AWS Certified Database Specialty DBS-C01 (DBS-C01) — Questions 601–675

Option B is correct because increasing the number of DMS task mappings (parallel threads) can improve throughput. Option A is wrong because reducing storage does not help. Option C is wrong because disabling LOBs is not always possible and may lose data.

Option D is wrong because increasing RDS instance size of the source doesn't affect DMS performance.

Option D is correct because global tables eventually replicate asynchronously; network latency between regions can cause delays. Option A is wrong because conflict resolution does not cause delays. Option B is wrong because throughput is separate per region.

Option C is wrong because Streams are used for replication, not the cause of delay.

AWS DMS can perform a full load and then continuously replicate changes to keep the target in sync with the source, enabling minimal downtime migration. SCT is used for schema conversion, not replication. Direct Connect provides network connectivity, not data migration.

Snowball is for offline data transfer and does not support ongoing replication.

Option C is correct because enabling persistence and replication ensures data availability to rebuild the cache. Option A is wrong because TTL is already low; increasing it might cause stale data. Option B is wrong because larger instance types may help but don't address the root cause of misses.

Option D is wrong because Cluster Mode improves scalability but not hit ratio.

Option D is correct. Adding DeletionProtection: true enables deletion protection. Option A is wrong because DeletionPolicy is a CloudFormation attribute, not a property.

Option B is wrong because PreventRDSDeletion is not a valid property. Option C is wrong because the syntax is incorrect.

Option D is correct because DynamoDB uses KMS for encryption; an interface VPC endpoint (AWS PrivateLink) is used for private access. Option A is wrong because gateway endpoints are for S3 and DynamoDB, but DynamoDB supports both, however interface endpoint is recommended for private access with security groups. Option B is wrong because using a NAT gateway is not secure and does not enforce VPC-only access.

Option C is wrong because CloudHSM is not needed for encryption; KMS is sufficient.

Option D is correct because duplicate key errors in DMS often occur when there are identity columns or triggers on the target that generate values conflicting with the source. Option A is wrong because DMS handles primary key conflicts by default. Option B is wrong because DMS usually handles this if configured, but the error suggests target-side uniqueness.

Option C is wrong because transaction log size does not cause duplicate key errors.

Global Tables replicate data across regions asynchronously, so conflict resolution (last writer wins) is important. Applications must handle eventually consistent reads. Write capacity must be provisioned in each region.

Option D (strong consistency) is not guaranteed across regions. Option E (single write region) defeats the purpose of Global Tables.

Option B is correct because Amazon DocumentDB (with MongoDB compatibility) stores JSON documents natively and supports MongoDB-like queries. Option A is wrong because DynamoDB is key-value, not optimized for rich JSON queries. Option C is wrong because RDS requires a fixed schema.

Option D is wrong because Neptune is a graph database.

Options A, B, and D are correct. You must create a KMS key (A), specify it during cluster creation (B), and modify the cluster to use encryption if not already encrypted (D). Option C is wrong because Redshift does not use CloudHSM for KMS-based encryption.

Option E is wrong because only the cluster owner can manage encryption; AWS does not manage it.

RDS for MySQL supports the SELECT INTO OUTFILE command to export query results to S3. This allows you to specify a SQL query (including joins) and export the results directly to S3 as CSV or other formats. This is efficient because it does not require an intermediate EC2 instance.

Option A (mysqldump) exports table by table and requires manual processing. Option C (pg_dump) is for PostgreSQL. Option D (copy command) is for Redshift.

Option B is correct because AWS DMS supports ongoing replication to minimize downtime during migration. Option A is wrong because AWS Snowball is for large data transfers but does not support ongoing replication. Option C is wrong because S3 is not a migration tool.

Option D is wrong because RDS does not natively support Oracle Data Pump directly; DMS is the recommended service.

Option B is correct because ReadThrottleEvents directly measures throttled read requests. Option A is wrong because ConsumedReadCapacityUnits shows actual usage, not throttled events. Option C is wrong because ThrottledRequests includes write throttles as well.

Option D is wrong because ReadLatency shows latency, not throttling.

AWS DMS provides data migration with ongoing replication, and AWS SCT can help convert schema if needed, but for homogeneous migration, DMS alone is sufficient. However, the combination is commonly used. Option C (CloudFormation) is for provisioning.

Option D (DataSync) is for file transfer. Option E (App2Container) is for containerization.

Option D is correct because Redshift uses KMS keys for encryption; a cluster-specific key can be created and used. Option A is wrong because default KMS key is AWS managed, not customer-managed. Option B is wrong because cluster subnet group does not affect encryption.

Option C is wrong because HSM is not used for Redshift encryption.

Option D is correct because on-demand tables can still throttle if a single partition receives more than 3,000 RCU or 1,000 WCU. Using adaptive capacity with a more uniform partition key distributes traffic. Option A is wrong because on-demand does not require adjusting RCU/WCU.

Option B is wrong because auto scaling is for provisioned capacity. Option C is wrong because DAX is a caching layer that reduces read load but does not eliminate throttling for hot partitions.

Option A is correct because the Sum metric over 1-minute period represents the total number of connections during that minute. A Sum of 200 indicates that at some point during the minute, connections exceeded the max_connections of 150, causing failures. Option B is wrong because the metric shows Sum, not average.

Option C is wrong because connection pooling reduces connections, not increases. Option D is wrong because the metric clearly shows high connection counts.

Option D is correct because AWS DMS can compress data during transfer, reducing the amount of data sent over the network, and can complete within a week even with a 50 Mbps connection. Option A is wrong because SQL Server native backup and restore requires the backup file to be transferred over the network, which may take too long with 50 Mbps. Option B is wrong because BCP export/import also transfers the entire data over the network.

Option C is wrong because creating a read replica is not possible from on-premises.

Using a customer-managed KMS key with automatic annual rotation and enabling CloudTrail logging of key usage provides encryption control and auditing. Option A is wrong because SSE-S3 does not provide customer control or audit. Option B is wrong because SSE-KMS with automatic rotation is more secure and auditable than manual rotation.

Option D is wrong because default encryption with AES-256 does not allow customer key rotation or detailed audit.

Option A is correct because enabling backup compression reduces backup size and speeds up transfers. Option B is correct because using Provisioned IOPS improves I/O performance for backups. Option C is wrong because increasing retention does not improve performance.

Option D is wrong because disabling Multi-AZ reduces availability. Option E is wrong because using a smaller instance class would worsen performance.

Option B is correct: using an S3 staging area to store archived logs temporarily gives DMS more time to read them. Option A is wrong because increasing instance size does not affect log retention. Option C is wrong because it would cause data loss.

Option D is wrong because changing to full load only would cause downtime.

Option C is correct because Performance Insights provides a dashboard to identify top queries by load. Option A is wrong because it shows connections, not query performance. Option B is wrong because CloudWatch logs show slow queries but not in real-time.

Option D is wrong because RDS events show instance events, not query load.

Option D is correct because DynamoDB encryption at rest uses KMS and the encryption key can only be changed when creating a new table. You cannot modify the encryption key on an existing table. Option A is wrong because there is no UpdateTable API for encryption key.

Option B is wrong because the default key cannot be deleted if in use. Option C is wrong because KMS key rotation does not change the key material used by DynamoDB.

Option A is correct because the PendingModifiedValues show EngineVersion 5.7.23, indicating a pending minor version upgrade. Option B is wrong because the parameter group is the default, not custom. Option C is wrong because the password is pending modification, but the question asks about the version.

Option D is wrong because the output does not show a failure.

Option D is correct because data skew causes some slices to have more data than others, leading to slower queries. Recreating the table with a different distribution style can help. Option A is incorrect because vacuum reclaims space and analyzes statistics, but does not fix data skew.

Option B is incorrect because modifying sort keys can improve query performance but does not address data skew. Option C is incorrect because adding more nodes does not automatically redistribute existing data; skew persists.

Option A is correct because the primary continues to accept writes independently; the secondary failure does not affect primary operations. Option B is wrong because failover is not automatic for read replicas. Option C is wrong because the primary does not become read-only.

Option D is wrong because write operations continue.

Option C is correct because AWS DMS with ongoing replication allows minimal downtime by keeping the target in sync until cutover. Option A is wrong because native backup/restore would require downtime and is not designed for minimal downtime. Option B is wrong because SCT is for schema conversion, not data migration.

Option D is wrong because exporting to CSV and using COPY is not suitable for large databases with minimal downtime.

Option B is correct. RDS encryption cannot be enabled on an existing unencrypted instance. They must create a new encrypted instance, migrate the data, and delete the old instance.

Option A is wrong because you cannot enable encryption on an existing instance. Option C is wrong because only the AWS managed key is used for encrypting snapshots of unencrypted instances, but that does not encrypt the instance itself. Option D is wrong because RDS does not support encryption at the storage level.

AWS DMS with ongoing replication (change data capture) can capture changes and replicate them to S3. Option B (AWS Glue) is for ETL jobs, not real-time CDC. Option C (Amazon Kinesis Data Streams) could ingest data but requires additional configuration.

Option D (Amazon RDS for SQL Server replication) does not directly write to S3.

Option C is correct because the Deny statement with condition rds:StorageEncrypted=false explicitly denies creating unencrypted instances. The Allow statement allows all creates, but the Deny overrides it. Option A is wrong because the Deny takes precedence.

Option B is wrong because the Allow alone would allow it, but the Deny blocks it. Option D is wrong because the Deny is explicit, not implicit.

Option D is correct because setting up replication from the on-premises Redis to ElastiCache using the replication features can achieve minimal downtime. Option A is wrong because AWS DMS does not support Redis as a source. Option B is wrong because taking a snapshot and restoring requires downtime during the restore process.

Option C is wrong because the SAVE command is synchronous and can cause performance issues; BGSAVE is preferred.

Options A, C, and D are correct. IAM policies should be used to grant least privilege. DynamoDB supports encryption at rest with KMS.

Point-in-time recovery (PITR) is a security best practice for data protection. Option B (public access) is not a security best practice; DynamoDB tables are private by default. Option E (limiting item size) is a performance consideration, not a security best practice.

Option A is correct because AWS SCT (Schema Conversion Tool) is specifically designed to convert database schemas and code from one engine to another, including Oracle to PostgreSQL. Option B is wrong because AWS DMS focuses on data migration, not schema conversion. Option C is wrong because AWS Database Migration Service is for data migration, not conversion.

Option D is wrong because AWS Glue is for ETL, not schema conversion.

Option C is correct. The explicit Deny overrides the Allow, so the user cannot delete items. Option A is wrong because Deny takes precedence.

Option B is wrong because the Deny explicitly restricts deletion. Option D is wrong because the policy explicitly denies deletion.

Options A, B, and D are correct. DMS requires a replication instance, source endpoint, and target endpoint. Option C is wrong because a CloudFormation stack is not required.

Option E is wrong because a load balancer is not needed for DMS.

Option A is correct because Timestream is purpose-built for time-series data, offering automatic tiering and optimized aggregation queries. Option B (DynamoDB) can handle time-series but requires careful design and is less cost-effective for large-scale. Option C (RDS) is relational and not optimized for time-series.

Option D (Redshift) is for analytical workloads but is heavier and more expensive for IoT sensor data.

Amazon Aurora Global Database provides cross-Region replication and automated failover, meeting the high availability requirements. Option A (DynamoDB) is NoSQL, not relational. Option B (RDS Multi-AZ) is single-Region.

Option D (Redshift) is a data warehouse, not for OLTP.

Option C is correct because SVV_DISKUSAGE provides information about disk usage per slice, which helps identify skew. Option A is wrong because STL_SCAN is for scan operations. Option B is wrong because STV_TBL_PERM shows permissions.

Option D is wrong because PG_TABLE_DEF shows table definitions.

Option B is correct because DMS disables foreign key constraints during full load to speed up data transfer, then re-enables them. If the data violates constraints, it fails. Option A is wrong because DMS handles data type conversions automatically.

Option C is wrong because CDC is not the issue. Option D is wrong because DMS doesn't require a primary key in the target during full load.

Option D is correct because DynamoDB auto scaling adjusts capacity based on actual usage and can handle predictable spikes with minimal cost. Option A is wrong because switching to on-demand can be more expensive for predictable workloads. Option B is wrong because increasing capacity manually requires monitoring and intervention.

Option C is wrong because SQS does not directly handle DynamoDB write throttling.

Option B is correct because CloudWatch Alarms can trigger on FreeStorageSpace metric. Option A is wrong because SNS is a notification service, not monitor. Option C is wrong because CloudTrail is for API activity.

Option D is wrong because Config tracks configuration changes.

Option B is correct because Performance Insights shows detailed query-level performance. Option A is wrong because CloudWatch Logs are for log files. Option C is wrong because CloudTrail is for API calls.

Option D is wrong because S3 does not monitor RDS memory.

Option D is correct. Adding a read replica offloads read traffic from the primary instance, reducing latency. Option A is wrong because Multi-AZ does not improve read performance; the standby is not used for reads.

Option B is wrong because increasing storage may improve throughput but not resolve read contention. Option C is wrong because gp3 provides consistent performance but does not solve read scaling.

Options A and D are correct. AWS Snowball can transfer the backup offline, bypassing network constraints. AWS DMS with ongoing replication can use change data capture to minimize downtime after initial load.

Option B is wrong because VPN does not increase bandwidth. Option C is wrong because DataSync is for file storage, not databases. Option E is wrong because direct transfer over the internet would be too slow.

Enforcing SSL/TLS for connections is required for encryption in transit. Option B is correct. Option A is wrong because enabling encryption at rest does not encrypt data in transit.

Option C is wrong because a VPN encrypts network traffic but does not enforce database-level SSL. Option D is wrong because modifying security group rules does not encrypt connections.

Options A, B, and D are correct. Enabling encryption at rest is done during instance creation. SSL enforcement requires modifying the parameter group and downloading the certificate.

Option C is wrong because RDS manages the certificate; you don't upload your own. Option E is wrong because you don't need to install the certificate on every client; it's needed on the application side.

Option C is correct because IAM database authentication for RDS MySQL requires creating an IAM role with a policy that allows the rds-db:connect action, then mapping that role to a database user using the CREATE USER statement with the AWSAuthenticationPlugin. Option A is wrong because SSL is not required for IAM auth, though recommended. Option B is wrong because the policy must include rds-db:connect, not rds:connect.

Option D is wrong because the database user must be created with AWSAuthenticationPlugin, not with a password.

Amazon Neptune is a fully managed graph database service optimized for highly connected data. DynamoDB is NoSQL but not graph. RDS is relational, which can model graphs but with complex queries.

DocumentDB is document-based.

Option C is correct because column-level GRANTs in Redshift do not revoke existing permissions; they only add. If the user already had SELECT on the table, they still have access to all columns. Option A is not relevant.

Option B is about views, not the issue. Option D is unrelated.

Option A is correct because the Lambda function creates new connections, exhausting the pool. Using RDS Proxy manages connections efficiently. Option B is wrong because increasing max_connections may cause resource contention.

Option C is wrong because reducing provisioned concurrency may not solve the root cause. Option D is wrong because decreasing max_connections would worsen the issue.

Option C is correct because Performance Insights provides a database performance tuning and monitoring feature that allows you to assess the load on your database and determine when and where to take action. Option A is wrong because CloudWatch Logs does not capture query-level performance. Option B is wrong because CloudTrail tracks API activity, not database queries.

Option D is wrong because RDS Enhanced Monitoring provides OS-level metrics, not query-level metrics.

Option A is correct because AWS Schema Conversion Tool (AWS SCT) is designed to convert database schema and code objects like stored procedures from one engine to another. Option B is wrong because AWS DMS migrates data, not schema/code. Option C is wrong because Amazon Redshift's COPY command loads data from S3.

Option D is wrong because AWS Glue is an ETL service, not specialized for schema conversion.

Options A and C are correct. Setting up AWS DMS with ongoing replication allows minimal downtime, and validating the schema with SCT before migration is a best practice. Option B is wrong because disabling archiving would prevent CDC.

Option D is wrong because increasing storage does not affect downtime. Option E is wrong because a single-AZ deployment does not inherently reduce downtime.

Amazon RDS provides managed relational databases (MySQL, PostgreSQL) that support complex JOINs and can be scaled vertically or with read replicas. Option B is wrong because DynamoDB is NoSQL and does not natively support JOINs. Option C is wrong because ElastiCache is an in-memory cache, not a primary database.

Option D is wrong because Neptune is a graph database, which is overkill and not optimized for typical relational queries.

Options A, C, and E are correct. Option A: An IAM role for the application to assume. Option C: A database user mapped to the IAM role.

Option E: A DB parameter group with require_secure_transport set to ON to enforce SSL. Option B is wrong because a KMS key is not required for IAM authentication. Option D is wrong because an RDS proxy is optional, not required.

Option D is correct because RDS for SQL Server supports exporting audit logs to S3 via the 'rds_sqlserver_audit' option group or by using the 'mysql' option? Actually, for SQL Server, you can use the 'SQLSERVER_AUDIT' option and specify an S3 bucket. Option A is for general log files. Option B is for Oracle.

Option C is for MySQL.

AWS DMS provides data migration with ongoing replication, and AWS SCT can help convert schema if needed, but for homogeneous migration, DMS alone is sufficient. However, the question asks for two services; the combination of DMS and SCT is commonly used for heterogeneous migrations. For homogeneous, DMS alone is enough, but SCT can still be used to assess schema compatibility.

Option E is incorrect because CloudEndure is for server migration.