Knowledge + Practice

AWS Certified Database Specialty DBS-C01 (DBS-C01) — Questions 376–450

1663 questions total · 23pages · All types, answers revealed

Take a mock exam Exam hub

Page 6 of 23

376

Multi-Selectmedium

A company is troubleshooting an Amazon DynamoDB table that is throttling write requests. The table has a partition key ('userId') and a sort key ('timestamp'). The 'WriteCapacityUnits' is set to 1000. CloudWatch shows 'ThrottledWriteRequests' but the 'ConsumedWriteCapacityUnits' is only 500. Which TWO actions could resolve the throttling?

Select 2 answers

A.Add a random suffix to the partition key to distribute writes more evenly

B.Enable DynamoDB Accelerator (DAX) to cache writes

C.Increase the write capacity units to allow more throughput

D.Enable Global Tables to replicate writes across regions

E.Remove the sort key and use only a partition key

AnswersA, C

Randomizing the partition key helps distribute write load across partitions, reducing throttling.

Why this answer

The issue is throttling on write requests despite consumed capacity below provisioned. This indicates a hot partition where one partition receives more writes than its limit (1000 WCU per partition). Option A (add random suffix to partition key) distributes writes across partitions, preventing any single partition from exceeding its limit.

Option C (increase write capacity units) can increase the number of partitions, thereby distributing the load and potentially raising the per-partition limit. Option B is incorrect because DAX is a read cache and does not affect write throughput. Option D (Global Tables) does not resolve throttling and may add latency.

Option E (removing sort key) does not address partition hotness.

Exam trap

Candidates often confuse throttling due to hot partitions with overall capacity shortage. They may think increasing capacity is unnecessary when consumed capacity is low, but it can help by increasing partitions.

Full explanation →

377

MCQhard

A company wants to audit all SQL queries made to their Amazon RDS for MySQL database. Which AWS service should they use?

A.VPC Flow Logs

B.AWS Config

C.AWS CloudTrail

D.Database Activity Streams

AnswerD

Database Activity Streams for Amazon RDS for MySQL push transactional logs directly to Amazon Kinesis, enabling near-real-time capture of all SQL queries at the database engine level. This satisfies the audit requirement without enabling slow query logs or general logs, which would impose performance overhead. The stream integrates with AWS CloudTrail and third-party monitoring tools for compliance analysis.

Why this answer

Database Activity Streams (D) is the correct choice because it provides a near-real-time stream of database activity, including all SQL queries, directly from the RDS for MySQL engine. This service integrates with AWS services like Amazon Kinesis and third-party monitoring tools to capture and audit every SQL statement, user login, and schema change at the database engine level, which is essential for comprehensive auditing.

Exam trap

The trap here is that candidates often confuse CloudTrail (which logs AWS API calls) with database-level auditing, failing to recognize that CloudTrail does not capture SQL queries executed inside the database engine.

How to eliminate wrong answers

Option A is wrong because VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol) at the network interface level, not SQL query content or database operations. Option B is wrong because AWS Config records resource configuration changes (e.g., DB instance settings, security group rules) and evaluates compliance, but it does not capture SQL query execution or database-level activity. Option C is wrong because AWS CloudTrail logs API calls made to the RDS service (e.g., CreateDBInstance, ModifyDBInstance) but does not capture SQL queries executed within the database session itself.

Full explanation →

378

MCQhard

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database contains personally identifiable information (PII). The security team requires that all PII columns be transparently encrypted and that the encryption keys be stored in AWS CloudHSM. Which solution meets these requirements?

A.Enable Amazon RDS encryption at rest using a KMS key and rely on that encryption.

B.Modify the Oracle database to use AWS KMS for column-level encryption.

C.Use Oracle Data Pump to export data with encryption and store the encryption key in AWS Secrets Manager.

D.Use Oracle Transparent Data Encryption (TDE) with AWS CloudHSM as the key store.

AnswerD

Oracle TDE provides transparent column encryption, and CloudHSM can serve as the hardware security module for key storage.

Why this answer

Oracle Transparent Data Encryption (TDE) with AWS CloudHSM as the key store enables transparent encryption of PII columns and stores the encryption keys in CloudHSM, meeting the security requirements. Option A is wrong because Amazon RDS encryption at rest uses AWS KMS, not CloudHSM, and it encrypts the entire database instance, not specific columns. Option B is wrong because modifying an Oracle database to use AWS KMS for column-level encryption is not supported natively in RDS; Oracle TDE is required for transparent column encryption.

Option C is wrong because Oracle Data Pump is an export/import utility, not a column-level encryption solution; it does not provide transparent encryption of PII columns in the live database.

Full explanation →

379

MCQmedium

Refer to the exhibit. An IAM policy is attached to a user. The user tries to delete a database instance named 'prod-mydb' in us-east-1. What will happen?

A.The delete will be allowed because the Allow statement is broader.

B.The delete will fail with an error because the policy is invalid.

C.The delete will succeed only if the instance is tagged with 'Environment: prod'.

D.The delete will be denied because the Deny statement explicitly matches the resource.

AnswerD

Explicit Deny overrides Allow.

Why this answer

D is correct because IAM policy evaluation follows an explicit deny priority rule. Even though the Allow statement grants 'rds:DeleteDBInstance' on 'arn:aws:rds:us-east-1:*:db:*', the Deny statement explicitly matches the resource 'arn:aws:rds:us-east-1:123456789012:db:prod-mydb' and specifies 'rds:DeleteDBInstance'. Since an explicit deny overrides any allow, the delete operation will be denied.

Exam trap

The trap here is that candidates often assume a broader Allow statement will override a more specific Deny, but AWS IAM's explicit deny always wins, regardless of specificity or scope.

How to eliminate wrong answers

Option A is wrong because AWS IAM policy evaluation is not based on breadth; an explicit deny always overrides any allow, regardless of scope. Option B is wrong because the policy is syntactically valid—it contains valid Effect, Action, and Resource elements, and AWS will evaluate it without throwing an error. Option C is wrong because the Deny statement does not include a condition tag check; it unconditionally denies the specific resource, so tagging is irrelevant for this denial.

Full explanation →

380

MCQmedium

A gaming company uses Amazon DynamoDB to store player profiles and game state. The access patterns include: (1) lookup by player ID, (2) query by game ID for recent games, and (3) leaderboard queries sorted by score. The current single-table design is causing hot partitions on the leaderboard queries. What design change should the company implement to resolve hot partitions?

A.Increase the read capacity units (RCUs) on the base table to handle the load.

B.Enable DynamoDB Accelerator (DAX) to cache frequent leaderboard queries.

C.Create a GSI with the game ID as the partition key and a composite sort key of score and timestamp.

D.Shard the table by player ID and use application-level aggregation for leaderboards.

AnswerC

GSI distributes write activity and allows efficient sorted queries per game.

Why this answer

Creating a Global Secondary Index (GSI) with game ID as the partition key and a composite sort key of score and timestamp allows efficient leaderboard queries without hot partitions. This design distributes write activity across multiple partitions by game ID, while the composite sort key enables sorted queries by score and timestamp within each game, avoiding the hot partition issue caused by the original single-table design.

Exam trap

The trap here is that candidates often confuse caching solutions (like DAX) with architectural fixes for hot partitions, failing to recognize that caching does not eliminate the underlying partition-level contention caused by a skewed access pattern.

How to eliminate wrong answers

Option A is wrong because increasing RCUs on the base table does not resolve hot partitions; it only increases throughput capacity, but the underlying partition key (likely player ID) still causes all leaderboard queries to hit the same partition, leading to throttling. Option B is wrong because DynamoDB Accelerator (DAX) caches query results but does not address the root cause of hot partitions; if the leaderboard queries are write-heavy or the cache misses, the hot partition still causes performance degradation. Option D is wrong because sharding by player ID and using application-level aggregation for leaderboards introduces complexity and latency, and does not leverage DynamoDB's native indexing capabilities; it also requires custom logic to maintain sorted leaderboards, which is inefficient compared to a GSI.

Full explanation →

381

MCQeasy

A company is deploying a new web application and needs a fully managed relational database with automatic failover and read replicas. Which AWS service should they choose?

A.Amazon DynamoDB

B.Amazon RDS for MySQL with Multi-AZ deployment

C.Amazon EC2 with self-managed MySQL

D.Amazon Redshift

AnswerB

RDS is fully managed, Multi-AZ provides automatic failover, and read replicas are supported.

Why this answer

Amazon RDS for MySQL with Multi-AZ deployment provides a fully managed relational database service that automatically provisions and maintains a synchronous standby replica in a different Availability Zone. In the event of a failure, Amazon RDS automatically fails over to the standby, ensuring high availability. Additionally, RDS for MySQL supports read replicas for offloading read traffic, which meets the requirement for both automatic failover and read replicas.

Exam trap

The trap here is that candidates often confuse DynamoDB's high availability and read replicas (DAX, global tables) with relational database requirements, or they assume that a self-managed database on EC2 can be 'fully managed' by using automation scripts, but the question explicitly requires a fully managed service.

How to eliminate wrong answers

Option A is wrong because Amazon DynamoDB is a NoSQL key-value and document database, not a relational database, and it does not support SQL joins or traditional relational schemas. Option C is wrong because Amazon EC2 with self-managed MySQL requires the company to manually configure and manage the database, including failover and read replicas, which contradicts the requirement for a 'fully managed' service. Option D is wrong because Amazon Redshift is a petabyte-scale data warehouse optimized for analytical queries, not a relational database for transactional web applications, and it does not provide automatic failover or read replicas in the same manner as RDS.

Full explanation →

382

Multi-Selectmedium

A company wants to migrate a 1 TB MySQL database to Amazon Aurora MySQL with minimal downtime. The database has a high write load. Which TWO options are valid approaches? (Choose two.)

Select 2 answers

A.Use AWS DMS with full load and ongoing replication.

B.Export to flat files, transfer via AWS Snowball, and import.

C.Perform a mysqldump and restore to Aurora.

D.Use MySQL native replication to replicate to Aurora MySQL.

E.Use AWS SCT to convert the schema and then use DMS.

AnswersA, D

DMS supports CDC for minimal downtime.

Why this answer

AWS DMS supports full load and ongoing change data capture (CDC) replication, which can migrate the 1 TB MySQL database to Aurora MySQL with minimal downtime by continuously applying changes from the source binary logs. This approach handles high write loads efficiently by using transactional replication to keep the target nearly synchronized until cutover.

Exam trap

The trap here is that candidates may overlook Option D as valid because they assume native replication is not supported between MySQL and Aurora MySQL, but Aurora MySQL fully supports MySQL native replication, making it a viable low-downtime migration approach alongside DMS.

Full explanation →

383

Multi-Selectmedium

Which TWO factors should be considered when designing a database for an IoT workload that ingests millions of sensor readings per second? (Choose 2.)

Select 2 answers

A.Ensure strong consistency for all reads

B.Enforce ACID transactions for all writes

C.Implement data retention and aggregation to reduce storage costs

D.Use a time-series database for efficient storage and querying

E.Use a graph database to model relationships between sensors

AnswersC, D

Storing raw data indefinitely is expensive; aggregation reduces volume.

Why this answer

IoT workloads generate massive volumes of data, and implementing data retention policies (e.g., automatically deleting raw data after a set period) combined with aggregation (e.g., downsampling sensor readings into hourly or daily averages) directly reduces storage costs. This is a core design pattern for time-series databases like Amazon Timestream, which supports automatic retention and aggregation via scheduled queries or rollups.

Exam trap

The trap here is that candidates may confuse the need for consistency in transactional databases with the relaxed consistency models acceptable in high-throughput time-series IoT workloads, leading them to incorrectly select strong consistency or ACID transactions.

Full explanation →

384

Multi-Selectmedium

A company is building a content management system that stores articles, images, and user comments. Articles are text-heavy and need full-text search. Images are binary files. Comments are relational with user IDs. Which TWO AWS services should be combined to best support this workload?

Select 2 answers

A.Amazon ElastiCache for Redis for caching

B.Amazon DynamoDB for articles and comments

C.Amazon OpenSearch Service for full-text search

D.Amazon RDS for MySQL for articles and comments

E.Amazon S3 for images

AnswersC, E

Provides powerful search capabilities.

Why this answer

Amazon OpenSearch Service is correct because it provides full-text search capabilities, which are essential for the text-heavy articles in the content management system. It supports advanced querying, stemming, and relevance scoring, making it ideal for searching article content. Amazon S3 is correct because it is designed for storing binary files like images, offering high durability, scalability, and cost-effectiveness for object storage.

Exam trap

The trap here is that candidates often choose Amazon RDS for MySQL for both articles and comments, overlooking that full-text search in MySQL is less performant and scalable than OpenSearch for text-heavy workloads, and that S3 is the optimal service for binary files, not RDS.

Full explanation →

385

MCQeasy

A company has an Amazon Aurora MySQL DB cluster with a single writer and two readers. The writer instance fails, and the failover mechanism promotes one of the readers to writer. The application, which uses a custom connection pool, continues to experience errors for several minutes. What should the database administrator do to minimize downtime during future failovers?

A.Increase the connection pool size to handle more connections.

B.Modify the application to use the cluster endpoint instead of the instance endpoint.

C.Configure the application to use the reader endpoint for all traffic.

D.Enable Multi-AZ on the Aurora cluster.

AnswerB

The cluster endpoint automatically points to the current writer instance. After a failover, DNS is updated to point to the new writer, so using this endpoint minimizes downtime.

Why this answer

The cluster endpoint always points to the current writer, so after a failover it automatically routes to the new writer without application changes. Option A is wrong because increasing the connection pool size does not help the application detect the new writer; it could even cause more failed connections. Option C is wrong because the reader endpoint only routes to read replicas, not the writer, so write traffic would fail.

Option D is wrong because Aurora already provides Multi-AZ replication; there is no separate 'enable Multi-AZ' setting.

Full explanation →

386

MCQhard

Refer to the exhibit. An IAM policy is attached to a user who is attempting to run a Scan operation on the Orders table using the AWS CLI. The Scan operation fails with an AccessDeniedException. What is the most likely reason?

A.The resource ARN does not include the table name.

B.The Scan action is not allowed in the policy.

C.The condition requires the partition key to be 'CustomerID', but the Scan operation does not specify a partition key.

D.The 'ForAllValues:StringEquals' condition set operator prevents the Scan operation because it requires all leading keys to match a single value, which is impossible for a Scan.

AnswerD

'ForAllValues' evaluates to false if the request has no leading keys (as in Scan) or multiple keys.

Why this answer

The condition 'dynamodb:LeadingKeys' applies only to Query and Scan operations when the condition key is used to restrict partition key values. However, the condition 'ForAllValues:StringEquals' requires that all leading keys in the request match the specified value. For a Scan operation without a specific partition key, the condition cannot be satisfied, leading to denial.

Option A is incorrect because the resource ARN includes the table name, so it is valid. Option B is incorrect because the policy allows Scan action. Option C is incorrect because the condition is on LeadingKeys, not on the table.

Full explanation →

387

MCQeasy

A company wants to deploy a highly available Amazon RDS for MySQL database across two Availability Zones. Which feature should be enabled?

A.Read replicas in a different AZ

B.Automated backups with retention

C.Enhanced Monitoring

D.Multi-AZ deployment

AnswerD

Multi-AZ provides synchronous standby for automatic failover.

Why this answer

Multi-AZ deployment synchronously replicates data to a standby instance in a different Availability Zone, providing automatic failover in case of an AZ outage. This is the correct feature for achieving high availability across two Availability Zones, as it ensures minimal downtime without manual intervention.

Exam trap

The trap here is that candidates often confuse read replicas with Multi-AZ deployments, thinking that placing a read replica in a different AZ provides high availability, but read replicas are asynchronous and do not support automatic failover.

How to eliminate wrong answers

Option A is wrong because read replicas are designed for read scaling and do not provide automatic failover or synchronous replication; they are asynchronous and can have replication lag. Option B is wrong because automated backups are for point-in-time recovery and disaster recovery, not for real-time high availability or automatic failover across AZs. Option C is wrong because Enhanced Monitoring provides OS-level metrics for performance tuning, not high availability or failover capabilities.

Full explanation →

388

MCQhard

Refer to the exhibit. An IAM policy statement allows creating manual snapshots for an RDS instance. A database administrator is unable to create a snapshot from the AWS Management Console. The error message indicates insufficient permissions. What is the likely cause?

A.The condition key 'aws:RequestedRegion' is misspelled.

B.The policy does not include necessary read actions (e.g., 'DescribeDBInstances', 'DescribeDBSnapshots') that the console uses.

C.The resource ARN is incorrect; it should include the snapshot ARN.

D.The condition uses 'StringEquals' but should use 'StringLike' for region matching.

AnswerB

The console requires read permissions to list instances and snapshots before creating a snapshot.

Why this answer

The AWS Management Console often performs multiple API calls (such as DescribeDBInstances and DescribeDBSnapshots) to list and display resources before allowing actions. Even if the CreateDBSnapshot action is allowed, the console will fail if it cannot describe the instance or snapshots. Option A is incorrect because the condition key 'aws:RequestedRegion' is correctly spelled.

Option C is incorrect because the resource ARN correctly identifies the RDS instance for snapshot creation. Option D is incorrect because StringEquals is appropriate for matching the region exactly; StringLike is not needed.

Full explanation →

389

MCQeasy

A developer is configuring an RDS for PostgreSQL instance for a new application. The application requires automatic failover to a standby instance in a different Availability Zone. Which deployment option should be selected?

A.Deploy a Single-AZ instance with a read replica.

B.Deploy a Multi-AZ instance.

C.Deploy a Single-AZ instance and take frequent snapshots.

D.Deploy a Single-AZ instance with a cross-region read replica.

AnswerB

Multi-AZ provides automatic failover.

Why this answer

Multi-AZ deployment for RDS PostgreSQL automatically provisions and maintains a synchronous standby replica in a different Availability Zone. In the event of a failure or Availability Zone outage, Amazon RDS automatically fails over to the standby, providing high availability without manual intervention. This meets the requirement for automatic failover to a standby instance in a different AZ.

Exam trap

The trap here is that candidates often confuse read replicas (asynchronous, manual promotion) with Multi-AZ (synchronous, automatic failover), assuming any secondary instance provides automatic failover.

How to eliminate wrong answers

Option A is wrong because a Single-AZ instance with a read replica provides asynchronous replication and does not support automatic failover; the read replica must be manually promoted, which is not automatic. Option C is wrong because taking frequent snapshots provides point-in-time recovery but does not create a standby instance or enable automatic failover; recovery requires manual restoration. Option D is wrong because a cross-region read replica is asynchronous and intended for disaster recovery across regions, not for automatic failover within the same region; it also requires manual promotion.

Full explanation →

390

MCQhard

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database is 2 TB in size and has a high transaction rate. The migration must have minimal downtime and support ongoing replication. Which AWS service should be used for the migration?

A.AWS Schema Conversion Tool (AWS SCT)

B.AWS Database Migration Service (AWS DMS)

C.AWS Direct Connect

D.Amazon RDS Read Replica

AnswerB

AWS DMS supports ongoing replication from on-premises to RDS, enabling minimal downtime migrations.

Why this answer

AWS DMS is the correct service because it supports ongoing replication (change data capture) from an on-premises Oracle source to Amazon RDS for Oracle, enabling a migration with minimal downtime. It can handle a 2 TB database by using a full load followed by continuous replication of transactions, and it supports Oracle-specific features like supplemental logging and LogMiner for CDC.

Exam trap

The trap here is that candidates confuse AWS DMS with AWS SCT, thinking SCT handles data migration, but SCT only converts schema objects and does not perform any data transfer or replication.

How to eliminate wrong answers

Option A is wrong because AWS SCT is used for schema conversion (e.g., migrating from Oracle to Aurora PostgreSQL), not for data migration or ongoing replication; it does not move actual data. Option C is wrong because AWS Direct Connect provides a dedicated network connection for lower latency and higher bandwidth, but it is not a migration service—it does not perform data replication or CDC. Option D is wrong because Amazon RDS Read Replica is used for offloading read traffic or disaster recovery within AWS, not for migrating data from an on-premises database; it cannot connect to an external Oracle source.

Full explanation →

391

MCQmedium

A company is building a document management system where each document can have multiple attributes (tags) that need to be queried efficiently. The workload is write-heavy with occasional reads. Which database is best suited?

A.Amazon QLDB

B.Amazon DynamoDB

C.Amazon ElastiCache for Redis

D.Amazon RDS for MySQL

AnswerB

DynamoDB allows flexible attributes and global secondary indexes for efficient queries.

Why this answer

Amazon DynamoDB is the best choice for a write-heavy, document management system with tag-based queries because it is a fully managed NoSQL key-value and document database that delivers single-digit millisecond performance at any scale. Its flexible schema allows each document to have multiple attributes (tags) without predefined schemas, and its secondary indexes (LSI/GSI) enable efficient querying on those tags. DynamoDB's auto-scaling and provisioned throughput are designed to handle high write volumes, while occasional reads benefit from its consistent low-latency access.

Exam trap

AWS often tests the misconception that a ledger database (QLDB) is suitable for general-purpose document storage because of its 'immutable' and 'verifiable' features, but candidates overlook that QLDB is not designed for high write throughput or flexible attribute queries, which DynamoDB handles natively.

How to eliminate wrong answers

Option A is wrong because Amazon QLDB is a ledger database optimized for immutable, cryptographically verifiable transaction logs, not for high-throughput write-heavy document storage with flexible tag queries; it lacks native support for secondary indexes on arbitrary attributes. Option C is wrong because Amazon ElastiCache for Redis is an in-memory cache designed for sub-millisecond read-heavy workloads and transient data, not for durable, write-heavy document persistence with complex query patterns. Option D is wrong because Amazon RDS for MySQL is a relational database with a fixed schema, which would require complex join tables or EAV (Entity-Attribute-Value) patterns to handle multiple tags, leading to performance degradation under write-heavy loads and poor scalability compared to DynamoDB's distributed architecture.

Full explanation →

392

MCQmedium

A company is running a production Amazon RDS for MySQL DB instance. The database size is 500 GB and the workload is write-heavy. The team notices that the automated backups are taking longer than expected and are impacting the performance during the backup window. Which action should be taken to minimize the performance impact?

A.Disable automated backups and rely on manual snapshots taken during off-peak hours.

B.Create a read replica and configure automated backups on the replica.

C.Increase the DB instance size to improve backup performance.

D.Move the backup window to a time when the workload is lowest.

AnswerB

Offloading backups to a read replica ensures that backup operations do not affect the primary instance's performance.

Why this answer

Creating a read replica and configuring automated backups on the replica offloads the backup process from the primary DB instance. Since the workload is write-heavy, this minimizes the performance impact on the primary during the backup window. Option A is incorrect because disabling automated backups removes the ability to perform point-in-time recovery, which is risky for a production database.

Option C is incorrect because increasing the DB instance size may improve backup speed but does not eliminate the performance impact on the primary instance, and it adds unnecessary cost. Option D is incorrect because moving the backup window to a low workload time does not reduce the performance impact during that window; it only changes when the impact occurs, and the workload may still be significant.

Full explanation →

393

MCQeasy

After migrating a database to Amazon RDS, an application on an EC2 instance in the same VPC cannot connect. The command in the exhibit shows the endpoint. What is the most likely cause?

A.The EC2 instance is in a different VPC and needs a VPN connection.

B.The security group for the DB instance does not allow inbound traffic from the EC2 instance's security group.

C.The DB instance endpoint is incorrect.

D.The DB instance is not publicly accessible.

AnswerB

Security group rules control access; if not configured, connections are blocked.

Why this answer

The most likely cause is that the security group for the RDS DB instance does not have an inbound rule allowing traffic from the EC2 instance's security group on the database port (typically TCP 3306 for MySQL or 5432 for PostgreSQL). Even though both resources are in the same VPC, security groups act as virtual firewalls that must explicitly permit inbound connections from the source. The command output showing the endpoint confirms the DNS resolution works, so the issue is at the network access control layer.

Exam trap

The trap here is that candidates often assume that being in the same VPC guarantees connectivity, but AWS security groups are stateful and require explicit inbound rules, even for intra-VPC traffic, which is a core concept tested in the DBS-C01 exam.

How to eliminate wrong answers

Option A is wrong because the EC2 instance is stated to be in the same VPC, so a VPN connection is unnecessary and would not solve a connectivity issue within a single VPC. Option C is wrong because the exhibit shows the endpoint being used, and if the endpoint were incorrect, the command would likely fail with a 'Name or service not known' error rather than a connection timeout or refused error. Option D is wrong because public accessibility is irrelevant when both resources are in the same VPC; RDS instances in a VPC are accessible privately via their endpoint without needing public access enabled.

Full explanation →

394

Multi-Selecthard

A company is using Amazon Redshift and needs to comply with regulatory requirements that mandate encryption of all data at rest and control of the encryption keys. Which THREE steps should be taken? (Choose THREE.)

Select 3 answers

A.Enable automatic key rotation for the KMS key.

B.Configure the cluster to use a customer-managed KMS key.

C.Use AWS CloudHSM to generate and manage encryption keys.

D.Enable encryption on the cluster after creation by modifying the cluster.

E.Create the cluster with encryption enabled using a KMS key.

AnswersA, B, E

Automatic rotation helps meet compliance requirements.

Why this answer

Enabling automatic key rotation for the KMS key ensures that encryption keys are rotated regularly, meeting key control requirements. Option B is correct because using a customer-managed KMS key allows the company to control the encryption keys themselves. Option E is correct because Amazon Redshift requires encryption to be enabled at cluster creation time, and using a KMS key accomplishes this.

Option C is incorrect because AWS CloudHSM is not necessary for this requirement; KMS provides sufficient key management. Option D is incorrect because encryption cannot be enabled on an existing Redshift cluster; it must be enabled at creation.

Full explanation →

395

MCQmedium

A company is using Amazon RDS for MySQL with Multi-AZ deployment. The database experiences a sudden increase in latency and the application reports timeouts. CloudWatch shows elevated 'ReadLatency' and 'WriteLatency' metrics, while 'CPUUtilization' and 'DatabaseConnections' remain normal. Which is the MOST likely cause?

A.A runaway query is consuming CPU resources

B.A Multi-AZ failover occurred

C.A large transaction is being processed

D.The database has insufficient provisioned IOPS

AnswerC

Large transactions can cause high I/O wait and latency without high CPU or connections.

Why this answer

A large transaction can cause increased latency without high CPU or connection count, as it may be waiting on disk I/O or replication. Option A is wrong because a runaway query consuming CPU would show elevated CPUUtilization, which is normal. Option B is wrong because a Multi-AZ failover would cause a brief spike in latency followed by recovery, not sustained latency.

Option D is wrong because insufficient provisioned IOPS would typically show BurstBalance or IOPS metrics, not just ReadLatency and WriteLatency.

Full explanation →

396

MCQeasy

A company is using Amazon DynamoDB and wants to ensure that all data is automatically encrypted at rest. What is the default encryption status for a new DynamoDB table?

A.Encryption is optional and can be enabled during table creation.

B.Encryption is disabled by default and must be enabled manually.

C.Encryption is enabled by default using an AWS-owned key.

D.Encryption is enabled by default using a customer-managed key.

AnswerC

Default encryption uses AWS-owned KMS keys.

Why this answer

All new DynamoDB tables are encrypted at rest by default using an AWS-owned key. Option A is wrong because encryption is not optional; it is always enabled by default. Option B is wrong because encryption is enabled by default, not disabled.

Option D is wrong because the default key is AWS-owned, not a customer-managed key.

Full explanation →

397

MCQeasy

A developer notices that an Amazon RDS for PostgreSQL DB instance is running low on free storage space. The instance has 100 GB of allocated storage. What is the recommended first step to troubleshoot this issue?

A.Enable storage auto scaling

B.Modify the DB instance to increase allocated storage

C.Check for unused indexes or table bloat using pg_repack or similar tools

D.Delete the oldest transaction logs

AnswerC

Index bloat and table bloat are common causes of storage consumption.

Why this answer

Checking for unused indexes or bloat is a typical starting point for storage issues. Option A is wrong because enabling storage auto scaling is a preventive measure, not a troubleshooting step. Option B is wrong because modifying storage is a solution, not a troubleshooting step.

Option D is wrong because deleting transaction logs may not recover significant space and can affect point-in-time recovery.

Full explanation →

398

MCQhard

A company is deploying a new application that requires a globally distributed database with low latency reads. They choose Amazon DynamoDB global tables. What is a key consideration for this deployment?

A.Writes are synchronously replicated to all regions.

B.Each replica can serve reads and writes independently.

C.The table class must be DynamoDB Standard-Infrequent Access.

D.Global tables support strongly consistent reads from any region.

AnswerB

Global tables are multi-master; each region can handle both reads and writes.

Why this answer

Amazon DynamoDB global tables use a multi-master, active-active replication model. This means each replica region can independently serve both reads and writes, with eventual consistency across regions. This design enables low-latency local reads and writes for globally distributed applications, as each region operates autonomously.

Exam trap

The trap here is confusing asynchronous multi-master replication with synchronous replication, leading candidates to incorrectly assume that global tables provide strong consistency across regions or that writes are synchronous.

How to eliminate wrong answers

Option A is wrong because writes in DynamoDB global tables are replicated asynchronously, not synchronously; synchronous replication would introduce cross-region latency and conflict. Option C is wrong because global tables support any DynamoDB table class (Standard, Standard-IA, etc.), and Standard-Infrequent Access is not a requirement. Option D is wrong because global tables only support eventually consistent reads from any replica region; strongly consistent reads are only available from the region where the write was performed, as they require a quorum read from the local replica.

Full explanation →

399

MCQmedium

A company is using Amazon Redshift for data warehousing. Users report that queries are taking longer than expected. Which CloudWatch metric should be monitored to identify if queries are waiting for resources due to concurrency scaling?

A.WLMQueueLength

B.DiskSpaceUsage

C.QueryDuration

D.ConcurrencyScalingActiveQueries

AnswerD

This metric shows the number of queries running on concurrency scaling clusters.

Why this answer

ConcurrencyScalingActiveQueries measures the number of queries currently running on concurrency scaling clusters, helping identify if queries are waiting due to concurrency scaling. Option A is incorrect because WLMQueueLength indicates queries waiting in the workload management queue, not necessarily due to concurrency scaling. Option B is incorrect because DiskSpaceUsage tracks storage consumption, not query waiting.

Option C is incorrect because QueryDuration measures execution time but does not indicate waiting for concurrency scaling resources.

Full explanation →

400

Multi-Selectmedium

A company is migrating a PostgreSQL database to Amazon Aurora PostgreSQL. The database has a large table that is frequently accessed. The team wants to minimize downtime during the migration. Which TWO strategies should be used together?

Select 2 answers

A.Use AWS DMS to create a target Aurora DB cluster and replicate data.

B.Take a manual snapshot of the source database and restore it to Aurora.

C.Use AWS Schema Conversion Tool (AWS SCT) to convert the schema.

D.Use AWS DMS to perform a full load followed by ongoing replication.

E.Configure Aurora as a read replica of the PostgreSQL instance.

AnswersA, D

DMS can migrate data to Aurora with ongoing replication to minimize downtime.

Why this answer

AWS DMS can perform a full load of the source PostgreSQL database to Aurora and then set up ongoing change data capture (CDC) replication to apply incremental changes, minimizing downtime by allowing the source to remain operational until cutover. Option A is correct because DMS can create and manage the target Aurora cluster as part of the replication task, while option D is correct because the combination of full load plus ongoing replication is the standard approach for near-zero downtime migrations.

Exam trap

The DBS-C01 exam often tests the misconception that a manual snapshot or read replica setup can achieve near-zero downtime, but candidates overlook that snapshots require downtime for consistency and Aurora cannot be a read replica of an external PostgreSQL instance.

Full explanation →

401

MCQmedium

A database administrator is troubleshooting a performance issue on an Amazon RDS for SQL Server instance. The CPU utilization is consistently above 90%, and the number of database connections is high. Which Amazon CloudWatch metric should be analyzed first to determine if the issue is due to a specific query?

A.DatabaseConnections

B.ReadIOPS

C.Enhanced Monitoring (cpuUtilization per process)

D.CPUUtilization

AnswerC

Enhanced Monitoring provides per-process CPU metrics, which can help identify which process (and thus which query) is consuming the most CPU.

Why this answer

Enhanced Monitoring provides per-process CPU utilization metrics, which allow you to identify if a specific SQL Server query or session is consuming excessive CPU. Unlike aggregate metrics like CPUUtilization, Enhanced Monitoring breaks down CPU usage by process (e.g., sqlservr.exe), enabling you to pinpoint a problematic query. This is the most direct way to determine if the high CPU is driven by a specific query rather than general load.

Exam trap

The trap here is that candidates often choose CPUUtilization (Option D) because it seems directly related to CPU issues, but they overlook that Enhanced Monitoring provides the granularity needed to isolate a specific query's impact.

How to eliminate wrong answers

Option A is wrong because DatabaseConnections only shows the total number of connections, not which queries are consuming CPU; high connections can cause CPU pressure but do not identify a specific query. Option B is wrong because ReadIOPS measures disk read operations, which may correlate with query performance but does not directly indicate CPU usage per query. Option D is wrong because CPUUtilization is an aggregate instance-level metric that cannot isolate CPU usage to a specific process or query, making it insufficient for diagnosing query-level issues.

Full explanation →

402

MCQeasy

A company uses Amazon DynamoDB to store session data for a web application. The table has a partition key of 'SessionId'. The company wants to automatically expire sessions after 1 hour. Which feature should be used?

A.DynamoDB Global Tables

B.AWS Lambda function that scans the table every hour and deletes old items.

C.DynamoDB Streams

D.DynamoDB Time to Live (TTL)

AnswerD

TTL automatically deletes expired items.

Why this answer

DynamoDB Time to Live (TTL) is the correct choice because it allows you to define a per-item timestamp attribute (e.g., 'expireAt') that automatically deletes items after a specified duration—in this case, 1 hour. TTL operates at no additional cost, requires no custom code, and handles expiration asynchronously in the background, making it ideal for session data management.

Exam trap

The trap here is that candidates may confuse DynamoDB Streams (which only tracks changes) with a mechanism that can automatically expire data, or they may over-engineer a solution with Lambda scans instead of using the simpler, native TTL feature.

How to eliminate wrong answers

Option A is wrong because DynamoDB Global Tables replicate data across multiple AWS regions for low-latency access and disaster recovery, not for automatic item expiration. Option B is wrong because scanning the entire table every hour is inefficient, costly (consumes read capacity), and does not scale; it also introduces latency and potential race conditions compared to a native TTL mechanism. Option C is wrong because DynamoDB Streams capture item-level changes (inserts, updates, deletes) for downstream processing, but they do not automatically expire or delete items—they only record changes that occur from other operations.

Full explanation →

403

MCQeasy

A database administrator needs to monitor the number of database connections to an Amazon RDS for PostgreSQL instance. Which Amazon CloudWatch metric should the administrator use?

A.DatabaseConnections

B.ActiveConnections

C.ConnectionsCount

D.DBInstanceIdentifier

AnswerA

This is the standard CloudWatch metric for active connections.

Why this answer

The correct metric is `DatabaseConnections`, which is published by Amazon RDS for PostgreSQL to CloudWatch. It reports the number of client network connections to the database instance, corresponding to the `numbackends` value from the `pg_stat_database` view. This metric directly reflects the current connection count and is the standard way to monitor connection usage for RDS PostgreSQL.

Exam trap

The trap here is that candidates confuse the metric name with generic terms like 'ActiveConnections' or 'ConnectionsCount', which sound plausible but are not the exact CloudWatch metric name published by RDS, leading them to pick a non-existent metric.

How to eliminate wrong answers

Option B is wrong because `ActiveConnections` is not a valid CloudWatch metric for RDS; RDS does not publish a metric with that name. Option C is wrong because `ConnectionsCount` is not a CloudWatch metric for RDS; it is a metric name used by other services like Amazon ElastiCache, not RDS. Option D is wrong because `DBInstanceIdentifier` is a dimension (a metadata filter) used to identify a specific RDS instance in CloudWatch, not a metric that measures connection count.

Full explanation →

404

MCQmedium

A developer is trying to create a FULLTEXT index on a column in an RDS MySQL instance. The error log shows the index creation failed. What is the most likely cause?

A.The column 'description' has a length that exceeds the maximum allowed for FULLTEXT index.

B.The table size is too large for a FULLTEXT index to be created.

C.The table uses a character set that is not compatible with FULLTEXT indexes.

D.The InnoDB engine does not support FULLTEXT indexes.

AnswerA

The error states the column length is 4294967295, which is too large.

Why this answer

In RDS MySQL, FULLTEXT indexes have a maximum column length limit of 1000 bytes for InnoDB and 1000 characters for MyISAM. If the 'description' column exceeds this limit, the index creation will fail. This is the most likely cause because the error log indicates a failure without other configuration issues.

Exam trap

The trap here is that candidates often assume InnoDB does not support FULLTEXT indexes (a common misconception from older MySQL versions) or that table size is the issue, but the actual constraint is the column length limit.

How to eliminate wrong answers

Option B is wrong because table size does not prevent FULLTEXT index creation; large tables may take longer to index but will not cause a failure. Option C is wrong because MySQL FULLTEXT indexes support character sets like utf8, utf8mb4, latin1, etc., as long as they are compatible with the full-text parser; incompatible character sets are rare and would produce a different error. Option D is wrong because InnoDB has supported FULLTEXT indexes since MySQL 5.6, and RDS MySQL instances use InnoDB by default.

Full explanation →

405

MCQeasy

A company wants to store database credentials for an Amazon RDS instance securely. Which AWS service should be used to rotate the credentials automatically?

A.AWS Secrets Manager

B.AWS CloudHSM

C.AWS Systems Manager Parameter Store

D.AWS IAM roles

AnswerA

Secrets Manager supports automatic rotation for RDS databases.

Why this answer

AWS Secrets Manager is the correct service because it can automatically rotate database credentials for Amazon RDS, simplifying credential management and improving security. AWS Systems Manager Parameter Store can store parameters but does not natively rotate RDS credentials. AWS IAM roles are used for authentication and authorization, not for storing credentials.

AWS CloudHSM provides hardware security module (HSM) for encryption key management, not credential storage or rotation.

Full explanation →

406

MCQeasy

An e-commerce company uses Amazon ElastiCache for Redis as a session store for its web application. The application experiences occasional latency spikes during flash sales. The operations team notices that the Redis cluster's CPU utilization reaches 90% during these events. The current cluster is a single shard with a cache.r5.large node. The team wants to reduce CPU utilization and improve performance. What should the database administrator do?

A.Add read replicas to offload read traffic from the primary node.

B.Increase the number of replicas for data durability.

C.Disable AOF persistence to reduce write overhead.

D.Enable encryption at rest to secure data.

AnswerA

Read replicas handle read requests, reducing CPU usage on the primary.

Why this answer

Adding read replicas to an ElastiCache for Redis cluster allows read traffic to be offloaded from the primary node, reducing its CPU utilization. During flash sales, the high read load from session retrieval causes the primary's CPU to spike. Read replicas handle read queries, lowering the primary's CPU usage.

Option B is incorrect because increasing replicas for data durability (e.g., for failover) does not directly reduce CPU load; replicas also serve reads but the primary still handles writes. Option C is incorrect because disabling AOF persistence reduces write overhead only marginally; the main CPU load during flash sales is from read traffic, not persistence. Option D is incorrect because enabling encryption at rest adds CPU overhead for encryption operations, which would increase CPU utilization, not reduce it.

Full explanation →

407

MCQeasy

A company needs to store and query time-series data from IoT devices. The data arrives in high volume and requires efficient range queries over time. Which database is most appropriate?

A.Amazon RDS for MySQL

B.Amazon Timestream

C.Amazon DynamoDB

D.Amazon Redshift

AnswerB

Timestream is a serverless time-series database designed for IoT and operational applications.

Why this answer

Amazon Timestream is a purpose-built time-series database that automatically scales to handle high-volume IoT data and is optimized for efficient range queries over time. It separates storage into a memory store for recent data and a magnetic store for historical data, enabling fast queries across time ranges with built-in time-series functions.

Exam trap

The trap here is that candidates often choose DynamoDB (Option C) because of its scalability, but they overlook that DynamoDB lacks native time-series optimization and requires complex workarounds for efficient range queries over time, making Timestream the correct purpose-built choice.

How to eliminate wrong answers

Option A is wrong because Amazon RDS for MySQL is a relational database not optimized for time-series workloads; it lacks automatic time-based partitioning and efficient range query performance at scale, and would require manual sharding and indexing. Option C is wrong because Amazon DynamoDB is a key-value and document database that does not natively support time-series range queries efficiently; it requires complex design patterns like composite sort keys and TTL for time-series data, and lacks built-in time-series functions. Option D is wrong because Amazon Redshift is a columnar data warehouse designed for OLAP and complex analytics on structured data, not for high-frequency time-series ingestion and real-time range queries; it incurs higher latency and cost for IoT workloads.

Full explanation →

408

MCQhard

A company has an Amazon DynamoDB table with a global secondary index (GSI). The security team wants to ensure that only certain attributes are returned in query results based on the IAM policy of the calling user. What is the most secure and scalable approach?

A.Use an AWS Lambda function as a middleware to filter attributes before returning results.

B.Create multiple global secondary indexes that include only the allowed attributes for each user group.

C.Use IAM condition keys with 'dynamodb:Attributes' to restrict access to specific attributes.

D.Create a VPC endpoint for DynamoDB and attach a bucket policy that limits attribute access.

AnswerC

IAM policies can limit which attributes are returned in query results.

Why this answer

Using IAM condition keys with 'dynamodb:Attributes' allows fine-grained access control at the attribute level. This is the recommended way to restrict access to specific attributes. Option A is incorrect because using a Lambda middleware adds latency and complexity, and it is not the most secure or scalable approach compared to native IAM attribute-level conditions.

Option B is incorrect because creating multiple GSIs for attribute access would be costly and not scalable, and GSIs are not designed for attribute-level access control; they are for querying. Option D is incorrect because VPC endpoints do not control attribute access; they provide network-level security. A bucket policy is for S3, not DynamoDB.

Full explanation →

409

MCQhard

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database is 500 GB in size and has a 24/7 uptime requirement. The migration window is limited to 2 hours. Which strategy should be used to minimize downtime?

A.Use AWS Schema Conversion Tool (SCT) to convert the schema and copy data

B.Take an on-premises backup and restore to RDS using Oracle RMAN

C.Export the database to a dump file and import into RDS

D.Use AWS Database Migration Service (DMS) with ongoing replication

AnswerD

DMS supports minimal downtime by replicating changes until cutover.

Why this answer

AWS Database Migration Service (DMS) can perform ongoing replication from the source Oracle database to Amazon RDS for Oracle, allowing a minimal cutover window of under 2 hours. Option A is incorrect because AWS Schema Conversion Tool (SCT) only converts schema and does not handle data migration. Option B is incorrect because performing an on-premises backup and restoring via Oracle RMAN would require significant downtime and may exceed the 2-hour window for a 500 GB database.

Option C is incorrect because exporting to a dump file and importing into RDS requires the database to be offline or in read-only mode, causing prolonged downtime.

Full explanation →

410

MCQmedium

A company is migrating a 5 TB Microsoft SQL Server database to Amazon RDS for SQL Server. The database has many stored procedures and triggers. The migration must have minimal downtime. Which approach should be used?

A.Use AWS SCT to convert the database schema and then use DMS for data load.

B.Use the SQL Server Import/Export wizard to copy data.

C.Use AWS DMS with full load and ongoing replication (CDC).

D.Take a native backup, copy to Amazon S3, and restore to RDS during a maintenance window.

AnswerC

CDC captures changes during migration, minimizing downtime.

Why this answer

AWS DMS with full load and ongoing change data capture (CDC) enables continuous replication of changes from the source SQL Server to the target Amazon RDS for SQL Server, minimizing downtime to a brief cutover window. This approach handles the migration of stored procedures and triggers as part of the schema conversion via AWS SCT, while CDC captures ongoing transactions to keep the target synchronized until the final switch.

Exam trap

The trap here is that candidates often assume native backup and restore (Option D) is the simplest method for minimal downtime, but they overlook that it requires a maintenance window and does not support ongoing replication, whereas DMS with CDC is specifically designed for near-zero downtime migrations.

How to eliminate wrong answers

Option A is wrong because AWS SCT converts the schema but does not handle ongoing replication; using DMS for data load alone would require a full load without CDC, resulting in significant downtime as the database must be offline to capture a consistent snapshot. Option B is wrong because the SQL Server Import/Export wizard is a one-time, bulk copy tool that does not support ongoing replication or minimal downtime, and it cannot handle large databases like 5 TB efficiently without extended outages. Option D is wrong because taking a native backup, copying to S3, and restoring to RDS requires the database to be in a consistent state during the backup, which typically involves taking the database offline or using a maintenance window, causing downtime; it also does not provide ongoing replication to minimize the cutover period.

Full explanation →

411

Multi-Selectmedium

Which TWO of the following are valid considerations when migrating an on-premises Oracle database to Amazon RDS for Oracle using AWS DMS? (Select TWO.)

Select 2 answers

A.DMS automatically converts Oracle stored procedures to RDS for Oracle compatible code.

B.DMS can continue to replicate changes after the full load is complete until the cutover.

C.DMS automatically converts partitioned tables to non-partitioned tables.

D.DMS can migrate directly to Amazon RDS Custom for Oracle without any configuration changes.

E.DMS can perform ongoing replication to minimize downtime during migration.

AnswersB, E

DMS supports ongoing replication for near-zero downtime.

Why this answer

AWS DMS supports ongoing replication (change data capture, CDC) after the full load completes, allowing you to keep the target database synchronized with the source until you perform the cutover. This minimizes downtime because you can replicate ongoing changes from the on-premises Oracle database to Amazon RDS for Oracle, then stop all applications and switch over with only a brief interruption.

Exam trap

AWS often tests the misconception that AWS DMS can automatically convert database code (like stored procedures) or that it can handle all schema transformations without additional tools, but in reality DMS focuses on data migration and ongoing replication, while schema and code conversion requires AWS Schema Conversion Tool (SCT).

Full explanation →

412

MCQeasy

A startup needs a fully managed, serverless database for a new web application with unpredictable traffic. The application requires ACID transactions and SQL queries. Which AWS database service should they use?

A.Amazon Neptune

B.Amazon DynamoDB

C.Amazon Aurora Serverless v2

D.Amazon Redshift

AnswerC

Serverless, auto-scaling, MySQL/PostgreSQL compatible, ACID.

Why this answer

Amazon Aurora Serverless v2 is the correct choice because it provides a fully managed, serverless relational database that automatically scales capacity based on application demand, supports ACID transactions, and uses standard SQL queries. It is ideal for unpredictable traffic patterns as it can scale from zero to hundreds of thousands of transactions per minute without manual intervention.

Exam trap

The trap here is that candidates often confuse DynamoDB's 'transactions' feature (which supports ACID-like semantics only within a single AWS account and region) with full ACID compliance across multiple items, or they mistakenly think Neptune or Redshift can handle OLTP SQL workloads, when in fact they are specialized for graph and analytics respectively.

How to eliminate wrong answers

Option A is wrong because Amazon Neptune is a graph database designed for highly connected data (e.g., social networks, recommendation engines) and does not support ACID transactions or SQL queries in the traditional relational sense. Option B is wrong because Amazon DynamoDB is a NoSQL key-value and document database that does not support ACID transactions across multiple items (only single-item atomicity) and uses a non-SQL API (e.g., PartiQL is limited). Option D is wrong because Amazon Redshift is a petabyte-scale data warehouse optimized for analytical queries (OLAP) on large datasets, not for transactional (OLTP) workloads requiring ACID compliance and low-latency SQL queries.

Full explanation →

413

MCQmedium

A company is using Amazon Aurora MySQL-Compatible Edition. The database is experiencing performance degradation due to long-running queries. The DBA needs to identify the queries that are consuming the most resources. Which action should be taken?

A.Enable Enhanced Monitoring and review the OS process list.

B.Enable the slow query log and use a third-party tool to analyze it.

C.Use Amazon RDS Performance Insights to identify the top SQL queries.

D.Enable CloudWatch Logs for the DB instance and search for errors.

AnswerC

Performance Insights helps identify queries that are consuming the most resources.

Why this answer

Amazon RDS Performance Insights is the correct tool for this scenario because it provides a built-in, easy-to-use dashboard that visualizes database load and identifies the top SQL queries consuming the most resources, such as CPU, I/O, and wait events. Unlike other options, Performance Insights directly correlates database performance metrics with specific queries, enabling the DBA to quickly pinpoint long-running or resource-intensive queries without additional setup or third-party tools.

Exam trap

The trap here is that candidates often confuse Enhanced Monitoring (OS-level metrics) with Performance Insights (database-level query performance), leading them to choose Option A because they think OS process list will show query details, but it only shows processes, not SQL text or resource consumption per query.

How to eliminate wrong answers

Option A is wrong because Enhanced Monitoring provides OS-level metrics (e.g., CPU, memory, disk I/O) and the process list, but it does not identify individual SQL queries or their resource consumption; it focuses on the instance's operating system, not the database engine's query performance. Option B is wrong because enabling the slow query log and using a third-party tool to analyze it can help identify long-running queries, but it requires additional configuration, log management, and external analysis, making it less efficient than the native, integrated solution provided by Performance Insights. Option D is wrong because CloudWatch Logs for the DB instance captures database logs (e.g., error logs, audit logs) but does not provide a real-time, query-level performance breakdown; searching for errors would not reveal which queries are consuming the most resources.

Full explanation →

414

MCQeasy

An Amazon RDS for Oracle instance is experiencing high swap usage. Which metric should be monitored to determine if the instance is memory-constrained?

A.CPUUtilization

B.SwapUsage

C.WriteIOPS

D.FreeableMemory

AnswerB

High swap usage indicates memory pressure.

Why this answer

SwapUsage indicates that the instance is using swap space, which is a sign of memory pressure. CPUUtilization is for CPU, not memory. FreeableMemory shows available memory, but swap usage directly indicates memory constraint.

Full explanation →

415

MCQeasy

A database specialist is trying to connect to an Amazon RDS for MySQL instance from an EC2 instance but receives a 'Connection timed out' error. The security group for the RDS instance allows inbound traffic on port 3306 from the security group of the EC2 instance. What should the specialist check next?

A.Check the network ACL associated with the subnet of the RDS instance to ensure it allows inbound traffic on port 3306 and outbound traffic on ephemeral ports.

B.Check that the RDS instance has a public DNS name and the EC2 instance can resolve it.

C.Ensure that the VPC has an internet gateway attached and the route table has a route to it.

D.Verify that the security group for the EC2 instance allows outbound traffic on port 3306.

AnswerA

Network ACLs are stateless and must allow both inbound and outbound traffic.

Why this answer

The 'Connection timed out' error suggests the packet is being dropped at the network layer, likely by a network ACL. Since the security group allows inbound on port 3306, the next step is to check the network ACL associated with the RDS instance's subnet. Network ACLs are stateless, so they must allow both inbound traffic on port 3306 and outbound traffic on ephemeral ports for the response.

Option B is incorrect because a timed out error occurs before the TCP handshake completes, so DNS resolution is not the issue. Option C is incorrect because an internet gateway and public route are irrelevant if both instances are in the same VPC or connected privately. Option D is incorrect because the security group for the EC2 instance can be stateful and typically allows outbound traffic by default; the timeout is not caused by missing outbound rules on the EC2 side.

Full explanation →

416

MCQeasy

Refer to the exhibit. A database administrator runs the AWS CLI command to retrieve CloudWatch metrics for an Amazon RDS DB instance. The output shows a spike in WriteLatency at 10:05 UTC. What is the most likely cause of this spike?

A.The DB instance's gp2 volume has exhausted its burst credits.

B.The DB instance is in the process of taking a snapshot.

C.There is a large number of concurrent connections to the DB instance.

D.The DB instance experienced a Multi-AZ failover.

AnswerA

A sudden spike in write latency often indicates that the storage volume has exhausted its burst credits and is now using baseline performance, which may be slower.

Why this answer

A sudden spike in write latency often indicates that the storage volume has exhausted its burst credits and is now using baseline performance, which may be slower. Option B is incorrect because taking a snapshot causes I/O suspension, not necessarily a latency spike. Option C is incorrect because a large number of concurrent connections typically causes increased CPU and memory usage, not a latency spike.

Option D is incorrect because a Multi-AZ failover would cause a brief downtime, not a latency spike.

Full explanation →

417

Multi-Selecthard

A company is migrating a 1 TB SQL Server database to Amazon RDS for SQL Server. The migration requires minimal downtime and must support ongoing changes. Which TWO AWS services should be used together to achieve this? (Choose two.)

Select 2 answers

A.AWS Schema Conversion Tool (AWS SCT) and AWS Snowball

B.AWS Database Migration Service (AWS DMS) and AWS Direct Connect

C.AWS Database Migration Service (AWS DMS) and AWS Lambda

D.AWS Database Migration Service (AWS DMS) and AWS Schema Conversion Tool (AWS SCT)

E.AWS Database Migration Service (AWS DMS) and AWS Snowball

AnswersD, E

DMS handles ongoing replication; SCT helps with schema conversion for compatibility.

Why this answer

To migrate a 1 TB SQL Server database to Amazon RDS for SQL Server with minimal downtime and ongoing changes, two services are needed. AWS DMS provides continuous replication (change data capture) to keep the target synchronized. For the initial bulk transfer of 1 TB, AWS Snowball can physically move the data offline, reducing network load and accelerating the initial load; DMS then takes over for ongoing changes.

Alternatively, DMS can be combined with AWS SCT for schema conversion and optimization, which is useful even when migrating to the same engine. Thus, both options D (DMS+SCT) and E (DMS+Snowball) are correct because they represent valid combinations for achieving minimal-downtime migration with ongoing changes.

Exam trap

Candidates may think only DMS is needed, but for large datasets like 1 TB, combining DMS with Snowball (offline initial load) enables faster migration while still supporting ongoing replication. Alternatively, pairing DMS with SCT addresses schema conversion. Both combinations are valid, and candidates must recognize that two services are required for this scenario.

Full explanation →

418

MCQeasy

A database administrator needs to retain backups of an Amazon RDS for PostgreSQL DB instance for 7 years to meet compliance requirements. The automated backup retention period is limited to 35 days. Which solution should be used?

A.Export the automated backups to Amazon S3 and apply an S3 lifecycle policy.

B.Create manual snapshots at regular intervals and retain them for 7 years.

C.Increase the automated backup retention period to 7 years.

D.Use an AWS Lambda function to copy automated backups to an EC2 instance.

AnswerB

Manual snapshots are retained until deleted, suitable for long-term retention.

Why this answer

Manual snapshots are retained indefinitely until deleted. Automated backups have a max retention of 35 days. Exporting to S3 is an option but not directly a backup retention method; you can export snapshots to S3, but manual snapshots are the standard way to retain backups long-term.

EC2 instance backups are not applicable.

Full explanation →

419

MCQhard

A company runs a critical PostgreSQL database on Amazon RDS Multi-AZ. They need to perform a major version upgrade (e.g., from 12 to 13) with minimal downtime. Which approach should they take?

A.Take a snapshot, restore as a new instance with the upgraded engine version, and redirect traffic.

B.Initiate a major version upgrade directly on the Multi-AZ instance; the upgrade will be applied during the next maintenance window with minimal downtime.

C.Modify the DB instance to disable Multi-AZ, perform the upgrade, then re-enable Multi-AZ.

D.Create a read replica of the DB instance, perform the major version upgrade on the replica, then promote the replica to a new primary and update the connection string.

AnswerD

This approach reduces downtime because the upgrade is done on the replica while the original primary remains active.

Why this answer

It leverages Amazon RDS read replicas to perform a major version upgrade with minimal downtime. By creating a read replica, upgrading it to PostgreSQL 13, and then promoting it to a new primary, you avoid any downtime on the original primary during the upgrade process. The promotion is a fast operation, and traffic is redirected by updating the connection string, resulting in only a brief interruption.

Exam trap

The trap here is that candidates often assume a direct upgrade on a Multi-AZ instance (Option B) is the simplest and least disruptive method, but they overlook the fact that major version upgrades require a reboot and can cause significant downtime, whereas the read replica promotion method is designed specifically for minimizing downtime in such scenarios.

How to eliminate wrong answers

Option A is wrong because taking a snapshot and restoring as a new instance requires significant downtime for the snapshot creation and restoration process, and does not minimize downtime compared to the replica promotion approach. Option B is wrong because initiating a major version upgrade directly on a Multi-AZ instance causes downtime during the upgrade process, even if applied during a maintenance window; the upgrade requires an instance reboot and can take considerable time, impacting availability. Option C is wrong because disabling Multi-AZ, performing the upgrade, and then re-enabling Multi-AZ introduces downtime during the disable and re-enable steps, and the upgrade itself still causes an outage; this approach does not provide the minimal downtime benefit of using a read replica.

Full explanation →

420

MCQhard

A financial services company needs to store trade data with strong consistency, high durability, and the ability to run complex SQL queries on the data. The data volume is 10 TB and grows by 1 GB per day. Queries must return results in less than 5 seconds. Which database solution best meets these requirements?

A.Amazon DynamoDB

B.Amazon DocumentDB

C.Amazon Aurora

D.Amazon Redshift

AnswerC

Aurora provides strong consistency, durability, and full SQL support.

Why this answer

Amazon Aurora is the correct choice because it is a fully relational, ACID-compliant database that provides strong consistency, high durability (6-way replication across 3 AZs), and supports complex SQL queries. With 10 TB of data and 1 GB/day growth, Aurora can scale storage automatically up to 128 TB and, using features like Aurora Serverless or provisioned instances with read replicas, can achieve sub-5-second query performance for complex analytical queries when properly indexed and optimized.

Exam trap

The trap here is that candidates often choose Amazon Redshift because of its reputation for handling large data volumes and complex queries, but they overlook the requirement for strong consistency and sub-5-second latency on transactional data, which Redshift's columnar storage and distributed architecture are not optimized for.

How to eliminate wrong answers

Option A is wrong because Amazon DynamoDB is a NoSQL key-value and document database that does not support complex SQL queries (it uses a limited query language based on primary keys and secondary indexes) and cannot perform joins, aggregations, or window functions required for the described workload. Option B is wrong because Amazon DocumentDB is a MongoDB-compatible document database that lacks full SQL support and ACID transactions across multiple documents, making it unsuitable for complex SQL queries and strong consistency requirements for trade data. Option D is wrong because Amazon Redshift is a columnar data warehouse optimized for large-scale analytical queries (petabytes) but is not designed for transactional workloads requiring strong consistency and sub-5-second query latency on individual trade records; its minimum storage increment is 10 GB per node, and query latency is typically higher for point lookups or mixed OLTP/OLAP patterns.

Full explanation →

421

MCQhard

A company is deploying a globally distributed application with users in the US, Europe, and Asia. The application requires sub-10ms read latency for user profiles stored in Amazon DynamoDB. Writes are less frequent. Which configuration meets the latency requirement while minimizing write conflicts?

A.Deploy Amazon RDS for MySQL with Multi-AZ and cross-Region read replicas.

B.Use Amazon ElastiCache for Redis Global Datastore with DynamoDB as backing store.

C.Deploy a single DynamoDB table in us-east-1 with DAX caches in each region.

D.Use DynamoDB global tables to replicate data to Regions close to users.

AnswerD

Global tables provide multi-region writes and reads with low latency.

Why this answer

DynamoDB global tables provide multi-region, multi-active replication with eventual consistency, enabling sub-10ms reads from local replicas while writes are replicated asynchronously. This minimizes write conflicts because DynamoDB uses last-writer-wins (LWW) conflict resolution, which is acceptable for user profiles where writes are infrequent and conflicts are rare.

Exam trap

The trap here is that candidates may confuse DynamoDB global tables with DAX caching, assuming that a local cache alone can solve global latency without addressing write replication and conflict resolution.

How to eliminate wrong answers

Option A is wrong because Amazon RDS for MySQL with Multi-AZ and cross-Region read replicas cannot achieve sub-10ms read latency globally due to cross-Region replication lag and does not natively handle write conflicts across regions. Option B is wrong because ElastiCache for Redis Global Datastore provides low-latency reads but requires DynamoDB as a backing store, adding operational complexity and potential write conflicts from dual-write patterns. Option C is wrong because a single DynamoDB table in us-east-1 with DAX caches in each region still requires cross-Region reads from the primary table, which cannot guarantee sub-10ms latency due to network distance, and DAX does not replicate writes, so write conflicts are not addressed.

Full explanation →

422

Multi-Selectmedium

A security engineer needs to restrict access to an Amazon DynamoDB table so that only users from a specific AWS account can read and write data. Which of the following can be used to achieve this? (Choose TWO.)

Select 2 answers

A.Use a VPC endpoint policy for DynamoDB.

B.Use a resource-based policy on the DynamoDB table.

C.Use an IAM policy with a condition key such as 'aws:SourceAccount'.

D.Use a security group to restrict access to the DynamoDB table.

E.Use an S3 bucket policy to allow access to the DynamoDB table.

AnswersA, C

VPC endpoint policies can restrict access to DynamoDB resources.

Why this answer

To restrict access to a DynamoDB table from a specific AWS account, you can use a VPC endpoint policy for DynamoDB (Option A) to control access through VPC endpoints, and an IAM policy with a condition key such as 'aws:SourceAccount' (Option C) to restrict API calls to those originating from the specified account. Option B is incorrect because DynamoDB does not support resource-based policies. Option D is incorrect because security groups are used for network-level access to EC2 instances, not DynamoDB.

Option E is incorrect because S3 bucket policies apply only to S3 resources, not DynamoDB.

Full explanation →

423

MCQmedium

A company wants to migrate an on-premises MySQL database to Amazon RDS for MySQL with minimal downtime. The database is 500 GB and has moderate write activity. Which approach is MOST suitable?

A.Use AWS Database Migration Service (DMS) with a full load and ongoing replication.

B.Use mysqldump to export the database, then import into RDS.

C.Use AWS Server Migration Service (SMS) to migrate the database server.

D.Create a read replica of the on-premises database and promote it to RDS.

AnswerA

DMS supports ongoing replication to minimize downtime.

Why this answer

AWS DMS with full load and ongoing replication is the most suitable approach because it supports continuous change data capture (CDC) from the on-premises MySQL source to the Amazon RDS target, enabling minimal downtime. The full load transfers the initial 500 GB dataset, while ongoing replication applies incremental changes until cutover, meeting the requirement for minimal downtime with moderate write activity.

Exam trap

The trap here is that candidates often confuse AWS Server Migration Service (SMS) as a database migration tool or assume that creating a read replica from an on-premises database is possible, when in fact read replicas are an Amazon RDS-specific feature that requires the source to be an RDS instance, not an on-premises server.

How to eliminate wrong answers

Option B is wrong because mysqldump performs a logical export that locks tables during the dump, causing significant downtime for a 500 GB database with moderate write activity, and it cannot provide ongoing replication to minimize downtime. Option C is wrong because AWS Server Migration Service (SMS) is designed for migrating virtual machines (VMs) as server images, not for database-level migration, and it does not support MySQL replication or CDC. Option D is wrong because creating a read replica of an on-premises database is not natively supported by MySQL; read replicas are an Amazon RDS feature for replicating within AWS, and promoting a read replica to a standalone instance does not apply to on-premises sources.

Full explanation →

424

MCQeasy

A startup needs a cost-effective database for a small application that handles both transactional and analytical workloads. They expect low traffic initially but want the database to automatically scale as the business grows. Which database solution is BEST suited?

A.Amazon Aurora Serverless v2

B.Amazon DynamoDB with on-demand capacity

C.Amazon RDS for MySQL with a Single-AZ deployment

D.Amazon Redshift Serverless

AnswerA

Automatically scales capacity and is cost-effective for variable workloads.

Why this answer

Amazon Aurora Serverless v2 is the best fit because it automatically scales compute and memory capacity in fine-grained increments (down to 1 ACU) based on actual workload demand, supporting both transactional (OLTP) and analytical (OLAP) queries via the MySQL/PostgreSQL-compatible Aurora engine. It offers a pay-per-ACU model that is cost-effective for low-traffic startups while providing near-instant scaling to handle growth without manual intervention.

Exam trap

The trap here is that candidates often confuse 'serverless' with 'NoSQL' (DynamoDB) or assume that any 'serverless' database (Redshift Serverless) can handle mixed workloads, but the key differentiator is the need for relational SQL support for both transactional and analytical queries, which only Aurora Serverless v2 provides among the options.

How to eliminate wrong answers

Option B is wrong because Amazon DynamoDB with on-demand capacity is a NoSQL key-value/document database optimized for simple key-value lookups and high-throughput transactional workloads, but it lacks native support for complex analytical queries (e.g., joins, aggregations) that the application requires. Option C is wrong because Amazon RDS for MySQL with a Single-AZ deployment does not automatically scale compute or storage capacity; scaling requires manual instance resizing or Multi-AZ failover, and it cannot handle mixed transactional-analytical workloads efficiently without additional read replicas or separate analytics engines. Option D is wrong because Amazon Redshift Serverless is a petabyte-scale data warehouse designed for heavy analytical workloads and large-scale data warehousing, not for transactional (OLTP) workloads; it is over-provisioned and cost-inefficient for a small application with mixed workloads.

Full explanation →

425

MCQeasy

Refer to the exhibit. A developer runs the AWS CLI command and receives the output shown. What is this output?

A.The DNS endpoint of the DB instance

B.The private IP address of the DB instance

C.The reader endpoint of a Multi-AZ cluster

D.The resource ID of the DB instance

AnswerA

RDS provides a DNS endpoint for connections.

Why this answer

The output shown is the DNS endpoint of the RDS instance. This is the standard endpoint used to connect to the DB instance. Option A is correct because it matches this output.

Option B is incorrect because the output is a DNS name, not a private IP address. Option C is incorrect because a reader endpoint includes a '-ro' suffix and applies only to Multi-AZ clusters. Option D is incorrect because the resource ID is a different identifier, not a DNS endpoint.

Full explanation →

426

MCQeasy

A company is using Amazon DynamoDB to store user session data. The security team requires that all access to the table be authenticated and authorized using AWS IAM. Which mechanism should the developer use to achieve this?

A.Create a VPC endpoint for DynamoDB and allow only traffic from the VPC.

B.Use Amazon Cognito identity pools to grant access to the DynamoDB table.

C.Use IAM policies to grant permissions to the DynamoDB table.

D.Use a DynamoDB resource-based policy to restrict access.

AnswerC

Correct. IAM policies are the mechanism for authenticating and authorizing access to DynamoDB tables.

Why this answer

DynamoDB is integrated with AWS IAM for authentication and authorization. IAM policies can be attached to users, groups, or roles to grant specific permissions to DynamoDB tables. Option A is wrong because VPC endpoints provide network isolation but do not authenticate or authorize access.

Option B is wrong because Amazon Cognito identity pools are used for federated user authentication, not for direct IAM-based access to DynamoDB. Option D is wrong because DynamoDB does not support resource-based policies; access control is managed through IAM policies.

Full explanation →

427

MCQmedium

A company is using Amazon RDS for MySQL and notices that database connections are being rejected intermittently. The application logs show 'Too many connections' errors. The DB instance has 1000 max_connections. Which action should the DBA take to troubleshoot and resolve this issue without impacting performance?

A.Increase the max_connections parameter to 5000 in the DB parameter group

B.Create a read replica to offload read traffic

C.Enable Performance Insights and review the 'DB Connections' metric to identify spikes and troubleshoot application connection pooling

D.Set the 'wait_timeout' parameter to a lower value to close idle connections faster

AnswerC

Performance Insights helps identify the source of connection bursts and allows tuning of the application's connection pooling behavior.

Why this answer

Enabling Performance Insights allows the DBA to monitor the 'DB Connections' metric in near real-time, identify exactly when connection spikes occur, and correlate those spikes with application behavior. This diagnostic approach pinpoints the root cause—such as a connection leak or insufficient connection pooling—without making changes that could degrade performance. Increasing max_connections or lowering wait_timeout without understanding the usage pattern can lead to resource exhaustion or premature connection termination.

Exam trap

The trap here is that candidates assume increasing max_connections or lowering timeouts is a quick fix, but AWS tests the ability to diagnose first using monitoring tools (Performance Insights) before making configuration changes that could harm performance or availability.

How to eliminate wrong answers

Option A is wrong because blindly increasing max_connections to 5000 does not resolve the underlying cause of connection spikes and can overwhelm the DB instance's memory and CPU, leading to worse performance or instability. Option B is wrong because a read replica offloads read traffic but does not address the 'Too many connections' error, which is a connection limit issue affecting all connections (reads and writes) on the primary instance. Option D is wrong because reducing wait_timeout may close idle connections faster, but it can disrupt long-running transactions or applications with legitimate idle periods, and it does not fix the root cause of connection spikes or leaks.

Full explanation →

428

MCQhard

A company is running an Amazon RDS for Oracle database in Multi-AZ. The primary instance fails over unexpectedly. The DBA wants to determine the cause of the failover. What should the DBA do?

A.Review the Enhanced Monitoring metrics for the primary instance.

B.Query the database error logs for the failover time.

C.View the RDS events in the AWS Management Console.

D.Check AWS CloudTrail for any database-related API calls.

AnswerC

RDS events provide details about failover reasons.

Why this answer

RDS events log failover reasons. Option A is wrong because Enhanced Monitoring does not capture failover events. Option B is wrong because error logs may not include the failover cause.

Option D is wrong because CloudTrail logs API calls, not failover reasons.

Full explanation →

429

MCQhard

A company is designing a database for an IoT application that ingests millions of sensor readings per second. Each reading includes device ID, timestamp, and measurement. The workload requires time-series analytics and data retention for 90 days. Which AWS database solution is MOST appropriate?

A.Amazon Redshift with auto-copy from S3

B.Amazon ElastiCache for Redis with time-series module

C.Amazon Timestream

D.Amazon DynamoDB with TTL

AnswerC

Timestream is purpose-built for time-series data, handles high ingestion, and includes built-in analytics.

Why this answer

Amazon Timestream is a purpose-built time-series database designed for IoT and operational applications that ingest millions of sensor readings per second. It automatically manages data retention policies (e.g., 90 days) by storing recent data in memory and historical data in a cost-optimized store, and it supports time-series analytics with built-in functions like interpolation and smoothing.

Exam trap

The trap here is that candidates often choose DynamoDB with TTL because they associate it with time-series data and automatic expiration, but they overlook the lack of native time-series analytics and the performance challenges of range queries across high-cardinality device IDs.

How to eliminate wrong answers

Option A is wrong because Amazon Redshift is a data warehouse optimized for complex analytical queries on structured data, not for ingesting millions of high-velocity sensor writes per second; the auto-copy from S3 adds latency and is not designed for real-time streaming ingestion. Option B is wrong because Amazon ElastiCache for Redis with the time-series module is an in-memory cache that cannot efficiently retain 90 days of data at scale due to memory cost and lack of tiered storage, and it is not designed for long-term durable storage. Option D is wrong because Amazon DynamoDB with TTL is a key-value and document database that lacks native time-series analytics functions (e.g., downsampling, interpolation) and cannot efficiently query over time ranges across millions of devices without complex secondary index design and scan-heavy patterns.

Full explanation →

430

Multi-Selectmedium

A company is using Amazon Aurora MySQL and needs to audit database logins. Which of the following can be used to capture login events? (Choose TWO.)

Select 2 answers

A.VPC Flow Logs

B.Database Activity Streams

C.Enhanced Monitoring

D.AWS CloudTrail

E.Aurora MySQL audit plugin

AnswersB, E

DAS captures database activity including logins.

Why this answer

Options B and E are correct. Database Activity Streams (DAS) in Amazon Aurora capture login events and other database activities. Additionally, the Aurora MySQL audit plugin can be enabled to log connections, including login attempts.

Option A (VPC Flow Logs) captures network traffic, not database logins. Option C (Enhanced Monitoring) captures OS-level metrics from the database host. Option D (AWS CloudTrail) records API calls made to AWS services, not database-level events.

Full explanation →

431

MCQhard

A gaming company uses Amazon DynamoDB to store player profiles with partition key player_id. The access pattern is to retrieve profiles for multiple players in a single request. The application currently makes separate GetItem calls, causing high latency. Which design pattern reduces latency and cost?

A.Enable DynamoDB Accelerator (DAX)

B.Redesign to a single-table design

C.Create a global secondary index on player_id

D.Use BatchGetItem to retrieve multiple items in one request

AnswerD

BatchGetItem reduces I/O and latency.

Why this answer

BatchGetItem allows you to retrieve up to 100 items or 16 MB of data from multiple tables in a single API call, reducing the number of network round trips compared to individual GetItem calls. This directly addresses the high latency caused by multiple sequential requests and also reduces cost because you pay for read capacity units (RCUs) based on the total item size, not per request overhead.

Exam trap

AWS often tests the misconception that caching (DAX) or indexing (GSI) can solve multi-item retrieval latency, when the actual solution is to reduce the number of API calls using BatchGetItem, which directly targets the root cause of high latency from sequential requests.

How to eliminate wrong answers

Option A is wrong because DynamoDB Accelerator (DAX) is an in-memory cache that speeds up individual GetItem queries but does not reduce the number of API calls; it still requires separate requests for each player_id, so it does not solve the latency issue of multiple sequential calls. Option B is wrong because the company already uses a single-table design with player_id as the partition key, and redesigning to another single-table design does not change the access pattern of needing multiple items; the problem is the number of API calls, not the table schema. Option C is wrong because a global secondary index on player_id is redundant—player_id is already the partition key of the base table, and creating an index on the same attribute does not enable batch retrieval or reduce latency; it would only add storage and write costs without addressing the multiple-request issue.

Full explanation →

432

MCQmedium

A company has an Amazon Redshift cluster with a single node. The cluster is used for reporting. Recently, queries have become slow, and the cluster's disk space is 80% full. Which action should be taken to improve query performance and manage storage?

A.Resize the cluster to include additional compute nodes.

B.Enable compression on all columns using the ENCODE AUTO option.

C.Modify the table's distribution style to DISTSTYLE ALL for all tables.

D.Run the VACUUM command to reclaim space from deleted rows.

AnswerA

Adding nodes distributes data across more slices, improving query parallelism and providing more storage.

Why this answer

Resizing the cluster to add compute nodes distributes data and workload across more nodes, improving query performance and increasing storage capacity. Option B is wrong because enabling compression (ENCODE AUTO) can reduce storage space but does not directly address the performance bottleneck caused by high disk usage on a single node; it also is not a quick fix for existing data. Option C is wrong because changing distribution style to ALL replicates all data to every node, which actually increases storage consumption and may worsen performance on a single-node cluster.

Option D is wrong because running VACUUM reclaims space from deleted rows, but the cluster is 80% full and VACUUM does not add new storage capacity; it may provide temporary relief but not a long-term solution for performance.

Full explanation →

433

MCQmedium

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security policy requires that all connections to the database use SSL/TLS. What should the database administrator do to meet this requirement?

A.Download the RDS certificate bundle and set the 'rds.force_ssl' parameter to 1 in the DB parameter group.

B.Enable IAM database authentication for the DB instance.

C.Modify the DB instance security group to only allow traffic on port 443.

D.Set the DB instance to be publicly accessible and use a VPN connection.

AnswerA

This enforces SSL connections to the database.

Why this answer

To enforce SSL/TLS connections to Amazon RDS for Oracle, you must download the RDS certificate bundle and set the 'rds.force_ssl' parameter to 1 in the DB parameter group. This forces all connections to use SSL/TLS. Option B is incorrect because IAM database authentication controls access but does not enforce SSL encryption.

Option C is incorrect because security groups control network access at the instance level, not database-level encryption. Option D is incorrect because making the DB instance publicly accessible increases exposure and does not enforce SSL; a VPN encrypts traffic but SSL enforcement is still needed at the database level.

Full explanation →

434

MCQmedium

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database uses Oracle Data Pump for export/import. The migration must be completed within a short maintenance window. Which migration approach should they use?

A.Use AWS Snowball to transfer the database files to AWS and then restore to RDS.

B.Use AWS Database Migration Service with full load and change data capture (CDC).

C.Use Oracle Data Pump to export the database and import into RDS.

D.Use AWS Schema Conversion Tool (SCT) to convert the schema and then use DMS for data migration.

AnswerB

AWS DMS with full load and CDC satisfies the short maintenance window constraint by performing an initial full copy of the Oracle database while simultaneously capturing ongoing changes via redo log mining. This allows the target RDS for Oracle instance to stay synchronised with the source during the migration, so cutover can occur with minimal downtime rather than requiring a single extended export/import window.

Why this answer

AWS Database Migration Service (DMS) with full load and change data capture (CDC) is the correct approach because it minimizes downtime by performing an initial full load of the Oracle database and then continuously replicating ongoing changes until the cutover, allowing the migration to complete within a short maintenance window. Unlike Oracle Data Pump, which requires the source database to be offline during export/import, DMS with CDC keeps the source operational and only requires a brief outage at final cutover.

Exam trap

The trap here is that candidates assume Oracle Data Pump (Option C) is the fastest because it's a native Oracle tool, but they overlook that it requires the source database to be offline during export, which violates the short maintenance window constraint, whereas DMS with CDC allows near-zero downtime.

How to eliminate wrong answers

Option A is wrong because AWS Snowball is designed for large-scale offline data transfer of flat files, not for direct database migration to RDS; it would require additional steps to restore from files, increasing complexity and time, and does not support CDC for minimal downtime. Option C is wrong because Oracle Data Pump export/import requires the source database to be offline or in restricted mode during the export, and the import into RDS also takes significant time, making it unsuitable for a short maintenance window. Option D is wrong because AWS Schema Conversion Tool (SCT) is used for heterogeneous migrations (e.g., Oracle to Aurora or PostgreSQL), not for homogeneous Oracle-to-Oracle migrations; using SCT here is unnecessary and adds complexity without benefit.

Full explanation →

435

MCQhard

A company's Amazon RDS for PostgreSQL instance is experiencing a high number of connections, causing performance degradation. The DBA wants to identify which user and application are creating the most connections. What should the DBA do?

A.Enable AWS CloudTrail to log database logins.

B.Enable Performance Insights and use the 'db.sql_tokenized' dimension to analyze connections by user.

C.Enable Enhanced Monitoring and check the 'Connection Count' metric.

D.Enable VPC Flow Logs to track connection attempts.

AnswerB

Performance Insights provides SQL-level performance data, including top users and applications.

Why this answer

Performance Insights with the 'db.sql_tokenized' dimension allows database administrators to group and analyze database connections by user and application, helping identify the source of high connection counts. Option A (CloudTrail) logs API calls, not database-level logins. Option C (Enhanced Monitoring) provides OS-level metrics like connection count but does not break down by user or application.

Option D (VPC Flow Logs) captures network traffic metadata, not database connection details.

Full explanation →

436

MCQhard

A database administrator runs the command shown in the exhibit to create a read replica in us-west-2 from a source DB instance in us-east-1. The command fails. What is the most likely cause?

A.The source DB instance does not have backup retention enabled.

B.The source DB instance is not publicly accessible.

C.The replica instance class db.r5.large is not available in us-west-2.

D.The replica must use the same DB instance class as the source.

AnswerA

Cross-region read replicas require automated backups enabled on the source.

Why this answer

The command fails because creating a cross-Region read replica requires the source DB instance to have automated backups enabled (backup retention period > 0). Without backups, Amazon RDS cannot generate the necessary transaction logs to replicate data to the replica in us-west-2. This is a prerequisite for any read replica creation, whether in the same Region or across Regions.

Exam trap

The trap here is that candidates often assume the failure is due to instance class availability or public accessibility, overlooking the mandatory backup retention requirement for read replica creation.

How to eliminate wrong answers

Option B is wrong because public accessibility of the source DB instance is not required for cross-Region read replica creation; RDS uses internal network paths and VPC peering or VPN connections for replication, not public internet. Option C is wrong because if the db.r5.large instance class were unavailable in us-west-2, the error would be an instance class availability issue, but the command would still attempt validation and fail with a specific 'instance class not supported' error, not a generic failure. Option D is wrong because the replica can use a different DB instance class than the source; RDS allows scaling the replica independently as long as the chosen class is compatible with the engine and Region.

Full explanation →

437

MCQeasy

A company is migrating an on-premises MySQL database to Amazon RDS for MySQL. The database is 500 GB in size and has a 24-hour maintenance window. Which AWS service or tool should be used for the initial data transfer with minimal downtime?

A.Amazon S3 with AWS Glue

B.AWS Snowball Edge

C.AWS Database Migration Service (DMS)

D.mysqldump and restore to RDS

AnswerC

DMS supports ongoing replication from on-premises to RDS, minimizing downtime.

Why this answer

AWS Database Migration Service (DMS) is the correct choice because it supports ongoing replication from a source MySQL database to Amazon RDS for MySQL, allowing you to perform a full load followed by continuous change data capture (CDC) to minimize downtime. With a 500 GB database and a 24-hour maintenance window, DMS can complete the initial load and then keep the target in sync until you cut over, achieving near-zero downtime.

Exam trap

The trap here is that candidates often choose mysqldump (Option D) because it is familiar and free, but they overlook that it requires locking tables or stopping writes, which violates the 'minimal downtime' requirement for a 24-hour maintenance window.

How to eliminate wrong answers

Option A is wrong because Amazon S3 with AWS Glue is designed for ETL and data transformation, not for direct database migration with minimal downtime; Glue cannot perform live CDC from MySQL to RDS. Option B is wrong because AWS Snowball Edge is a physical data transfer device intended for large datasets (typically >10 TB) over slow networks, and for a 500 GB database, the overhead of shipping and copying data would exceed the 24-hour window and cannot achieve minimal downtime. Option D is wrong because mysqldump and restore is a logical backup method that requires taking the source database offline or locking tables during the dump, causing significant downtime, and it does not support ongoing replication to keep the target in sync.

Full explanation →

438

MCQmedium

A company is running an Amazon RDS for PostgreSQL DB instance with Multi-AZ. The database experiences a failover during a maintenance window. After the failover, the application connection pool continues to use the old primary endpoint, causing connection errors. What is the BEST way to ensure application connections automatically redirect to the new primary after a failover?

A.Use the RDS endpoint (CNAME) provided by RDS, which automatically points to the primary instance.

B.Create a custom Route 53 failover routing policy pointing to both DB instances.

C.Modify the application connection string to point to the new primary IP address after each failover.

D.Configure the application to use a static IP address of the primary instance.

AnswerA

The RDS endpoint is a DNS CNAME that updates after failover, ensuring seamless redirection.

Why this answer

The RDS endpoint (CNAME) provided by Amazon RDS automatically points to the current primary instance. After a failover, RDS updates the CNAME record to point to the new primary, so application connections using the endpoint are seamlessly redirected without manual intervention. This is the simplest and most reliable approach.

Option B (Custom Route 53 failover routing) is unnecessary because RDS already provides a managed DNS endpoint. Option C (modifying connection string manually) is not automated and prone to human error. Option D (static IP) is not practical as RDS instances do not have static IPs; the DNS endpoint handles failover transparently.

Full explanation →

439

MCQmedium

A company has a high-traffic e-commerce application that uses Amazon RDS for MySQL. During flash sales, the database experiences high read load causing slow page loads. The application is read-heavy with occasional writes. Which design change would provide the most immediate performance improvement?

A.Add an Amazon ElastiCache layer

B.Create read replicas of the RDS instance

C.Enable Multi-AZ deployment

D.Upgrade to a larger instance type

AnswerB

Read replicas offload read traffic, improving performance.

Why this answer

Creating read replicas of the RDS instance offloads SELECT queries from the primary database, directly addressing the high read load during flash sales. Read replicas are asynchronous copies that can serve read traffic, reducing the burden on the primary instance and improving page load times for read-heavy workloads.

Exam trap

The trap here is that candidates often confuse Multi-AZ with read scaling, but Multi-AZ does not allow the standby to serve read traffic, making it ineffective for reducing read load.

How to eliminate wrong answers

Option A is wrong because adding an ElastiCache layer would require application code changes to cache query results, which is not the most immediate improvement compared to read replicas that require no application changes. Option C is wrong because Multi-AZ deployment provides high availability and automatic failover, not read scaling; the standby replica cannot serve read traffic. Option D is wrong because upgrading to a larger instance type increases capacity but does not offload read traffic as efficiently as distributing reads across multiple replicas, and it involves downtime during the upgrade.

Full explanation →

440

MCQhard

A company is deploying a new Amazon RDS for SQL Server DB instance with Multi-AZ. The database will be used by a critical application that requires minimal downtime during failover. The application uses a single connection string with the CNAME of the RDS endpoint. During a recent failover test, the application experienced a 3-minute timeout. The DBA wants to reduce the failover time. The current RDS instance is db.r5.large with 100 GB gp2 storage. The application is hosted on EC2 in the same VPC. Which change would MOST effectively reduce the failover time?

A.Change the storage to Provisioned IOPS (io1)

B.Change the instance type to db.r5.xlarge

C.Configure the application to use a low TTL for DNS lookups and implement connection retries

D.Use a read replica with automatic failover

AnswerC

Low TTL ensures the DNS record is refreshed quickly, reducing failover time.

Why this answer

The most effective because the 3-minute timeout during failover is likely due to DNS caching on the application side. By configuring the application to use a low TTL (e.g., 5 seconds) for DNS lookups and implementing connection retries with exponential backoff, the application can quickly resolve the new RDS endpoint's IP address after failover and re-establish connectivity promptly. Option A is incorrect because changing to Provisioned IOPS (io1) improves storage performance but does not reduce DNS-related failover time.

Option B is incorrect because increasing the instance size does not directly impact failover duration. Option D is incorrect because Multi-AZ already provides automatic failover; a read replica with manual promotion would not reduce failover time and would require additional management.

Full explanation →

441

MCQeasy

A developer needs to monitor the number of throttled read requests for a DynamoDB table. Which CloudWatch metric should be used?

A.ReadThrottleEvents

B.ThrottledWriteEvents

C.SuccessfulRequestLatency

D.ConsumedReadCapacityUnits

AnswerA

This metric directly counts throttled read requests.

Why this answer

(ReadThrottleEvents) is the correct CloudWatch metric for monitoring throttled read requests on a DynamoDB table. Option B (ThrottledWriteEvents) tracks write throttles, not reads. Option C (SuccessfulRequestLatency) measures latency, not throttling.

Option D (ConsumedReadCapacityUnits) shows read capacity consumption, not throttled requests.

Full explanation →

442

MCQhard

A company uses Amazon DynamoDB with a global secondary index (GSI) and client-side encryption using the AWS Encryption SDK. The security team requires that the partition key and sort key be searchable by the application but not stored in plaintext in the table. Which approach should be taken?

A.Encrypt the entire item client-side and use a secondary index on the encrypted keys.

B.Use server-side encryption with a KMS key and enable DynamoDB Streams to decrypt on read.

C.Use client-side encryption to encrypt only the non-key attributes, leaving the partition and sort keys in plaintext.

D.Use DynamoDB encryption at rest with a customer-managed KMS key.

AnswerA

Correct. Deterministic encryption of the entire item, including keys, allows a GSI on the encrypted keys to be searchable without storing plaintext keys.

Why this answer

The requirement is to prevent partition and sort keys from being stored in plaintext while still allowing the application to search by them. Option A achieves this by using client-side deterministic encryption (supported by the AWS Encryption SDK) for the entire item, which encrypts the keys. Because the encryption is deterministic, the same plaintext key always produces the same ciphertext, so a global secondary index can be built on the encrypted key attributes.

The application encrypts the search key and queries the GSI using that encrypted value, enabling search without exposing plaintext keys. Option C leaves keys in plaintext, violating the requirement. Options B and D do not address client-side encryption and cannot prevent plaintext key storage in the database.

Exam trap

Candidates often assume that partition and sort keys must be stored in plaintext to be indexed, but deterministic encryption allows indexed attributes to be encrypted while still supporting equality searches via a GSI.

Full explanation →

443

MCQhard

An administrator is troubleshooting a permissions issue. A user with the IAM policy shown is unable to share an automated system snapshot with another AWS account. Which action should the administrator take to resolve this issue?

A.Add the rds:ModifyDBSnapshotAttribute action to the policy.

B.Add the rds:CopyDBSnapshot action for cross-region copy.

C.Change the Resource to "arn:aws:rds:us-east-1:123456789012:snapshot:automated:*".

D.Change the Resource to "arn:aws:rds:us-east-1:123456789012:snapshot:rds:*".

AnswerC

Automated snapshots require a resource ARN that includes 'automated'.

Why this answer

The policy allows actions on DB snapshots, but automated snapshots have the resource type 'automated-snapshot' and require explicit resource ARN instead of '*'. Option A is wrong because the policy already includes the necessary actions. Option B is wrong because the issue is not about cross-region copying.

Option D is wrong because the issue is not about manual snapshots.

Full explanation →

444

MCQhard

A financial services company needs a database to store transaction records with strong consistency and the ability to run complex analytical queries. The data volume is in the terabytes and is expected to grow. The company also needs point-in-time recovery. Which AWS database solution meets these requirements?

A.Amazon Redshift with automated snapshots

B.Amazon RDS for MySQL with read replicas

C.Amazon ElastiCache for Redis with AOF persistence

D.Amazon DynamoDB with on-demand backup

AnswerA

Redshift is built for analytics and supports point-in-time recovery via snapshots.

Why this answer

Amazon Redshift is correct because it is a fully managed, petabyte-scale data warehouse designed for complex analytical queries on large datasets, and it supports automated snapshots for point-in-time recovery within a configurable retention period. The service provides strong consistency for committed transactions and can handle terabytes of data with columnar storage and massively parallel processing, making it ideal for the financial services company's requirements.

Exam trap

The trap here is that candidates often confuse OLTP databases like RDS or DynamoDB with OLAP solutions like Redshift, assuming that any database with point-in-time recovery and strong consistency can handle complex analytical queries at scale, but Redshift is the only option purpose-built for petabyte-scale analytics with columnar storage and MPP architecture.

How to eliminate wrong answers

Option B is wrong because Amazon RDS for MySQL is an OLTP database optimized for transactional workloads, not for complex analytical queries on terabytes of data, and while it supports point-in-time recovery, its read replicas do not enhance analytical query performance at the scale required. Option C is wrong because Amazon ElastiCache for Redis is an in-memory cache, not a durable database for terabytes of transaction records, and its AOF persistence is for data durability in caching scenarios, not for running complex analytical queries. Option D is wrong because Amazon DynamoDB is a NoSQL key-value and document database that provides strong consistency and on-demand backup, but it is not designed for complex analytical queries on terabytes of data, and its point-in-time recovery is available only with continuous backups, not automated snapshots.

Full explanation →

445

MCQeasy

A database administrator needs to audit all SQL statements executed on an Amazon RDS for PostgreSQL DB instance. Which service should be used to capture and log the SQL statements?

A.AWS CloudTrail

B.AWS Config

C.Amazon Inspector

D.Amazon RDS for PostgreSQL database activity streams

AnswerD

Database activity streams provide a near real-time stream of database activities including SQL statements.

Why this answer

Amazon RDS for PostgreSQL supports database activity streams, which can be integrated with services like Amazon CloudWatch and AWS CloudTrail to provide a near real-time stream of database activities. The other options do not capture SQL statements: CloudTrail records API calls to RDS, Config records resource configuration changes, and Inspector is for vulnerability assessment.

Full explanation →

446

MCQhard

A team is troubleshooting an Amazon RDS for SQL Server instance that is running out of storage. The instance uses General Purpose SSD (gp2) storage. The team wants to increase storage without downtime. Which action should they take?

A.Migrate to gp3 storage.

B.Add a read replica to offload queries.

C.Take a snapshot and restore to a larger instance.

D.Modify the DB instance to increase allocated storage.

AnswerD

Modifying the DB instance to increase allocated storage can be done without downtime, as RDS supports dynamic storage scaling.

Why this answer

Amazon RDS allows you to modify the allocated storage for a DB instance dynamically without downtime; the change takes effect during the next maintenance window or can be applied immediately. Option A is incorrect because migrating from gp2 to gp3 changes the storage type but does not increase the storage capacity. Option B is incorrect because adding a read replica does not increase storage on the primary instance; it only offloads read traffic.

Option C is incorrect because while you can restore a snapshot to a larger instance, this process involves downtime and is not as straightforward as modifying the storage directly.

Full explanation →

447

MCQeasy

A company is using Amazon RDS for MySQL with encryption at rest enabled. The security team wants to ensure that the database backups stored in Amazon S3 are also encrypted using a customer-managed KMS key. What should be done to meet this requirement?

A.Create a new KMS key and specify it when creating the DB instance to encrypt backups differently.

B.No additional action is required; RDS automatically uses the same KMS key for backups.

C.Modify the DB instance to enable backup encryption using a new KMS key.

D.Enable default encryption on the S3 bucket where backups are stored.

AnswerB

RDS automatically encrypts backups with the same key.

Why this answer

When encryption at rest is enabled for an RDS DB instance, RDS automatically encrypts automated backups, snapshots, and read replicas with the same KMS key used for the DB instance. No additional action is required. Option A is incorrect because you cannot specify a separate KMS key for backups; the key is inherited.

Option C is incorrect because you cannot modify the DB instance to enable backup encryption with a different key; it is automatically encrypted with the same key. Option D is incorrect because enabling S3 default encryption does not affect RDS backups, as RDS manages the backup storage and encryption directly.

Full explanation →

448

MCQeasy

A company's application is logging the error shown in the exhibit. The application is deployed on Amazon EC2 and connects to an Amazon RDS for MySQL Multi-AZ DB instance. Which configuration change is most likely to resolve this issue?

A.Add an additional standby instance in a third Availability Zone.

B.Increase the connection pool timeout in the application configuration.

C.Create a read replica and direct write traffic to it.

D.Increase the DB instance class to handle more concurrent connections.

AnswerD

A larger instance can handle more connections and reduce timeouts.

Why this answer

The error log indicates that the application is hitting the maximum number of connections allowed by the RDS DB instance. Increasing the DB instance class (Option D) provides more memory and CPU resources, which allows the instance to support a higher `max_connections` value (calculated as `DBInstanceClassMemory / 12582880` for MySQL). This directly resolves the connection limit issue without changing the application's connection pool behavior or architecture.

Exam trap

The trap here is that candidates often confuse connection pool timeout adjustments (Option B) with connection limit increases, but timeout only affects how long a request waits, not the hard limit imposed by the database engine's `max_connections` parameter.

How to eliminate wrong answers

Option A is wrong because adding a third standby instance in a Multi-AZ deployment does not increase the connection limit; it only improves availability and failover capability. Option B is wrong because increasing the connection pool timeout does not reduce the number of concurrent connections; it only changes how long the application waits for a connection, which could actually worsen the backlog. Option C is wrong because a read replica cannot accept write traffic; directing writes to it would cause application errors, and it does not increase the write capacity or connection limit of the primary instance.

Full explanation →

449

Multi-Selectmedium

A company is designing a database for an IoT application that ingests sensor data from thousands of devices. Each device sends a reading every minute. The data includes device_id, timestamp, temperature, humidity, and pressure. The application needs to store this data and support queries that retrieve all readings for a specific device within a time range. The company expects high write throughput and moderate read frequency. The data must be stored with high durability. Which TWO database designs are appropriate for this workload? (Choose TWO.)

Select 2 answers

A.Use Amazon DynamoDB with device_id as partition key and store all readings for a device as a list attribute in a single item, updating the list every minute.

B.Use Amazon S3 to store compressed JSON files per device per hour, and query using Amazon Athena.

C.Use Amazon DynamoDB with device_id as partition key and timestamp as sort key.

D.Use Amazon RDS for MySQL with a single table and index on device_id and timestamp.

E.Use Amazon Timestream, a time series database, with device_id as dimension and timestamp as time column.

AnswersC, E

DynamoDB can handle high write throughput and efficient queries by device and time range.

Why this answer

DynamoDB's partition key (device_id) and sort key (timestamp) design allows efficient retrieval of all readings for a specific device within a time range using a Query operation with a KeyConditionExpression on the sort key. This schema supports high write throughput by distributing writes across partitions based on device_id, and DynamoDB's multi-AZ replication provides high durability.

Exam trap

The trap here is that candidates often overlook DynamoDB's item size limit and write hotspot issues in Option A, or assume that any SQL database can handle high write throughput without considering single-writer bottlenecks in Option D.

Full explanation →

450

Multi-Selectmedium

Which TWO database services are most suitable for workloads that require ACID transactions?

Select 2 answers

A.Amazon Neptune

B.Amazon Timestream

C.Amazon Aurora

D.Amazon RDS for MySQL

E.Amazon DynamoDB

AnswersC, D

Aurora is a relational database with full ACID support.

Why this answer

Amazon Aurora is correct because it is a MySQL- and PostgreSQL-compatible relational database engine that provides full ACID (Atomicity, Consistency, Isolation, Durability) transaction support, including multi-statement transactions with commit and rollback. Aurora uses a distributed, fault-tolerant storage subsystem that replicates data across three Availability Zones, ensuring durability and consistency for transactional workloads.

Exam trap

The trap here is that candidates often assume DynamoDB supports full ACID transactions because of its 'DynamoDB Transactions' feature, but those transactions are limited to a maximum of 25 items or 4 MB per transaction and do not provide the same isolation guarantees as a relational database, making it unsuitable for workloads requiring strict ACID compliance across many rows or tables.

Full explanation →

Page 6 of 23

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23

Practice DBS-C01 by domain

Target a specific domain to shore up weak areas.

Workload-Specific Database Design Deployment and Migration Management and Operations Monitoring and Troubleshooting Database Security

See all domains with question counts →