AWS Certified Database Specialty DBS-C01 (DBS-C01) — Questions 301–375

Options A and C are correct. Setting 'rds.force_ssl=1' in the parameter group forces the server to accept only SSL connections. Revoking non-SSL privileges (or modifying pg_hba.conf) ensures no non-SSL users can connect.

Option B is unnecessary if the server enforces SSL. Option D is for client-side, not server-side. Option E is for client-side.

Option A is correct because RDS allows modifying storage with minimal downtime, though a brief outage may occur. Option B is incorrect because restoring from snapshot requires downtime. Option C is incorrect because converting storage type is a modification, not a separate process.

Option D is incorrect because DMS is not needed.

Option C is correct because the security group must allow inbound from the specific CIDR, and the DB instance must be publicly accessible. Option A is wrong because subnet assignment is not directly for access control. Option B is wrong because NACLs are stateless and not typically used for RDS access control.

Option D is wrong because the DB parameter group does not control network access.

Option C is correct because RDS Database Activity Streams sends database activity to CloudWatch Logs and Kinesis Data Streams for auditing. Option A is wrong because Enhanced Monitoring provides OS-level metrics, not SQL statements. Option B is wrong because RDS Performance Insights monitors performance, not audit SQL.

Option D is wrong because CloudWatch Logs can store logs but does not capture SQL statements directly; it requires a source like Database Activity Streams.

Options A, B, and D are correct. Option A: AWS DMS can perform ongoing replication with change data capture. Option B: AWS SCT helps convert the schema.

Option D: A replication instance is required for DMS. Option C is wrong because RDS Oracle does not support cross-region automated backups as a migration tool. Option E is wrong because RDS Oracle does not support native Oracle Data Guard for cross-region replication.

Option A is correct because the command retrieves average DatabaseConnections over 5-minute intervals. Option B is incorrect because it is for CPU, not connections. Option C is incorrect because it is for storage.

Option D is incorrect because it is for write latency.

Option D is correct because enabling encryption at rest is done when launching the RDS instance. Option A is wrong because encryption is applied to the instance, not the engine. Option B is wrong because encryption is set at creation time.

Option C is wrong because it's about encryption in transit, not at rest.

Option A is correct because DynamoDB encrypts all tables and GSIs at rest by default. Option B is wrong because encryption is always on. Option C is wrong because encryption cannot be disabled.

Option D is wrong because GSIs are automatically encrypted with the table.

Option C is correct because a GSI with game_id as partition key and score as sort key allows efficient top-N queries using ScanIndexForward=false. Option A (GSI with player_id) doesn't sort by score. Option B (LSI) cannot use a different partition key.

Option D (no index) would require full table scan.

Option B is correct because Multi-AZ deployment provides synchronous standby in another AZ. Option A is wrong because it's single-AZ. Option C is wrong because read replicas are for read scaling, not failover.

Option D is wrong because it's a different service.

Option A is correct because evictions occur when memory is full and the cache evicts keys based on the eviction policy. This would cause session loss. Option B is wrong because replication lag would cause stale data, not loss.

Option C is wrong because snapshotting may cause latency but not evictions. Option D is wrong because encryption in transit does not affect memory.

Option B is correct because the output shows the DBInstanceStatus is 'available' and MultiAZ is false. Option A is wrong because MultiAZ is false. Option C is wrong because MultiAZ false means it is not configured for Multi-AZ.

Option D is wrong because the status is 'available', not 'stopped'.

Option C is correct because global tables rely on DynamoDB Streams to replicate changes. If streams are disabled, replication stops. Option A is incorrect because DynamoDB does not have a replication delay setting.

Option B is incorrect because IAM permissions would cause errors, not silent failure. Option D is incorrect because point-in-time recovery does not affect replication.

Option A (DMS with CDC) and Option C (Enable binlog on source for CDC) are correct. Option B (mysqldump) causes downtime. Option D (Snowball) is for offline transfer.

Option E (SCT) is for schema conversion.

Option B is correct because the high CPU and low memory indicate the instance is overworked. Scaling up to a larger instance provides more CPU and memory resources. Option A is incorrect because adding a reader instance helps with read scaling but does not reduce CPU/memory pressure on the primary writer.

Option C is incorrect because creating an index may improve query performance but the team already ruled out query optimization. Option D is incorrect because increasing storage does not directly affect CPU or memory.

Option C is correct because GRANT SELECT ON db_name.* TO user grants SELECT on all tables in the database. Option A is wrong because REVOKE removes privileges. Option B is wrong because CREATE USER creates a user but does not grant privileges.

Option D is wrong because ALTER USER modifies user attributes.

Options A, B, and D are correct. Auto-scaling cannot handle sudden bursts (A), hot partitions (B), or exceeded max capacity (D). Option C is wrong because eventual consistency doesn't cause throttling.

Option E is wrong because GSI consumes write capacity from the table.

Option B is correct because RDS for PostgreSQL supports many extensions but not all; PostGIS is supported but may require enabling. Option A is wrong because extensions are supported. Option C is wrong because extensions are allowed.

Option D is wrong because the question is about extensions not available.

Option B is correct because IAM database authentication requires that the database user be created with the IAM authentication method (using the CREATEROLE option and granting rds_iam role). Without creating a user that is mapped to the IAM role, authentication fails. Option A is wrong because the IAM role is already created.

Option C is wrong because IAM authentication does not require a password; it uses authentication tokens. Option D is wrong because the port does not need to be changed.

AWS SCT converts the schema, AWS DMS migrates the data with continuous sync. Option B: DMS only does not convert schema. Option C: SCT only does not migrate data.

Option D: Data Migration Assistant is for SQL Server to SQL Server.

Option C is correct because SCT may not always generate optimal indexes for Aurora PostgreSQL, leading to performance issues. Option A is wrong because Aurora PostgreSQL supports partitioning. Option B is wrong because DMS does not affect query execution plans.

Option D is wrong because storage performance should not cause query slowness.

Option A is correct because increasing the maximum read capacity prevents throttling. Option B is correct because enabling DynamoDB Accelerator (DAX) reduces read load. Option E is correct because implementing exponential backoff helps handle throttling gracefully.

Option C is wrong because decreasing target utilization would cause auto scaling to scale out earlier, but it would not prevent throttling during spikes because auto scaling reacts after the spike. Option D is wrong because write capacity is not the issue.

Option A and Option C are correct. ReadIOPS and WriteIOPS measure the input/output operations per second, which can indicate storage performance issues. Option B (DatabaseConnections) is about connections, not storage performance.

Option D (CPUUtilization) is about CPU usage. Option E (NetworkReceiveThroughput) is about network throughput.

Options A and C are correct. CloudWatch metrics provide health indicators (throttling, latency). DynamoDB Streams can be used to track changes but not health directly.

Options B and D are incorrect: B is for data plane, D is for monitoring, but not health.

Option B is correct because DynamoDB Accelerator (DAX) caches reads, reducing read capacity consumption. Option A is wrong because increasing read capacity costs more. Option C is wrong because auto-scaling still incurs cost.

Option D is wrong because changing to On-Demand may be more expensive for predictable workloads.

Option B is correct because 'secretsmanager:GetSecretValue' retrieves the secret. Option A is wrong because 'kms:Decrypt' may be needed if the secret is encrypted with a KMS key, but the primary action is GetSecretValue. Option C is wrong because 'secretsmanager:ListSecrets' only lists secrets, not retrieve values.

Option D is wrong because 'secretsmanager:PutSecretValue' is for updating secrets.

Amazon Aurora MySQL-Compatible Edition supports JSON data type and ACID transactions. Option B (DynamoDB) is NoSQL but does not support complex nested queries natively. Option C (DocumentDB) is MongoDB-compatible but not ACID.

Option D (Neptune) is graph database.

To audit SQL queries in RDS PostgreSQL, you can enable the pgaudit extension (Option A) and set the appropriate parameters (Option B). Database Activity Streams (Option C) send events to CloudWatch and Kinesis, but they capture a subset of activities and require additional configuration; they are not the primary method for SQL auditing. Option D is about logging connections, not queries.

Option E is for MySQL, not PostgreSQL.

Option B is correct. Amazon RDS for PostgreSQL integrates with AWS CloudTrail for API calls, but for SQL-level auditing, you must use the database's native audit logging (e.g., pgaudit extension) and log files to CloudWatch Logs. Option A is for VPC flow logs.

Option C is for database activity streams, but that's for Aurora, not RDS PostgreSQL. Option D is for monitoring performance.

Aurora cloning creates a logical copy of the cluster volume that is space-efficient and fast, using copy-on-write semantics. Creating a new instance from a snapshot incurs storage costs and takes longer. Read replicas are for read scaling, not cloning.

Using a different DB instance class does not reduce storage.

Option D is correct because high WriteLatency and growing oplog suggest that the secondary instance is too slow to apply operations, causing replication lag. Checking the secondary's metrics helps diagnose. Option A is wrong because enabling Multi-AZ does not directly address write latency.

Option B is wrong because increasing the instance class may help but should be done after diagnosis. Option C is wrong because increasing storage does not improve write performance.

Option A is correct because Amazon CloudWatch can monitor RDS metrics such as 'FreeStorageSpace' and trigger an alarm that sends a notification via Amazon SNS. Option B is incorrect because AWS CloudTrail is for auditing API calls. Option C is incorrect because AWS Config tracks resource configuration changes.

Option D is incorrect because Amazon Inspector is for security assessments.

The only way to encrypt an existing unencrypted RDS instance is to take a snapshot, copy it with encryption, and restore. Options D and E are correct. Option A is wrong because you cannot modify an unencrypted instance to add encryption.

Option B is wrong because enabling encryption at launch only applies to new instances. Option C is wrong because SSL does not encrypt at rest.

RDS supports modifying storage online with minimal downtime. Increasing allocated storage from 500 GB to, for example, 600 GB can be done via a modification to the DB instance. The instance remains available during the modification, though a brief performance impact may occur.

Stopping the instance is unnecessary. Creating a snapshot and restoring would cause longer downtime. Waiting for autoscaling might not be quick enough if space is critically low.

Option D is correct because DynamoDB Auto Scaling can handle the spikes by scaling up and down, reducing costs. Option A is wrong because doubling WCU would be costly and unnecessary. Option B is wrong because DynamoDB Accelerator (DAX) is for read performance, not writes.

Option C is wrong because SQS would add latency and complexity.

Option A is correct because low free space can cause performance degradation on gp2; increasing storage increases baseline IOPS. Option B is correct because high 'DiskQueueDepth' indicates I/O bottleneck; switching to Provisioned IOPS provides consistent I/O. Option C is correct because enabling Multi-AZ does not improve I/O performance, it adds overhead.

Option D is wrong because Performance Insights is a monitoring tool, not a fix. Option E is correct because deleting old data frees up space and can improve performance. So correct: A, B, E.

Option D is correct because DynamoDB Standard-IA is cheaper for data that is accessed less frequently. Option A is wrong because DAX adds cost. Option B is wrong because increasing read capacity increases cost.

Option C is wrong because adding a GSI adds cost.

Option A is correct because with on-demand capacity, DynamoDB can handle sudden traffic spikes without throttling. Increasing read capacity is not applicable because on-demand mode automatically adjusts. Optimistic locking is already used implicitly with condition expressions.

Adding a global secondary index does not directly reduce UpdateItem latency.

Option A increases IOPS by scaling up to an io1 volume, which directly addresses the queue depth issue and improves latency. Option B is incorrect because increasing instance size may not resolve IOPS bottleneck. Option C is incorrect because Multi-AZ does not improve read performance for a single instance.

Option D is incorrect because increasing storage alone does not guarantee more IOPS for gp2.

Amazon Redshift supports encryption at rest using a KMS key. You can enable automatic key rotation on a customer-managed KMS key. Option A is wrong because Redshift does not use S3-managed keys for encryption.

Option B is wrong because HSM is not required for encryption at rest in Redshift. Option D is wrong because CloudHSM is an alternative but requires manual rotation.

Option A (DynamoDB Streams + Lambda) enables real-time updates. Option D (DAX) provides low-latency read caching for the leaderboard. Option B (GSI) could help but not for real-time top-N.

Option C (ElastiCache) is an alternative but not DynamoDB-native. Option E (Sort key on score) is a good design but not a separate pattern; it's part of table design.

The gp2 volume's baseline IOPS are determined by the volume size at a ratio of 3 IOPS per GB, up to 16,000 IOPS. With a 100 GB gp2 volume, the baseline IOPS is only 300 (100 × 3). This is insufficient for write-heavy workloads, causing write latency as the volume exhausts its IOPS credit balance and enters a throttled state.

Burst credits can temporarily boost performance, but sustained high write throughput will deplete credits and lead to latency.

Option B is correct because AWS Schema Conversion Tool (SCT) is designed to convert database schemas from commercial engines like Oracle to open-source engines like PostgreSQL. Option A is wrong because DMS handles data migration but not schema conversion. Option C is wrong because S3 is storage, not conversion.

Option D is wrong because Lambda is for serverless compute, not schema conversion.

Option C is correct because creating a DMS replication task requires permissions to create the DMS endpoint resources, which are not included in the policy. Option A is wrong because S3 permissions are not needed for a basic task. Option B is wrong because EC2 permissions are not required.

Option D is wrong because CloudWatch Logs permissions are not required at creation time.

Option A is correct because creating a snapshot and copying with encryption is the standard method. Option B is incorrect because you cannot enable encryption on existing instance. Option C is incorrect because it is not supported.

Option D is incorrect because restoring snapshot to encrypted instance works but the process is snapshot copy.

Option D is correct because DynamoDB with a partition key of device ID and sort key of timestamp allows high write throughput and efficient time-range queries. Option A is wrong because RDS with auto-scaling cannot handle millions of events per second. Option B is wrong because Redshift is optimized for analytics but not for high-velocity writes.

Option C is wrong because ElastiCache is in-memory and too expensive for historical storage.

Aurora Replicas offload read traffic, and Auto Scaling adjusts the number of replicas based on load. Option C (Multi-AZ) is for failover, not read scaling. Option D (EBS optimization) is not applicable to Aurora (uses cluster volume).

Option E (DynamoDB) is a different service.

AWS SCT helps convert database schema and code objects like stored procedures from one engine to another (including SQL Server to RDS for SQL Server for compatibility checks). DMS handles data migration, not schema conversion. CloudEndure is for server migration.

Snowball is for offline data transfer.

Option B is correct. Adding Aurora Replicas to distribute read traffic improves read performance and reduces load on the primary. Option A is wrong because DAX is for DynamoDB, not Aurora.

Option C is wrong because increasing cache size may not help if cache misses are not the issue. Option D is wrong because read replicas in ElastiCache are already used; the issue is the database.

Option A is correct because Aurora's fast failover requires the JDBC driver to use the cluster endpoint with the Aurora hostlist provider. Option B is wrong because increasing instance size does not reduce failover time. Option C is wrong because Multi-AZ is already inherent in Aurora.

Option D is wrong because increasing backup retention does not affect failover.

Option A is correct because high CPUUtilization indicates the cache nodes are overloaded. Option B is wrong because CacheHits are a measure of effectiveness, not provisioning. Option C is wrong because Evictions occur when memory is full but CPU is more direct for throughput.

Option D is wrong because ReplicationLag indicates replication issues, not capacity.

Option A is correct because high 'Threads_running' often indicates queries waiting on locks or I/O. Option B is wrong because 'Connections' shows total connections, not concurrent active queries. Option C is wrong because 'Queries' shows total queries over time, not concurrency.

Option D is wrong because 'Slow_queries' shows only long-running queries.

Option D is correct. To create a snapshot of an encrypted RDS instance, the IAM role needs permission to the KMS key for the kms:CreateGrant action. The policy allows kms:Decrypt and kms:GenerateDataKey but not kms:CreateGrant, which is required for RDS to use the KMS key on behalf of the user when creating a snapshot.

Options A, B, and C are not required for snapshot creation.

Option C is correct because promoting a read replica makes it a standalone instance; it can be done without downtime. Option A is wrong because modifying MultiAZ requires a reboot, causing downtime. Option B is wrong because creating a snapshot and restoring is not a promotion.

Option D is wrong because modifying the DB instance class requires a reboot.

Option C is correct because creating a read replica offloads read traffic from the primary instance, reducing read latency without changing the instance class. Option A is wrong because enabling Multi-AZ is for high availability, not read performance. Option B is wrong because upgrading to a larger instance class is more expensive than adding a read replica.

Option D is wrong because converting to Aurora is a significant migration effort and may not be cost-effective for this issue.

Option D is correct because a KMS key policy can grant the kms:Decrypt permission to a specific IAM role. Option A does not restrict decryption. Option B is for S3 bucket policy, not KMS.

Option C is for S3, not KMS.