Courseiva

AWS Certified Database Specialty DBS-C01 (DBS-C01) — Questions 301–375

1663 questions total · 23pages · All types, answers revealed

Take a mock examExam hub
Page 4

Page 5 of 23

Page 6
301
MCQeasy

A database administrator runs the above AWS CLI command. What is the purpose of the command?

A.Retrieve average free storage space for mydb.
B.Retrieve average number of database connections for mydb.
C.Retrieve average CPU utilization for mydb.
D.Retrieve average write latency for mydb.
AnswerB

The metric is DatabaseConnections.

Why this answer

The AWS CLI command `aws cloudwatch get-metric-statistics` with the namespace `AWS/RDS`, metric name `DatabaseConnections`, and statistic `Average` retrieves the average number of database connections for the specified DB instance `mydb` over the given time period. The `--metric-name DatabaseConnections` parameter explicitly targets the connection count metric, making option B correct.

Exam trap

The trap here is that candidates may confuse the metric name `DatabaseConnections` with other common RDS metrics like `FreeStorageSpace` or `CPUUtilization`, or assume the command retrieves performance metrics without carefully reading the `--metric-name` parameter.

How to eliminate wrong answers

Option A is wrong because the metric for free storage space is `FreeStorageSpace`, not `DatabaseConnections`. Option C is wrong because CPU utilization is tracked under the metric name `CPUUtilization`, not `DatabaseConnections`. Option D is wrong because write latency is measured by the metric `WriteLatency`, not `DatabaseConnections`.

Full explanation →
302
MCQmedium

A company is deploying a MySQL database on Amazon RDS and needs to enforce encryption at rest. Which configuration step is required?

A.Use a custom DB parameter group with SSL enabled.
B.Modify the DB instance to enable encryption after creation.
C.Enable SSL/TLS on the RDS instance.
D.Select encryption option when creating the RDS instance.
AnswerD

Encryption at rest is enabled at launch.

Why this answer

Amazon RDS for MySQL requires encryption at rest to be enabled at instance creation time by selecting the encryption option in the AWS Management Console, CLI, or API. Encryption at rest uses AWS Key Management Service (KMS) to encrypt the underlying storage, automated backups, read replicas, and snapshots. This setting cannot be applied to an existing unencrypted DB instance, so it must be chosen during the initial launch.

Exam trap

The trap here is that candidates confuse encryption at rest with encryption in transit (SSL/TLS), leading them to select options that enable SSL rather than the required storage-level encryption.

How to eliminate wrong answers

Option A is wrong because a custom DB parameter group with SSL enabled controls in-transit encryption (SSL/TLS connections), not encryption at rest. Option B is wrong because Amazon RDS does not support enabling encryption at rest on an existing unencrypted DB instance; you must migrate data to a new encrypted instance. Option C is wrong because enabling SSL/TLS on the RDS instance enforces encryption in transit between clients and the database, not encryption of data at rest on the storage volume.

Full explanation →
303
MCQeasy

A company has an Amazon DynamoDB table with a global secondary index (GSI). The security team wants to ensure that the table and the GSI are encrypted at rest. How can this be achieved?

A.Nothing; DynamoDB encrypts all data at rest by default.
B.Create the table with encryption disabled to avoid performance impact.
C.Enable encryption at rest on the table and the GSI separately.
D.Enable encryption on the GSI using a KMS key.
AnswerA

DynamoDB tables and GSIs are encrypted at rest by default.

Why this answer

DynamoDB encrypts all tables and GSIs at rest by default. Option B is wrong because encryption is always on. Option C is wrong because encryption cannot be disabled.

Option D is wrong because GSIs are automatically encrypted with the table.

Full explanation →
304
MCQmedium

A company uses Amazon DynamoDB for a high-traffic leaderboard application that updates scores in real-time. The table has partition key 'game_id' and sort key 'player_id'. Queries retrieve top 10 players by score for each game. Which secondary index design is most efficient?

A.Create a global secondary index (GSI) with partition key 'game_id' and sort key 'score'
B.Create a global secondary index (GSI) with partition key 'game_id' and sort key 'player_id'
C.Create a local secondary index (LSI) with sort key 'score'
D.Do not create any index; use the base table with a scan
AnswerA

Correct because a GSI with partition key 'game_id' and sort key 'score' enables efficient query per game, ordering by score descending to retrieve top players.

Why this answer

A global secondary index (GSI) with partition key 'game_id' and sort key 'score' allows efficient retrieval of the top 10 players per game by querying a single partition (game_id) and using the sort key to order by score descending. This avoids the 1 MB read limit per partition and provides the necessary ordering without scanning the entire table.

Exam trap

The trap here is that candidates often confuse LSIs with GSIs, thinking an LSI can provide a different sort key for global queries, but LSIs are limited to the same partition key as the base table and cannot be used to query across all games.

How to eliminate wrong answers

Option B is wrong because using 'player_id' as the sort key does not enable ordering by score; it orders by player ID, which does not support the top-N query requirement. Option C is wrong because a local secondary index (LSI) shares the same partition key as the base table but cannot be created after table creation, and it still requires a query on a single partition; however, the primary issue is that an LSI cannot provide a different sort key for global ordering across all games. Option D is wrong because a full table scan is highly inefficient for a high-traffic leaderboard application, as it reads every item and consumes excessive read capacity units, leading to poor performance and high cost.

Full explanation →
305
MCQmedium

A company is deploying a new application with a PostgreSQL database on Amazon RDS. The database must be highly available across two Availability Zones. Which deployment option meets this requirement?

A.RDS with a read replica in another AZ.
B.Multi-AZ RDS instance.
C.Single-AZ RDS instance.
D.Amazon Aurora Global Database.
AnswerB

Provides automatic failover to a standby in another AZ.

Why this answer

A Multi-AZ RDS instance automatically provisions and maintains a synchronous standby replica in a different Availability Zone, providing automatic failover for high availability. This ensures the database remains accessible even if the primary AZ fails, meeting the requirement for cross-AZ high availability.

Exam trap

The trap here is that candidates often confuse read replicas with Multi-AZ deployments, assuming a read replica in another AZ provides high availability, but it lacks automatic failover and synchronous replication required for true HA.

How to eliminate wrong answers

Option A is wrong because a read replica is designed for read scaling, not high availability; it requires manual promotion to become the primary and does not provide automatic failover. Option C is wrong because a Single-AZ RDS instance runs in only one Availability Zone, offering no redundancy or automatic failover if that AZ fails. Option D is wrong because Amazon Aurora Global Database is designed for global disaster recovery across multiple AWS regions, not for high availability within a single region across two AZs; it adds complexity and cost beyond the stated requirement.

Full explanation →
306
MCQmedium

A company is designing a multi-tenant SaaS application on Amazon RDS for PostgreSQL. Each tenant's data must be isolated for security and performance. The application has millions of tenants, with most tenants having small datasets (under 100 MB). Which database design pattern is MOST cost-effective and operationally efficient?

A.Use Amazon DynamoDB with a separate table per tenant.
B.Use a single RDS instance with a shared schema and implement Row-Level Security (RLS) policies based on tenant_id.
C.Use a single RDS instance with a separate schema per tenant.
D.Use a separate Amazon RDS for PostgreSQL instance per tenant.
AnswerB

RLS provides tenant isolation with minimal overhead, suitable for many small tenants.

Why this answer

Using a single RDS for PostgreSQL instance with Row-Level Security (RLS) allows you to isolate tenant data at the row level based on a tenant_id column, without the overhead of managing millions of separate schemas or tables. This design is both cost-effective (single instance, no per-tenant provisioning) and operationally efficient (simple schema management, no connection pooling issues), while still meeting security and performance isolation requirements for small datasets under 100 MB.

Exam trap

The trap here is that candidates often assume separate schemas per tenant (Option C) are the best balance of isolation and cost, but they overlook PostgreSQL's practical limits on the number of schemas and the severe performance degradation from catalog bloat when dealing with millions of tenants.

How to eliminate wrong answers

Option A is wrong because Amazon DynamoDB with a separate table per tenant would require creating millions of tables, which exceeds the default DynamoDB table limit (256 per account) and introduces significant operational overhead for table management, throughput provisioning, and cross-tenant queries. Option C is wrong because using a separate schema per tenant on a single RDS instance would require creating millions of schemas, which is not supported by PostgreSQL (the system catalog pg_namespace would become bloated, and performance would degrade due to excessive catalog lookups). Option D is wrong because using a separate RDS for PostgreSQL instance per tenant would be prohibitively expensive and operationally unmanageable for millions of tenants, as each instance incurs minimum billing costs and requires individual maintenance, backups, and monitoring.

Full explanation →
307
MCQhard

An application uses Amazon ElastiCache for Redis as a session store. Users report that sessions are being lost intermittently. The ElastiCache cluster has replication enabled with one replica. CloudWatch metrics show 'Evictions' spiking during peak hours. What is the MOST likely cause?

A.Replication lag between primary and replica is causing read failures
B.Encryption in transit is enabled and causes decryption errors
C.The cache's memory is full and the eviction policy is removing keys
D.The cluster is performing automatic snapshots that block writes
AnswerC

Eviction spikes indicate that the cache is out of memory and is removing keys to make space, causing session loss.

Why this answer

A spike in 'Evictions' CloudWatch metric indicates that the cache's memory is full, and ElastiCache is evicting keys based on the configured eviction policy (e.g., allkeys-lru). This removal of keys directly causes session data to be lost. Option A is incorrect: replication lag can cause stale reads but not evictions or loss of keys.

Option B is incorrect: encryption in transit does not affect memory usage or evictions. Option D is incorrect: automatic snapshots may cause a brief latency spike but do not result in evictions.

Full explanation →
308
MCQeasy

Refer to the exhibit. A database administrator runs the AWS CLI command shown. The output is: ["available", false]. What does this output indicate about the DB instance?

A.The DB instance is in the process of being modified to enable Multi-AZ.
B.The DB instance is in a Multi-AZ deployment and is available.
C.The DB instance is stopped and is not in a Multi-AZ configuration.
D.The DB instance is available and is not configured for Multi-AZ.
AnswerD

The status is 'available' and MultiAZ is false.

Why this answer

The output shows the DBInstanceStatus is 'available' and MultiAZ is false. Option A is incorrect because MultiAZ false indicates it is not in the process of being modified to enable Multi-AZ. Option B is incorrect because MultiAZ is false, meaning it is not in a Multi-AZ deployment.

Option C is incorrect because the status is 'available', not 'stopped'.

Full explanation →
309
MCQeasy

A company is using Amazon DynamoDB with global tables. The application writes to a table in the us-east-1 region. The database administrator notices that updates made in us-east-1 are not appearing in the replica table in eu-west-1. What is the most likely cause?

A.DynamoDB Streams are not enabled on the table.
B.The replication delay is set too high.
C.Point-in-time recovery is not enabled on the replica table.
D.The IAM role for replication does not have sufficient permissions.
AnswerA

Global tables require DynamoDB Streams to be enabled for replication to work.

Why this answer

DynamoDB global tables rely on DynamoDB Streams to replicate changes. If streams are not enabled, updates will not be replicated to other regions. Option B is incorrect because DynamoDB does not have a configurable replication delay; replication is near real-time.

Option C is incorrect because point-in-time recovery is a backup feature and does not affect replication. Option D is incorrect because insufficient IAM permissions would typically cause error messages or failures, not a silent lack of replication.

Full explanation →
310
Multi-Selecteasy

A company is migrating a 2 TB MySQL database to Amazon Aurora MySQL. They want to minimize downtime and ensure data consistency. Which TWO methods should they use? (Choose two.)

Select 2 answers
A.Use AWS DMS with ongoing replication
B.Use AWS Schema Conversion Tool to convert the schema
C.Use AWS Snowball Edge to transfer backup files
D.Enable binary logging on the source database for change data capture
E.Use mysqldump to export data
AnswersA, D

Minimizes downtime with CDC.

Why this answer

AWS DMS with ongoing replication (Option A) is correct because it allows continuous change data capture (CDC) from the source MySQL database to the target Aurora MySQL cluster, minimizing downtime by keeping the target synchronized during the migration. This approach ensures data consistency by applying incremental changes after the initial full load, enabling a controlled cutover with minimal service interruption.

Exam trap

The trap here is that candidates often think mysqldump or Snowball are viable for minimizing downtime, but they fail to recognize that these methods require taking the source offline or introduce significant latency, whereas DMS with binary logging enables near-zero downtime through continuous replication.

Full explanation →
311
MCQeasy

A company uses Amazon DocumentDB (with MongoDB compatibility) for its content management system. The application runs on EC2 instances and connects to a DocumentDB cluster with one instance (db.r5.large). Recently, users reported that retrieving documents takes longer than usual. CloudWatch metrics show that the CPU utilization of the DocumentDB instance is at 90% and the freeable memory is below 100 MB. The team has verified that no query optimization is possible. Which action should the team take FIRST to improve performance?

A.Add a read replica instance to offload read traffic.
B.Create additional indexes on frequently queried fields.
C.Increase the storage volume size to improve I/O performance.
D.Scale up the instance to db.r5.xlarge.
AnswerD

Scaling up to a larger instance (db.r5.xlarge) provides more CPU and memory resources, directly addressing the high CPU and low memory issues.

Why this answer

High CPU utilization (90%) and low freeable memory (<100 MB) indicate that the current instance size (db.r5.large) is insufficient for the workload. Scaling up to db.r5.xlarge provides additional CPU and memory resources, directly addressing the performance bottleneck. Option A (adding a read replica) offloads read traffic but does not reduce CPU/memory pressure on the primary writer.

Option B (creating additional indexes) could improve query performance, but the team has verified that no query optimization is possible. Option C (increasing storage volume) improves I/O performance but does not directly affect CPU or memory usage.

Full explanation →
312
MCQmedium

A company is using Amazon Aurora MySQL-Compatible Edition. The database administrator wants to restrict a specific user to only execute SELECT statements on a specific database. Which SQL command should the administrator use?

A.ALTER USER 'user'@'%' WITH GRANT OPTION;
B.CREATE USER 'user'@'%' IDENTIFIED BY 'password';
C.REVOKE ALL PRIVILEGES ON db_name.* FROM 'user'@'%';
D.GRANT SELECT ON db_name.* TO 'user'@'%';
AnswerD

Grants SELECT on all tables in the database.

Why this answer

The GRANT SELECT ON db_name.* TO 'user'@'%' command grants SELECT privilege on all tables within the specified database to the user. Option A is incorrect because ALTER USER with GRANT OPTION is used to change user attributes or grant the ability to grant privileges, not to directly grant SELECT. Option B is incorrect because CREATE USER only creates a new user without assigning any privileges.

Option C is incorrect because REVOKE ALL PRIVILEGES removes all privileges from the user, which is opposite of the desired action.

Full explanation →
313
Multi-Selecthard

An Amazon DynamoDB table is experiencing throttled write requests. The table uses provisioned capacity with auto-scaling enabled. Which THREE factors could contribute to throttling despite auto-scaling?

Select 3 answers
A.Global secondary index is defined with same partition key
B.Auto-scaling maximum capacity is set too low
C.Sudden traffic spike that exceeds the max capacity
D.Use of eventually consistent reads
E.Uneven key distribution causing hot partitions
AnswersB, C, E

If max is reached, throttling occurs.

Why this answer

Auto-scaling can prevent throttling only if the maximum capacity is set appropriately and traffic patterns are predictable. Option B is correct because if the auto-scaling maximum capacity is set too low, the table cannot scale enough to handle the write demand. Option C is correct because auto-scaling reacts to sustained traffic but cannot instantly accommodate a sudden traffic spike that exceeds the maximum capacity.

Option E is correct because even with auto-scaling, an uneven partition key distribution can cause a single partition to exceed its throughput capacity, leading to throttling. Option A is incorrect; a global secondary index with the same partition key does not inherently cause throttling on the base table. Option D is incorrect because eventually consistent reads affect read capacity, not write capacity, and do not cause write throttling.

Full explanation →
314
MCQeasy

A company needs a fully managed graph database for a social networking application that requires real-time recommendations based on friend connections. Which AWS service should they use?

A.Amazon Neptune
B.Amazon DocumentDB
C.Amazon ElastiCache
D.Amazon DynamoDB
AnswerA

Neptune is a managed graph database suitable for social networking.

Why this answer

Amazon Neptune is the correct choice because it is a fully managed graph database service optimized for storing and querying highly connected data. It supports both property graph (Apache TinkerPop Gremlin) and RDF (SPARQL) models, making it ideal for social networking applications that require real-time friend-of-friend recommendations and traversal queries across complex relationships.

Exam trap

The trap here is that candidates often confuse Amazon DocumentDB or DynamoDB as suitable for graph workloads because they can store JSON with references, but they lack native graph traversal engines and query languages (Gremlin/SPARQL) required for efficient relationship queries.

How to eliminate wrong answers

Option B (Amazon DocumentDB) is wrong because it is a document database (MongoDB-compatible) designed for JSON document storage and indexing, not for graph traversal or relationship-heavy queries like friend connections. Option C (Amazon ElastiCache) is wrong because it is an in-memory caching service (Redis/Memcached) that does not natively support graph data models or traversal algorithms; it can accelerate queries but cannot replace a graph database. Option D (Amazon DynamoDB) is wrong because it is a key-value and document NoSQL database optimized for single-item access patterns and simple queries, lacking native graph traversal capabilities such as shortest-path or multi-hop relationship queries.

Full explanation →
315
MCQhard

A company is migrating a self-managed PostgreSQL database with extensions (PostGIS, pg_stat_statements) to Amazon RDS for PostgreSQL. After migration, they find that the extensions are not available. What is the most likely cause?

A.The required extensions are not included in the default parameter group and must be manually added to shared_preload_libraries.
B.The extensions are incompatible with the RDS engine version.
C.The RDS instance is not configured to allow extensions.
D.RDS does not support any PostgreSQL extensions.
AnswerA

Extensions need to be enabled via parameter group.

Why this answer

Amazon RDS for PostgreSQL does not automatically load extensions that require shared library preloading, such as pg_stat_statements. These extensions must be explicitly added to the `shared_preload_libraries` parameter in the DB parameter group. PostGIS, while not requiring preloading, must be created via `CREATE EXTENSION` after the extension files are present; however, the most likely cause of extensions not being available is that the custom parameter group was not configured to include the required libraries in `shared_preload_libraries`.

Exam trap

The trap here is that candidates assume extensions are automatically available after migration, overlooking that certain extensions require explicit parameter group configuration and a reboot to load the shared library.

How to eliminate wrong answers

Option B is wrong because both PostGIS and pg_stat_statements are fully supported by Amazon RDS for PostgreSQL on compatible engine versions; incompatibility is not the typical cause. Option C is wrong because RDS does not have a blanket 'allow extensions' toggle; extensions are controlled via parameter groups and permissions, not a single instance-level setting. Option D is wrong because RDS for PostgreSQL supports many extensions, including PostGIS and pg_stat_statements, as documented in the AWS RDS user guide.

Full explanation →
316
Multi-Selecteasy

A company is designing a disaster recovery strategy for an Amazon RDS for PostgreSQL database. The database is 2 TB in size. The company wants to recover to a different AWS Region with minimal data loss. Which TWO options meet these requirements?

Select 2 answers
A.Create a read replica in the other Region.
B.Use AWS Database Migration Service (DMS) with ongoing replication to a target in the other Region.
C.Take a manual snapshot and copy it to the other Region. Restore from the snapshot.
D.Enable automatic backups and copy automated snapshots to the other Region.
E.Use AWS Backup to schedule cross-Region backups.
AnswersA, B

Correct. A cross-Region read replica uses streaming replication to maintain near-synchronous data in the other Region, providing an RPO of seconds to minutes.

Why this answer

Both A and B are valid options for achieving minimal data loss when recovering to a different AWS Region. Option A uses Amazon RDS native cross-Region read replicas with PostgreSQL streaming replication, providing near real-time synchronization. Option B uses AWS Database Migration Service (DMS) with ongoing replication (change data capture) to replicate changes continuously, achieving a low RPO.

Options C, D, and E involve snapshot-based solutions that are not continuous and therefore do not meet the minimal data loss requirement.

Exam trap

Candidates often assume that copying automated backups cross-Region includes transaction logs, enabling point-in-time recovery. However, RDS automated snapshot copies only transfer the full snapshot, not the transaction logs, so recovery is limited to the snapshot time with up to 24 hours of data loss.

Full explanation →
317
MCQhard

A financial services company runs a critical application on Amazon RDS for PostgreSQL. The database stores sensitive customer financial data. The security team has mandated that all access to the database must be through IAM database authentication to eliminate the need for passwords. The application currently uses a master user password stored in AWS Secrets Manager. The DBA needs to implement IAM authentication without downtime. The application is deployed on Amazon ECS and connects to the database using a connection string. The DBA has already created an IAM role for the ECS task with a policy that allows rds-db:connect. The DBA has also modified the DB instance to require SSL. However, after making these changes, the application cannot connect. The error message indicates 'IAM authentication is not enabled for this user'. What step did the DBA miss?

A.The DBA did not create a database user that is set to use IAM authentication.
B.The DBA did not attach the IAM policy to the ECS task role.
C.The DBA did not enable the 'password' authentication method.
D.The DBA did not update the security group to allow traffic on port 5432.
AnswerA

When using IAM database authentication, you must create a database user that is set to authenticate using IAM. This is done by creating the user with the CREATEROLE option and granting rds_iam role. Without this, authentication fails. This is the missed step.

Why this answer

IAM database authentication requires that a database user be created with the IAM authentication method. Specifically, the user must be created with the CREATEROLE privilege and granted the rds_iam role. Without this step, the authentication fails even if the IAM role is correctly configured.

Option B is incorrect because the IAM policy was already attached. Option C is incorrect because IAM authentication does not require a password; it uses authentication tokens. Option D is incorrect because the security group and port are not related to IAM authentication.

Full explanation →
318
MCQhard

A company needs to migrate a 3 TB Amazon RDS for SQL Server database to Amazon RDS for PostgreSQL. The migration must be automated and repeatable with minimal manual intervention. Which combination of services should be used?

A.Use AWS SCT to convert the schema and export data to PostgreSQL-compatible format, then import.
B.Use AWS Schema Conversion Tool (SCT) to convert the schema, then use AWS DMS to migrate the data.
C.Use AWS DMS with native SQL Server CDC to migrate directly to PostgreSQL.
D.Use Microsoft Data Migration Assistant to assess and migrate to PostgreSQL.
AnswerB

SCT handles schema conversion, DMS handles data migration.

Why this answer

AWS Schema Conversion Tool (SCT) handles the schema conversion from SQL Server to PostgreSQL, which is necessary due to incompatible data types, stored procedures, and indexes. AWS Database Migration Service (DMS) then performs the continuous data migration with minimal downtime, supporting both full load and ongoing replication. This combination automates the migration process and makes it repeatable via AWS CloudFormation or DMS task templates.

Exam trap

The trap here is that candidates assume DMS alone can handle both schema conversion and data migration, but DMS does not perform schema transformation for heterogeneous migrations; schema conversion must be done separately with SCT before DMS can replicate the data.

How to eliminate wrong answers

Option A is wrong because AWS SCT can export data, but importing a 3 TB database manually is not automated or repeatable, and SCT alone does not provide ongoing replication to minimize downtime. Option C is wrong because AWS DMS with native SQL Server CDC can migrate data directly, but it does not convert the schema; PostgreSQL requires schema conversion from SQL Server, and DMS cannot handle incompatible data types or objects like sequences and stored procedures without prior schema transformation. Option D is wrong because Microsoft Data Migration Assistant is designed for SQL Server-to-SQL Server migrations (e.g., on-premises to Azure SQL Database) and does not support PostgreSQL as a target, nor does it integrate with AWS services for automation.

Full explanation →
319
MCQmedium

A company is migrating a 2 TB Oracle database to Amazon Aurora PostgreSQL using AWS SCT and DMS. After migration, the application reports that some queries are significantly slower than before. The database schema was converted automatically. What is the most likely cause?

A.The schema conversion did not create appropriate indexes
B.Aurora storage is slower than Oracle's storage
C.DMS introduced data type conversions that slow down queries
D.Aurora PostgreSQL does not support partitioning, causing full table scans
AnswerA

Indexes may not be migrated optimally, requiring manual tuning.

Why this answer

The most likely cause is that AWS Schema Conversion Tool (SCT) converted the Oracle schema to Aurora PostgreSQL but did not automatically create optimal indexes. Oracle and PostgreSQL use different query optimizers and index strategies; SCT focuses on structural compatibility, not performance tuning. Without manual review and addition of appropriate indexes (e.g., for foreign keys, composite columns, or partial indexes), PostgreSQL may resort to sequential scans on large tables, causing significant query slowdowns.

Exam trap

The trap here is that candidates assume schema conversion tools like SCT produce a fully optimized schema, when in fact they only ensure syntactic compatibility, leaving performance tuning—especially index creation—as a manual post-migration task.

How to eliminate wrong answers

Option B is wrong because Aurora storage is built on a distributed, SSD-backed volume that typically provides lower latency and higher throughput than traditional Oracle storage, not slower performance. Option C is wrong because DMS handles data type conversions during migration, but once data is in Aurora PostgreSQL, queries operate on native PostgreSQL types; any conversion overhead is negligible and does not cause persistent query slowness. Option D is wrong because Aurora PostgreSQL supports partitioning (table partitioning via declarative partitioning) and can use partition pruning to avoid full table scans; the absence of partitioning alone would not explain the slowdown.

Full explanation →
320
Multi-Selecthard

A company uses Amazon RDS for SQL Server with Multi-AZ deployment. The security team wants to ensure that all data at rest is encrypted using a customer-managed KMS key in both the primary and standby instances. Which THREE actions are required?

Select 3 answers
A.Create a separate KMS key for the standby instance.
B.Specify a customer-managed KMS key during creation.
C.Enable Transparent Data Encryption (TDE) on the instance.
D.Enable Multi-AZ with encryption enabled.
E.Enable encryption at rest when creating the DB instance.
AnswersB, D, E

Customer-managed key is required.

Why this answer

Options B, D, and E are correct. To encrypt data at rest with a customer-managed KMS key, you must specify the KMS key during DB instance creation (B). Multi-AZ with encryption enabled (D) ensures both primary and standby instances are encrypted.

Encryption at rest must be enabled when creating the DB instance (E); it cannot be added later. Option A is wrong because a separate KMS key is not required—the same key encrypts both instances. Option C is wrong because Transparent Data Encryption (TDE) is a SQL Server feature for encrypting the database files, but RDS handles encryption at the storage layer using KMS, not TDE.

TDE is not applicable when using RDS encryption with KMS.

Full explanation →
321
Multi-Selecthard

A company is using Amazon DynamoDB with auto scaling enabled. The table has a provisioned read capacity of 10,000 RCU and write capacity of 5,000 WCU. Auto scaling target utilization is 70%. The table experiences a sudden spike in read traffic, reaching 12,000 RCU. The table throttles some requests. Which THREE actions should the company take to prevent future throttling?

Select 3 answers
A.Implement exponential backoff in the application to retry throttled requests.
B.Increase the maximum read capacity in the auto scaling configuration.
C.Decrease the auto scaling target utilization to 50% to scale out earlier.
D.Increase the write capacity to 10,000 WCU.
E.Enable DAX to cache read requests and reduce the load on the table.
AnswersA, B, E

Exponential backoff helps handle throttled requests gracefully by retrying with delays.

Why this answer

Implementing exponential backoff with jitter helps handle throttled requests gracefully by retrying after increasing delays, reducing further load on the table. Option B is correct because increasing the maximum read capacity in the auto scaling configuration allows the table to scale up further (beyond 10,000 RCU) during traffic spikes, preventing throttling. Option E is correct because enabling DynamoDB Accelerator (DAX) caches read requests, offloading the table and reducing the read load that can cause throttling.

Option C is wrong because decreasing the target utilization would cause auto scaling to trigger earlier, but it does not increase the maximum capacity; the table would still be limited to the max capacity set, and the spike might exceed it. Option D is wrong because the issue is read traffic, not write capacity, so increasing write capacity does not address read throttling.

Full explanation →
322
Multi-Selectmedium

Which TWO CloudWatch metrics should be monitored to detect storage performance issues for an Amazon RDS for MySQL instance? (Choose two.)

Select 2 answers
A.NetworkReceiveThroughput
B.DatabaseConnections
C.WriteIOPS
D.CPUUtilization
E.ReadIOPS
AnswersC, E

WriteIOPS indicates storage write performance.

Why this answer

Options C and E are correct. ReadIOPS and WriteIOPS measure the input/output operations per second, which directly indicate storage performance for an RDS MySQL instance. High or erratic IOPS can signal storage contention or saturation.

Option A (NetworkReceiveThroughput) tracks network traffic, not storage. Option B (DatabaseConnections) reflects concurrent connections, unrelated to storage performance. Option D (CPUUtilization) measures CPU usage, which may impact overall performance but is not a direct storage metric.

Full explanation →
323
Multi-Selectmedium

Which TWO actions can be taken to monitor the health of an Amazon DynamoDB table? (Choose 2.)

Select 2 answers
A.Use AWS Trusted Advisor to check table limits
B.Enable Amazon CloudWatch metrics for the table
C.Enable DynamoDB Streams and process events with AWS Lambda
D.Use DynamoDB Accelerator (DAX) to improve response times
E.Set up CloudWatch alarms for ThrottledRequests
AnswersB, E

CloudWatch metrics like ConsumedWriteCapacityUnits, ThrottledRequests indicate health.

Why this answer

Enabling CloudWatch metrics for a DynamoDB table provides key health indicators such as read/write capacity utilization, throttled requests, and latency. Option E is correct because setting up CloudWatch alarms on ThrottledRequests allows you to proactively detect and respond to throttling events, which directly impacts table health. Option A is incorrect because AWS Trusted Advisor checks overall account limits but does not provide real-time health monitoring of a specific table.

Option C is incorrect because DynamoDB Streams capture item-level changes for event-driven processing, not for monitoring the table's operational health. Option D is incorrect because DAX is an in-memory cache that improves read performance, not a monitoring tool.

Full explanation →
324
MCQeasy

A DevOps engineer notices that an Amazon DynamoDB table's read capacity is frequently throttled during peak hours. The table has read-once, read-many workload. Which action is MOST cost-effective to reduce throttling?

A.Enable auto-scaling for read capacity
B.Enable DynamoDB Accelerator (DAX)
C.Switch to On-Demand capacity mode
D.Increase the provisioned read capacity units
AnswerB

DAX caches reads, reducing read load on the table.

Why this answer

DynamoDB Accelerator (DAX) caches frequently read items, reducing the number of read requests to the table. For a read-once, read-many workload, this significantly lowers read capacity consumption, thus reducing throttling cost-effectively. Option A is incorrect: Enabling auto-scaling for read capacity would help reduce throttling by automatically adjusting capacity, but it does not reduce the number of reads; it increases capacity when needed, which can be more expensive than using DAX.

Option C is incorrect: Switching to On-Demand capacity mode eliminates throttling by paying per request, but for a predictable, high-read workload, this is typically more expensive than provisioned capacity with DAX. Option D is incorrect: Increasing the provisioned read capacity units would reduce throttling, but it increases cost because you pay for higher capacity even during off-peak hours. DAX is more cost-effective as it reduces the required capacity.

Full explanation →
325
MCQeasy

A developer is writing an AWS Lambda function that needs to access a Secrets Manager secret to retrieve database credentials. The Lambda function has an IAM role. Which action must be allowed in the IAM policy?

A.kms:Decrypt
B.secretsmanager:PutSecretValue
C.secretsmanager:ListSecrets
D.secretsmanager:GetSecretValue
AnswerD

This is required to retrieve the secret.

Why this answer

The Lambda function must call secretsmanager:GetSecretValue to retrieve the secret. Option A (kms:Decrypt) may be necessary if the secret is encrypted with a KMS key, but it is not the primary action. Option B (secretsmanager:PutSecretValue) is for updating secrets, not reading.

Option C (secretsmanager:ListSecrets) only lists secret names, not the actual values.

Full explanation →
326
Multi-Selecthard

A company is migrating a 5 TB Oracle database to Amazon Aurora PostgreSQL. They have a 4-hour maintenance window weekly. Which THREE steps should be taken to minimize downtime? (Choose 3)

Select 3 answers
A.Create an Aurora read replica for testing.
B.Use AWS Snowball to transfer the initial data load.
C.Use AWS Direct Connect for network connectivity.
D.Use AWS DMS with change data capture (CDC).
E.Use AWS Schema Conversion Tool (SCT) to convert schema.
AnswersB, D, E

Speeds up initial load.

Why this answer

AWS Snowball provides a physical data transfer mechanism that avoids saturating the network for the initial 5 TB load, which could otherwise take days over typical internet connections. This allows the bulk data to be loaded into Amazon S3 and then into Aurora PostgreSQL before the cutover, while AWS DMS with CDC (Option D) captures ongoing changes to keep the target synchronized with the source during the migration window. Option E is correct because the AWS Schema Conversion Tool (SCT) is essential for converting the Oracle schema (including data types, stored procedures, and indexes) to Aurora PostgreSQL-compatible format before data migration begins, ensuring compatibility and reducing downtime during the final sync.

Exam trap

The trap here is that candidates may assume AWS Direct Connect (Option C) is always the best choice for large data transfers, but for a 5 TB initial load, Snowball is faster and more cost-effective than even a 10 Gbps Direct Connect link, which would still take over an hour for the transfer alone, not accounting for schema conversion and CDC setup.

Full explanation →
327
MCQeasy

A company needs to store JSON documents that require complex querying on nested attributes. The database must support ACID transactions and be fully managed. Which service should they use?

A.Amazon Aurora MySQL
B.Amazon DocumentDB (with MongoDB compatibility)
C.Amazon DynamoDB
D.Amazon Neptune
AnswerA

Supports JSON and ACID transactions.

Why this answer

Amazon Aurora MySQL is correct because it supports JSON documents with complex querying on nested attributes via MySQL's JSON data type and JSON path expressions, while also providing full ACID transaction support through its MySQL-compatible engine. As a fully managed service, Aurora handles provisioning, backups, and patching, meeting all stated requirements.

Exam trap

The trap here is that candidates often choose Amazon DocumentDB assuming it supports full ACID transactions because of its MongoDB compatibility, but MongoDB (and DocumentDB) only guarantees atomicity for single-document operations, not multi-document ACID transactions, which Aurora MySQL provides via its relational engine.

How to eliminate wrong answers

Option B (Amazon DocumentDB) is wrong because, while it stores JSON documents and supports complex queries via MongoDB-compatible aggregation pipelines, it does not support ACID transactions across multiple documents (only single-document atomicity). Option C (Amazon DynamoDB) is wrong because, although it is fully managed and supports ACID transactions via DynamoDB Transactions, it is a NoSQL key-value and document database that does not natively support complex querying on deeply nested attributes with the same flexibility as JSON path queries in a relational database. Option D (Amazon Neptune) is wrong because it is a graph database optimized for highly connected data and graph queries (e.g., SPARQL, Gremlin), not for storing and querying JSON documents with nested attributes, and it does not support ACID transactions in the same multi-document sense as Aurora MySQL.

Full explanation →
328
Multi-Selectmedium

A company uses Amazon RDS for PostgreSQL to store customer data. The security team wants to audit all SQL queries executed against the database, including SELECT statements. Which TWO actions should be taken to achieve this?

Select 2 answers
A.Install the pgaudit extension in the DB instance.
B.Enable the 'log_connections' and 'log_disconnections' parameters.
C.Set the 'pgaudit.log' parameter to include 'read' and 'write' statements.
D.Set the 'audit_log_enabled' parameter to 1 in the DB parameter group.
E.Enable Database Activity Streams on the DB instance.
AnswersA, C

pgaudit is the standard extension for PostgreSQL audit logging.

Why this answer

To audit SQL queries on Amazon RDS for PostgreSQL, the pgaudit extension must be installed (Option A). Then, the 'pgaudit.log' parameter must be set to include 'read' and 'write' statements to capture SELECT and DML operations (Option C). Option B enables connection logging but not query auditing.

Option D ('audit_log_enabled') is for MySQL, not PostgreSQL. Option E (Database Activity Streams) provides a different auditing mechanism that may not capture all SQL queries and requires additional setup.

Full explanation →
329
MCQeasy

A company wants to audit all SQL statements executed on their RDS for PostgreSQL database. Which AWS service should they use?

A.AWS Database Migration Service (DMS)
B.VPC Flow Logs
C.Amazon RDS Performance Insights
D.CloudWatch Logs with PostgreSQL audit logs
AnswerD

Enable pgaudit extension and publish logs to CloudWatch Logs.

Why this answer

For auditing SQL statements on Amazon RDS for PostgreSQL, you enable the PostgreSQL Audit Extension (pgaudit) and configure it to send logs to Amazon CloudWatch Logs. CloudWatch Logs can then be used to monitor, store, and access the SQL audit logs. Option A (AWS Database Migration Service) is used for migrating databases, not auditing.

Option B (VPC Flow Logs) captures IP traffic metadata, not SQL statements. Option C (Amazon RDS Performance Insights) monitors database performance metrics, not individual SQL statements.

Full explanation →
330
MCQmedium

A company is deploying a new Amazon Aurora MySQL database. The development team requires a separate database instance for testing that is a clone of the production database but does not require the same level of performance. What is the MOST cost-effective way to create this test database?

A.Use the Aurora cloning feature to create a clone of the production cluster
B.Create a new Aurora cluster from the latest snapshot of the production cluster
C.Create a read replica of the production cluster and promote it to a standalone cluster
D.Create a new Aurora cluster and use a smaller DB instance class
AnswerA

Aurora cloning is fast and space-efficient, ideal for test environments.

Why this answer

The Aurora cloning feature creates a copy of the production cluster that is both fast and storage-efficient, using copy-on-write technology. This clone can be created with a different (smaller) DB instance class than the source, meeting the requirement for lower performance at minimal cost, as no additional storage is provisioned until data is modified.

Exam trap

The trap here is that candidates often assume creating a new cluster from a snapshot (Option B) is the standard way to create a test database, overlooking the fact that Aurora cloning provides a faster and more cost-effective alternative by sharing storage pages until writes occur.

How to eliminate wrong answers

Option B is wrong because creating a new cluster from a snapshot incurs the full storage cost of the new cluster and takes longer to provision, making it less cost-effective than cloning. Option C is wrong because creating a read replica and promoting it to a standalone cluster still provisions a full replica with the same storage as the source, and the promotion process can cause data loss or inconsistency; it is not designed as a cost-effective cloning method. Option D is wrong because creating a new cluster from scratch (even with a smaller instance class) requires restoring data from a snapshot or exporting data, which incurs additional storage and compute costs, and does not leverage the zero-copy efficiency of Aurora cloning.

Full explanation →
331
MCQhard

A database specialist is analyzing an Aurora MySQL error log and finds the above deadlock error. The application performs an update on the orders table and then updates the inventory table within the same transaction. The deadlock occurs when two concurrent transactions try to update orders and inventory in different orders. Which design change should the database specialist recommend to reduce deadlocks?

A.Combine the orders and inventory tables into a single table to avoid multiple table locks
B.Ensure all transactions update tables in the same order (e.g., always update inventory first, then orders)
C.Use SELECT ... FOR UPDATE on both tables before updating
D.Change the transaction isolation level to READ UNCOMMITTED
AnswerB

Consistent lock ordering prevents circular wait conditions, reducing deadlocks.

Why this answer

Deadlocks in Aurora MySQL often occur when concurrent transactions acquire row-level locks on tables in different orders. By enforcing a consistent lock order (e.g., always updating inventory first, then orders), the database can avoid circular wait conditions, which are a necessary condition for deadlocks. This is a standard best practice for reducing deadlocks in InnoDB, which uses row-level locking and two-phase locking.

Exam trap

The trap here is that candidates may think combining tables or using SELECT ... FOR UPDATE will prevent deadlocks, but the root cause is inconsistent lock ordering, not the number of tables or the use of explicit locking.

How to eliminate wrong answers

Option A is wrong because combining tables into a single table does not eliminate the need for multiple row locks and can introduce data redundancy, normalization issues, and still allow deadlocks if rows are locked in different orders. Option C is wrong because using SELECT ... FOR UPDATE on both tables before updating does not guarantee a consistent lock order; if the SELECT ...

FOR UPDATE statements acquire locks in different orders across transactions, deadlocks can still occur. Option D is wrong because changing the isolation level to READ UNCOMMITTED can lead to dirty reads, non-repeatable reads, and phantom reads, and it does not prevent deadlocks; deadlocks are caused by lock contention, not isolation level.

Full explanation →
332
MCQmedium

A company is using Amazon DocumentDB (with MongoDB compatibility) for a content management system. The application team notices that write operations are taking longer than usual. CloudWatch metrics show high WriteLatency and a growing number of documents in the oplog. Which step should the database specialist take to troubleshoot the issue?

A.Enable Multi-AZ on the cluster to offload reads to the standby.
B.Increase the instance size of the primary instance to handle more writes.
C.Increase the allocated storage to improve I/O throughput.
D.Check the CPU and memory utilization of the secondary instance and consider scaling it up.
AnswerD

Secondary might be bottlenecked; scaling it up can reduce replication lag and write latency.

Why this answer

High WriteLatency and growing oplog suggest that the secondary instance is too slow to apply operations, causing replication lag. Checking the secondary's metrics helps diagnose. Option A is wrong because enabling Multi-AZ does not directly address write latency.

Option B is wrong because increasing the instance class may help but should be done after diagnosis. Option C is wrong because increasing storage does not improve write performance.

Full explanation →
333
Multi-Selecthard

Which THREE of the following are key considerations when designing a time-series database using Amazon DynamoDB? (Select THREE.)

Select 3 answers
A.Always use strongly consistent reads for accurate time-series data
B.Enable Time to Live (TTL) to automatically expire old data
C.Use a composite primary key with a high-cardinality partition key and a sort key that includes a truncated timestamp
D.Use local secondary indexes for aggregating data across partitions
E.Design for adaptive capacity to handle uneven access patterns
AnswersB, C, E

Automatically deletes data after a specified time.

Why this answer

Amazon DynamoDB's Time to Live (TTL) feature automatically deletes expired items without consuming write throughput, making it ideal for managing data retention in time-series workloads. This eliminates the need for custom cleanup scripts and reduces storage costs over time.

Exam trap

AWS often tests the misconception that strongly consistent reads are mandatory for time-series accuracy, when in fact eventually consistent reads are acceptable for most time-series patterns and provide better performance and cost efficiency.

Full explanation →
334
MCQeasy

A SysOps administrator is tasked with monitoring the free storage space on all Amazon RDS DB instances. Which AWS service should be used to set up an alarm that sends an email notification when free storage space falls below a threshold?

A.AWS CloudTrail to monitor storage events.
B.AWS Config to track storage configuration changes.
C.Amazon CloudWatch with an alarm on the FreeStorageSpace metric and an SNS topic.
D.Amazon Inspector to check for storage vulnerabilities.
AnswerC

CloudWatch monitors metrics and can trigger actions via SNS.

Why this answer

Amazon CloudWatch provides the `FreeStorageSpace` metric for RDS DB instances, which reports the amount of available storage in bytes. You can create a CloudWatch alarm on this metric and configure it to send a notification via an Amazon SNS topic when the value falls below a specified threshold, enabling proactive monitoring of storage capacity.

Exam trap

The trap here is confusing logging/auditing services (CloudTrail, Config) or security scanners (Inspector) with the monitoring and alerting capabilities of CloudWatch, leading candidates to select a service that cannot evaluate real-time metric thresholds.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail records API calls for auditing and governance, not real-time storage metrics; it cannot monitor free storage space or trigger alarms. Option B is wrong because AWS Config tracks configuration changes to AWS resources (e.g., DB instance class or storage type) but does not provide continuous metric monitoring or threshold-based alerting for storage usage. Option D is wrong because Amazon Inspector is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, not for monitoring storage space on RDS instances.

Full explanation →
335
Multi-Selecthard

Which TWO actions can be used to encrypt an existing unencrypted Amazon RDS for MySQL DB instance? (Choose 2.)

Select 2 answers
A.Create a read replica with encryption enabled.
B.Enable SSL on the DB instance.
C.Create a new encrypted DB instance and migrate data using database dump and restore.
D.Take a snapshot of the DB instance, copy it with encryption enabled, and restore from the encrypted snapshot.
E.Modify the DB instance and enable encryption.
AnswersC, D

Migrating to a new encrypted instance is another valid method.

Why this answer

To encrypt an existing unencrypted RDS for MySQL DB instance, you cannot modify the instance directly (option E is incorrect). You can either take a snapshot, copy it with encryption enabled, and restore from the encrypted snapshot (option D), or create a new encrypted DB instance and migrate data using database dump and restore (option C). Option A is incorrect because creating a read replica with encryption enabled does not encrypt the source instance.

Option B is incorrect because enabling SSL encrypts data in transit, not at rest.

Full explanation →
336
MCQmedium

A company has an Amazon RDS for MySQL DB instance that is running low on storage. The current allocated storage is 500 GB, and the free space is down to 10 GB. The database administrator wants to increase storage with minimal downtime. Which action should be taken?

A.Use the AWS Management Console to modify the DB instance and increase the allocated storage.
B.Stop the DB instance, modify the allocated storage, and start the instance.
C.Create a snapshot of the current DB instance, restore it to a new larger instance, and point the application to the new endpoint.
D.Enable storage autoscaling and wait for the automatic increase.
AnswerA

Modifying storage is an online operation with minimal impact.

Why this answer

RDS supports modifying storage online with minimal downtime. Increasing allocated storage from 500 GB to, for example, 600 GB can be done via a modification to the DB instance. The instance remains available during the modification, though a brief performance impact may occur.

Stopping the instance is unnecessary. Creating a snapshot and restoring would cause longer downtime. Waiting for autoscaling might not be quick enough if space is critically low.

Full explanation →
337
MCQmedium

A company uses Amazon DynamoDB for a gaming application. During a new game launch, the table experiences throttling on write requests. The table has a provisioned capacity of 10,000 WCU and 5,000 RCU. The write traffic pattern shows spikes up to 15,000 WCU for 5 minutes. Which action would resolve the throttling with minimal cost impact?

A.Use Amazon SQS to buffer the write requests
B.Increase the provisioned WCU to 20,000 permanently
C.Enable Auto Scaling for DynamoDB with a target utilization of 70%
D.Enable DynamoDB Accelerator (DAX) for the table
AnswerC

Enabling Auto Scaling dynamically adjusts provisioned capacity based on traffic, handling spikes cost-effectively by scaling up during high demand and down during low demand.

Why this answer

Auto Scaling for DynamoDB automatically adjusts provisioned write capacity based on actual traffic, handling spikes up to 15,000 WCU without manual intervention and minimizing cost by scaling down during low traffic. Option A is wrong: SQS buffers requests but does not directly resolve DynamoDB throttling; it adds latency and complexity. Option B is wrong: permanently increasing WCU to 20,000 is costly and wasteful for short spikes.

Option D is wrong: DynamoDB Accelerator (DAX) is an in-memory cache for read-heavy workloads, not for write throughput.

Full explanation →
338
Multi-Selecthard

A database administrator is monitoring an Amazon RDS for MySQL instance and sees the following CloudWatch metrics: 'DiskQueueDepth' is consistently at 10, 'WriteLatency' is 20 ms, 'FreeStorageSpace' is less than 10% of total. The instance uses gp2 storage. Which THREE actions should be taken to improve performance?

Select 3 answers
A.Switch to Provisioned IOPS (io1 or io2) for consistent performance
B.Increase allocated storage to improve baseline IOPS
C.Delete unnecessary data to free up storage space
D.Enable Multi-AZ to increase I/O capacity
E.Enable Performance Insights to identify slow queries
AnswersA, B, C

Provisioned IOPS ensures consistent I/O performance regardless of storage size.

Why this answer

High 'WriteLatency' and 'DiskQueueDepth' indicate an I/O bottleneck. Switching to Provisioned IOPS (io1 or io2) provides consistent low-latency I/O performance. Option B is correct: gp2 storage baseline IOPS scales with storage size.

Increasing allocated storage raises the baseline IOPS, which can improve performance. Option C is correct: Low free storage space on gp2 can cause performance degradation because write operations may be throttled. Deleting unnecessary data frees up space and alleviates this issue.

Option D is incorrect: Multi-AZ provides high availability and disaster recovery, not increased I/O capacity. It can add write latency due to synchronous replication. Option E is incorrect: Performance Insights is a monitoring tool for analyzing database performance; it helps identify slow queries but does not directly improve performance.

Therefore, the correct actions are A, B, and C.

Full explanation →
339
MCQmedium

A company uses Amazon DynamoDB to store user profiles. The access pattern is mostly GetItem by user_id. They want to reduce costs. Which design change is most effective?

A.Use DynamoDB Standard-IA table class for the user profiles table.
B.Increase the read capacity units to reduce throttling.
C.Add a Global Secondary Index on an additional attribute.
D.Add DynamoDB Accelerator (DAX) for caching.
AnswerA

Standard-IA lowers storage cost for infrequently accessed data.

Why this answer

DynamoDB Standard-IA (Infrequent Access) table class offers a lower storage cost for data that is accessed infrequently, while still providing the same single-digit millisecond latency for GetItem operations. Since the access pattern is mostly GetItem by user_id, and assuming the data is not accessed frequently enough to justify the higher per-request cost of Standard, Standard-IA can significantly reduce overall costs. The trade-off is a slightly higher per-request cost, but for predominantly read-heavy workloads with low access frequency, the storage savings outweigh the request cost increase.

Exam trap

The trap here is that candidates may assume adding a cache (DAX) or an index always improves performance and reduces cost, but in reality, these add-ons increase complexity and cost without addressing the core storage cost issue for infrequently accessed data.

How to eliminate wrong answers

Option B is wrong because increasing read capacity units would increase costs, not reduce them, and throttling is not mentioned as a problem in the scenario. Option C is wrong because adding a Global Secondary Index (GSI) incurs additional storage and write capacity costs, and does not directly reduce costs for the primary access pattern of GetItem by user_id. Option D is wrong because adding DAX would introduce additional cost for the caching cluster, and while it can reduce read latency, it does not reduce the underlying storage or throughput costs of the DynamoDB table.

Full explanation →
340
MCQeasy

A company is using Amazon DynamoDB for a gaming leaderboard application. Recently, users have experienced increased latency when updating scores. The DynamoDB table has on-demand capacity mode. The application performs UpdateItem calls with a condition expression. Which action is most likely to reduce the latency?

A.Add a global secondary index (GSI) with the score as the sort key to improve update performance.
B.Switch the table to provisioned capacity and increase the read capacity units to handle peak load.
C.Disable conditional writes to reduce the overhead of condition expression evaluation.
D.Ensure that there are no throttled requests in the CloudWatch metrics and verify that the table is not experiencing hot partitions.
AnswerD

On-demand mode automatically scales, but hot partitions can cause latency; checking metrics helps identify partition issues.

Why this answer

Increased latency in DynamoDB can be caused by hot partitions where many requests hit the same partition, leading to throttling even with on-demand capacity if the partition limits are exceeded. Checking CloudWatch metrics for throttled requests and partition metrics helps identify hot partitions. Option A is incorrect because adding a GSI does not improve UpdateItem performance; it only helps query performance.

Option B is incorrect: on-demand mode already handles capacity, and increasing read capacity units does not affect write operations like UpdateItem. Option C is incorrect: disabling conditional writes would break the application's concurrency control and does not guarantee latency reduction; condition evaluation is a fast, internal operation.

Full explanation →
341
MCQeasy

A company is migrating an on-premises MongoDB database to AWS. The application uses MongoDB's aggregation pipeline for real-time analytics. Which AWS database service is most compatible and provides the least application changes?

A.Amazon ElastiCache for Redis with RedisJSON module.
B.Amazon DocumentDB (with MongoDB compatibility).
C.Amazon DynamoDB with DynamoDB Streams and Lambda for aggregation.
D.Amazon Aurora with JSON data type.
AnswerB

DocumentDB is MongoDB-compatible and supports aggregation pipeline.

Why this answer

Amazon DocumentDB is designed to be MongoDB-compatible, supporting the MongoDB aggregation pipeline with minimal changes. This allows the company to migrate the existing MongoDB database and continue using the same aggregation pipeline for real-time analytics without rewriting application code, making it the most compatible option.

Exam trap

The trap here is that candidates may assume DynamoDB's flexibility or Aurora's JSON support can easily replace MongoDB's aggregation pipeline, overlooking the fundamental differences in query language and data model that necessitate significant application rewrites.

How to eliminate wrong answers

Option A is wrong because Amazon ElastiCache for Redis with RedisJSON module is an in-memory cache, not a document database, and does not support MongoDB's aggregation pipeline or provide persistent storage for the full dataset. Option C is wrong because Amazon DynamoDB is a key-value and document database that does not natively support MongoDB's aggregation pipeline; using DynamoDB Streams and Lambda would require significant application changes to reimplement aggregation logic. Option D is wrong because Amazon Aurora with JSON data type is a relational database that does not support MongoDB's aggregation pipeline or its query language, requiring a complete rewrite of application queries and logic.

Full explanation →
342
MCQeasy

A database administrator is troubleshooting a sudden increase in read latency on an Amazon RDS for PostgreSQL instance. The instance has 200 GB of General Purpose SSD (gp2) storage with 600 provisioned IOPS. The administrator notices that the average queue depth is consistently above 4. Which action is the MOST effective way to reduce read latency?

A.Enable Multi-AZ deployment to offload reads to the standby.
B.Change the instance type to a larger size with more vCPUs.
C.Migrate to an io1 volume with 3000 provisioned IOPS.
D.Increase the allocated storage to 500 GB without changing IOPS.
AnswerC

Increasing IOPS addresses the queue depth and reduces latency.

Why this answer

Migrating to an io1 volume with 3000 provisioned IOPS directly increases the available IOPS, addressing the high queue depth and reducing read latency. Option A is incorrect because Multi-AZ does not allow read traffic to the standby; the standby is only used for failover. Option B is incorrect because increasing the instance size may not resolve the I/O bottleneck if the issue is insufficient IOPS.

Option D is incorrect because increasing the allocated storage for gp2 increases baseline IOPS (3 IOPS per GB), but the option specifies not changing IOPS, so it would not help; even if it did, 500 GB would provide 1500 IOPS, which may still not be sufficient.

Full explanation →
343
MCQmedium

A company uses Amazon Redshift for data warehousing. The security team requires that all data be encrypted at rest with a customer-managed key, and that the key be rotated every year. Which configuration meets these requirements?

A.Launch the Redshift cluster without encryption and enable encryption later using AWS CloudHSM.
B.Launch the Redshift cluster with encryption enabled using an S3-managed key.
C.Launch the Redshift cluster with encryption enabled using a customer-managed KMS key with automatic annual rotation.
D.Launch the Redshift cluster with encryption enabled using a KMS key and configure the cluster to use an HSM for key storage.
AnswerC

This meets both requirements.

Why this answer

Amazon Redshift supports encryption at rest using a KMS key. You can enable automatic key rotation on a customer-managed KMS key. Option A is wrong because launching without encryption and enabling later using CloudHSM is not supported; Redshift does not support enabling encryption after launch without reloading data, and CloudHSM requires manual key rotation.

Option B is wrong because Redshift does not use S3-managed keys for encryption; you must use a KMS key or HSM. Option C is correct because it meets the requirements. Option D is wrong because using an HSM for key storage does not provide automatic key rotation; you would need to rotate the key manually.

Full explanation →
344
Multi-Selectmedium

A company is building a real-time leaderboard for an online game using Amazon DynamoDB. The leaderboard must update scores within seconds and support queries for top 100 players. Which TWO design patterns should be used? (Choose TWO.)

Select 2 answers
A.Create a global secondary index on the score attribute for efficient range queries.
B.Use DynamoDB Streams to trigger a Lambda function that updates a separate leaderboard table.
C.Store the leaderboard in Amazon ElastiCache for Redis for low-latency reads.
D.Enable DynamoDB Accelerator (DAX) for faster reads of the leaderboard.
E.Set the sort key to the score attribute for natural ordering.
AnswersB, D

Streams and Lambda provide real-time processing.

Why this answer

DynamoDB Streams can capture score updates in near real-time and trigger a Lambda function to maintain a separate leaderboard table optimized for top-100 queries. This decouples the write-heavy game table from the read-heavy leaderboard, ensuring low-latency updates without contention.

Exam trap

The trap here is that candidates often assume a GSI on score alone can efficiently return a global top-N list, but DynamoDB requires a hash key for GSIs and cannot perform a global ordered scan without a partition key, making it unsuitable for leaderboard queries.

Full explanation →
345
MCQeasy

A company needs to store JSON documents that are frequently accessed by a web application. The documents have varying attributes and the query pattern includes filtering on multiple fields. Which AWS database service is most suitable?

A.Amazon Neptune
B.Amazon ElastiCache for Redis
C.Amazon DynamoDB
D.Amazon RDS for MySQL
AnswerC

NoSQL, supports JSON and flexible queries with GSIs.

Why this answer

Amazon DynamoDB is the most suitable choice because it is a fully managed NoSQL key-value and document database that natively supports JSON documents with varying attributes. Its flexible schema allows each item to have different attributes, and its support for secondary indexes (Local Secondary Indexes and Global Secondary Indexes) enables efficient filtering and querying on multiple fields without requiring predefined schemas or complex joins.

Exam trap

The trap here is that candidates often choose Amazon RDS for MySQL because they assume JSON support in relational databases is sufficient, but they overlook the performance and schema flexibility limitations when dealing with varying attributes and multi-field filtering at scale.

How to eliminate wrong answers

Option A is wrong because Amazon Neptune is a graph database designed for highly connected data (e.g., social networks, recommendation engines) and is not optimized for storing or querying JSON documents with varying attributes or multi-field filtering; it uses SPARQL or Gremlin, not simple key-value or document queries. Option B is wrong because Amazon ElastiCache for Redis is an in-memory cache, not a durable primary database; while it can store JSON via the RedisJSON module, it lacks persistent storage guarantees and is not designed for complex multi-field filtering or secondary indexes. Option D is wrong because Amazon RDS for MySQL is a relational database that requires a fixed schema, making it unsuitable for storing JSON documents with varying attributes; although MySQL supports JSON columns, querying multiple fields within JSON requires complex expressions and cannot leverage secondary indexes efficiently, leading to performance issues.

Full explanation →
346
MCQhard

Refer to the exhibit. A developer reports that the RDS MySQL instance 'mydb' is experiencing high write latency. The storage is gp2 with 100 GB. What is the MOST likely cause of the write latency?

A.There is a read replica causing replication lag
B.The gp2 volume size is too small, resulting in insufficient baseline IOPS
C.The instance class db.r5.large does not provide enough memory
D.Multi-AZ is not enabled, causing synchronous replication overhead
AnswerB

gp2 baseline IOPS is 3 per GB, so 100 GB gives only 300 IOPS.

Why this answer

The gp2 volume's baseline IOPS are determined by the volume size at a ratio of 3 IOPS per GB, up to 16,000 IOPS. With a 100 GB gp2 volume, the baseline IOPS is only 300 (100 × 3). This is insufficient for write-heavy workloads, causing write latency as the volume exhausts its IOPS credit balance and enters a throttled state.

Burst credits can temporarily boost performance, but sustained high write throughput will deplete credits and lead to latency.

Exam trap

The trap here is that candidates may overlook the gp2 IOPS-to-size ratio and assume any gp2 volume can burst indefinitely, or they may confuse storage performance issues with instance class or replication factors.

How to eliminate wrong answers

Option A is wrong because read replicas do not cause write latency on the source instance; replication lag affects read replicas, not the primary's write performance. Option C is wrong because db.r5.large provides ample memory (16 GiB) for typical workloads, and insufficient memory would manifest as swap usage or out-of-memory errors, not directly as write latency. Option D is wrong because Multi-AZ does not introduce synchronous replication overhead for writes; it uses synchronous replication to a standby in a different AZ, but this adds minimal latency (typically <10 ms) and is not the primary cause of high write latency.

Full explanation →
347
MCQhard

A financial services company is migrating a 2 TB Oracle database to Amazon Aurora PostgreSQL. The database uses Oracle-specific features like hierarchical queries and stored procedures. The company wants to minimize manual code changes. Which service should be used to automate schema conversion?

A.AWS Database Migration Service (DMS) with full load and ongoing replication.
B.AWS Schema Conversion Tool (SCT).
C.AWS Storage Gateway to cache data on-premises and then sync to S3.
D.AWS Lambda to execute custom scripts for schema transformation.
AnswerB

SCT automates the conversion of Oracle schema objects to PostgreSQL-compatible format.

Why this answer

AWS Schema Conversion Tool (SCT) is specifically designed to convert database schemas from one engine to another, including Oracle to Amazon Aurora PostgreSQL. It automates the conversion of Oracle-specific features like hierarchical queries (CONNECT BY) and stored procedures into PostgreSQL-compatible syntax (e.g., recursive CTEs and PL/pgSQL), minimizing manual code changes. This makes SCT the correct choice for schema conversion, while AWS DMS handles data migration separately.

Exam trap

The trap here is that candidates often confuse AWS DMS (data migration) with schema conversion, assuming DMS can handle both data and schema transformation, but DMS only migrates data and requires a pre-converted target schema, which SCT provides.

How to eliminate wrong answers

Option A is wrong because AWS DMS focuses on data migration and ongoing replication, not schema conversion; it cannot translate Oracle-specific SQL syntax like hierarchical queries or stored procedures into PostgreSQL equivalents. Option C is wrong because AWS Storage Gateway is a hybrid storage service for caching and syncing files to S3, with no capability to convert or transform database schemas. Option D is wrong because AWS Lambda is a serverless compute service for running custom code, but it lacks built-in database schema conversion logic and would require extensive manual scripting to handle Oracle-to-PostgreSQL syntax translation, defeating the goal of minimizing manual code changes.

Full explanation →
348
MCQmedium

A user has the IAM policy shown in the exhibit. When attempting to create a DMS replication task, they receive an authorization error. What is the most likely missing permission?

A.ec2:DescribeSecurityGroups to allow network configuration
B.dms:CreateEndpoint permission
C.s3:PutObject for the S3 bucket
D.logs:CreateLogGroup to enable logging
AnswerB

The policy lacks permission to create endpoints, which are required for the replication task.

Why this answer

The user is attempting to create a DMS replication task, which requires the ability to create the underlying DMS resources. The error indicates a missing permission for the `dms:CreateEndpoint` action, as DMS replication tasks depend on source and target endpoints that must be created first. Without this permission, the API call to create the endpoint fails, resulting in an authorization error.

Exam trap

The trap here is that candidates often focus on permissions for the target service (like S3 or CloudWatch) or network-related actions, overlooking that the immediate authorization failure is due to missing the core DMS action required to create the endpoint itself.

How to eliminate wrong answers

Option A is wrong because `ec2:DescribeSecurityGroups` is used for network configuration but is not required to create a DMS replication task; DMS handles network settings via replication instances, not directly through security group descriptions. Option C is wrong because `s3:PutObject` is only needed if the DMS task writes to an S3 target, but the error occurs during task creation, not during data transfer, and the question does not specify S3 as a target. Option D is wrong because `logs:CreateLogGroup` is needed for enabling CloudWatch logging, but logging is optional and not a prerequisite for creating a replication task; the authorization error points to a missing core DMS permission, not a logging one.

Full explanation →
349
Multi-Selecthard

A company is planning to migrate a 1 TB MySQL database from on-premises to Amazon RDS for MySQL. The migration must have minimal downtime and support ongoing replication. Which THREE steps should the company include in the migration plan? (Choose THREE.)

Select 3 answers
A.Set up an AWS Direct Connect or VPN connection between on-premises and AWS.
B.Deploy an Amazon EC2 instance to act as a proxy for the DMS replication.
C.Create the target Amazon RDS for MySQL instance.
D.Use AWS DMS with ongoing replication from the on-premises MySQL database.
E.Install the AWS Schema Conversion Tool on the source server to convert the schema.
AnswersA, C, D

Network connectivity is required for DMS to access the source.

Why this answer

A stable, low-latency network connection (Direct Connect or VPN) is essential for AWS DMS to perform ongoing replication with minimal downtime. Without this, the replication can be interrupted by network issues, causing data loss or extended cutover windows.

Exam trap

The trap here is that candidates often assume an EC2 proxy is needed for DMS replication, but DMS replication instances handle connectivity directly, and the proxy is only used in specific scenarios like VPC peering across regions or complex network topologies.

Full explanation →
350
MCQeasy

A company wants to encrypt an existing unencrypted Amazon RDS for SQL Server instance. What is the MOST efficient way to achieve this?

A.Create a read replica with encryption enabled.
B.Modify the DB instance to enable encryption.
C.Create a snapshot of the DB instance and copy it with encryption enabled. Restore the snapshot to a new encrypted instance.
D.Use AWS DMS to migrate data to a new encrypted instance.
AnswerC

This is the recommended approach.

Why this answer

You cannot directly enable encryption on an existing unencrypted RDS instance. The most efficient method is to take a snapshot of the instance, copy it with encryption enabled (which re-encrypts the data using AWS KMS), and then restore that snapshot to a new encrypted DB instance. This approach minimizes downtime and leverages native RDS snapshot capabilities without requiring external tools.

Exam trap

The trap here is that candidates assume you can simply modify an existing RDS instance to enable encryption (Option B), but AWS requires encryption to be set at creation time, so the snapshot-restore workflow is the only native way to convert an unencrypted instance to encrypted.

How to eliminate wrong answers

Option A is wrong because creating a read replica with encryption enabled requires the source instance to already be encrypted; you cannot create an encrypted read replica from an unencrypted source. Option B is wrong because RDS does not support modifying an existing unencrypted DB instance to enable encryption—encryption can only be enabled at creation time. Option D is wrong because while AWS DMS can migrate data to a new encrypted instance, it is less efficient than the snapshot method, as it requires setting up a replication task and incurs additional data transfer overhead.

Full explanation →
351
MCQhard

A company is designing a database for a global IoT application that ingests millions of events per second. Each event includes a device ID, timestamp, and sensor readings. The requirement is to store data for historical analysis and to support queries that aggregate data by device ID over time ranges. The team needs a cost-effective solution that can scale write throughput. Which database design is most appropriate?

A.Use Amazon DynamoDB with a table keyed by device ID (partition) and timestamp (sort).
B.Use Amazon RDS for MySQL with Multi-AZ and auto-scaling storage.
C.Use Amazon Redshift with a schema optimized for time-series data.
D.Use Amazon ElastiCache for Redis with persistence enabled.
AnswerA

DynamoDB supports massive write throughput and efficient querying by device and time range.

Why this answer

Amazon DynamoDB with a composite primary key of device ID (partition key) and timestamp (sort key) is ideal for this IoT workload because it provides scalable write throughput to handle millions of events per second, while the sort key enables efficient time-range queries and aggregation by device ID. DynamoDB's fully managed, serverless architecture ensures cost-effectiveness by automatically scaling capacity and charging only for consumed resources, making it suitable for high-velocity time-series data.

Exam trap

The trap here is that candidates often choose Amazon RDS or Redshift because they are familiar with SQL and time-series databases, but they overlook the critical requirement for extreme write scalability and cost-effectiveness that DynamoDB's serverless model provides for IoT workloads.

How to eliminate wrong answers

Option B is wrong because Amazon RDS for MySQL is a relational database with limited write scalability (typically thousands of writes per second) and cannot handle millions of events per second without significant sharding and overhead, making it unsuitable for high-throughput IoT ingestion. Option C is wrong because Amazon Redshift is a columnar data warehouse optimized for analytical queries on large datasets, not for real-time, high-frequency writes; it is designed for batch loading and complex aggregations, not for ingesting millions of events per second with low latency. Option D is wrong because Amazon ElastiCache for Redis is an in-memory cache, not a durable database; while it can handle high write throughput, its persistence options are limited and it is not designed for long-term historical analysis or complex aggregation queries over time ranges.

Full explanation →
352
MCQeasy

A company's RDS for MySQL instance is experiencing high CPU utilization. Which AWS service should be used to set up automated actions to scale the instance vertically?

A.AWS Systems Manager Automation with a custom runbook
B.AWS Auto Scaling with a target tracking scaling policy
C.AWS Lambda function to modify the DB instance class
D.Amazon CloudWatch Alarms to send an SNS notification to the DBA
AnswerC

An AWS Lambda function can be triggered by a CloudWatch alarm to call the RDS modify-db-instance API and change the instance class, enabling automated vertical scaling.

Why this answer

For automated vertical scaling of an RDS for MySQL instance, the most direct approach among the options is to use an AWS Lambda function that modifies the DB instance class, triggered by a CloudWatch alarm based on CPU utilization. AWS Auto Scaling (B) only supports horizontal scaling for RDS (adding read replicas) and does not natively change instance class. Systems Manager Automation (A) could orchestrate a change but is less straightforward than Lambda.

CloudWatch Alarms (D) only notify; they cannot automatically scale without an action target like Lambda. Therefore, option C is the best choice.

Exam trap

The trap is that candidates assume AWS Auto Scaling handles both horizontal and vertical scaling for RDS, but it only supports horizontal scaling (adding/removing replicas). Vertical scaling (changing instance class) requires a custom automation, such as a Lambda function triggered by CloudWatch Alarms.

How to eliminate wrong answers

Option A is wrong because AWS Systems Manager Automation runbooks are designed for operational tasks like patching or configuration changes, not for automatically scaling RDS instances based on real-time metrics. Option C is wrong because while a Lambda function could modify the DB instance class via API calls, it is not a managed service purpose-built for automated scaling; it requires custom code, monitoring, and error handling, making it less reliable and more complex than AWS Auto Scaling. Option D is wrong because CloudWatch Alarms sending SNS notifications only alert the DBA to the issue; they do not perform any automated scaling action, which is explicitly required by the question.

Full explanation →
353
Multi-Selecthard

Which TWO strategies can improve query performance in Amazon Aurora MySQL for a read-heavy workload? (Select TWO.)

Select 2 answers
A.Enable Aurora Auto Scaling for read replicas
B.Use Provisioned IOPS EBS volumes for the primary instance
C.Enable Multi-AZ to create a standby for read traffic
D.Create Aurora Replicas and distribute read traffic to them
E.Migrate the read-heavy queries to Amazon DynamoDB
AnswersA, D

Auto Scaling automatically adjusts the number of replicas based on load.

Why this answer

Amazon Aurora Auto Scaling automatically adjusts the number of Aurora Replicas in response to changes in read workload demand, ensuring consistent read performance without manual intervention. This is ideal for read-heavy workloads where traffic patterns fluctuate, as it dynamically adds or removes replicas based on target metrics like CPU utilization or connections.

Exam trap

The trap here is confusing Multi-AZ standby replicas (which are not accessible for reads) with Aurora Replicas (which are dedicated read endpoints), leading candidates to incorrectly select Multi-AZ as a read-scaling solution.

Full explanation →
354
MCQeasy

A company wants to migrate an on-premises SQL Server database to Amazon RDS for SQL Server. They need to convert stored procedures and functions. Which AWS service should they use?

A.AWS CloudEndure Migration
B.AWS DMS
C.AWS SCT
D.AWS Snowball
AnswerC

SCT converts schema and code objects.

Why this answer

AWS SCT (Schema Conversion Tool) is the correct service because it specializes in converting database schemas, including stored procedures and functions, from one engine to another. For migrating on-premises SQL Server to Amazon RDS for SQL Server, SCT can analyze and convert the schema objects, handling syntax differences and compatibility issues automatically.

Exam trap

The trap here is that candidates confuse AWS DMS with schema conversion, but DMS only moves data and does not convert stored procedures or functions, which requires a separate schema conversion tool like AWS SCT.

How to eliminate wrong answers

Option A is wrong because AWS CloudEndure Migration is designed for block-level replication of entire servers (OS, applications, data) for lift-and-shift migrations, not for schema or code conversion. Option B is wrong because AWS DMS (Database Migration Service) handles data replication and ongoing synchronization, but it does not convert stored procedures, functions, or other schema objects—it moves data as-is. Option D is wrong because AWS Snowball is a physical data transfer device for large-scale data movement, not a tool for schema or code conversion.

Full explanation →
355
MCQhard

A company is using Amazon ElastiCache for Redis as a caching layer in front of an Amazon Aurora MySQL database. The application is experiencing higher latency than expected. Which database design pattern should the specialist recommend to improve read performance?

A.Increase the ElastiCache cluster size to accommodate more data.
B.Enable Multi-AZ on the ElastiCache cluster and use read replicas.
C.Use Aurora Replicas to offload read traffic from the primary instance.
D.Implement Amazon DynamoDB Accelerator (DAX) in front of Aurora.
AnswerC

Aurora Replicas can handle read queries and reduce latency.

Why this answer

The application is experiencing higher latency than expected despite using ElastiCache for Redis. This indicates that the cache is not effectively absorbing read traffic, likely due to cache misses or insufficient cache hit ratio. By using Aurora Replicas, read traffic can be offloaded from the primary Aurora instance, reducing load and improving read performance directly at the database layer, which complements the caching layer.

Exam trap

The trap here is that candidates may assume that increasing cache capacity (Option A) or adding cache replicas (Option B) will solve read performance issues, but the real problem is that the cache is not effectively reducing database load, so the solution must address the database read path directly with Aurora Replicas.

How to eliminate wrong answers

Option A is wrong because simply increasing the ElastiCache cluster size does not address the root cause of high latency; it only provides more capacity for data, but if the cache hit ratio is low or the application is not using the cache effectively, more nodes will not reduce latency. Option B is wrong because enabling Multi-AZ on ElastiCache provides high availability and failover, but does not improve read performance; read replicas in ElastiCache are not used to offload read traffic in the same way as database read replicas, and Multi-AZ is for redundancy, not read scaling. Option D is wrong because Amazon DynamoDB Accelerator (DAX) is an in-memory cache for DynamoDB, not for Aurora MySQL; it is incompatible with Aurora and would require migrating the database to DynamoDB, which is not a recommended pattern for this scenario.

Full explanation →
356
MCQmedium

A company uses Amazon Aurora MySQL. They notice that the DB cluster's failover took longer than expected during a recent primary instance failure. CloudWatch shows Failover latency of 120 seconds. Which configuration change would most likely reduce the failover time?

A.Increase the instance class of the primary and replica instances.
B.Increase the backup retention period to 35 days.
C.Enable Multi-AZ on the DB cluster.
D.Configure the application to use the cluster endpoint with Aurora JDBC driver's fast failover feature.
AnswerD

Using the cluster endpoint with the Aurora JDBC driver's fast failover feature reduces failover time by enabling the driver to quickly detect the new writer and reconnect without waiting for DNS propagation.

Why this answer

Configuring the application to use the cluster endpoint with the Aurora JDBC driver's fast failover feature allows the driver to quickly detect the new writer after a failover and reconnect, significantly reducing the perceived failover time by avoiding DNS propagation delays. Option A is incorrect because increasing the instance class improves performance but does not affect failover speed. Option B is incorrect because backup retention period is unrelated to failover latency.

Option C is incorrect because Aurora MySQL is already Multi-AZ by design; enabling Multi-AZ is not a separate configuration step.

Full explanation →
357
MCQmedium

A company uses Amazon ElastiCache for Redis as a caching layer for a web application. They notice increased latency and cache miss rates. The cache cluster has 5 nodes with replication. Which metric should be monitored to identify if the cache is under-provisioned?

A.ReplicationLag
B.CacheHits
C.CPUUtilization
D.Evictions
AnswerC

High CPU suggests nodes are processing too many requests.

Why this answer

High CPUUtilization indicates the cache nodes are overloaded, suggesting the cache is under-provisioned and cannot handle the request volume. Option A is incorrect because ReplicationLag measures replication delays, not overall capacity. Option B is incorrect because CacheHits measure cache effectiveness, but a high miss rate could be due to capacity or other factors; CPU is more direct for throughput.

Option D is incorrect because Evictions occur when memory is full, but CPU utilization is a better indicator of processing capacity constraints.

Full explanation →
358
MCQeasy

A developer is troubleshooting slow queries in Amazon RDS for MySQL. The 'Threads_running' status variable is consistently above 200. The application uses connection pooling. Which metric should be monitored to identify the root cause?

A.Innodb_row_lock_current_waits
B.Queries_per_second
C.Slow_queries
D.Threads_connected
AnswerA

High thread count with many lock waits indicates contention.

Why this answer

High 'Threads_running' consistently above 200 often indicates queries waiting on locks or I/O. 'Innodb_row_lock_current_waits' directly measures the number of row lock waits, which is a common cause of blocked queries when connection pooling is used. Option B is wrong because 'Queries_per_second' measures throughput, not concurrent active queries. Option C is wrong because 'Slow_queries' counts only queries exceeding a time threshold, not all concurrent queries.

Option D is wrong because 'Threads_connected' shows the number of open connections, not necessarily active queries; with connection pooling, many connections may be idle.

Full explanation →
359
MCQmedium

An IAM policy is attached to a role used by an application to access an Amazon RDS for MySQL DB instance. The DB instance is encrypted with a customer-managed KMS key. The application is unable to create a snapshot of the encrypted DB instance. Which missing permission is the most likely cause?

A.kms:ReEncrypt
B.kms:DescribeKey
C.kms:CreateGrant
D.kms:Encrypt
AnswerC

RDS needs kms:CreateGrant to authorize RDS to use the KMS key for snapshot operations.

Why this answer

To create a snapshot of an encrypted RDS DB instance, the IAM role must have the kms:CreateGrant permission on the customer-managed KMS key. This permission allows RDS to create a grant that enables it to use the key for encrypting the snapshot. Without kms:CreateGrant, the snapshot creation fails.

Options A (kms:ReEncrypt), B (kms:DescribeKey), and D (kms:Encrypt) are not required for this operation.

Full explanation →
360
MCQhard

A database administrator runs the above CLI command. The output shows that 'mydb' is a read replica of 'mydb-source'. The administrator wants to promote 'mydb' to a standalone instance with no downtime. Which action should be taken?

A.Use the promote-read-replica CLI command.
B.Modify the DB instance to enable Multi-AZ, which automatically promotes it.
C.Create a snapshot of the read replica and restore it as a new DB instance.
D.Modify the DB instance class to a larger size to force promotion.
AnswerA

Promoting a read replica makes it a standalone instance without downtime.

Why this answer

The `promote-read-replica` CLI command is the correct action because it transitions the read replica from a replication slave to a standalone primary DB instance without requiring any downtime. During promotion, RDS stops replication and makes the replica writable, but the instance remains available throughout the process. This is the only method that achieves zero downtime promotion directly.

Exam trap

The trap here is that candidates may confuse promoting a read replica with other high-availability or backup operations, such as Multi-AZ or snapshot restore, which do not achieve the same zero-downtime promotion goal.

How to eliminate wrong answers

Option B is wrong because enabling Multi-AZ on a read replica does not promote it; Multi-AZ provides high availability by creating a standby in a different Availability Zone, but the replica remains a read replica until explicitly promoted. Option C is wrong because creating a snapshot and restoring it as a new instance incurs downtime during the snapshot and restore process, and it does not promote the existing read replica—it creates a separate, independent instance. Option D is wrong because modifying the DB instance class does not trigger promotion; changing the instance size is a scaling operation that does not alter the replication role of the read replica.

Full explanation →
361
MCQmedium

A company is running an Amazon RDS for MySQL DB instance with Multi-AZ deployment. The database experiences a failover due to a hardware failure. After the failover, the application team reports that a critical stored procedure is missing. What should the database administrator do to prevent this issue in the future?

A.Create the stored procedure as a function instead.
B.Modify the DB parameter group to enable binary logging.
C.Ensure that the stored procedure is created on both the primary and standby instances by using a script or manually recreating it after failover.
D.Increase the binlog retention period to ensure the stored procedure is captured.
AnswerB

Correct. Enabling binary logging ensures all DDL changes are logged, which helps in replication consistency and provides the ability to recover from replication issues that might cause a stored procedure to be missing after failover.

Why this answer

In Amazon RDS MySQL Multi-AZ deployments, all database objects including stored procedures are replicated via synchronous storage-level replication. Therefore, a missing stored procedure after a failover is unlikely and indicates a potential replication issue. To prevent this, enabling binary logging ensures that DDL statements (such as CREATE PROCEDURE) are captured in binary logs.

This allows binary log replication to maintain consistency, reduces the risk of orphaned objects, and provides the ability to recover using point-in-time restore if needed. Thus, modifying the DB parameter group to enable binary logging is the best preventive measure.

Full explanation →
362
MCQmedium

Refer to the exhibit. A developer runs the command against an RDS MySQL instance. The application team reports that the database is experiencing high read latency during peak hours. The database is not currently in Multi-AZ. What is the MOST cost-effective way to reduce read latency?

A.Enable Multi-AZ to distribute reads to the standby.
B.Upgrade the instance to db.r5.2xlarge.
C.Migrate to Aurora MySQL with a read replica.
D.Create a read replica in the same region.
AnswerD

Offloads read traffic; cost-effective.

Why this answer

Creating a read replica in the same region offloads read traffic from the primary RDS MySQL instance, reducing read latency during peak hours without incurring the cost of a larger instance or a full Aurora migration. Read replicas are asynchronous and can serve SELECT queries, providing a cost-effective scaling solution for read-heavy workloads.

Exam trap

The trap here is that candidates often confuse Multi-AZ with read scaling, assuming the standby can serve reads, but in RDS MySQL Multi-AZ, the standby is only used for failover and cannot accept connections.

How to eliminate wrong answers

Option A is wrong because Multi-AZ is designed for high availability and failover, not for distributing reads; the standby in a Multi-AZ deployment cannot serve read traffic. Option B is wrong because upgrading to a larger instance (db.r5.2xlarge) increases cost without addressing the root cause of read contention, and may not be the most cost-effective solution. Option C is wrong because migrating to Aurora MySQL with a read replica involves significant migration effort and cost, and is not the most cost-effective immediate fix for high read latency.

Full explanation →
363
MCQeasy

A company has an Amazon S3 bucket that stores database backup files. The backups are encrypted using server-side encryption with AWS KMS (SSE-KMS). The security team wants to ensure that only a specific IAM role can decrypt the backups when restoring the database. Which policy should be attached to the KMS key to achieve this?

A.An S3 bucket policy that grants kms:Decrypt to the IAM role.
B.An S3 bucket policy that grants s3:GetObject to the IAM role.
C.An IAM policy attached to the role that grants kms:Decrypt.
D.A KMS key policy that grants kms:Decrypt to the IAM role.
AnswerD

The KMS key policy controls who can use the key for decryption.

Why this answer

A KMS key policy can grant the kms:Decrypt permission to a specific IAM role, ensuring only that role can decrypt the backups. Option A is incorrect because an S3 bucket policy cannot grant kms:Decrypt; KMS permissions are controlled via KMS key policies or IAM policies. Option B is incorrect because s3:GetObject alone does not enable decryption of SSE-KMS encrypted objects; decryption also requires kms:Decrypt.

Option C is incorrect because an IAM policy attached to the role that grants kms:Decrypt is not sufficient unless the KMS key policy also allows the role to use the key; the key policy must explicitly grant permission to the role or the root account.

Full explanation →
364
MCQmedium

A company runs an Amazon RDS for PostgreSQL DB instance with Multi-AZ enabled. The primary instance is in us-east-1a and the standby is in us-east-1b. During a routine audit, the security team discovers that database connections are being terminated unexpectedly. The database administrator reviews the RDS events and sees an event: 'A Multi-AZ failover has been completed.' What step should be taken to determine the cause of this failover?

A.Examine Amazon CloudWatch metrics for increased CPU or memory usage
B.Check the RDS console for maintenance windows
C.Review RDS events and AWS CloudTrail logs for API calls related to the failover
D.Run the describe-db-instances CLI command to check the status of the standby
AnswerC

RDS events and CloudTrail logs capture API calls and system events that can reveal the exact cause of the failover, such as a manual failover request or underlying hardware issues.

Why this answer

Reviewing RDS events and AWS CloudTrail logs is the correct step because these services record detailed information about the failover, including any API calls that may have triggered the failover or underlying issues. Option A is incorrect because CloudWatch metrics show resource utilization (CPU, memory) but do not directly indicate the cause of a failover. Option B is incorrect because maintenance windows are scheduled events; although they may cause failovers, simply checking the console for maintenance windows does not provide a definitive cause for an unexpected failover.

Option D is incorrect because the describe-db-instances CLI command shows the current status of instances (e.g., whether the standby is available) but does not provide historical information about why the failover occurred.

Full explanation →
365
MCQmedium

A company runs a production Amazon RDS for MySQL Multi-AZ DB instance. The database experiences a failover event. After the failover, the application team reports increased latency for write operations. Which action should be taken to investigate the issue?

A.Increase the allocated storage for the DB instance to reduce I/O contention.
B.Enable automated backups and configure a backup window.
C.Verify that the application is using the correct DB endpoint and that DNS has propagated.
D.Modify the DB instance to a larger instance class to improve write performance.
AnswerC

After failover, the DNS record updates to point to the new primary; ensuring the application resolves the correct endpoint is critical.

Why this answer

After a failover, the DNS record updates to point to the new primary. If DNS has not propagated, the application may be connecting to the old primary or experiencing routing issues, leading to increased write latency. Verifying DNS resolution ensures the application is using the correct endpoint.

Option A is incorrect because increasing storage does not directly address latency caused by DNS propagation; it might help with I/O contention under normal conditions, but it is not the appropriate first step for investigating post-failover latency.

Option B is incorrect because automated backups do not impact write latency; they run in the background and do not interfere with database operations.

Option D is incorrect because changing the instance class can improve performance, but the immediate issue after failover is likely DNS propagation, not insufficient compute capacity.

Full explanation →
366
MCQhard

A company is using an Amazon DynamoDB table with a global table configuration across two AWS regions. The security team wants to ensure that all data is encrypted in transit between the regions. What should the team do?

A.Configure an Internet gateway in each region and enforce HTTPS for all traffic.
B.Use AWS CloudFront to route traffic between the regions with SSL/TLS termination.
C.Set up a VPC peering connection between the two regions and route DynamoDB traffic through it.
D.No additional action is required; DynamoDB global tables encrypt all replication traffic in transit by default.
AnswerD

Replication traffic between regions is automatically encrypted.

Why this answer

DynamoDB global tables automatically encrypt all replication traffic in transit using TLS, so no additional configuration is required. Option A is incorrect because internet gateways are not involved in inter-region replication; DynamoDB global tables use the AWS backbone network. Option B is incorrect because CloudFront is a content delivery network and does not handle DynamoDB replication traffic.

Option C is incorrect because VPC peering is not required; global tables operate outside of VPCs and do not traverse VPC peering connections.

Full explanation →
367
MCQmedium

A company is running Amazon RDS for MySQL and notices that the database CPU utilization is consistently above 80% during peak hours. The application performance is degrading. Which action should be taken first to troubleshoot the issue?

A.Increase the instance size of the RDS instance immediately.
B.Create a read replica to offload read traffic.
C.Enable Performance Insights to identify the queries causing high CPU usage.
D.Switch the database engine to Amazon Aurora for better performance.
AnswerC

Performance Insights helps identify performance bottlenecks.

Why this answer

Enabling Performance Insights provides detailed analysis of database performance, helping to identify the root cause of high CPU utilization. Option A is wrong because increasing instance size without understanding the cause may lead to unnecessary costs. Option B is wrong because creating a read replica does not directly address CPU utilization on the primary instance.

Option D is wrong because switching to a different database engine is a major change and not a troubleshooting step.

Full explanation →
368
MCQeasy

A developer needs to grant an IAM user permission to perform automated backups of an Amazon RDS DB instance. Which IAM action should be allowed?

A.rds:BackupDBInstance
B.rds:CreateDBSnapshot
C.rds:RestoreDBInstanceFromDBSnapshot
D.rds:ModifyDBInstance
AnswerD

rds:ModifyDBInstance allows modifying the backup retention period to enable automated backups, which is the correct action for automated backups.

Why this answer

The question asks for the IAM action to perform automated backups of an Amazon RDS DB instance. Automated backups are managed by setting the backup retention period, which is configured using the ModifyDBInstance API call. Therefore, the correct IAM action is rds:ModifyDBInstance (option D).

Option A (rds:BackupDBInstance) is not a valid IAM action. Option B (rds:CreateDBSnapshot) is for manual snapshots, not automated backups. Option C (rds:RestoreDBInstanceFromDBSnapshot) is for restoration.

Full explanation →
369
MCQeasy

A company needs to store and query a graph of relationships between users for a recommendation engine. The queries involve traversing multiple edges. Which AWS database service is most suitable?

A.Amazon DynamoDB with adjacency list design
B.Amazon Neptune
C.Amazon DocumentDB (with MongoDB compatibility)
D.Amazon RDS for PostgreSQL with recursive CTEs
AnswerB

Neptune is optimized for graph traversals and supports Gremlin and SPARQL.

Why this answer

Amazon Neptune is a fully managed graph database service purpose-built for storing and traversing highly connected data. It supports both property graph (Gremlin, openCypher) and RDF (SPARQL) models, making it ideal for recommendation engines that require multi-edge traversals across user relationships.

Exam trap

The trap here is that candidates often choose DynamoDB with adjacency lists (Option A) because they assume any NoSQL database can handle graphs, but they overlook the fundamental architectural mismatch: DynamoDB's partition-based access pattern cannot efficiently support multi-hop traversals without costly fan-out queries.

How to eliminate wrong answers

Option A is wrong because DynamoDB is a key-value and document database that lacks native graph traversal capabilities; an adjacency list design would require multiple round-trip queries and client-side joins, leading to high latency and complexity for multi-edge traversals. Option C is wrong because DocumentDB is a document database (MongoDB-compatible) that does not support graph-specific query languages or efficient multi-hop relationship traversal; it would require manual joins and application-level logic. Option D is wrong while PostgreSQL with recursive CTEs can model graphs, it is not a purpose-built graph database; it lacks native graph storage, indexing, and traversal optimizations, resulting in poor performance for deep or complex graph queries compared to Neptune.

Full explanation →
370
MCQmedium

A team is migrating an on-premises Oracle database to Amazon Aurora PostgreSQL. The database is 2 TB and has a 6-hour maintenance window. Which AWS service should the team use to minimize downtime?

A.AWS Database Migration Service (AWS DMS)
B.Amazon S3 Transfer Acceleration
C.AWS Snowball Edge
D.Amazon EC2 with Oracle installed
AnswerA

DMS supports heterogeneous migrations with minimal downtime.

Why this answer

AWS DMS is the correct choice because it can perform a live migration from Oracle to Aurora PostgreSQL with minimal downtime using ongoing replication (change data capture). It supports heterogeneous migrations, automatically converting the source schema and data types, and can handle a 2 TB database within the 6-hour maintenance window by using multiple parallel tasks and large instance types.

Exam trap

AWS often tests the misconception that offline transfer services like Snowball are suitable for minimal-downtime migrations, but the trap here is that Snowball requires a full data export and import, which cannot achieve the sub-hour cutover needed within a 6-hour maintenance window.

How to eliminate wrong answers

Option B (Amazon S3 Transfer Acceleration) is wrong because it only speeds up uploads to S3 over the internet but does not provide any database migration or replication capabilities, nor does it support ongoing synchronization to minimize downtime. Option C (AWS Snowball Edge) is wrong because it is designed for offline, bulk data transfer of large datasets (e.g., 2 TB) and cannot perform live, ongoing replication; using it would require a full data dump and reload, causing significant downtime beyond the 6-hour window. Option D (Amazon EC2 with Oracle installed) is wrong because it simply rehosts the Oracle database on AWS without addressing the migration to Aurora PostgreSQL, and it does not provide any native mechanism for minimal-downtime heterogeneous migration or schema conversion.

Full explanation →
371
MCQhard

A company is deploying a new web application on AWS. The application uses Amazon RDS for MySQL with a Multi-AZ deployment. The application team wants to reduce latency for read-heavy workloads. Which action should be taken?

A.Enable Multi-AZ on the existing RDS instance
B.Increase the instance size of the primary RDS instance
C.Add a read replica in the same Region
D.Switch from RDS to Amazon DynamoDB with DAX
AnswerC

Read replicas can handle read queries, reducing load on the primary and improving latency.

Why this answer

Adding a read replica in the same Region offloads read-heavy workloads from the primary RDS instance, reducing latency for read queries because replicas serve read traffic directly. Amazon RDS for MySQL read replicas use asynchronous replication and can be promoted to a primary instance if needed, making this the most effective and cost-efficient solution for read scaling.

Exam trap

The trap here is that candidates confuse Multi-AZ (which provides failover and high availability) with read replicas (which provide read scaling), leading them to incorrectly select Option A or B, thinking that adding Multi-AZ or a larger instance will reduce read latency.

How to eliminate wrong answers

Option A is wrong because Multi-AZ is already enabled per the question, and enabling it again does nothing; Multi-AZ provides high availability, not read scaling. Option B is wrong because increasing the instance size of the primary RDS instance may improve overall throughput but does not specifically reduce latency for read-heavy workloads, as the primary still handles all writes and reads, and scaling vertically is less efficient than horizontal read scaling. Option D is wrong because switching to DynamoDB with DAX is a complete database migration that introduces significant architectural changes, complexity, and potential application rewrites, which is unnecessary when a simple read replica can solve the latency issue.

Full explanation →
372
Multi-Selecthard

Which THREE considerations are important when deploying Amazon Aurora Global Database? (Choose 3.)

Select 3 answers
A.AWS DMS must be used to set up replication
B.Each secondary region can have up to 16 read replicas
C.Cross-region read replicas are created for each secondary region
D.Amazon S3 is used to store transaction logs
E.Replication is typically less than 1 second between regions
AnswersB, C, E

Correct. Each secondary region can have up to 16 read replicas.

Why this answer

Amazon Aurora Global Database allows each secondary region to have up to 16 read replicas, enabling low-latency global reads. Option C is correct because a secondary region gets its own Aurora cluster that functions as a cross-region read replica. Option E is correct because replication between the primary and secondary regions typically completes in less than one second, ensuring near-real-time data consistency.

Options A and D are incorrect: AWS DMS is not required for Aurora Global Database replication (it uses built-in storage-based replication), and transaction logs are stored in Aurora's storage layer, not in Amazon S3.

Exam trap

The trap here is that candidates often confuse Aurora Global Database with standard cross-region read replica setups (which use MySQL binary log replication) and incorrectly assume that cross-region read replicas are not created in each secondary region, or that AWS DMS or S3 is involved.

Full explanation →
373
MCQmedium

A healthcare company runs a critical application on Amazon RDS for PostgreSQL with a Multi-AZ deployment. The database stores patient records and must comply with HIPAA regulations. Recently, a security audit revealed that the database is using the default port 5432 and that SSL connections are not enforced. The security team requires that all connections to the database use SSL and that the default port be changed to 5439 to reduce the risk of automated attacks. The database administrator needs to implement these changes with minimal downtime. What should the administrator do?

A.Create a new RDS instance with the desired settings, migrate the data using pg_dump, and update the application connection string.
B.Update the security group inbound rules to only allow traffic on port 5439 and enforce SSL at the network level.
C.Modify the default DB parameter group to change the port and enable SSL, then apply it to the instance without a reboot.
D.Modify the DB parameter group associated with the instance to set 'ssl' to '1' and 'port' to 5439. Reboot the instance to apply the changes.
AnswerD

Parameter changes require a reboot; this method has minimal downtime.

Why this answer

Modifying the DB parameter group to require SSL (set 'ssl' to '1') and change the port to 5439, then rebooting the instance, applies the changes with minimal downtime (a few minutes). Option A is wrong because creating a new RDS instance and migrating with pg_dump involves significant downtime and complexity. Option B is wrong because updating security group inbound rules only controls network access, not database-level SSL enforcement; SSL must be enabled on the database itself.

Option C is wrong because you cannot modify the default DB parameter group; you must use a custom parameter group, and changing the port requires a reboot.

Full explanation →
374
MCQmedium

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all data be encrypted at rest using a key stored in AWS CloudHSM. What must be done to meet this requirement?

A.Enable RDS encryption at rest using a KMS key backed by CloudHSM.
B.Create an encrypted file system on the RDS instance using CloudHSM.
C.Configure SSL/TLS for the database connection.
D.Use Oracle Transparent Data Encryption (TDE) with CloudHSM as the key store.
AnswerD

RDS Oracle supports TDE with CloudHSM.

Why this answer

Use Oracle Transparent Data Encryption (TDE) with CloudHSM as the key store. RDS for Oracle supports TDE, which allows encryption at rest using keys stored in CloudHSM. Option A is incorrect because RDS encryption at rest uses AWS KMS, and while KMS can use a CloudHSM key as a custom key store, the question specifies the key must be stored in CloudHSM directly, which is achieved via TDE integration.

Option B is incorrect because RDS does not support custom file system encryption; encryption at rest is managed at the database or instance level. Option C is incorrect because SSL/TLS provides encryption in transit, not at rest.

Full explanation →
375
MCQmedium

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database is 2 TB in size. The company wants to minimize downtime during the migration. Which AWS service should be used to perform an online migration with minimal downtime?

A.AWS Direct Connect
B.AWS Database Migration Service (DMS)
C.AWS Snowball
D.Amazon S3
AnswerB

DMS supports continuous replication for minimal downtime migration.

Why this answer

AWS Database Migration Service (DMS) supports ongoing replication to minimize downtime. Snowball is for offline data transfer. S3 is not a migration service.

Direct Connect provides a dedicated network connection but is not a migration service itself.

Full explanation →
Page 4

Page 5 of 23

Page 6

All pages

1234567891011121314151617181920212223

Practice DBS-C01 by domain

Target a specific domain to shore up weak areas.

Workload-Specific Database DesignDeployment and MigrationManagement and OperationsMonitoring and TroubleshootingDatabase Security
See all domains with question counts →