, and then promote the read replica to become the primary instance.
B.Modify the DB instance and enable encryption using the AWS Management Console.
C.Take a snapshot of the DB instance, copy the snapshot with encryption enabled using the desired KMS key, and restore the encrypted snapshot to a new DB instance.
D.Take a snapshot of the DB instance, copy the snapshot with encryption enabled, and restore the encrypted snapshot to the same DB instance ID.
AnswerC

This is the standard procedure to enable encryption on an existing unencrypted RDS instance.

Why this answer

To enable encryption on an existing unencrypted RDS MySQL DB instance, you must take a snapshot of the instance, copy the snapshot with encryption enabled using the desired KMS key, and then restore the encrypted snapshot to a new DB instance. This process results in some downtime but is the standard method. Option A is incorrect because you cannot create an encrypted read replica from an unencrypted source instance; encryption on a read replica requires the source to be encrypted.

Option B is incorrect because you cannot enable encryption on an existing unencrypted DB instance by modifying it; encryption can only be enabled at creation time or by restoring an encrypted snapshot. Option D is incorrect because you cannot restore an encrypted snapshot to the same DB instance ID; you must restore to a new instance, then update the application endpoint.

Full explanation →
177
MCQmedium

A financial services company needs a database for trade settlement records. Each trade must be processed exactly once and the database must ensure ACID compliance across multiple rows. The workload is write-intensive with moderate reads. Which AWS database service should they choose?

A.Amazon Aurora PostgreSQL
B.Amazon DynamoDB with DynamoDB transactions
C.Amazon ElastiCache for Redis
D.Amazon Neptune
AnswerA

Aurora PostgreSQL provides full ACID compliance and is optimized for high write throughput.

Why this answer

Amazon Aurora PostgreSQL is the correct choice because it provides full ACID compliance across multiple rows, which is essential for trade settlement records where each trade must be processed exactly once. Aurora PostgreSQL is a relational database that supports multi-row transactions with strong consistency, and its write-intensive workload performance is enhanced by a distributed storage subsystem that offloads redo log processing, making it suitable for high-throughput write operations while maintaining moderate read performance.

Exam trap

The trap here is that candidates may choose DynamoDB with transactions because they see 'ACID compliance' in the DynamoDB transactions feature, but they overlook that DynamoDB is a NoSQL database that does not support relational joins or enforce referential integrity, which are critical for trade settlement records that require multi-row ACID transactions across related tables.

How to eliminate wrong answers

Option B is wrong because Amazon DynamoDB with DynamoDB transactions, while supporting ACID-like transactions across multiple items, is a NoSQL database that does not enforce relational constraints and is optimized for key-value and document workloads, not for the strict multi-row ACID compliance required for trade settlement records. Option C is wrong because Amazon ElastiCache for Redis is an in-memory data store that does not provide ACID compliance across multiple rows; it is designed for caching and low-latency access, not for durable, transactional record-keeping. Option D is wrong because Amazon Neptune is a graph database optimized for highly connected data and relationships, not for transactional, write-intensive workloads requiring ACID compliance across multiple rows.

Full explanation →
178
MCQmedium

A company is deploying an Amazon RDS for MySQL database in a VPC. The database must be accessible only from a specific set of application servers in the same VPC. Which configuration provides the most secure access?

A.Set the security group inbound rule to allow all traffic from the VPC CIDR
B.Place the RDS instance in a separate subnet group
C.Set the RDS instance to publicly accessible
D.Set the security group inbound rule to reference the security group of the application servers
AnswerD

Restricts access to resources with that security group.

Why this answer

Referencing the application servers' security group as the source in the RDS inbound rule allows traffic only from those specific instances, regardless of IP changes. This follows the AWS security best practice of using security group IDs for fine-grained, stateful access control within a VPC, eliminating reliance on static IP addresses or CIDR ranges.

Exam trap

The trap here is that candidates often confuse subnet placement (Option B) with access control, mistakenly thinking a separate subnet inherently restricts traffic, when in fact security groups are the primary mechanism for instance-level firewall rules in a VPC.

How to eliminate wrong answers

Option A is wrong because allowing all traffic from the VPC CIDR grants access to every resource in the VPC, including unauthorized instances or services, violating the principle of least privilege. Option B is wrong because placing the RDS instance in a separate subnet group does not restrict access; it only affects network segmentation and routing, not security group rules or connectivity. Option C is wrong because setting the RDS instance to publicly accessible assigns a public IP and opens it to the internet, which is insecure and contradicts the requirement for VPC-only access.

Full explanation →
179
MCQmedium

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database size is 500 GB. The migration must have minimal downtime. Which AWS service should be used to perform the migration?

A.AWS Snowball Edge
B.AWS Database Migration Service (DMS)
C.AWS DataSync
D.Amazon RDS for Oracle snapshot copy
AnswerB

DMS supports Oracle to RDS Oracle migrations with minimal downtime using change data capture.

Why this answer

AWS Database Migration Service (DMS) is the correct choice because it supports heterogeneous migrations from Oracle to Amazon RDS for Oracle with minimal downtime. DMS can perform continuous replication using Oracle's change data capture (CDC) via LogMiner or binary reader, allowing the source database to remain operational during the migration. This makes it ideal for a 500 GB database where downtime must be minimized.

Exam trap

The trap here is that candidates often confuse AWS DataSync or Snowball Edge as viable options for live database migrations, but DataSync is for file/object transfers and Snowball Edge is for offline bulk data movement, neither of which support ongoing change replication or minimal-downtime database migration.

How to eliminate wrong answers

Option A is wrong because AWS Snowball Edge is a physical data transfer device designed for large-scale offline data migrations (typically >10 TB) or environments with limited network bandwidth, not for minimal-downtime online database migrations. Option C is wrong because AWS DataSync is a service for transferring files and objects between on-premises storage and AWS (e.g., NFS, SMB, S3), not for live database replication or heterogeneous database migrations. Option D is wrong because Amazon RDS for Oracle snapshot copy only works between existing RDS instances (e.g., cross-region or cross-account copies) and cannot ingest data from an on-premises Oracle database; it requires the source to already be an RDS instance.

Full explanation →
180
MCQhard

A security engineer created the IAM policy above for an application that reads from a DynamoDB table named UserSessions. The application reports that it cannot query the table using a Global Secondary Index (GSI). The table's GSI is named GSI_UserSessions. Why is the application unable to query the index?

A.The Query action is not allowed on the index because the Allow statement only applies to the table, not the index.
B.The Deny statement explicitly denies all DynamoDB actions on the index resource, overriding the Allow statement.
C.The application is using GetItem instead of Query to access the index.
D.The policy allows Query on the table, which automatically includes the index.
AnswerA

Correct. The Allow statement only applies to the table, not the index, so the Query action is implicitly denied on the index.

Why this answer

The IAM policy's Allow statement grants the Query action only on the table resource (arn:aws:dynamodb:...:table/UserSessions) but not on the index resource (arn:aws:dynamodb:...:table/UserSessions/index/GSI_UserSessions). In DynamoDB, a Global Secondary Index is a separate subresource, and IAM policies must explicitly include the index ARN to allow operations like Query on that index. Without an explicit Allow on the index, the default implicit deny prevents the query.

Option B is incorrect because while a Deny statement would override any Allow, the primary reason the application fails is the lack of an Allow on the index; the Deny statement, if present, is an additional but not necessary condition.

Exam trap

The trap here is that candidates often assume that granting permissions on a DynamoDB table automatically covers its Global Secondary Indexes, but AWS IAM treats indexes as separate resources requiring explicit ARN-based permissions.

How to eliminate wrong answers

Option B is wrong because the Deny statement in the policy explicitly denies all DynamoDB actions on the index resource, which would indeed override the Allow statement, but the question states the application cannot query the index; the Deny statement is present in the policy and is the actual reason for the failure, not the Allow statement's scope. Option C is wrong because the application reports it cannot query the table using a GSI, and the issue is about permissions, not the API method; GetItem cannot query an index anyway, but the problem is IAM authorization. Option D is wrong because allowing Query on the table does not automatically include the index; DynamoDB treats indexes as separate resources for IAM purposes, so explicit permissions on the index ARN are required.

Full explanation →
181
MCQhard

A DevOps engineer notices that an Amazon RDS for PostgreSQL instance has been in 'storage-full' state for the past 30 minutes. The instance has 500 GB of General Purpose SSD (gp2) storage, and the free storage space is 0 bytes. The database is critical and cannot tolerate downtime. What is the MOST efficient way to resolve this issue while minimizing downtime?

A.Take a snapshot of the DB instance and restore it to a new instance with larger storage
B.Modify the DB instance to increase allocated storage to 1,000 GB
C.Enable storage auto-scaling on the DB instance
D.Delete unnecessary data, such as old logs or temporary tables
AnswerB

Modifying storage online adds space without downtime.

Why this answer

Modifying the storage allocation for an RDS instance can be done without downtime; the instance remains available during the modification. Increasing storage from 500 GB to 1,000 GB immediately resolves the 'storage-full' state. Option A is wrong because taking a snapshot and restoring to a new instance incurs downtime.

Option C is wrong because enabling storage auto-scaling does not address the current full state; it only prevents future issues. Option D is wrong because deleting data may not free enough space and requires time-consuming intervention, risking downtime.

Full explanation →
182
MCQhard

A CloudFormation template is used to create an RDS DB instance with encryption, as shown in the exhibit. The stack creation fails because the DB instance creation fails. What is the most likely cause?

A.The DB instance has StorageEncrypted set to true but KmsKeyId is not a valid ARN.
B.The KMS key policy does not grant permissions to the RDS service principal.
C.The KmsKeyId property requires the key ARN, not a reference.
D.The DB instance depends on the KMS key, but there is no DependsOn clause to ensure the key is created first.
AnswerD

Without DependsOn, the DB instance may be created before the key.

Why this answer

KMS key creation must be completed before the DB instance can use it; CloudFormation does not automatically order creation unless dependencies are defined. Option A is wrong because the KMS key policy allows the account root full access. Option B is wrong because the KMS key ID is passed correctly via !Ref.

Option C is wrong because encryption is set to true and the KMS key is provided.

Full explanation →
183
MCQmedium

A company is migrating an on-premises Oracle database to Amazon Aurora PostgreSQL. The database is used for a financial application that requires complex joins and transactions. Which migration strategy is MOST appropriate?

A.Use AWS DMS with native Oracle to PostgreSQL endpoint
B.Use Oracle GoldenGate to replicate data to Aurora PostgreSQL
C.Use AWS SCT to convert the schema and AWS DMS to migrate data
D.Use pg_dump to export the Oracle database and restore to Aurora PostgreSQL
AnswerC

SCT converts schema, DMS migrates data.

Why this answer

AWS Schema Conversion Tool (SCT) is required to convert the Oracle schema (including complex joins and transaction logic) to a PostgreSQL-compatible format, and AWS Database Migration Service (DMS) performs the ongoing data migration with minimal downtime. This combination handles both schema transformation and data replication for heterogeneous migrations, which is essential for a financial application with complex joins and transactions.

Exam trap

The trap here is that candidates assume DMS alone can handle heterogeneous migrations without schema conversion, or that a PostgreSQL-native tool like pg_dump can extract data from Oracle, leading them to choose options A or D instead of recognizing the mandatory role of SCT.

How to eliminate wrong answers

Option A is wrong because AWS DMS with native Oracle to PostgreSQL endpoint does not automatically convert the schema; DMS relies on SCT for schema conversion, and without it, the migration would fail due to incompatible data types, stored procedures, and transaction semantics. Option B is wrong because Oracle GoldenGate is a log-based replication tool primarily used for homogeneous Oracle-to-Oracle migrations or real-time streaming, and it does not natively convert Oracle schema objects to PostgreSQL; using it would require additional custom transformation logic and is not the most appropriate strategy for a full migration to Aurora PostgreSQL. Option D is wrong because pg_dump is a PostgreSQL-native tool that cannot export from an Oracle database; it only works with PostgreSQL databases, so it cannot be used to extract data from an Oracle source.

Full explanation →
184
MCQmedium

A company is migrating an on-premises PostgreSQL database to Amazon RDS for PostgreSQL. The database is 2 TB in size and has a high write workload. The company needs to minimize downtime during the migration. Which AWS service or feature should the company use to achieve this?

A.Use pg_dump and pg_restore to export and import the database.
B.Use AWS Database Migration Service (AWS DMS) with ongoing replication.
C.Use the AWS Schema Conversion Tool (AWS SCT) to convert the schema and migrate data.
D.Use AWS DataSync to replicate the database files.
AnswerB

AWS DMS supports ongoing replication via change data capture, minimizing downtime.

Why this answer

AWS DMS with ongoing replication (change data capture, CDC) is the correct choice because it allows continuous synchronization of the source PostgreSQL database with the target RDS for PostgreSQL instance after an initial full load. This minimizes downtime by enabling the target to stay up-to-date with changes until the cutover, which is critical for a 2 TB database with a high write workload.

Exam trap

The trap here is that candidates often confuse AWS DMS with AWS SCT, assuming SCT is needed for same-engine migrations, but SCT is only required for heterogeneous migrations, not for PostgreSQL to RDS PostgreSQL.

How to eliminate wrong answers

Option A is wrong because pg_dump and pg_restore are logical backup and restore tools that require the source database to be quiesced or taken offline during the export, causing significant downtime, and they do not support ongoing replication for a near-zero-downtime migration. Option C is wrong because AWS SCT is used for schema conversion when migrating between different database engines (e.g., Oracle to PostgreSQL), not for migrating within the same engine (PostgreSQL to RDS PostgreSQL), and it does not handle data migration or ongoing replication. Option D is wrong because AWS DataSync is designed for file-based data transfers (e.g., NFS, SMB) and cannot replicate live PostgreSQL database files or support transactional consistency and ongoing change capture for a relational database.

Full explanation →
185
MCQmedium

A user is unable to list the contents of the S3 bucket 'my-db-backups' using the AWS CLI. The IAM policy attached to the user is shown in the exhibit. What is the likely cause?

A.The user is using the wrong bucket name.
B.The policy does not grant 's3:ListBucket' permission.
C.The resource ARN is missing the bucket-level ARN needed for listing.
D.The policy has a syntax error.
AnswerB

ListBucket is required to list objects.

Why this answer

The IAM policy must include the 's3:ListBucket' action to allow listing the contents of an S3 bucket. The given policy lacks this action, so the user cannot list the bucket's objects. Option A is incorrect because there is no indication the bucket name is wrong.

Option C is incorrect because the resource ARN in the policy includes the bucket-level ARN (e.g., 'arn:aws:s3:::my-db-backups'), which is sufficient for listing. Option D is incorrect because the policy syntax is valid JSON.

Full explanation →
186
Multi-Selecteasy

A company is designing a highly available e-commerce application using Amazon DynamoDB. The application requires strongly consistent reads for inventory data and eventual consistency for user session data. Which TWO design decisions should the company make?

Select 2 answers
A.Enable DynamoDB Streams on the inventory table to replicate data for disaster recovery.
B.Use DynamoDB Accelerator (DAX) for the inventory table to provide strongly consistent reads.
C.Use a single DynamoDB table for both inventory and session data with different partition keys.
D.Use strongly consistent reads for the inventory table by setting ConsistentRead=true in the query.
E.Use DynamoDB global tables for the user session data to achieve low-latency access across regions.
AnswersD, E

ConsistentRead=true ensures strongly consistent reads in DynamoDB.

Why this answer

DynamoDB supports strongly consistent reads by setting the `ConsistentRead=true` parameter in the GetItem, Query, or Scan API calls. This ensures that the application always reads the most recent write, which is critical for inventory data where accuracy is paramount. Strongly consistent reads come at the cost of higher latency and lower throughput compared to eventually consistent reads, but they meet the requirement for inventory consistency.

Exam trap

The trap here is that candidates often assume DAX can provide strongly consistent reads because it accelerates read performance, but DAX is an eventually consistent cache and cannot guarantee read-after-write consistency for inventory data.

Full explanation →
187
MCQmedium

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database is 5 TB in size and has a daily change rate of 2%. The migration must have minimal downtime. Which migration strategy should be used?

A.Use AWS Schema Conversion Tool (SCT) to convert the schema, then use AWS DMS for full load only.
B.Create an RDS read replica in the same region and promote it.
C.Use AWS Database Migration Service (DMS) with ongoing replication from the source database.
D.Export the database to a dump file using Oracle Data Pump, upload to S3, and restore to RDS.
AnswerC

DMS with ongoing replication enables continuous sync and minimal downtime.

Why this answer

AWS DMS with ongoing replication (change data capture, CDC) allows a full load of the 5 TB database followed by continuous replication of the 2% daily changes, minimizing downtime by keeping the target RDS instance nearly synchronized until cutover. This approach handles large databases and high change rates without requiring a lengthy final export/import window.

Exam trap

The trap here is that candidates may confuse RDS read replicas (which are only for RDS-to-RDS replication) with cross-database replication, or assume that a full load plus manual catch-up is sufficient for minimal downtime, ignoring the need for continuous CDC to handle ongoing changes.

How to eliminate wrong answers

Option A is wrong because AWS SCT only converts schema, not data, and DMS full load alone would require a long downtime window to capture all changes after the load completes, failing to meet minimal downtime. Option B is wrong because RDS read replicas are only supported for RDS instances, not for on-premises Oracle databases, and cannot be created from an external source. Option D is wrong because exporting a 5 TB database with Oracle Data Pump, uploading to S3, and restoring to RDS would involve significant downtime for the export and restore processes, and does not provide ongoing replication to handle the 2% daily change rate with minimal interruption.

Full explanation →
188
MCQhard

A company is using Amazon DynamoDB for a high-traffic application. Users report occasional 'ProvisionedThroughputExceededException' errors. The application uses consistent reads and retries with exponential backoff. What is the MOST efficient way to handle these errors and reduce the number of retries?

A.Increase the provisioned read capacity units manually
B.Switch to eventually consistent reads
C.Enable DynamoDB Auto Scaling for the table
D.Increase the provisioned write capacity units manually
AnswerC

DynamoDB Auto Scaling adjusts the provisioned throughput automatically in response to traffic patterns, reducing throttling and the need for retries.

Why this answer

DynamoDB Auto Scaling adjusts the provisioned throughput automatically in response to traffic patterns, reducing throttling and the need for retries. Option A is wrong because increasing read capacity manually is inefficient and does not adapt to fluctuating traffic. Option B is wrong because switching to eventually consistent reads changes the consistency model, which may not be acceptable for the application's requirements.

Option D is wrong because increasing write capacity does not address read throttling.

Full explanation →
189
MCQmedium

A company is monitoring an Amazon Aurora MySQL DB cluster. They observe that the AuroraReplicaLagMaximum metric is consistently above 10 seconds. Which action would best reduce the replica lag?

A.Increase the instance size of the writer.
B.Increase the instance size of the reader.
C.Reduce the number of transactions per second.
D.Enable Multi-AZ on the cluster.
AnswerB

Correct. A larger reader instance can apply changes faster, reducing lag.

Why this answer

Increasing the instance size of the reader can improve its ability to apply changes faster. Option A is wrong because increasing the writer size may not help if the reader is the bottleneck. Option C is wrong because reducing transaction size helps but may not be feasible.

Option D is wrong because Multi-AZ is always enabled for Aurora.

Full explanation →
190
MCQmedium

A company is migrating a 500 GB MySQL database from an on-premises server to Amazon RDS for MySQL. The company uses AWS DMS with ongoing replication. The initial full load completes successfully, and the target RDS instance is in sync. However, after a few hours, the replication task fails with an error: 'Last Error: Error executing source loop; The table 'orders' has a row size larger than the maximum payload size of the target endpoint.' The target RDS instance is configured with db.r5.large and the default parameter group. The company has already verified that the table does not have any BLOB or TEXT columns. What is the MOST likely cause of this error?

A.The DMS task is using a low-memory instance.
B.The source table has a row that exceeds the MySQL row size limit.
C.The target RDS instance's max_allowed_packet parameter is set too low.
D.The target RDS instance does not have enough storage allocated.
AnswerB

MySQL enforces a row size limit; DMS cannot insert rows exceeding it.

Why this answer

RDS for MySQL has a maximum row size limit (65,535 bytes). DMS attempts to insert a row that exceeds this limit. Increasing the instance size does not change the row size limit.

Using a different storage engine might help, but InnoDB is default. Enabling compression reduces row size but is not a direct solution for the DMS error.

Full explanation →
191
MCQmedium

A company needs to enforce that all new Amazon RDS DB instances are automatically encrypted at rest. What is the most efficient way to achieve this?

A.Create an IAM policy that denies rds:CreateDBInstance unless encryption is enabled, and attach it to all users.
B.Enable the 'encryption at rest' default in each AWS account's RDS console.
C.Use an AWS Organizations service control policy (SCP) to deny creation of unencrypted RDS instances.
D.Use AWS CloudFormation StackSets to deploy a template that creates encrypted instances in every account.
AnswerC

SCPs can enforce encryption at the organizational level.

Why this answer

Using an AWS Organizations service control policy (SCP) to deny creation of unencrypted RDS instances is the most efficient way to enforce encryption at rest for all new RDS DB instances across multiple accounts. SCPs are applied at the organization, organizational unit, or account level and cannot be overridden by users, ensuring consistent enforcement. Option A is wrong because IAM policies with condition keys only affect specified users or roles, not service-linked roles or resources, and can be bypassed if users have permissions to modify policies.

Option B is wrong because there is no 'encryption at rest' default setting in the RDS console; encryption must be enabled per instance or via other mechanisms. Option D is wrong because CloudFormation StackSets require manual creation and maintenance of templates, and do not enforce encryption if users launch instances outside the stack.

Full explanation →
192
MCQhard

A company runs a critical application on an Amazon RDS for MySQL DB instance. The company requires that the database be available with minimal downtime during a disaster recovery scenario. The current RDS instance is in us-east-1. The company wants to have a standby database in us-west-2 with automatic failover. What should the company do to meet this requirement?

A.Create a Multi-AZ deployment in us-west-2 and use Amazon Route 53 to failover.
B.Take daily snapshots and copy them to us-west-2. Restore from snapshot in us-west-2 during a disaster.
C.Create a cross-region read replica in us-west-2. Configure automatic failover using Amazon Route 53 health checks.
D.Create a Multi-AZ deployment in us-east-1.
AnswerC

The read replica can be promoted quickly, and Route 53 can redirect traffic automatically.

Why this answer

An RDS cross-region read replica can be promoted to a standalone instance in a disaster, providing automatic failover with minimal downtime when combined with Route 53 health checks. Option A (Multi-AZ in us-west-2) does not provide cross-region failover; Multi-AZ only provides high availability within a single region. Option B (snapshots) requires manual restoration and incurs downtime.

Option D (Multi-AZ in us-east-1) only protects against Availability Zone failures within us-east-1, not region failures. Therefore, option C is the correct solution.

Full explanation →
193
MCQeasy

A developer is troubleshooting a slow-running query on an Amazon RDS for PostgreSQL instance. The query is performing a sequential scan on a large table. Which AWS service or feature should the developer use to identify the missing index?

A.Amazon RDS Enhanced Monitoring
B.AWS CloudTrail
C.Amazon RDS Performance Insights
D.Amazon CloudWatch Logs
AnswerC

Correct. Performance Insights helps identify performance bottlenecks such as missing indexes.

Why this answer

Amazon RDS Performance Insights provides database performance analysis with a dashboard that helps identify performance bottlenecks, such as missing indexes causing sequential scans. Option A is wrong because Amazon RDS Enhanced Monitoring provides OS-level metrics, not database query details. Option B is wrong because AWS CloudTrail logs API calls to AWS services, not database queries.

Option D is wrong because Amazon CloudWatch Logs can store database logs but does not analyze query performance to identify missing indexes.

Full explanation →
194
Multi-Selecthard

A company is migrating a 500 GB Oracle database to Amazon RDS for Oracle. They need to validate the migration and ensure data consistency. Which TWO methods should they use?

Select 2 answers
A.Use Amazon S3 inventory reports on the exported data.
B.Use AWS DMS data validation feature.
C.Run random SELECT queries on a subset of tables.
D.Compare row counts and checksums on both databases.
E.Use Amazon CloudWatch Logs to compare database logs.
AnswersB, D

DMS validation compares source and target data automatically.

Why this answer

AWS DMS data validation (Option B) is a built-in feature that automatically compares source and target records by computing checksums on each row, ensuring end-to-end data consistency without manual effort. Comparing row counts and checksums (Option D) is a standard manual validation technique that provides a reliable, independent verification of data completeness and integrity. Together, these two methods cover both automated and manual validation, which is critical for a 500 GB migration where manual inspection of every row is impractical.

Exam trap

The trap here is that candidates often choose Option C (random SELECT queries) thinking it is sufficient for validation, but the exam expects you to recognize that sampling is not statistically reliable for a 500 GB database and that AWS DMS provides a purpose-built, automated validation feature.

Full explanation →
195
MCQhard

A company is migrating a 3 TB Oracle database from on-premises to Amazon RDS for Oracle. The migration must have zero downtime. The on-premises server uses Oracle Data Guard for disaster recovery. The network bandwidth is 200 Mbps. The team plans to use AWS DMS with CDC from Oracle redo logs. During the initial full load, DMS reports that the source table 'ORDERS' has a table-level supplemental log missing. The migration fails. What should the team do first to resolve this issue?

A.Switch to Oracle GoldenGate for migration.
B.Use AWS SCT to convert the schema and then use a native export/import.
C.Enable supplemental logging on the Oracle source database for the 'ORDERS' table.
D.Recreate the DMS task with 'full load only' to bypass CDC.
AnswerC

Required for DMS CDC to capture changes.

Why this answer

AWS DMS requires supplemental logging on the source Oracle tables to capture change data for CDC. Without it, DMS cannot track changes. Option A is incorrect because switching to Oracle GoldenGate would not address the root cause and adds complexity.

Option B is incorrect because using AWS SCT and native export/import does not provide zero-downtime migration. Option D is incorrect because recreating the task with 'full load only' would lose the CDC requirement, causing downtime for ongoing changes.

Full explanation →
196
MCQeasy

Refer to the exhibit. A database administrator retrieves CloudWatch metrics for an RDS instance. What is the trend of CPU utilization during the monitored period?

A.CPU utilization is decreasing over time.
B.CPU utilization is constant around 90%.
C.CPU utilization fluctuates randomly.
D.CPU utilization is increasing over time.
AnswerD

The average values go from 75.5% to 98.2%.

Why this answer

The average CPU utilization increases from 75.5% to 98.2% over the hour, indicating a steady increase. Option A is incorrect because it is not decreasing. Option B is incorrect because it is not constant around 90%.

Option C is incorrect because it does not fluctuate randomly; it increases monotonically.

Full explanation →
197
Multi-Selecteasy

A company is planning to migrate its on-premises Oracle database to Amazon RDS for Oracle. The database uses Oracle Data Guard for disaster recovery. Which TWO AWS services can be used to assess the database and plan the migration? (Choose TWO.)

Select 2 answers
A.AWS Migration Hub
B.CloudEndure Disaster Recovery
C.AWS Snowball
D.AWS Database Migration Service (DMS)
E.AWS Schema Conversion Tool (SCT)
AnswersD, E

DMS can migrate data and assess compatibility.

Why this answer

AWS Database Migration Service (DMS) can migrate the Oracle database to RDS, while the AWS Schema Conversion Tool (SCT) assesses the source database and converts the schema to target format. Option A (AWS Migration Hub) tracks migrations but does not assess databases. Option B (CloudEndure Disaster Recovery) is for server-level disaster recovery, not database assessment.

Option C (AWS Snowball) is for offline data transfer, not assessment or migration planning.

Full explanation →
198
MCQeasy

A company is migrating an on-premises MySQL database to Amazon RDS for MySQL. The database uses InnoDB tables and is 500 GB in size. The migration must be completed within a 2-hour maintenance window. Which approach is MOST likely to meet the requirement?

A.Create a read replica of the on-premises database and promote it to RDS.
B.Use mysqldump to export the database and then import it into RDS.
C.Use AWS DMS with a full load task.
D.Take a physical backup of the data directory and copy it to RDS.
AnswerB

mysqldump with --single-transaction provides a consistent export without locking.

Why this answer

B is correct because mysqldump creates a logical backup that can be imported into Amazon RDS for MySQL within the 2-hour window for a 500 GB database, assuming sufficient network bandwidth and parallel import optimizations. The migration must complete within a fixed maintenance window, and mysqldump allows direct control over the export and import process, making it predictable for a single-shot migration.

Exam trap

The trap here is that candidates often choose AWS DMS (Option C) assuming it is the fastest migration tool, but for a one-time migration within a strict 2-hour window, mysqldump's simplicity and direct control often outperform DMS's overhead, especially when CDC is not required.

How to eliminate wrong answers

Option A is wrong because creating a read replica of an on-premises database and promoting it to RDS is not supported; MySQL read replicas require a source instance that is either an RDS instance or an external MySQL instance configured with binary log replication, but the promotion process does not apply to on-premises sources and would not complete within 2 hours due to initial sync overhead. Option C is wrong because AWS DMS with a full load task typically requires a change data capture (CDC) phase for ongoing replication, and the full load alone for 500 GB may exceed 2 hours depending on network throughput and target instance performance, plus DMS adds complexity and potential latency. Option D is wrong because taking a physical backup of the data directory (e.g., raw InnoDB files) and copying it to RDS is not supported; RDS does not allow direct file-level restoration of physical backups from on-premises, as it requires a compatible backup format like XtraBackup or mysqldump, and the copy would not be importable without additional conversion steps.

Full explanation →
199
Multi-Selecthard

A financial services company runs an Amazon Aurora MySQL database cluster with a single writer and two readers. The cluster handles critical transactional workloads. Over the past month, the database experienced intermittent read replica lag spikes that caused stale reads in application queries. The database administrator needs to identify the root cause and reduce replica lag. Which THREE steps should the administrator take to diagnose and mitigate the issue?

Select 3 answers
A.Switch from a single-writer cluster to Multi-AZ DB instance to reduce replication lag.
B.Upgrade the reader instances to a larger instance class to match the writer.
C.Use Performance Insights on the reader instances to identify high-load queries causing resource contention.
D.Check the binlog retention hours parameter and reduce it if set to a high value.
E.Enable slow query logging on the writer instance and analyze long-running transactions.
AnswersC, D, E

Performance Insights can pinpoint resource bottlenecks on readers.

Why this answer

Using Performance Insights on reader instances helps identify high-load queries causing resource contention, which can lead to replica lag. Option D is correct because a high binlog retention hours parameter can cause the replica to spend more time replaying binary logs; reducing it can mitigate lag. Option E is correct because enabling slow query logging on the writer instance helps identify long-running transactions that may lock rows or generate excessive binlog data, thereby causing replication delays.

Option A is incorrect because switching from an Aurora cluster to a Multi-AZ DB instance does not address replica lag; Multi-AZ is for failover redundancy, not replication performance. Option B is incorrect because upgrading reader instances to match the writer's class may help if readers are underpowered, but this is not a direct diagnostic step and may not resolve the root cause if the issue stems from the writer side.

Full explanation →
200
MCQmedium

A company's RDS for SQL Server instance is frequently running out of disk space. The instance uses General Purpose SSD (gp2) storage. Which monitoring step will help identify the root cause?

A.Review CloudTrail logs for API calls
B.Monitor FreeStorageSpace and BinaryLogUsage metrics
C.Monitor BackupStorageUsed metric
D.Enable Enhanced Monitoring
AnswerD

Enhanced Monitoring provides per-second OS-level metrics including disk utilization, which can reveal disk space consumption and help identify the root cause.

Why this answer

Enhanced Monitoring provides OS-level metrics such as disk space usage, which can help identify if the instance is running out of disk space due to growth of database files or logs. Option B is incorrect because BinaryLogUsage is a metric specific to MySQL, not SQL Server; RDS for SQL Server uses different metrics like Transaction Log Disk Usage. Options A and C are unrelated to instance disk space.

Exam trap

A common trap is confusing MySQL-specific metrics (BinaryLogUsage) with SQL Server metrics. For RDS SQL Server, monitor Transaction Log Disk Usage instead.

Full explanation →
201
MCQhard

A company is migrating a 500 GB Oracle database to Amazon Aurora PostgreSQL. They need to convert the schema and migrate the data. The application uses Oracle-specific features like hierarchical queries and stored procedures. Which combination of services should they use?

A.Use AWS Snowball Edge to transfer the database files and then use SCT to convert the schema.
B.Use AWS Schema Conversion Tool (SCT) to convert the schema and AWS Database Migration Service (DMS) to migrate the data.
C.Use AWS Database Migration Service (DMS) with the Oracle as source and Aurora PostgreSQL as target.
D.Use AWS Schema Conversion Tool (SCT) to convert the schema and then manually export/import data.
AnswerB

SCT converts the schema including Oracle-specific features, and DMS migrates the data efficiently.

Why this answer

AWS SCT converts Oracle-specific schema objects (including hierarchical queries and stored procedures) to PostgreSQL-compatible code, while AWS DMS handles the ongoing data migration with minimal downtime. This combination is the standard AWS approach for heterogeneous database migrations, as SCT addresses schema conversion and DMS handles data transfer.

Exam trap

The trap here is that candidates assume DMS alone can handle schema conversion, but DMS only migrates data and requires SCT for schema transformation, especially when Oracle-specific features like hierarchical queries are involved.

How to eliminate wrong answers

Option A is wrong because AWS Snowball Edge is designed for large-scale offline data transfer, not for schema conversion; SCT can convert the schema, but Snowball Edge does not facilitate the conversion process and is unnecessary for a 500 GB database. Option C is wrong because DMS alone cannot convert Oracle-specific schema features like hierarchical queries and stored procedures; it only migrates data, not schema objects. Option D is wrong because manually exporting/importing data is error-prone, time-consuming, and does not leverage DMS's ability to perform continuous replication or handle large volumes efficiently, making it unsuitable for a production migration.

Full explanation →
202
MCQhard

A company is deploying a globally distributed application that requires a low-latency, highly available database with multi-region write support. The application needs to handle conflicts automatically. Which AWS database solution meets these requirements?

A.Amazon Aurora Global Database
B.Amazon ElastiCache for Redis global datastore
C.Amazon DynamoDB global tables
D.Amazon RDS Multi-AZ with cross-region read replicas
AnswerC

DynamoDB global tables provide multi-region, multi-master writes with automatic conflict resolution.

Why this answer

Amazon DynamoDB global tables provide a fully managed, multi-region, multi-active database solution that automatically replicates data across AWS Regions, supports low-latency reads and writes from any region, and uses conflict resolution based on 'last writer wins' (LWW) with a timestamp vector clock. This meets the requirement for a globally distributed application needing automatic conflict handling without custom code.

Exam trap

The trap here is that candidates often confuse 'global database' (Aurora Global Database) with 'multi-region write support', not realizing Aurora Global Database is active-passive and cannot handle concurrent writes from multiple regions, while DynamoDB global tables are truly multi-active with built-in conflict resolution.

How to eliminate wrong answers

Option A is wrong because Amazon Aurora Global Database is designed for primary-secondary (active-passive) replication, not multi-region write support; writes can only occur in the primary region, and failover to a secondary region is manual or requires an RTO of minutes, not automatic conflict resolution. Option B is wrong because Amazon ElastiCache for Redis global datastore is an in-memory cache, not a durable database; it supports cross-region replication but does not provide automatic conflict resolution for writes, and data loss can occur on failover. Option D is wrong because Amazon RDS Multi-AZ with cross-region read replicas is an active-passive setup where writes are only allowed in the primary region; cross-region replicas are read-only and cannot handle multi-region writes or automatic conflict resolution.

Full explanation →
203
Multi-Selecteasy

A company uses Amazon Redshift and notices that queries are taking longer than usual. CloudWatch metrics show 'CPUUtilization' is high and 'DiskSpace' is low. Which TWO actions can help improve query performance?

Select 2 answers
A.Disable concurrency scaling to free resources
B.Add more nodes to the cluster
C.Enable Multi-AZ to distribute load
D.Run VACUUM to reclaim space
E.Optimize sort keys to reduce data scanned
AnswersB, E

Adding nodes increases parallelism and resources for queries.

Why this answer

Adding nodes increases both compute capacity and storage, addressing high CPU and low disk space. Option E is correct because optimizing sort keys reduces the amount of data scanned per query, which lowers CPU usage and speeds up queries. Option A is incorrect because disabling concurrency scaling would reduce the cluster's ability to handle concurrent queries, increasing wait times.

Option C is incorrect because Multi-AZ is not a feature of Amazon Redshift; it's used for RDS. Option D is incorrect because VACUUM reorganizes data but requires free disk space to operate; with low disk space, it may fail or not help.

Full explanation →
204
MCQmedium

A company is using Amazon DocumentDB (with MongoDB compatibility) for a content management system. The security team requires that all data be encrypted at rest and in transit. The DocumentDB cluster is already encrypted at rest using AWS KMS. To enforce encryption in transit, the security team wants to ensure that all client connections use TLS. The team has enabled the 'tls' parameter in the cluster parameter group. However, a developer reports that they can still connect to the cluster without specifying TLS options using the mongo shell. The developer is connecting from an EC2 instance in the same VPC. The security group for the DocumentDB cluster allows inbound traffic on port 27017 from the EC2 instance's security group. What is the most likely reason the developer can connect without TLS?

A.DocumentDB does not support TLS; it only supports SSL.
B.The EC2 instance is in the same VPC, so TLS is not enforced for intra-VPC traffic.
C.The developer is using an older version of the mongo shell that does not support TLS.
D.The 'tls' parameter was not applied to the cluster because the parameter group was not associated with the cluster or the cluster was not rebooted.
AnswerD

Parameter group changes require a reboot to take effect.

Why this answer

In Amazon DocumentDB, enabling the 'tls' parameter in the cluster parameter group requires the parameter group to be associated with the cluster and the cluster to be rebooted for the change to take effect. If the parameter group was not properly associated or the cluster was not rebooted after modifying the parameter, TLS enforcement would not be active, allowing connections without TLS. Options A, B, and C are incorrect because DocumentDB supports TLS (via SSL), intra-VPC traffic does not bypass TLS, and older mongo shell versions can still use TLS if configured.

Exam trap

Candidates often overlook that parameter group changes in DocumentDB require a cluster reboot to take effect, and that enabling the 'tls' parameter does not immediately force TLS on all connections.

Full explanation →
205
MCQmedium

Refer to the exhibit. A database administrator is reviewing the output of 'SHOW FULL PROCESSLIST' on an Amazon RDS for MySQL DB instance. The company's security policy requires that all database users access only the minimum necessary data. Which user's activity should be investigated further?

A.Both users, because they are both accessing the credit_cards table.
B.The admin user, because the query is selecting all columns from the credit_cards table.
C.The app_user, because the query is selecting card_number which is sensitive.
D.Neither user, because the queries are normal for their roles.
AnswerB

This violates the principle of least privilege; the admin should not be selecting all columns.

Why this answer

The admin user is executing a full scan of the credit_cards table, which is a security concern because it could be accessing unnecessary data. The app_user is querying a specific column with a condition, which is more appropriate. The admin user should have a more restrictive query.

Option B is correct. Option A is wrong because the admin user's query is broad. Option C is wrong because the app_user's query is specific.

Option D is wrong because both queries are selecting data, but the admin's is more concerning.

Full explanation →
206
MCQmedium

A company is migrating an on-premises SQL Server database to Amazon RDS for SQL Server. They need to minimize downtime and have a limited network bandwidth of 50 Mbps. The database size is 1 TB. What is the MOST effective approach?

A.Use AWS DMS with CDC over the network.
B.Use AWS SCT to compress data before transfer.
C.Use AWS Snowball Edge to transfer initial load, then DMS for CDC.
D.Use native SQL Server backup and restore to Amazon S3.
AnswerC

Snowball accelerates initial transfer, CDC handles changes.

Why this answer

The 1 TB database size combined with a 50 Mbps network bandwidth would require over 46 hours for the initial load, making a full network transfer impractical. AWS Snowball Edge allows you to transfer the initial 1 TB seed data offline via a physical appliance, bypassing bandwidth constraints. After the seed is loaded into RDS, AWS DMS with Change Data Capture (CDC) can then replicate ongoing changes over the network, minimizing downtime to only the final cutover window.

Exam trap

The trap here is that candidates assume DMS with CDC alone can handle the full migration, underestimating the time required for the initial load over limited bandwidth, and overlook the offline seeding option provided by Snowball Edge.

How to eliminate wrong answers

Option A is wrong because using AWS DMS with CDC over the network for the full 1 TB initial load at 50 Mbps would take approximately 46+ hours, causing unacceptable downtime and risk of failure due to bandwidth limitations. Option B is wrong because AWS SCT compresses schema and code objects, not the actual data payload; it cannot compress the 1 TB database files for transfer, so it does not solve the bandwidth bottleneck. Option D is wrong because native SQL Server backup and restore to Amazon S3 requires uploading the full 1 TB backup file over the 50 Mbps network, which would take the same prohibitive amount of time as any other network-based approach, and it does not provide a CDC mechanism to minimize downtime.

Full explanation →
207
Multi-Selectmedium

A company is migrating an on-premises PostgreSQL database to Amazon RDS for PostgreSQL. The migration must have minimal downtime. Which TWO AWS services should be used together to achieve this?

Select 2 answers
A.AWS DataSync
B.AWS CloudEndure Migration
C.AWS Database Migration Service (AWS DMS)
D.AWS Direct Connect
E.AWS Schema Conversion Tool (AWS SCT)
AnswersC, E

DMS provides ongoing replication for minimal downtime.

Why this answer

AWS Database Migration Service (DMS) is used for the actual data migration with minimal downtime, supporting ongoing replication via change data capture (CDC) from the on-premises PostgreSQL database to Amazon RDS for PostgreSQL. AWS Schema Conversion Tool (SCT) is required to convert the source database schema and code to match the target RDS for PostgreSQL, identifying and resolving any compatibility issues. Together, SCT pre-processes the schema and DMS performs the data migration with replication, enabling a near-zero downtime migration.

Exam trap

The trap here is that candidates often confuse AWS DataSync or CloudEndure Migration as viable for database migration, but neither supports the logical replication and schema conversion required for minimal-downtime PostgreSQL to RDS migration, while DMS and SCT are the only services that directly address both schema conversion and ongoing data replication.

Full explanation →
208
Multi-Selecthard

A company uses Amazon DynamoDB with DAX and wants to implement fine-grained access control using IAM. Which THREE conditions can be used in an IAM policy to restrict access to specific items based on the primary key?

Select 3 answers
A.dynamodb:Attributes
B.dynamodb:ReturnValues
C.dynamodb:TableName
D.dynamodb:LeadingKeys
E.dynamodb:Select
AnswersA, D, E

Restricts access to specific attributes (columns).

Why this answer

Options A, D, and E are correct. DynamoDB supports fine-grained access control using IAM conditions: dynamodb:LeadingKeys restricts access based on partition key, dynamodb:Attributes controls access to specific attributes, and dynamodb:Select restricts the use of Select parameters. Option B (dynamodb:ReturnValues) is a write operation parameter, not a condition for access control.

Option C (dynamodb:TableName) identifies the table, not specific items.

Full explanation →
209
MCQhard

A company is running a self-managed MongoDB cluster on Amazon EC2. The cluster consists of three replica set members in different Availability Zones. The primary node recently experienced a crash, and the cluster failed over to a secondary. However, the new primary is showing significantly higher latency. The operations team wants to ensure that failover is fast and consistent. What should be done to improve the failover reliability?

A.Use Amazon EBS io2 Block Express volumes with provisioned IOPS.
B.Use Amazon EBS Multi-Attach to allow all replicas to share the same volume.
C.Switch to instance store volumes for better I/O performance.
D.Configure EBS snapshots to be taken every 5 minutes.
AnswerA

Using Amazon EBS io2 Block Express volumes with provisioned IOPS provides high throughput and low latency, which helps the secondary node catch up quickly after a failover, reducing latency and improving reliability.

Why this answer

Amazon EBS io2 Block Express volumes provide high IOPS and low latency, which can significantly reduce the time required for a secondary node to catch up and become the new primary after a failover. This improves failover reliability and reduces latency spikes. Option B is incorrect: EBS Multi-Attach is designed for shared block storage across multiple instances and is not suitable for MongoDB replica sets; using it could lead to data corruption.

Option C is incorrect: while instance store volumes offer high I/O performance, they are ephemeral; if the instance fails, data is lost, making them unreliable for database workloads. Option D is incorrect: EBS snapshots are for backup and disaster recovery, not for improving failover performance.

Full explanation →
210
MCQmedium

A company is migrating an on-premises PostgreSQL database to Amazon RDS for PostgreSQL. The database is 2 TB in size and has a sustained write rate of 50 MB/s. The migration must have minimal downtime. Which migration approach should be used?

A.Create an RDS read replica from the on-premises database
B.Use pg_dump and pg_restore
C.Use AWS DMS with a full-load task only
D.Use AWS DMS with ongoing replication (change data capture)
AnswerD

Ongoing replication allows minimal downtime by continuously synchronizing changes.

Why this answer

AWS DMS with ongoing replication (change data capture) is the correct approach because it allows a full load of the 2 TB database followed by continuous replication of changes from the on-premises PostgreSQL source to the RDS for PostgreSQL target, minimizing downtime to a brief cutover window. The sustained 50 MB/s write rate indicates a high-volume transactional workload that cannot be captured by a single full-load task, making CDC essential for near-zero downtime migration.

Exam trap

The trap here is that candidates often choose pg_dump/pg_restore (Option B) because they are familiar with it for smaller databases, but they fail to account for the downtime required by a 2 TB database with a high write rate, or they mistakenly think AWS DMS full-load (Option C) can handle ongoing writes without CDC.

How to eliminate wrong answers

Option A is wrong because RDS read replicas can only be created from an existing RDS DB instance, not from an on-premises database; they are a feature for scaling read traffic within AWS, not for migrating external databases. Option B is wrong because pg_dump and pg_restore are logical backup and restore tools that require the source database to be quiesced or taken offline during the dump, resulting in significant downtime for a 2 TB database with a 50 MB/s write rate. Option C is wrong because a full-load task only copies the current state of the database at the start of the task and does not capture ongoing changes, so any writes during the migration will be lost, leading to data inconsistency and extended downtime.

Full explanation →
211
MCQhard

A company has a production Amazon Aurora MySQL DB cluster with one writer and two reader instances. The application uses a custom connection pool that uses the writer endpoint for all database calls. The application is experiencing increased latency during peak hours. A database specialist suggests using the reader endpoint for read-only queries. What change is required on the application side to implement this recommendation?

A.Modify the Aurora cluster to enable load balancing for the reader endpoint.
B.Create a new custom endpoint for read-only queries and use it instead of the reader endpoint.
C.Replace the writer endpoint with the reader endpoint in the connection pool configuration.
D.Update the application's connection logic to use the cluster endpoint for writes and the reader endpoint for reads.
AnswerD

The reader endpoint distributes read traffic across all reader instances, reducing writer load.

Why this answer

The application needs to differentiate between read and write queries and send read queries to the reader endpoint while write queries continue to use the writer endpoint. No changes to the Aurora cluster are needed; Aurora automatically handles connectivity to reader instances via the reader endpoint. The cluster endpoint remains unchanged for writes.

Full explanation →
212
Multi-Selecthard

Which THREE factors should be considered when choosing between Amazon DynamoDB and Amazon Aurora for a new application? (Select THREE.)

Select 3 answers
A.Access patterns (key-value vs relational queries)
B.Need for complex joins and transactions
C.Scalability model (horizontal vs vertical)
D.Cost per GB of storage
E.Maximum data size per table
AnswersA, B, C

Determines NoSQL vs SQL choice.

Why this answer

DynamoDB is optimized for key-value and document access patterns with single-digit millisecond latency at any scale, while Aurora is a relational database designed for SQL queries with joins and complex filtering. The choice between them hinges on whether the application requires simple key-based lookups (DynamoDB) or relational queries with multiple access patterns (Aurora).

Exam trap

The trap here is that candidates often confuse cost per GB or table size limits as decisive factors, but the DBS-C01 exam emphasizes access patterns, query complexity, and scalability model as the core architectural considerations.

Full explanation →
213
Multi-Selectmedium

A company is using an Amazon Aurora MySQL DB cluster. The company wants to implement a backup strategy that supports point-in-time recovery (PITR) with a recovery time objective (RTO) of 15 minutes and a recovery point objective (RPO) of 5 minutes. Which TWO actions should the company take?

Select 2 answers
A.Configure automated backups with a retention period of at least 1 day.
B.Create manual snapshots every 5 minutes.
C.Enable cross-Region replication for the cluster.
D.Enable parallel query for the cluster.
E.Enable Aurora Backtrack.
AnswersA, E

Automated backups enable PITR.

Why this answer

Aurora automated backups with a retention period of at least 1 day provide continuous backup and point-in-time recovery (PITR) with an RPO of 5 minutes because transaction logs are uploaded every 5 minutes. This meets the required RPO of 5 minutes, and restoring can achieve an RTO under 15 minutes. Option E is correct because Aurora Backtrack allows rewinding the cluster to a specific point in time, achieving an RPO of 5 minutes and an RTO of minutes (typically under 15).

No other option meets both the stated RTO and RPO.

Exam trap

The trap here is that candidates assume automated backups require a retention period of exactly 5 minutes to achieve a 5-minute RPO, but Aurora's PITR is based on the frequency of transaction log application (every 5 minutes) and the retention period must be at least 1 day; the 5-minute RPO is inherent to the service, not configurable via retention period.

Full explanation →
214
MCQeasy

A company's security policy requires that all database passwords be rotated every 90 days. The company uses AWS Secrets Manager to store database credentials for Amazon RDS. Which feature can be used to automate password rotation?

A.Configure automatic rotation in Secrets Manager with a rotation interval of 90 days.
B.Use an AWS Lambda function triggered by Amazon CloudWatch Events every 90 days to rotate the password.
C.Use IAM Access Analyzer to detect unused passwords and rotate them.
D.Store the password in AWS Systems Manager Parameter Store and use automatic rotation.
AnswerA

Secrets Manager can automatically rotate RDS credentials on a schedule.

Why this answer

Secrets Manager has built-in rotation support for RDS databases. Option B is wrong because Lambda can be used but is not a feature of Secrets Manager itself; the managed rotation is the simplest. Option C is wrong because IAM Access Analyzer is for analyzing resource policies, not password rotation.

Option D is wrong because Systems Manager Parameter Store does not have built-in rotation for RDS.

Full explanation →
215
MCQmedium

A company is using Amazon Aurora MySQL-Compatible Edition. The security team wants to restrict access to the database so that only specific applications running on Amazon EC2 instances can connect. The EC2 instances are in the same VPC as the Aurora cluster. Which combination of steps should be taken to enforce this restriction?

A.Enable IAM database authentication and create database users for each application.
B.Modify the DB subnet group to include only subnets where the EC2 instances reside.
C.Use a network ACL to allow traffic only from the EC2 instances' IP addresses.
D.Configure the Aurora cluster's security group to allow inbound traffic from the EC2 instances' security group.
AnswerD

Security group rules can reference other security groups.

Why this answer

Configuring the Aurora cluster's security group to allow inbound traffic from the EC2 instances' security group is the correct approach because security groups can reference other security groups as a source, enabling dynamic, instance-level access control without managing individual IP addresses. Option A is incorrect because IAM database authentication manages user authentication at the database level, not network access. Option B is incorrect because the DB subnet group defines the subnets where the Aurora cluster can be placed, not traffic filtering rules.

Option C is incorrect because network ACLs are stateless and operate at the subnet boundary, making them less granular and harder to manage for instance-specific access compared to security group references.

Full explanation →
216
Multi-Selecthard

A company is migrating a 500 GB Oracle database to Amazon Aurora PostgreSQL. Which THREE steps should be part of the migration plan?

Select 3 answers
A.Use AWS Snowball to transfer the database files.
B.Set up AWS Direct Connect between on-premises and AWS.
C.Use AWS DMS to perform a full load and ongoing replication from Oracle to Aurora.
D.Use AWS SCT to convert the Oracle schema to PostgreSQL-compatible schema.
E.Validate the migrated data and test the application against the new database.
AnswersC, D, E

DMS supports Oracle as source and Aurora PostgreSQL as target.

Why this answer

AWS DMS supports heterogeneous migrations from Oracle to Aurora PostgreSQL, performing a full load followed by ongoing change data capture (CDC) using Oracle's redo logs to replicate changes with minimal downtime. This makes it the correct service for both the initial data transfer and continuous replication during migration.

Exam trap

The trap here is that candidates confuse network connectivity tools (Direct Connect) or offline transfer methods (Snowball) with actual migration services, overlooking that DMS and SCT are the core services for heterogeneous database migrations, while Direct Connect is an optional optimization, not a required step.

Full explanation →
217
MCQeasy

A company is planning to deploy an Amazon RDS for PostgreSQL instance. Which of the following is a required step to enable automated backups?

A.Set the backup retention period to a value greater than 0.
B.Set a preferred maintenance window.
C.Enable encryption at rest.
D.Configure a Multi-AZ deployment.
AnswerA

Automated backups require a retention period > 0; default is 7 days.

Why this answer

Automated backups in Amazon RDS for PostgreSQL are enabled by setting a backup retention period greater than 0 days. By default, the retention period is 0, which disables automated backups. Once set to a value between 1 and 35 days, RDS automatically takes daily snapshots and retains transaction logs for point-in-time recovery within that window.

Exam trap

The trap here is that candidates often confuse enabling automated backups with configuring a maintenance window or Multi-AZ, but the only required step is setting the backup retention period to a non-zero value.

How to eliminate wrong answers

Option B is wrong because a preferred maintenance window is optional and only controls when system updates occur, not whether backups are enabled. Option C is wrong because encryption at rest is a security feature that protects data on disk but has no effect on backup configuration. Option D is wrong because Multi-AZ deployment provides high availability and automatic failover, but automated backups can be enabled independently of Multi-AZ.

Full explanation →
218
MCQhard

A company is migrating a 500 GB MySQL database to Amazon Aurora MySQL. The migration must have minimal downtime and the source database is already using binary logging. Which migration approach should be used?

A.Take a snapshot of the source database and restore to Aurora
B.Use AWS DMS with full load only
C.Set up binary log replication from the source to an Aurora MySQL cluster
D.Use mysqldump to export the data and import into Aurora
AnswerC

Binary log replication allows minimal downtime by continuously replicating changes.

Why this answer

MySQL native binary log replication can be set up directly from a source MySQL database to an Amazon Aurora MySQL cluster. Since binary logging is already enabled, the Aurora cluster can act as a replica, synchronizing continuously with minimal downtime. This approach allows a full load followed by ongoing replication, meeting the requirement for near-zero downtime migration.

Exam trap

The trap here is that candidates often choose mysqldump or snapshot because they are familiar backup methods, but they fail to recognize that these approaches require the source database to be offline or locked, which contradicts the minimal downtime requirement.

How to eliminate wrong answers

Option A is wrong because taking a snapshot of the source database and restoring to Aurora is a one-time, offline operation that requires the source to be stopped or locked, causing significant downtime. Option B is wrong because AWS DMS with full load only transfers the existing data but does not capture ongoing changes, so any writes during the migration would be lost, requiring an application downtime window. Option D is wrong because mysqldump exports data as SQL statements, which is a slow, single-threaded process that locks tables during export and requires the target to be offline during import, resulting in substantial downtime.

Full explanation →
219
MCQhard

A company uses Amazon RDS for SQL Server with a 4 TB database for a financial reporting application. The database performs nightly batch updates that take 6 hours. The company needs to reduce the batch update time to under 2 hours. The current instance is db.r5.8xlarge with 64 vCPUs and 512 GB memory. The batch process is I/O-bound with high write throughput. Which change will MOST effectively reduce the batch update time?

A.Upgrade to db.r5.16xlarge with 128 vCPUs.
B.Switch to Provisioned IOPS (io2) with 80,000 IOPS.
C.Increase the instance memory to 1024 GB.
D.Enable Multi-AZ deployment.
AnswerB

Eliminates I/O bottleneck with consistent performance.

Why this answer

The batch process is I/O-bound with high write throughput, so the bottleneck is disk I/O, not compute or memory. Switching to Provisioned IOPS (io2) with 80,000 IOPS provides a predictable, high-performance storage tier that can sustain the required write throughput, directly reducing the batch update time from 6 hours to under 2 hours. RDS for SQL Server on io2 volumes delivers consistent low-latency I/O, which is critical for write-heavy workloads.

Exam trap

The trap here is that candidates often assume adding more vCPUs or memory will speed up any slow process, but the question explicitly states the workload is I/O-bound, so the correct solution must address storage performance, not compute or memory.

How to eliminate wrong answers

Option A is wrong because upgrading to db.r5.16xlarge adds more vCPUs, but the process is I/O-bound, not CPU-bound; additional compute resources will not address the I/O bottleneck. Option C is wrong because increasing instance memory to 1024 GB does not improve I/O throughput; memory helps with caching reads, but the batch is write-heavy and I/O-bound, so more memory will not reduce write latency. Option D is wrong because enabling Multi-AZ deployment provides high availability and automatic failover, but does not improve I/O performance; it may even add synchronous replication overhead, potentially increasing write latency.

Full explanation →
220
Matchingmedium

Match each RDS storage type to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

SSD storage with baseline IOPS and burst credits

SSD storage with consistent IOPS for I/O-intensive workloads

Previous generation HDD storage, lowest cost

SSD storage with baseline IOPS and throughput independent of size

Block Express SSD with higher durability and IOPS

Why these pairings

Correct matches: General Purpose SSD balances price and performance; Provisioned IOPS SSD provides high, consistent performance; Magnetic is low-cost for infrequent access. Common confusions include swapping the descriptions of General Purpose and Provisioned IOPS, or associating low cost with Provisioned IOPS.

Full explanation →
221
MCQmedium

A security team is investigating a potential data breach in an Amazon RDS for SQL Server database. They need to determine which user executed a specific DELETE statement at a particular time. What should they do?

A.Enable AWS CloudTrail for the RDS instance.
B.Enable audit logs for the RDS instance and send them to CloudWatch Logs.
C.Enable VPC Flow Logs for the database subnet.
D.Enable AWS Trusted Advisor.
AnswerB

Audit logs record SQL statements and can be analyzed.

Why this answer

Enabling audit logs for the RDS for SQL Server instance captures detailed SQL statement execution, including the users and timestamps. Sending these logs to CloudWatch Logs allows for easy searching and alerting. Option B is correct because it directly addresses the need to identify the user who executed a specific SQL statement.

Option A is incorrect because AWS CloudTrail logs API actions (e.g., creating or modifying RDS instances), not SQL queries. Option C is incorrect because VPC Flow Logs capture network traffic metadata, not database-level activity. Option D is incorrect because AWS Trusted Advisor provides best-practice checks and does not offer fine-grained auditing.

Full explanation →
222
MCQmedium

A gaming company uses Amazon DynamoDB as the primary database for their player sessions. The player sessions table has a partition key of 'player_id' and a sort key of 'session_start_time'. The application frequently queries for recent sessions of a specific player, using the query API with 'player_id' and a filter on 'session_start_time' for the last 24 hours. The average item size is 5 KB. The company notices high latency on these queries during peak hours. The table has 10 Read Capacity Units (RCUs) provisioned. There are no indexes. Which design change would MOST improve query performance?

A.Increase the RCUs to 100.
B.Add a random suffix to the partition key values to distribute writes across partitions.
C.Create a Local Secondary Index (LSI) with the same partition key and a sort key of 'session_start_time', and query the index instead of the table.
D.Create a Global Secondary Index (GSI) with partition key 'event_type' and sort key 'session_start_time' and query the GSI.
AnswerC

LSI allows efficient range queries on the sort key without scanning and filtering.

Why this answer

Creating a Local Secondary Index (LSI) with the same partition key (player_id) and sort key (session_start_time) allows DynamoDB to efficiently retrieve items for a specific player sorted by session_start_time without scanning and filtering. The current query uses a filter on session_start_time after retrieving all sessions for the player, which wastes read capacity and increases latency. Querying the LSI directly uses the sort key to limit the data read to only the last 24 hours, reducing the read footprint and improving performance.

Exam trap

AWS often tests the misconception that simply increasing RCUs (Option A) solves high latency, but the real issue is inefficient data access patterns that waste read capacity, not insufficient throughput.

How to eliminate wrong answers

Option A is wrong because increasing RCUs to 100 only addresses throughput capacity but does not fix the root cause of high latency—the query still reads all sessions for the player and applies a filter, wasting read capacity and causing throttling or excessive consumed capacity. Option B is wrong because adding a random suffix to the partition key would distribute writes across partitions but does not improve query performance for reading recent sessions of a specific player; it would actually make queries harder by requiring knowledge of the suffix. Option D is wrong because creating a GSI with partition key 'event_type' is irrelevant to the query pattern (which filters by player_id), and querying such a GSI would not efficiently retrieve sessions for a specific player, leading to full index scans.

Full explanation →
223
Multi-Selectmedium

A company is designing a document database on Amazon DocumentDB. The workload requires high write throughput and needs to support complex queries on nested attributes. Which THREE design considerations should the company evaluate to meet these requirements?

Select 3 answers
A.Denormalize data to reduce the number of joins.
B.Enable Multi-AZ deployment for high availability.
C.Use sharding to distribute write load across shards.
D.Use change streams to capture and process data changes.
E.Use appropriate indexes on frequently queried fields.
AnswersA, C, E

Denormalization improves query performance for document databases.

Why this answer

Denormalizing data in Amazon DocumentDB reduces the need for joins, which are expensive and can degrade write throughput. By embedding related data into a single document, the database can perform complex queries on nested attributes more efficiently, as DocumentDB is optimized for document-level operations. This design aligns with the workload's requirement for high write throughput and complex query support.

Exam trap

The trap here is that candidates often confuse high availability features (like Multi-AZ) with performance optimization, or mistake change streams as a mechanism to improve write throughput rather than a tool for capturing data changes.

Full explanation →
224
Multi-Selectmedium

A company is designing a database for a global e-commerce platform that requires low-latency reads and writes from multiple AWS regions. The data must be strongly consistent within a region but can be eventually consistent across regions. Which TWO services should the company consider?

Select 2 answers
A.Amazon DynamoDB Global Tables
B.Amazon ElastiCache for Redis Global Datastore
C.Amazon RDS Cross-Region Read Replicas
D.Amazon Redshift
E.Amazon Aurora Global Database
AnswersA, E

Provides multi-region, multi-master replication.

Why this answer

Amazon DynamoDB Global Tables is correct because it provides a fully managed, multi-region, multi-active database solution that delivers low-latency reads and writes to globally distributed applications. It uses DynamoDB Streams to replicate data across regions with eventual consistency, meeting the requirement for strong consistency within a region and eventual consistency across regions.

Exam trap

The key trap is that both Amazon DynamoDB Global Tables and Amazon Aurora Global Database meet the stated requirements, but they do so in different ways. Candidates might incorrectly think that only one of them is suitable, or they might confuse the active-active multi-region writes of DynamoDB Global Tables with the single-primary but globally distributed reads of Aurora Global Database. Another common mistake is selecting Amazon ElastiCache Global Datastore (a cache, not a durable database) or Amazon RDS Cross-Region Read Replicas (which only support read replicas, not writes in multiple regions).

Full explanation →
225
MCQhard

A company runs a MySQL-compatible database on Amazon RDS with a 3 TB dataset. They need to run complex analytical queries that involve joins and aggregations on millions of rows. The current RDS instance is a db.r5.8xlarge with 32 vCPUs and 256 GB RAM, but complex queries take over an hour. Which design change would most improve query performance for this workload?

A.Migrate to Amazon Aurora with parallel query
B.Add an Amazon ElastiCache cluster to cache query results
C.Enable DynamoDB Accelerator (DAX) on the RDS instance
D.Use Amazon Redshift for the analytical workload
AnswerD

Redshift is a columnar data warehouse ideal for complex analytics.

Why this answer

Amazon Redshift is a fully managed, petabyte-scale data warehouse service optimized for complex analytical queries involving joins and aggregations on large datasets. Unlike RDS, which is designed for OLTP workloads, Redshift uses columnar storage, massively parallel processing (MPP), and automatic compression to dramatically reduce query times for analytical workloads. Migrating the analytical workload to Redshift offloads the heavy processing from the RDS instance, allowing it to continue serving transactional queries efficiently.

Exam trap

The trap here is that candidates may assume Amazon Aurora with parallel query is sufficient for analytical workloads, but the DBS-C01 exam tests the understanding that Aurora is still an OLTP engine and that Redshift is the correct service for complex, long-running analytical queries on large datasets.

How to eliminate wrong answers

Option A is wrong because Amazon Aurora with parallel query improves query performance by pushing down filtering and aggregation to the storage layer, but it is still an OLTP-optimized engine and not designed for the complex, multi-table joins and aggregations on millions of rows that require a dedicated analytical data warehouse. Option B is wrong because Amazon ElastiCache caches query results to reduce latency for repeated queries, but it does not accelerate the initial execution of complex analytical queries on a 3 TB dataset; it only helps if the same queries are run frequently. Option C is wrong because DynamoDB Accelerator (DAX) is an in-memory cache for Amazon DynamoDB, a NoSQL database, and cannot be enabled on an RDS instance; it is incompatible with MySQL-compatible databases.

Full explanation →
Page 2

Page 3 of 23

Page 4

All pages

1234567891011121314151617181920212223

Practice DBS-C01 by domain

Target a specific domain to shore up weak areas.

Workload-Specific Database DesignDeployment and MigrationManagement and OperationsMonitoring and TroubleshootingDatabase Security
See all domains with question counts →