Knowledge + Practice

AWS Certified Database Specialty DBS-C01 (DBS-C01) — Questions 601–675

1663 questions total · 23pages · All types, answers revealed

Take a mock exam Exam hub

Page 9 of 23

601

MCQhard

A financial services company uses Amazon DynamoDB to store transaction records. The security team requires that all items be encrypted at rest using a customer-managed AWS KMS key. Additionally, the company must be able to audit key usage and rotation. What is the MOST secure and auditable approach?

A.Enable default encryption on the DynamoDB table using SSE-S3.

B.Use SSE-KMS with a customer-managed key and manually rotate the key every 90 days.

C.Use SSE-KMS with a customer-managed key, enable automatic key rotation, and enable CloudTrail data events for the key.

D.Use client-side encryption with the AWS Encryption SDK.

AnswerC

SSE-KMS with customer-managed key and automatic rotation, combined with CloudTrail data events, meets the requirements for control and audit.

Why this answer

Using a customer-managed KMS key with automatic annual rotation and enabling CloudTrail logging of key usage provides encryption control and auditing. Option A is wrong because SSE-S3 does not provide customer control or audit. Option B is wrong because manual rotation is less secure and auditable than automatic rotation.

Option D is wrong because client-side encryption would require managing encryption keys on the client side, which does not leverage the AWS KMS infrastructure for automatic key rotation and auditing, and is not as integrated or auditable as server-side encryption with KMS.

Full explanation →

602

Multi-Selecteasy

A company is using Amazon RDS for Oracle with Automated Backups enabled. The database size is 1 TB. The company wants to improve the backup and restore performance. Which TWO actions should be taken? (Choose two.)

Select 2 answers

A.Use Provisioned IOPS storage for the database.

B.Enable backup compression.

C.Use a smaller DB instance class to reduce backup size.

D.Increase the backup retention period to 35 days.

E.Disable Multi-AZ to reduce backup time.

AnswersA, B

Higher IOPS improves backup and restore throughput.

Why this answer

Using Provisioned IOPS storage improves I/O performance, which speeds up backup and restore operations. Option B is correct because enabling backup compression reduces the backup size, leading to faster transfer and restore times. Option C is wrong because using a smaller DB instance class would degrade performance, not improve it.

Option D is wrong because increasing the backup retention period to 35 days does not affect backup performance; it only increases the storage used. Option E is wrong because disabling Multi-AZ would reduce availability and does not improve backup performance; in fact, Multi-AZ can improve backup performance by offloading backups to the standby instance.

Full explanation →

603

MCQhard

A company is migrating a 2 TB Oracle database to Amazon RDS for Oracle. The migration requires minimal downtime. They use AWS SCT to convert the schema and AWS DMS for data migration. After the full load, DMS ongoing replication is unable to capture changes because the archived redo logs are being deleted on the source before DMS can read them. The source database has a log retention setting of 2 hours. The team cannot increase the retention due to storage constraints. What should they do?

A.Switch to a full load only migration strategy.

B.Disable archiving on the source database.

C.Increase the DMS replication instance size to improve log reading speed.

D.Configure DMS to use an S3 bucket to store archived redo logs.

AnswerD

Correct: Configuring DMS to use an S3 bucket to store archived redo logs provides a temporary staging area, allowing DMS to read the logs before they are deleted. This solves the issue without increasing log retention on the source.

Why this answer

AWS DMS supports storing archived redo logs in an S3 bucket as a staging area, which allows DMS to process the logs before they are deleted from the source. This resolves the issue without requiring increased log retention on the source. Option A (full load only) would cause downtime.

Option B (disabling archiving) would prevent DMS from capturing ongoing changes. Option C (increasing DMS instance size) does not affect log reading speed from archived logs.

Full explanation →

604

MCQmedium

An Amazon RDS for MySQL DB instance has a high number of connections and the application is experiencing slow response times. The database administrator wants to identify the queries that are causing the most load. Which approach is most effective?

A.Enable slow query logs and analyze them in CloudWatch Logs

B.Monitor the DatabaseConnections metric in CloudWatch

C.Enable Amazon RDS Performance Insights and review the top SQL queries

D.Check RDS events for any error messages

AnswerC

Performance Insights provides real-time and historical analysis of database load and top queries.

Why this answer

Performance Insights provides a dashboard to identify top queries by load. Option A is wrong because it shows connections, not query performance. Option B is wrong because CloudWatch logs show slow queries but not in real-time.

Option D is wrong because RDS events show instance events, not query load.

Full explanation →

605

MCQhard

A company uses Amazon DynamoDB to store sensitive user data. The security team wants to ensure that all data is encrypted at rest using a customer-managed AWS KMS key. The DynamoDB table was created with the default AWS managed key. What is the required action to change the encryption key?

A.Use the UpdateTable API to specify the new KMS key.

B.Create a new DynamoDB table with the desired KMS key, export data from the old table, and import into the new table.

C.Enable automatic key rotation on the existing KMS key.

D.Delete the default AWS managed key and create a new customer managed key.

AnswerB

Encryption key can only be set at table creation.

Why this answer

DynamoDB does not allow changing the encryption key on an existing table. To use a customer-managed KMS key, you must create a new table with the desired key, export data from the old table, and import it into the new table. Option A is incorrect because the UpdateTable API does not support changing the encryption key.

Option C is incorrect because enabling automatic key rotation on the existing KMS key does not change the key used by DynamoDB; it rotates the key material but the table still uses the same key ID. Option D is incorrect because deleting the default AWS managed key would break encryption for any tables using it, and it does not allow you to change the key for the existing table.

Full explanation →

606

MCQmedium

A company uses Amazon DynamoDB for a time-series IoT workload. Each device sends a data point every minute. The primary key consists of device_id (partition key) and timestamp (sort key). The company wants to efficiently retrieve the latest 10 data points for a specific device. Which query design is most efficient?

A.Use GetItem on the device_id partition key with the maximum timestamp.

B.Query the table with ScanIndexForward=true and Limit=10, then reverse the result set.

C.Query the table with ScanIndexForward=false and Limit=10.

D.Scan the entire table and filter by device_id, then sort by timestamp.

AnswerC

This returns the most recent 10 items in descending order by timestamp.

Why this answer

Query with ScanIndexForward=false retrieves items in descending order by the sort key (timestamp), and Limit=10 stops after the first 10 items, which are the most recent 10 data points for the given device_id. This is the most efficient design as it reads only the 10 items needed, leveraging the DynamoDB local secondary index or table's sort key order without any post-processing.

Exam trap

The trap here is that candidates may confuse ScanIndexForward=true with 'latest' results, or incorrectly assume GetItem can retrieve the maximum sort key without knowing its value, leading them to choose inefficient options like scanning or reversing an ascending query.

How to eliminate wrong answers

Option A is wrong because GetItem requires both partition key and sort key; using only device_id with a maximum timestamp is not a valid operation—GetItem cannot compute a max value, and you would need to know the exact timestamp. Option B is wrong because ScanIndexForward=true retrieves items in ascending order (oldest first), so with Limit=10 you get the oldest 10 items, not the latest; reversing the result set still gives the oldest 10, not the newest. Option D is wrong because Scan reads the entire table, which is inefficient and costly for large datasets, and filtering by device_id after scanning defeats the purpose of using DynamoDB's indexed access.

Full explanation →

607

MCQhard

An administrator runs the CLI command shown in the exhibit and sees the output. The DB instance 'mydb' is currently running MySQL 5.7.22. What does the output indicate?

A.The master user password has been changed

B.The DB instance has failed to apply modifications

C.The DB instance is using a custom DB parameter group

D.The DB instance has a pending minor version upgrade to 5.7.23

AnswerD

The EngineVersion in PendingModifiedValues indicates a pending upgrade.

Why this answer

The output shows 'Pending maintenance: Yes' with 'Minor version upgrade to 5.7.23' listed. This indicates that the DB instance has a pending minor version upgrade that will be applied during the next maintenance window. The CLI command 'aws rds describe-db-instances --db-instance-identifier mydb' returns this information when a minor version upgrade is scheduled but not yet applied.

Exam trap

The trap here is that candidates may confuse 'Pending maintenance' with a failed modification or a password change, but RDS clearly separates pending maintenance actions (like version upgrades) from immediate modifications (like password changes) in the CLI output.

How to eliminate wrong answers

Option A is wrong because changing the master user password would not appear as a pending maintenance action; it would be reflected in the 'MasterUsername' field and is applied immediately without a pending state. Option B is wrong because the output does not show any error or failure state; 'Pending maintenance: Yes' is a normal status indicating a scheduled action, not a failure to apply modifications. Option C is wrong because using a custom DB parameter group would be shown in the 'DBParameterGroup' field of the output, not as a pending maintenance action; the pending maintenance field specifically tracks upgrades and patches.

Full explanation →

608

MCQmedium

A company is using Amazon Redshift for data warehousing. They notice that query performance has degraded over time. The database administrator checks the system tables and finds that there is significant skew in data distribution across slices. What action should be taken to improve query performance?

A.Recreate the table with a different distribution style, such as KEY distribution on a column with high cardinality.

B.Increase the number of nodes in the cluster.

C.Run the VACUUM command to reclaim space and update statistics.

D.Modify the sort keys to better match the query patterns.

AnswerA

Changing distribution style can redistribute data evenly across slices, reducing skew.

Why this answer

Data skew causes some slices to have more data, leading to slower queries. Recreating the table with a different distribution style, such as KEY distribution on a column with high cardinality, can distribute data more evenly across slices. Option B is incorrect because adding more nodes does not automatically redistribute existing data; the skewed distribution persists.

Option C is incorrect because running VACUUM reclaims space and updates statistics but does not address data skew. Option D is incorrect because modifying sort keys improves query performance by optimizing data ordering but does not fix uneven data distribution across slices.

Full explanation →

609

MCQmedium

A company is using Amazon RDS for SQL Server with Always On Availability Groups. The primary DB instance is in us-east-1, and the secondary is in us-west-2. The application writes to the primary and reads from the secondary. The secondary instance becomes unreachable due to a network issue. What happens to the primary instance?

A.The primary continues to accept read and write operations.

B.The primary stops accepting write operations.

C.The primary automatically fails over to the secondary.

D.The primary becomes read-only until the secondary is restored.

AnswerA

The primary continues to accept read and write operations normally because the failure of the secondary does not impact primary operations in an Always On Availability Group setup.

Why this answer

When the secondary DB instance (read replica) becomes unreachable, the primary continues to accept read and write operations normally. The secondary is an asynchronous replica, so its failure does not affect the primary. Option B is wrong because the primary does not stop accepting writes; write operations continue.

Option C is wrong because failover is not automatic for asynchronous replicas; manual intervention would be required to promote the secondary. Option D is wrong because the primary remains fully available and does not become read-only.

Full explanation →

610

MCQhard

A company needs to migrate a 10 TB SQL Server database from on-premises to Amazon RDS for SQL Server with minimal downtime. The database is heavily used with frequent write operations. Which migration strategy should be used?

A.Use native SQL Server backup and restore to Amazon S3, then restore to RDS.

B.Export the database to CSV files, upload to S3, and use the COPY command in RDS.

C.Use AWS Schema Conversion Tool (SCT) to convert the schema, then use AWS DMS for full load.

D.Use AWS DMS with ongoing replication from the on-premises database to RDS until cutover.

AnswerD

DMS ongoing replication enables minimal downtime by keeping the target current.

Why this answer

AWS DMS with ongoing replication (change data capture) allows a full load of the 10 TB database followed by continuous replication of write operations from the on-premises SQL Server to Amazon RDS for SQL Server. This minimizes downtime by keeping the target database synchronized until the cutover window, where only a brief pause is needed to apply final changes and switch traffic.

Exam trap

The trap here is that candidates often assume native backup/restore (Option A) is the simplest approach for large databases, but they overlook the requirement for minimal downtime and the fact that DMS with CDC is specifically designed for near-zero downtime migrations with ongoing writes.

How to eliminate wrong answers

Option A is wrong because native SQL Server backup and restore to S3 and then to RDS requires the database to be offline or in read-only mode during the backup and restore process, causing significant downtime for a heavily used database with frequent writes. Option B is wrong because exporting a 10 TB database to CSV files is impractical due to schema complexity, foreign keys, and the need to stop writes to maintain consistency; the COPY command in RDS is for loading flat files, not for ongoing replication. Option C is wrong because AWS SCT is used for schema conversion when migrating to a different database engine (e.g., SQL Server to Aurora), not for a homogeneous SQL Server to SQL Server migration, and DMS alone without ongoing replication would still require downtime for the final sync.

Full explanation →

611

MCQeasy

A startup is using Amazon RDS for MySQL as its primary database. The database contains user profiles and payment information. The security team wants to ensure that database snapshots are encrypted and that the encryption key is managed by the company. The team also wants to enforce that all future snapshots are encrypted automatically. The current RDS instance is not encrypted. What should they do?

A.Enable encryption on the existing RDS instance by modifying the DB instance.

B.Create a new encrypted RDS instance, migrate the data, and point the application to the new instance.

C.Use AWS KMS to encrypt the underlying EBS volumes of the RDS instance.

D.Take a snapshot of the current instance, copy it with encryption enabled, and restore from the encrypted snapshot.

AnswerB, D

Correct. Creating a new encrypted RDS instance and migrating data is a valid approach to achieve encryption.

Why this answer

For an unencrypted RDS instance, you cannot enable encryption directly. You have two valid options: either create a new encrypted instance and migrate the data (Option B), or take a snapshot, copy it with encryption enabled, and restore from that encrypted snapshot (Option D). Both methods result in an encrypted instance.

Option D is often simpler and faster. Option A is incorrect because encryption cannot be enabled on an existing instance. Option C is incorrect because RDS encryption is not applied at the EBS volume level; it is managed at the instance level.

Full explanation →

612

MCQeasy

A company is using Amazon ElastiCache for Redis as a caching layer for frequently accessed data. The application needs to support caching of session data that must be highly available across multiple Availability Zones. Which ElastiCache configuration should be used?

A.Deploy a single Redis node in one Availability Zone.

B.Deploy a Redis cluster with cluster mode disabled.

C.Deploy a Memcached cluster with multiple nodes.

D.Deploy a Redis cluster with cluster mode enabled and replica nodes in a different Availability Zone.

AnswerD

Cluster mode with replicas across AZs provides high availability and automatic failover.

Why this answer

Deploying a Redis cluster with cluster mode enabled and replica nodes in a different Availability Zone provides both high availability and automatic failover for session data. ElastiCache for Redis with cluster mode enabled supports sharding and replication, allowing replica nodes to be placed in a separate AZ to survive an AZ failure. This configuration ensures session data remains accessible even if the primary node or an entire AZ becomes unavailable, meeting the requirement for multi-AZ high availability.

Exam trap

The trap here is that candidates often confuse cluster mode enabled/disabled with multi-AZ support, mistakenly thinking that cluster mode disabled cannot place replicas in different AZs, when in fact both modes support multi-AZ replication, but the question's requirement for 'highly available across multiple Availability Zones' and the specific wording of the correct answer point to cluster mode enabled as the intended solution for a Redis cluster that can scale and survive AZ failures.

How to eliminate wrong answers

Option A is wrong because a single Redis node in one AZ provides no redundancy; if the node or AZ fails, all session data is lost and the application becomes unavailable. Option B is wrong because a Redis cluster with cluster mode disabled (i.e., a single shard with replicas) can provide multi-AZ replication, but the question specifies 'cluster mode enabled' is required for the configuration that explicitly supports sharding and scaling; however, the core issue is that cluster mode disabled still allows replicas in different AZs, but the exam trap is that candidates may think cluster mode disabled cannot achieve multi-AZ HA—actually it can, but the question's correct answer explicitly requires cluster mode enabled for the described scenario, and the other options are clearly wrong. Option C is wrong because Memcached does not support replication or persistence; it is a pure caching engine with no built-in high availability or failover, so it cannot guarantee session data durability across AZ failures.

Full explanation →

613

MCQmedium

A company is running an Amazon RDS for SQL Server DB instance. The company needs to capture changes to a specific table and replicate them to an Amazon S3 bucket in near real time. Which AWS service should be used to achieve this?

A.AWS Glue

B.AWS Database Migration Service (AWS DMS) with ongoing replication

C.Amazon RDS for SQL Server native replication

D.Amazon Kinesis Data Streams

AnswerB

DMS supports change data capture to replicate changes to S3 nearly in real time.

Why this answer

AWS DMS with ongoing replication (change data capture) is the correct choice because it can continuously capture changes from the RDS for SQL Server source and replicate them to an Amazon S3 bucket in near real time. Option A (AWS Glue) is incorrect because AWS Glue is a batch ETL service, not designed for real-time change data capture. Option C (Amazon RDS for SQL Server native replication) is incorrect because native replication features like Always On Availability Groups or log shipping replicate data to another SQL Server instance, not directly to S3.

Option D (Amazon Kinesis Data Streams) is incorrect because while it can ingest streaming data, it would require additional custom application logic to capture changes from RDS and push to Kinesis, making it less straightforward than DMS for this use case.

Full explanation →

614

MCQeasy

A company uses Amazon DynamoDB for a gaming application that stores player data. The application frequently accesses items by the player's user ID. However, the company also needs to query players by their subscription tier (Gold, Silver, Bronze) and registration date. Which design should the database specialist recommend for this access pattern?

A.Export the data to Amazon Elasticsearch Service for querying.

B.Create a Local Secondary Index (LSI) on subscription tier and registration date.

C.Enable DynamoDB Streams and process the stream to populate a separate table.

D.Create a Global Secondary Index (GSI) on subscription tier and registration date.

AnswerD

A GSI allows querying on different attributes with its own partition and sort keys.

Why this answer

A Global Secondary Index (GSI) on subscription tier and registration date is the correct choice because it allows efficient querying on non-primary key attributes without affecting the base table's primary key structure. DynamoDB GSIs support eventually consistent reads and can be created on any table, enabling the required access pattern of querying players by subscription tier and registration date while maintaining the primary access pattern by user ID.

Exam trap

The DBS-C01 exam often tests the distinction between LSI and GSI, where candidates mistakenly choose LSI because they think it's the only index that can include multiple attributes, but they forget that LSI shares the base table's partition key and cannot be added after table creation.

How to eliminate wrong answers

Option A is wrong because exporting data to Amazon Elasticsearch Service introduces unnecessary complexity, latency, and cost for a simple query pattern that DynamoDB can handle natively with an index. Option B is wrong because a Local Secondary Index (LSI) can only be created at table creation time and shares the same partition key as the base table, which would not allow efficient querying by subscription tier and registration date as a composite sort key across all partitions. Option C is wrong because enabling DynamoDB Streams and populating a separate table adds operational overhead and eventual consistency delays without providing the direct query capability that a GSI offers.

Full explanation →

615

MCQmedium

An IAM policy is shown in the exhibit. What is the effect of this policy when a user tries to create an unencrypted RDS DB instance?

A.The user is denied from creating the unencrypted instance because of the Deny statement.

B.The user is allowed to create the unencrypted instance because the Deny statement is not valid.

C.The user is denied from creating any DB instance because of an implicit deny.

D.The user is allowed to create the unencrypted instance because of the Allow statement.

AnswerA

The Deny statement explicitly denies creation when encryption is false.

Why this answer

The IAM policy includes an Allow statement for 'rds:CreateDBInstance' and a Deny statement with a condition 'rds:StorageEncrypted=false'. When the user attempts to create an unencrypted RDS instance, the Deny statement explicitly denies the action because the condition is met (encryption is not enabled). Explicit Deny always overrides any Allow, so the user is denied.

Option B is incorrect because the Deny statement is valid under IAM policy evaluation logic. Option C is incorrect because the Deny is explicit, not implicit, and only applies to unencrypted instances, not all DB instances. Option D is incorrect because the Deny explicitly overrides the Allow for unencrypted instances.

Full explanation →

616

MCQmedium

A company has a self-managed Redis cluster that needs to be migrated to Amazon ElastiCache for Redis. The cluster is 100 GB in size and has a high write throughput. The migration must have minimal downtime. Which steps should be taken?

A.Use AWS DMS to migrate the data with ongoing replication

B.Take a snapshot of the source and restore to ElastiCache

C.Use the SAVE command to create a dump, upload to S3, and import to ElastiCache

D.Set up replication from the source to ElastiCache using Redis replication

AnswerD

Replication allows minimal downtime by continuously syncing changes.

Why this answer

Redis replication (using the REPLICAOF or SLAVEOF command) allows you to set up the ElastiCache cluster as a read-replica of the self-managed Redis cluster, enabling continuous, asynchronous replication with minimal downtime. Once the replica is fully synchronized, you can promote it to the primary role with a brief failover, achieving a near-zero-downtime migration. This approach is ideal for a 100 GB cluster with high write throughput, as it avoids the performance impact of snapshotting or dump/restore operations.

Exam trap

The trap here is that candidates often assume AWS DMS is a universal migration tool for any data store, but it does not support Redis, making option A a tempting but incorrect choice.

How to eliminate wrong answers

Option A is wrong because AWS DMS does not support Redis as a source or target for ongoing replication; DMS is designed for relational databases and some NoSQL stores like DynamoDB, but not for Redis. Option B is wrong because taking a snapshot of a 100 GB cluster with high write throughput would cause significant performance degradation and potential data inconsistency, and restoring from a snapshot requires downtime that may be unacceptable. Option C is wrong because the SAVE command is a blocking operation that halts all client writes until the dump completes, causing downtime; additionally, uploading to S3 and importing to ElastiCache is a manual, offline process that does not support ongoing replication.

Full explanation →

617

Multi-Selecthard

Which THREE of the following are best practices for securing an Amazon DynamoDB table? (Select THREE.)

Select 3 answers

A.Enable point-in-time recovery (PITR) to protect against accidental writes or deletes.

B.Enable encryption at rest using AWS KMS.

C.Enable public access to the table to allow easy data sharing.

D.Use IAM policies to restrict access to the table based on the principle of least privilege.

E.Limit the maximum item size to 100 KB to reduce storage costs.

AnswersA, B, D

PITR allows restoring to any point within the last 35 days.

Why this answer

Options A, B, and D are correct. Point-in-time recovery (PITR) protects against accidental writes or deletes by allowing you to restore the table to any point within the last 35 days. Encryption at rest using AWS KMS secures data at rest.

IAM policies based on least privilege restrict access to only necessary actions and resources. Option C (public access) is not a best practice; DynamoDB tables are private by default and should not be exposed publicly. Option E (limiting item size) is a performance consideration, not a security best practice.

Full explanation →

618

MCQeasy

A company wants to migrate its on-premises Oracle database to Amazon Aurora PostgreSQL. The company needs to convert the database schema and code from Oracle to PostgreSQL. Which AWS service should they use for schema conversion?

A.AWS DMS

B.AWS Glue

C.AWS Schema Conversion Tool (SCT)

D.AWS Database Migration Service

AnswerC

SCT converts Oracle schemas to PostgreSQL.

Why this answer

AWS Schema Conversion Tool (SCT) is the correct choice because it is specifically designed to convert database schemas, stored procedures, functions, and other code objects from one database engine to another, such as Oracle to Amazon Aurora PostgreSQL. It analyzes the source schema and generates a target schema with equivalent PostgreSQL syntax, handling data type mappings, PL/SQL to PL/pgSQL conversion, and other compatibility issues. AWS DMS handles data migration but does not perform schema or code conversion.

Exam trap

The trap here is that candidates often confuse AWS DMS with schema conversion, assuming DMS can handle both data and schema migration, but DMS only moves data and requires SCT for schema transformation.

How to eliminate wrong answers

Option A (AWS DMS) is wrong because AWS Database Migration Service (DMS) is a data migration tool that moves data between databases, but it does not convert schema or code objects like stored procedures or triggers; it relies on SCT for schema conversion. Option B (AWS Glue) is wrong because AWS Glue is a serverless data integration service for ETL (Extract, Transform, Load) jobs, primarily used for data preparation and analytics, not for converting database schemas between different engines. Option D (AWS Database Migration Service) is essentially the same as Option A and is wrong for the same reason: it handles data replication and migration, not schema or code conversion.

Full explanation →

619

MCQhard

A database specialist created the above IAM policy for a user. When the user attempts to delete an item from the Orders table, what happens?

A.The user cannot delete items because the Deny statement takes precedence.

B.The user cannot delete items because the policy does not include a condition.

C.The user can delete items because the Allow statement grants permission.

D.The user can delete items only if they have another policy that allows it.

AnswerA

Explicit Deny overrides any Allow.

Why this answer

In IAM, an explicit Deny overrides any Allow. Even though there is an Allow statement that grants DeleteItem permission, the explicit Deny for DeleteItem takes precedence, so the user cannot delete items. Option B is incorrect because the presence of a condition is irrelevant; the Deny is unconditional.

Option C is incorrect because the Allow is overridden by the Deny. Option D is incorrect because the Deny in this policy explicitly blocks deletion regardless of other policies.

Full explanation →

620

MCQeasy

A company needs to migrate a 100 GB MongoDB database to Amazon DocumentDB (with MongoDB compatibility). The migration must have minimal impact on the source database performance. Which approach should the company take?

A.Use AWS Database Migration Service (AWS DMS) with ongoing replication from the MongoDB source.

B.Use AWS DataSync to transfer the MongoDB data files.

C.Set up a MongoDB replica set on Amazon EC2 and promote it to primary, then migrate to DocumentDB.

D.Use mongodump to export the data and mongorestore to import into DocumentDB.

AnswerA

AWS DMS supports ongoing change data capture (CDC) from MongoDB oplog, enabling continuous replication with minimal read overhead on the source. This satisfies the stem’s constraint of minimal performance impact, as CDC reads only the oplog rather than scanning the entire 100 GB collection, avoiding sustained load on the production database.

Why this answer

AWS DMS with ongoing replication is the correct approach because it supports continuous change data capture (CDC) from MongoDB, enabling a live migration with minimal performance impact on the source. DMS reads the MongoDB oplog to capture changes without locking the database, which is critical for a 100 GB production database. This allows the target DocumentDB to stay synchronized until cutover, reducing downtime and avoiding the need for a full export/import that would strain the source.

Exam trap

The trap here is that candidates often choose mongodump/mongorestore (Option D) as the simplest tool, overlooking that it causes significant source performance impact and downtime for large databases, while AWS DMS's CDC capability is specifically designed for minimal-impact migrations.

How to eliminate wrong answers

Option B is wrong because AWS DataSync is designed for file-based transfers (e.g., NFS, SMB) and cannot directly read MongoDB's internal data files or handle the BSON format; it would require stopping the database to ensure consistency, causing significant impact. Option C is wrong because setting up a MongoDB replica set on EC2 and promoting it to primary involves complex manual steps, potential downtime, and does not directly migrate to DocumentDB; it also requires managing EC2 instances and does not leverage AWS-managed services for minimal impact. Option D is wrong because mongodump and mongorestore perform a full logical dump, which locks the source database during the dump (or requires a secondary read), causing performance degradation on a 100 GB database; it also lacks ongoing replication, leading to longer downtime.

Full explanation →

621

Multi-Selecteasy

A company is migrating a PostgreSQL database to Amazon Aurora PostgreSQL. They want to use the AWS DMS for the migration. Which THREE resources need to be created in the AWS account?

Select 3 answers

A.Application Load Balancer for the replication instance.

B.AWS CloudFormation stack to provision resources.

C.DMS target endpoint pointing to Aurora PostgreSQL.

D.DMS replication instance.

E.DMS source endpoint pointing to the PostgreSQL database.

AnswersC, D, E

The target endpoint defines the connection to the target database.

Why this answer

AWS DMS requires a target endpoint that specifies the connection details for the Amazon Aurora PostgreSQL database. This endpoint tells DMS where to load the migrated data, and it must be configured with the correct database name, credentials, and VPC settings to ensure successful connectivity during the migration task.

Exam trap

The trap here is that candidates might think CloudFormation is mandatory for provisioning DMS resources, but the exam tests that only the replication instance and both endpoints are the core required components for a DMS migration task.

Full explanation →

622

MCQeasy

A company wants to store and analyze time-series sensor data from millions of IoT devices. The data is append-only and rarely updated. Queries aggregate data over time ranges. Which AWS database service is most cost-effective and performant for this workload?

A.Amazon DynamoDB with time-series design pattern

B.Amazon Timestream

C.Amazon Redshift

D.Amazon RDS for MySQL with partitioning by date

AnswerB

Amazon Timestream is a fast, scalable, fully managed time-series database service.

Why this answer

Amazon Timestream is purpose-built for time-series data, offering automatic tiered storage (in-memory for recent data and magnetic for historical data) and optimized query performance for time-range aggregations. Its serverless architecture eliminates provisioning overhead, making it the most cost-effective and performant choice for append-only IoT sensor data with infrequent updates.

Exam trap

The trap here is that candidates often choose DynamoDB due to its familiarity and scalability, overlooking that Timestream is purpose-built for time-series workloads and offers automatic tiered storage and optimized query performance, which DynamoDB lacks without significant custom engineering.

How to eliminate wrong answers

Option A is wrong because DynamoDB with a time-series design pattern requires manual sharding, TTL management, and lacks native time-series query optimizations, leading to higher complexity and cost for large-scale append-only workloads. Option C is wrong because Amazon Redshift is a columnar data warehouse designed for complex analytical queries on structured data, not for high-ingest, append-only time-series data; its minimum cluster size and provisioning overhead make it less cost-effective for this use case. Option D is wrong because Amazon RDS for MySQL with partitioning by date incurs significant storage and I/O overhead for high-frequency inserts, lacks automatic tiered storage, and requires manual maintenance of partitions, making it less performant and more expensive than a purpose-built time-series database.

Full explanation →

623

MCQmedium

A company is designing a relational database for an e-commerce application that requires high availability and automated failover across AWS Regions. Which AWS database service should they use?

A.Amazon DynamoDB Global Tables

B.Amazon RDS with Multi-AZ deployment

C.Amazon Aurora Global Database

D.Amazon Redshift with cross-Region snapshot copy

AnswerC

Supports cross-Region replication and failover.

Why this answer

Amazon Aurora Global Database is the correct choice because it is designed for cross-Region disaster recovery and high availability, replicating data with a typical latency of under one second across multiple AWS Regions. It supports automated failover from the primary Region to one of the secondary Regions, meeting the requirement for automated cross-Region failover without manual intervention.

Exam trap

The trap here is that candidates often confuse Multi-AZ deployments (which are Region-specific) with cross-Region failover, or they mistakenly think DynamoDB Global Tables is relational, but the question's requirement for a relational database eliminates that option.

How to eliminate wrong answers

Option A is wrong because Amazon DynamoDB Global Tables is a NoSQL database, not a relational database, and the question explicitly requires a relational database. Option B is wrong because Amazon RDS with Multi-AZ deployment only provides high availability within a single AWS Region (across Availability Zones), not automated failover across Regions. Option D is wrong because Amazon Redshift with cross-Region snapshot copy is a data warehouse solution, not a relational database designed for transactional e-commerce workloads, and its cross-Region copy is manual or scheduled, not automated failover.

Full explanation →

624

MCQmedium

A company is using Amazon Redshift for data warehousing. The query performance has degraded over time. The DBA suspects that the distribution style of large tables is suboptimal. Which Redshift system view should be queried to identify distribution skew?

A.STL_SCAN

B.PG_TABLE_DEF

C.SVV_DISKUSAGE

D.STV_TBL_PERM

AnswerC

SVV_DISKUSAGE provides disk usage per slice, which helps identify distribution skew.

Why this answer

SVV_DISKUSAGE provides disk usage per slice, which helps identify distribution skew. Option A is wrong because STL_SCAN provides details about scan operations, not skew. Option B is wrong because PG_TABLE_DEF shows table definitions, not skew.

Option D is wrong because STV_TBL_PERM shows storage usage per table but not per slice, making it less suitable for skew analysis.

Full explanation →

625

MCQeasy

A company is migrating a PostgreSQL database to Amazon Aurora PostgreSQL. To minimize downtime, they plan to use the AWS DMS with change data capture (CDC). During the full load phase, DMS reports an error: 'Failed to add foreign key constraint'. What is the most likely cause?

A.CDC is incompatible with foreign key constraints

B.Referential integrity violations in the source data

C.The target table lacks a primary key

D.Data type mismatch between source and target

AnswerB

DMS applies constraints after loading data, and if data violates them, the task fails.

Why this answer

The error 'Failed to add foreign key constraint' during the full load phase of AWS DMS indicates that the source data contains referential integrity violations. DMS attempts to apply foreign key constraints on the target Aurora PostgreSQL after loading data, but if parent-child relationships are broken (e.g., orphan rows), the constraint creation fails. This is a common issue when migrating databases with existing data integrity problems, as DMS does not automatically validate or fix source data.

Exam trap

The trap here is that candidates assume the error is due to a DMS limitation or configuration issue, rather than recognizing it as a data integrity problem in the source database that must be resolved before migration.

How to eliminate wrong answers

Option A is wrong because CDC (change data capture) is fully compatible with foreign key constraints; DMS handles constraints by applying them after the full load and during ongoing replication. Option C is wrong because the target table lacking a primary key would cause a different error (e.g., 'No primary key defined' or issues with CDC), not a foreign key constraint failure. Option D is wrong because data type mismatches between source and target typically cause row-level conversion errors or truncation warnings, not a failure to add a foreign key constraint.

Full explanation →

626

MCQmedium

A company uses Amazon DynamoDB with provisioned capacity for a gaming application. During a new game launch, write traffic spikes to 2x the provisioned write capacity for 30 minutes. Some writes are throttled. The company wants to handle these predictable spikes without manual intervention. What is the MOST cost-effective solution?

A.Increase the provisioned write capacity to 2x the baseline permanently.

B.Change the table to on-demand capacity mode.

C.Enable DynamoDB auto scaling with a target utilization of 70%.

D.Use Amazon SQS to buffer writes and process them later.

AnswerC

Auto scaling dynamically adjusts capacity to match traffic, cost-effective for predictable spikes.

Why this answer

DynamoDB auto scaling automatically adjusts provisioned capacity based on actual usage, handling predictable spikes without manual intervention while minimizing cost by scaling down when demand drops. Option A is wrong because permanently doubling capacity leads to wasted resources and higher costs. Option B is wrong because on-demand mode can be more expensive for predictable workloads with consistent baseline traffic.

Option D is wrong because SQS buffers writes but does not directly address DynamoDB write throttling; it adds latency and complexity without solving the capacity issue.

Full explanation →

627

MCQeasy

A database administrator wants to receive an alert when an RDS instance's storage space drops below 10% of total allocated storage. Which AWS service should be used to set up this alert?

A.Amazon SNS

B.AWS CloudTrail

C.AWS Config

D.Amazon CloudWatch Alarms

AnswerD

CloudWatch Alarms monitor metrics and trigger actions when thresholds are breached.

Why this answer

Amazon CloudWatch Alarms can monitor the FreeStorageSpace metric for RDS instances and trigger an action (e.g., send an SNS notification) when the storage space drops below 10% of total allocated storage. Option A (Amazon SNS) is a notification service that can be used with CloudWatch Alarms but does not itself monitor metrics. Option B (AWS CloudTrail) records API activity, not storage metrics.

Option C (AWS Config) tracks configuration changes. Therefore, Option D is the correct service for setting up the alert.

Full explanation →

628

MCQeasy

A database specialist notices that an RDS MySQL instance's FreeableMemory metric is consistently below 100 MB. Which monitoring tool should be used to identify the queries consuming the most memory?

A.Performance Insights

B.Amazon S3 access logs

C.AWS CloudTrail

D.CloudWatch Logs

AnswerA

Performance Insights provides database load and wait events per query.

Why this answer

Performance Insights provides detailed query-level performance metrics, including memory consumption per query, which helps identify the queries consuming the most memory on an RDS MySQL instance. Option B is incorrect because Amazon S3 access logs record requests made to S3 buckets, not RDS memory usage. Option C is incorrect because AWS CloudTrail logs API calls for auditing, not database memory.

Option D is incorrect because CloudWatch Logs can store logs but do not provide query-level memory analysis.

Full explanation →

629

MCQmedium

A company is migrating a 500 GB on-premises PostgreSQL database to Amazon RDS for PostgreSQL. The migration must have minimal downtime and support ongoing replication after the initial load. Which AWS service should be used?

A.AWS Schema Conversion Tool (SCT)

B.AWS Database Migration Service (DMS) with full load only

C.AWS Database Migration Service (DMS) with ongoing replication

D.AWS Glue

AnswerC

DMS supports full load plus CDC for minimal downtime.

Why this answer

AWS Database Migration Service (DMS) with ongoing replication (change data capture, CDC) is required because the scenario demands minimal downtime and continuous synchronization after the initial 500 GB load. DMS uses transaction logs (e.g., PostgreSQL WAL) to capture and apply ongoing changes, enabling a near-zero-duration cutover. Full load only (Option B) would cause downtime during the final sync and cannot support ongoing replication.

Exam trap

The trap here is that candidates often confuse 'full load only' with 'full load + CDC' and overlook the requirement for ongoing replication, or they mistakenly think AWS SCT handles data migration when it only handles schema conversion.

How to eliminate wrong answers

Option A is wrong because AWS Schema Conversion Tool (SCT) is used for converting database schema and code (e.g., from Oracle to PostgreSQL), not for migrating data with ongoing replication. Option B is wrong because AWS DMS with full load only performs a one-time snapshot and does not capture ongoing changes, resulting in downtime during the final sync and no support for ongoing replication. Option D is wrong because AWS Glue is a serverless ETL service designed for batch data processing and transformation, not for continuous database replication or minimal-downtime migrations.

Full explanation →

630

MCQmedium

A company runs an Amazon RDS for MySQL Multi-AZ DB instance. The application experiences intermittent read latency spikes. The DB instance type is db.r5.large with 500 GB of General Purpose SSD (gp2) storage. The spike occurs during peak hours when read activity is high. Which action would most effectively reduce read latency?

A.Change the storage type to Provisioned IOPS (io1).

B.Enable Multi-AZ with a standby replica.

C.Increase the allocated storage to 1 TB to improve IOPS.

D.Create an Amazon RDS read replica and direct read traffic to it.

AnswerD

Creating an RDS read replica offloads read traffic from the primary instance, reducing read contention and latency.

Why this answer

Adding an RDS read replica offloads read traffic from the primary DB instance, reducing read contention and latency. Option A is incorrect because changing to io1 improves I/O performance but does not address read contention from high read load on the primary. Option B is incorrect because Multi-AZ provides high availability but the standby replica does not serve read traffic.

Option C is incorrect because increasing storage increases baseline IOPS but does not offload read operations.

Full explanation →

631

MCQhard

A company hosts a critical application on Amazon RDS for PostgreSQL. The security team requires that all database connections be encrypted in transit. Which configuration step is necessary?

A.Create a VPN connection between the application and the database.

B.Set the rds.force_ssl parameter to 1 in the DB parameter group.

C.Modify the security group to allow only port 5432 from the application.

D.Enable encryption at rest using AWS KMS.

AnswerB

Setting rds.force_ssl to 1 in the DB parameter group enforces SSL/TLS for connections.

Why this answer

Enforcing SSL/TLS for connections is required for encryption in transit. Option B is correct. Option A is wrong because a VPN encrypts network traffic but does not enforce database-level SSL.

Option C is wrong because modifying security group rules to allow only port 5432 does not encrypt connections. Option D is wrong because enabling encryption at rest does not encrypt data in transit.

Full explanation →

632

Multi-Selecthard

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The security team requires that all database connections use SSL and that the database is encrypted at rest. Which THREE steps are required to meet these requirements? (Choose THREE.)

Select 3 answers

A.Upload a custom SSL certificate to the RDS instance.

B.Install the SSL certificate on every client machine.

C.Modify the DB parameter group to set 'require_ssl' to 'true'.

D.Download the RDS SSL certificate and configure the application to trust it.

E.Enable encryption at rest when creating the RDS instance.

AnswersC, D, E

This enforces SSL connections.

Why this answer

To meet the requirements, three steps are needed. First, enable encryption at rest by selecting the encryption option when creating the RDS instance (option E). Second, to enforce SSL connections, modify the DB parameter group to set require_ssl to true (option C).

Third, download the RDS SSL certificate from AWS and configure the application to trust it (option D). Options A and B are incorrect because you cannot upload a custom SSL certificate to RDS, and the certificate must be trusted by the application, not necessarily installed on every client machine individually.

Full explanation →

633

MCQmedium

A company is using Amazon RDS for MySQL with encryption at rest enabled. The security team requires that all access to the database be authenticated using IAM database authentication. Which combination of steps must the company take to meet this requirement?

A.Create an IAM role with a policy that allows rds:Connect and attach it to the RDS instance.

B.Create a database user with a password and attach an IAM role that allows rds-db:connect to the database user.

C.Enable SSL on the RDS instance and create an IAM policy that allows rds:Connect.

D.Create an IAM policy that allows the rds-db:connect action and map the IAM role to a database user created with the AWSAuthenticationPlugin.

AnswerD

This is the correct procedure for IAM database authentication with RDS MySQL.

Why this answer

IAM database authentication for Amazon RDS MySQL requires creating an IAM policy that allows the rds-db:connect action, then mapping that IAM role/entity to a database user created with the AWSAuthenticationPlugin. This enables authentication via IAM credentials instead of a password. Option A is incorrect because rds:Connect is not a valid action; the correct action is rds-db:connect, and the IAM role is not attached to the RDS instance but mapped to a database user.

Option B is incorrect because IAM database authentication does not use passwords; the database user must be created with AWSAuthenticationPlugin, not with a password. Option C is incorrect because SSL is not required for IAM database authentication, though it is recommended for encryption in transit; also, the correct action is rds-db:connect, not rds:Connect.

Full explanation →

634

Drag & Dropmedium

Arrange the steps to configure a read replica for an Amazon RDS for PostgreSQL DB instance in a different AWS Region in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Cross-Region read replicas require backups enabled on the source, then creating a replica in another Region and monitoring lag.

Full explanation →

635

MCQhard

Refer to the exhibit. An IAM policy is attached to a role used by an application that accesses the DynamoDB 'Orders' table. The application needs to perform a Scan operation on the table. According to the policy, is the Scan operation allowed?

A.Yes, but only if the scan uses a filter expression

B.No, because the Deny statement blocks all actions

C.Yes, because the policy explicitly allows Scan

D.No, because the policy does not specify a condition

AnswerC

The Allow statement includes 'Scan', so it is permitted.

Why this answer

The IAM policy includes an explicit Allow statement for the `dynamodb:Scan` action on the `Orders` table. In IAM policy evaluation logic, an explicit Allow overrides any default implicit Deny, and the Deny statement in the policy only blocks actions that match its `NotAction` element, which does not include Scan. Therefore, the Scan operation is allowed.

Exam trap

The trap here is that candidates misread the Deny statement's `NotAction` as a blanket denial of all actions, when in fact it only denies actions not explicitly listed, allowing the explicit Allow for Scan to take effect.

How to eliminate wrong answers

Option A is wrong because the policy does not require a filter expression for Scan; filter expressions are optional and do not affect IAM authorization. Option B is wrong because the Deny statement uses `NotAction` to block all actions except those listed (like `dynamodb:GetItem`), but `dynamodb:Scan` is not listed in the Deny's `NotAction`, so it is not blocked. Option D is wrong because IAM policies do not require a condition element for an action to be allowed; conditions are optional and only refine permissions.

Full explanation →

636

MCQeasy

A company wants to run a graph database for a social network application. The data model involves users, posts, comments, and likes, with many-to-many relationships. Which AWS database service is most appropriate?

A.Amazon RDS for PostgreSQL

B.Amazon Neptune

C.Amazon DocumentDB

D.Amazon DynamoDB

AnswerB

Neptune is purpose-built for graph databases and efficiently handles complex relationships.

Why this answer

Amazon Neptune is purpose-built for highly connected data, supporting property graph and RDF models with SPARQL and Gremlin/TinkerPop query languages. For a social network with users, posts, comments, and likes forming many-to-many relationships, Neptune efficiently traverses these connections using graph traversal algorithms, avoiding the expensive JOINs or denormalization required by other database types.

Exam trap

The trap here is that candidates often choose Amazon DynamoDB for its scalability, overlooking that graph traversal queries require multiple round-trips or inefficient scan operations, whereas Neptune provides native graph traversal with single-query efficiency.

How to eliminate wrong answers

Option A is wrong because Amazon RDS for PostgreSQL is a relational database that would require complex JOINs across multiple tables (users, posts, comments, likes) to traverse many-to-many relationships, leading to poor performance as the social graph grows. Option C is wrong because Amazon DocumentDB is a document database optimized for JSON-like documents and does not natively support graph traversal queries or relationship traversal without application-level joins. Option D is wrong because Amazon DynamoDB is a key-value and document database that lacks native graph traversal capabilities; modeling many-to-many relationships would require manual denormalization, adjacency lists, or multiple queries with application-side logic, which is inefficient for deep relationship queries.

Full explanation →

637

MCQhard

A company uses Amazon Redshift for data warehousing. The security team has implemented column-level security using Redshift's column-level access controls. However, during a security audit, it is discovered that a user with SELECT privilege on a table can still see the content of a column that should be restricted. The column is defined with a GRANT statement that only allows SELECT on certain columns to specific users. What is the most likely cause of this issue?

A.The column is part of a distribution key that bypasses security controls.

B.The user is accessing the table via a stored procedure that bypasses column-level security.

C.The column-level security is not supported in Redshift; it must be implemented using views.

D.The user was previously granted SELECT on the entire table, and the column-level GRANT did not revoke that broader permission.

AnswerD

Column-level GRANTs are additive; they do not remove existing table-level permissions.

Why this answer

Column-level GRANTs in Redshift do not revoke existing table-level permissions. If a user was previously granted SELECT on the entire table, that permission remains even after a column-level GRANT is applied. To restrict access, the table-level SELECT must be revoked first, then column-level GRANTs can be applied to specific columns.

Option A is incorrect because distribution keys do not bypass column-level security. Option B is incorrect because stored procedures inherit the caller's permissions and do not bypass column-level security. Option C is incorrect because Redshift does support column-level security via GRANT statements.

Full explanation →

638

MCQhard

A financial services company uses Amazon RDS for MySQL to store transaction data. The database has a single table 'transactions' with 500 million rows. The table has an auto-increment primary key and an index on 'transaction_date'. The company runs a monthly report that aggregates transactions by account_id and transaction_date. The report query uses a GROUP BY on account_id and transaction_date, and scans the entire table. The query takes over 2 hours to complete and often times out. The DBA suggests creating a materialized view. However, the company wants to minimize operational overhead. Which solution meets the requirements with the LEAST operational overhead?

A.Increase the RDS instance size to the largest available to improve performance.

B.Migrate the reporting workload to Amazon Redshift by loading the transactions table into Redshift and running the report query there.

C.Create a materialized view in MySQL that pre-aggregates the data and refreshes it nightly.

D.Add a composite index on (account_id, transaction_date) to speed up the GROUP BY.

AnswerB

Redshift is optimized for analytical queries and can handle large aggregations efficiently with minimal operational overhead.

Why this answer

Amazon Redshift is purpose-built for large-scale analytical queries. By migrating the reporting workload to Redshift, the company offloads the heavy aggregation from the transactional RDS instance to a columnar storage engine that can scan and aggregate 500 million rows efficiently using massively parallel processing (MPP). This approach requires no changes to the existing RDS database and minimizes operational overhead compared to managing a materialized view or manual indexing.

Exam trap

The trap here is that candidates often assume a larger instance or a composite index can fix any performance issue, but the DBS-C01 exam tests the understanding that analytical workloads require a different engine (Redshift) and that operational overhead includes ongoing maintenance, not just initial setup.

How to eliminate wrong answers

Option A is wrong because simply increasing the RDS instance size does not address the fundamental architectural limitation: MySQL is optimized for OLTP, not for full-table scans and large aggregations; the query will still be I/O and CPU-bound, and scaling vertically has a hard ceiling and high cost. Option C is wrong because creating a materialized view in MySQL adds significant operational overhead—it requires custom refresh logic, storage management, and risks data staleness, contradicting the requirement to minimize overhead. Option D is wrong because adding a composite index on (account_id, transaction_date) will not help a query that scans the entire table with a GROUP BY; the optimizer will likely ignore the index for a full scan, and even if used, it cannot avoid reading all rows for aggregation.

Full explanation →

639

Multi-Selecthard

Which THREE factors should be considered when designing a database for a high-traffic web application that requires low-latency reads and writes?

Select 3 answers

A.Caching layer

B.Partitioning strategy

C.Strict normalization

D.Connection pooling

E.Denormalization of data

AnswersA, B, D

Caching reduces database load and latency.

Why this answer

A caching layer (e.g., Amazon ElastiCache for Redis or Memcached) reduces read latency by serving frequently accessed data from in-memory stores, offloading the primary database. For high-traffic web applications, this minimizes disk I/O and improves response times for both reads and writes when combined with write-through or write-behind strategies.

Exam trap

The trap here is that candidates may confuse denormalization as a mandatory design choice for low-latency reads, when in fact it is a trade-off that can complicate writes and is not a core factor for both low-latency reads and writes in a high-traffic web application.

Full explanation →

640

MCQmedium

A company has an Amazon RDS for PostgreSQL database that is experiencing intermittent connection timeouts. The application logs show 'FATAL: remaining connection slots are reserved for non-replication superuser connections'. The database has a max_connections parameter set to 200. The application uses a connection pool. The DBA checks the CloudWatch metric 'DatabaseConnections' and sees it at 195 during peak hours. The application is deployed on AWS Lambda with a provisioned concurrency of 100. The Lambda function creates a new connection for each invocation. What should the DBA do to resolve the issue?

A.Reduce the Lambda provisioned concurrency to 50.

B.Increase max_connections to 500 to accommodate more connections.

C.Set up Amazon RDS Proxy to manage the database connections from Lambda.

D.Decrease max_connections to 100 to reserve more slots.

AnswerC

RDS Proxy pools connections and reduces the number of connections needed.

Why this answer

Set up Amazon RDS Proxy. The issue is that Lambda functions create a new connection per invocation, quickly exhausting the connection pool. While the DatabaseConnections metric shows 195 out of 200 max_connections, the Lambda functions are opening connections and not closing them properly, leading to connection exhaustion.

RDS Proxy manages connection pooling, reusing connections across invocations, reducing the number of connections needed. Option A is wrong because reducing provisioned concurrency does not address the underlying connection management issue and may impact application performance. Option B is wrong because increasing max_connections could lead to increased memory usage and potential performance degradation.

Option D is wrong because decreasing max_connections would make the problem worse by reserving fewer slots.

Full explanation →

641

MCQmedium

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The database is experiencing increased latency and the application team reports slow queries. The DBA wants to identify the queries that consume the most resources. Which AWS service should be used to capture and analyze these queries?

A.Amazon RDS Performance Insights

B.Amazon CloudWatch Logs

C.Amazon RDS Enhanced Monitoring

D.AWS CloudTrail

AnswerA

Performance Insights offers a dashboard that visualizes database load and identifies top queries by resource consumption, making it the right tool for analyzing slow queries.

Why this answer

Amazon RDS Performance Insights provides database performance tuning and monitoring with query-level metrics, enabling identification of resource-intensive queries. Option B is wrong because CloudWatch Logs collects log files but does not capture query-level performance. Option C is wrong because Enhanced Monitoring provides OS-level metrics (CPU, memory) but not query-level details.

Option D is wrong because CloudTrail records AWS API activity, not database queries.

Full explanation →

642

MCQeasy

A company wants to migrate its Oracle data warehouse to Amazon Redshift. The source database is 10 TB and has many complex stored procedures. Which AWS service should be used primarily for converting the stored procedures to Amazon Redshift compatible code?

A.AWS Glue

B.AWS Database Migration Service (AWS DMS)

C.Amazon Redshift COPY command

D.AWS Schema Conversion Tool (AWS SCT)

AnswerD

SCT converts schema and code objects like stored procedures to target engine syntax.

Why this answer

AWS Schema Conversion Tool (AWS SCT) is the correct choice because it is specifically designed to convert database schemas and complex code objects, such as stored procedures, functions, and packages, from one database engine to another. For an Oracle-to-Amazon Redshift migration, AWS SCT can automatically translate Oracle PL/SQL stored procedures into Amazon Redshift compatible SQL (e.g., using PL/pgSQL or SQL functions), handling syntax differences and unsupported features. This makes it the primary tool for converting the 10 TB data warehouse's stored procedures, whereas other services focus on data movement or ETL, not schema and code conversion.

Exam trap

The trap here is that candidates often confuse AWS DMS (which moves data) with AWS SCT (which converts schema and code), leading them to choose DMS for stored procedure conversion when DMS cannot translate procedural logic at all.

How to eliminate wrong answers

Option A is wrong because AWS Glue is an ETL (extract, transform, load) service used for data preparation and transformation, not for converting database schema objects like stored procedures. Option B is wrong because AWS Database Migration Service (AWS DMS) handles continuous data replication and migration of table data, but it does not convert stored procedures or other schema-level code. Option C is wrong because the Amazon Redshift COPY command is used to load data from flat files into Redshift tables, and it has no capability to convert or translate stored procedures from Oracle.

Full explanation →

643

Multi-Selectmedium

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. They need to minimize downtime. Which TWO actions should they take?

Select 2 answers

A.Set up AWS DMS with change data capture (CDC) from the source

B.Increase the allocated storage on the target RDS instance to improve performance

C.Use AWS SCT to validate and convert the schema before migration

D.Deploy the target RDS instance as a Single-AZ to simplify replication

E.Disable Oracle archivelog mode to speed up data transfer

AnswersA, C

CDC enables near-zero downtime migration.

Why this answer

AWS DMS with change data capture (CDC) enables continuous replication of ongoing changes from the source Oracle database to the target RDS instance. This allows the source to remain fully operational during the bulk load phase and then switch over with minimal downtime, as only the final CDC catch-up is needed before cutover.

Exam trap

The trap here is that candidates may think disabling archivelog mode speeds up data transfer (Option E), but in reality, CDC requires archivelogs to capture ongoing changes, and disabling them would force a full stop-and-copy migration, increasing downtime.

Full explanation →

644

MCQhard

A company uses Amazon RDS for MySQL with a Multi-AZ deployment. During a recent failover, the application experienced a 2-minute downtime because it was connecting to the primary instance endpoint. The company needs to reduce failover downtime to under 30 seconds. What should be done?

A.Implement Amazon ElastiCache to cache database connections.

B.Use the Multi-AZ DB cluster endpoint instead of the instance endpoint.

C.Increase the instance size to improve failover speed.

D.Deploy a read replica and promote it manually during failover.

AnswerB

Cluster endpoint automatically redirects to the new primary after failover.

Why this answer

The Multi-AZ DB cluster endpoint provides a single DNS name that automatically routes connections to the current writer instance, eliminating the need for application-side reconnection logic. During a failover, the endpoint updates its DNS record to point to the new primary within seconds, reducing downtime to under 30 seconds. This is the recommended approach for minimizing failover disruption in Multi-AZ deployments.

Exam trap

The trap here is that candidates assume increasing instance size or using read replicas will speed up failover, but the real bottleneck is DNS propagation and the lack of an automatic redirect for the instance endpoint, which the cluster endpoint specifically addresses.

How to eliminate wrong answers

Option A is wrong because ElastiCache caches query results or session data, not database connections; it does not reduce failover downtime for the database itself. Option C is wrong because increasing instance size improves performance but does not affect the failover process timing, which is governed by DNS propagation and replication lag, not compute capacity. Option D is wrong because promoting a read replica manually requires application reconfiguration and typically takes longer than 30 seconds due to DNS changes and manual intervention, defeating the goal of automated fast failover.

Full explanation →

645

MCQeasy

A startup is building a social media application that requires storing user profiles, posts, comments, and likes. The workload has variable traffic, with spikes after marketing campaigns. The team expects to run complex JOIN queries to generate a user's feed. Which AWS database service is MOST suitable for this relational workload?

A.Amazon Neptune

B.Amazon RDS for PostgreSQL

C.Amazon DynamoDB with global secondary indexes

D.Amazon ElastiCache for Redis

AnswerB

RDS PostgreSQL offers full relational capabilities and managed scaling.

Why this answer

Amazon RDS for PostgreSQL is the most suitable choice because the workload requires complex JOIN queries on relational data (user profiles, posts, comments, likes). PostgreSQL provides full SQL support, ACID compliance, and robust indexing capabilities (e.g., B-tree, GiST, GIN) that efficiently handle multi-table joins. RDS also offers managed scaling, automated backups, and read replicas to accommodate traffic spikes after marketing campaigns.

Exam trap

The trap here is that candidates often choose DynamoDB for its scalability and low latency, overlooking that complex JOINs are not supported in NoSQL databases, making RDS PostgreSQL the correct choice for relational workloads requiring SQL JOIN operations.

How to eliminate wrong answers

Option A is wrong because Amazon Neptune is a graph database optimized for highly connected data (e.g., social graphs, recommendation engines) and does not support SQL JOINs or relational schema design; it uses Gremlin or SPARQL query languages. Option C is wrong because Amazon DynamoDB is a NoSQL key-value and document database that lacks native JOIN operations; while global secondary indexes improve query flexibility, they cannot replace the relational JOIN logic required for generating a user's feed. Option D is wrong because Amazon ElastiCache for Redis is an in-memory caching layer, not a primary database; it does not support complex JOIN queries or provide durable, relational storage.

Full explanation →

646

Multi-Selecthard

Which THREE components are required to set up IAM database authentication for an Amazon RDS for MySQL DB instance? (Choose three.)

Select 3 answers

A.An IAM role that the application can assume.

B.An AWS KMS key to encrypt the authentication token.

C.A database user that is mapped to the IAM role.

D.A DB parameter group with require_secure_transport set to ON.

E.An RDS Proxy to manage connections.

AnswersA, C, D

The application assumes the IAM role to get authentication tokens.

Why this answer

The three required components for setting up IAM database authentication for an Amazon RDS for MySQL DB instance are: (A) an IAM role that the application can assume to retrieve an authentication token from IAM; (C) a database user that is mapped to the IAM role in the RDS MySQL database; and (D) a DB parameter group with `require_secure_transport` set to ON to enforce SSL/TLS connections, which are mandatory for IAM authentication. Option B (AWS KMS key) is not required because the authentication token is signed by IAM, not encrypted with KMS. Option E (RDS Proxy) is optional and not a requirement; while it can provide connection pooling, it is not needed to set up IAM authentication itself.

Full explanation →

647

MCQeasy

A company is using Amazon RDS for SQL Server with Multi-AZ deployment. The security team wants to ensure that database audit logs are stored in a secure S3 bucket for long-term retention. The audit logs are currently stored on the RDS instance. Which approach should be used to export the audit logs to S3?

A.Use the Amazon RDS for Oracle 'Audit' feature and specify an S3 bucket as the audit trail destination.

B.Modify the RDS instance to use the 'SQLSERVER_AUDIT' option and specify an S3 bucket as the audit destination.

C.Enable the 'General Log' option in the RDS parameter group and configure the log destination as S3.

D.Configure the RDS instance to publish logs to CloudWatch Logs, and then export CloudWatch Logs to S3 using a subscription filter.

AnswerB

RDS for SQL Server supports this option group for exporting audit logs to S3.

Why this answer

RDS for SQL Server provides the 'SQLSERVER_AUDIT' option to export audit logs directly to an S3 bucket. This option is configured in the RDS option group and allows specifying the S3 bucket as the destination. Option A is incorrect because it refers to Oracle's 'Audit' feature, not SQL Server.

Option C is incorrect because the 'General Log' is for MySQL/MariaDB and does not apply to SQL Server audit logs. Option D, while feasible, is not the most direct or recommended approach for exporting audit logs to S3; exporting via CloudWatch Logs adds complexity and latency compared to the native 'SQLSERVER_AUDIT' option.

Full explanation →

648

Multi-Selectmedium

A company is migrating an on-premises PostgreSQL database to Amazon RDS for PostgreSQL. The database is 2 TB and the migration must have minimal downtime. Which TWO AWS services should be used together to accomplish this?

Select 2 answers

A.AWS CloudFormation

B.AWS DataSync

C.AWS Schema Conversion Tool (AWS SCT)

D.AWS CloudEndure Migration

E.AWS Database Migration Service (AWS DMS)

AnswersC, E

AWS SCT can assess and convert schema if needed, though not strictly required for homogeneous migration.

Why this answer

AWS Schema Conversion Tool (AWS SCT) is used to convert the source PostgreSQL schema and objects to be compatible with Amazon RDS for PostgreSQL, handling any heterogenous elements. AWS Database Migration Service (AWS DMS) then performs the continuous data replication from the on-premises database to RDS, enabling minimal downtime by keeping the target in sync until a cutover.

Exam trap

The trap here is that candidates may confuse AWS DataSync (file-level sync) or CloudEndure (server replication) with database-specific migration tools, overlooking that only DMS provides CDC for relational databases and SCT handles schema conversion.

Full explanation →

649

MCQeasy

A developer is migrating a self-managed MongoDB database to Amazon DocumentDB. The database contains 500 GB of data. What is the most efficient method to perform the initial data load?

A.Take a file system snapshot and restore to DocumentDB

B.Use mongodump and mongorestore

C.Use AWS DMS with full load

D.Use mongodump with --out and then import using mongoimport

AnswerB

These native tools are efficient and compatible with DocumentDB.

Why this answer

Mongodump and mongorestore are the native MongoDB tools designed for logical backups and restores, and Amazon DocumentDB is wire-protocol compatible with MongoDB 3.6 and 4.0. This method efficiently exports the 500 GB dataset as BSON files and imports them directly into DocumentDB, preserving indexes and data types without the overhead of file-system-level differences.

Exam trap

The trap here is that candidates confuse file system snapshots (Option A) with database-native snapshots, or assume AWS DMS (Option C) is the universal migration tool, when in fact DocumentDB's MongoDB compatibility requires MongoDB-native tools for the most efficient and reliable initial load.

How to eliminate wrong answers

Option A is wrong because file system snapshots capture the underlying storage format (e.g., WiredTiger files), which is not compatible with DocumentDB's architecture; DocumentDB does not support restoring from a raw file system snapshot. Option C is wrong because AWS DMS with full load is designed for relational databases and has limited support for MongoDB-to-DocumentDB migrations; it can introduce schema mapping issues and is less efficient for large-scale document databases. Option D is wrong because mongodump with --out exports data as JSON/CSV files, and mongoimport is used for importing those formats, but this approach loses BSON-specific data types (e.g., ObjectId, Date) and is slower than the native BSON restore with mongorestore.

Full explanation →

650

MCQmedium

A company is running Amazon Redshift for data warehousing. The data warehouse is used for complex analytical queries. Recently, query performance has degraded due to data skew. Which steps should be taken to address this issue?

A.Apply sort keys on the skewed columns.

B.Apply compression on the skewed columns.

C.Re-evaluate the distribution style of the tables.

D.Increase the number of nodes in the cluster.

AnswerC

Choosing the right distribution style can evenly distribute data across nodes.

Why this answer

Data skew in Amazon Redshift occurs when data is unevenly distributed across slices, causing some nodes to process more data than others and degrading query performance. Re-evaluating the distribution style (e.g., switching from AUTO or EVEN to KEY on a column with high cardinality and even distribution, or using ALL for small dimension tables) redistributes the data evenly, mitigating skew and improving parallel query execution.

Exam trap

The trap here is that candidates confuse data skew (uneven distribution across slices) with data sorting or compression, leading them to incorrectly choose sort keys or compression as solutions, whereas only distribution style changes directly address the underlying imbalance.

How to eliminate wrong answers

Option A is wrong because sort keys determine the physical order of data on disk within each slice, which improves query performance for range-restricted or sorted data but does not address data distribution across slices or nodes. Option B is wrong because compression reduces storage footprint and I/O by encoding column data, but it does not affect how rows are distributed across slices or nodes, so it cannot fix data skew. Option D is wrong because adding nodes increases cluster capacity and parallelism but does not resolve the root cause of skew; if data is already skewed, adding nodes may even worsen the imbalance as new nodes receive disproportionately small amounts of data.

Full explanation →

651

MCQeasy

A developer reports that an application is unable to connect to an Amazon RDS for MySQL DB instance. The security group for the DB instance allows inbound traffic on port 3306 from the application server's security group. The DB instance is in a VPC with both public and private subnets. The application server is in a private subnet. What is the most likely cause of the connection failure?

A.The DB instance is in a public subnet and the application server is in a private subnet, so they cannot communicate.

B.The security group for the DB instance does not allow inbound traffic from the application server's security group.

C.The network ACL for the private subnet is blocking outbound traffic to the DB instance.

D.The DB instance is not part of a DB subnet group that includes the private subnet.

AnswerC

Correct. Network ACLs are stateless and can block outbound traffic from the private subnet to the DB instance, even when security groups permit inbound traffic.

Why this answer

The most likely cause is that the network ACL (NACL) for the private subnet is blocking outbound traffic to the DB instance. Security groups are stateful and allow return traffic automatically, but NACLs are stateless and require explicit rules for both inbound and outbound. If the private subnet's NACL does not allow outbound traffic to the DB instance's subnet on port 3306, the application server cannot initiate the connection.

Options A and B are incorrect because the security group already allows inbound traffic, and instances in public and private subnets within the same VPC can communicate via private IPs. Option D is incorrect; while a DB subnet group is required for RDS, it does not directly affect connectivity once the instance is running.

Exam trap

Candidates often overlook that network ACLs are stateless and can block traffic even when security groups allow it. Always check both layers.

Full explanation →

652

MCQeasy

A company needs to store session state for a web application that runs on Amazon EC2 instances behind an Application Load Balancer. The session data is small (less than 1 KB per user) and must be highly available with low latency. Which AWS database service is best for this use case?

A.Amazon S3

B.Amazon ElastiCache for Redis

C.Amazon DynamoDB

D.Amazon RDS for MySQL

AnswerB

In-memory storage with low latency and high availability.

Why this answer

Amazon ElastiCache for Redis is the best choice because it provides an in-memory data store with sub-millisecond latency, ideal for storing small session state data (less than 1 KB per user). Redis supports key-value operations with built-in data expiration (TTL), making it perfect for session management. Its replication and automatic failover capabilities ensure high availability, meeting the application's requirements.

Exam trap

The trap here is that candidates often choose DynamoDB (Option C) because it is a managed NoSQL database with low latency, but they overlook that for sub-millisecond session state, an in-memory cache like Redis is more performant and cost-effective, as DynamoDB's latency is higher and its pricing model is less efficient for very small, high-throughput workloads.

How to eliminate wrong answers

Option A is wrong because Amazon S3 is an object storage service designed for large, static objects with higher latency (typically tens to hundreds of milliseconds), not suitable for low-latency session state access. Option C is wrong because Amazon DynamoDB is a NoSQL database that offers single-digit millisecond latency, but it is a disk-based service with higher overhead for very small, frequently accessed session data compared to an in-memory cache like Redis. Option D is wrong because Amazon RDS for MySQL is a relational database with ACID transactions and disk-based storage, introducing unnecessary latency and complexity for simple key-value session storage, and it lacks native TTL-based expiration for session data.

Full explanation →

653

MCQhard

A company runs a global application using Amazon Aurora Global Database. The primary region is us-east-1, and secondary regions are eu-west-1 and ap-southeast-1. The application reports that writes to the primary are taking longer than expected. What is the most likely cause?

A.Multi-AZ failover occurred in the primary region.

B.The Global Database replication to secondary regions is causing synchronous commit latencies.

C.The primary DB instance is under-provisioned.

D.Read replicas in secondary regions are overloaded.

AnswerC

An under-provisioned primary DB instance can lead to longer write times due to insufficient CPU, memory, or I/O capacity to handle the write workload.

Why this answer

Amazon Aurora Global Database uses asynchronous replication from the primary region to secondary regions. Writes to the primary are committed locally and do not wait for replication to complete. Therefore, replication to secondary regions does not introduce synchronous commit latencies.

The most likely cause of slower writes to the primary is an under-provisioned primary DB instance that cannot handle the write workload efficiently.

Exam trap

Candidates often assume that Global Database replication causes synchronous overhead on the primary, but Aurora Global Database uses asynchronous replication, which does not add commit latency. The real performance bottleneck is typically the primary instance's capacity.

How to eliminate wrong answers

Option A is wrong because Multi-AZ failover in the primary region would cause a brief write outage or failover time, not consistently longer write latencies; after failover, writes resume normally. Option B is wrong because Aurora Global Database replication is asynchronous, not synchronous; synchronous replication would cause commit latency, but that is not how Aurora Global Database works. Option D is wrong because read replicas in secondary regions are read-only and do not affect write performance on the primary; they handle only read traffic.

Full explanation →

654

Multi-Selecthard

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The security team wants to audit all database logins and queries. Which TWO actions should be taken to enable auditing?

Select 2 answers

A.Enable AWS CloudTrail data events for RDS.

B.Create an RDS event notification subscription.

C.Publish MySQL logs to Amazon CloudWatch Logs.

D.Set the general_log parameter to 1.

E.Enable Enhanced Monitoring.

AnswersC, D

Correct because it allows analysis of database logs.

Why this answer

Options C and D are correct. Setting the general_log parameter to 1 (D) captures all queries, and publishing MySQL logs to CloudWatch Logs (C) allows analysis. Option A is wrong because AWS CloudTrail data events capture API calls to RDS, not database queries.

Option B is wrong because event notifications are for instance events, not queries. Option E is wrong because Enhanced Monitoring provides OS-level metrics, not query logs.

Full explanation →

655

MCQmedium

A company is running a MongoDB workload on-premises and wants to migrate to AWS with minimal operational overhead. The application uses MongoDB-specific features like aggregation pipelines. Which service is best?

A.Amazon DynamoDB

B.Amazon DocumentDB

C.Amazon RDS for PostgreSQL

D.Amazon Elasticsearch Service

AnswerB

DocumentDB is MongoDB-compatible and fully managed, reducing operational overhead.

Why this answer

Amazon DocumentDB is the correct choice because it is a fully managed, MongoDB-compatible document database that supports MongoDB-specific features like aggregation pipelines, indexes, and queries. It minimizes operational overhead by handling hardware provisioning, patching, backups, and replication, making it ideal for migrating an on-premises MongoDB workload to AWS without significant application changes.

Exam trap

The trap here is that candidates often choose Amazon DynamoDB because it is a NoSQL database, but they overlook that DynamoDB lacks MongoDB wire protocol compatibility and aggregation pipeline support, forcing a complete application rewrite.

How to eliminate wrong answers

Option A is wrong because Amazon DynamoDB is a key-value and document database that does not support MongoDB aggregation pipelines or MongoDB wire protocol, requiring significant application rewrites. Option C is wrong because Amazon RDS for PostgreSQL is a relational database that does not natively support MongoDB's document model or aggregation pipelines, forcing schema redesign and data migration complexity. Option D is wrong because Amazon Elasticsearch Service is a search and analytics engine, not a document database, and lacks MongoDB compatibility, making it unsuitable for running MongoDB workloads.

Full explanation →

656

MCQmedium

A security engineer needs to ensure that all access to an Amazon DynamoDB table is encrypted in transit. Which configuration achieves this?

A.Configure a VPC endpoint for DynamoDB and enable encryption.

B.Ensure all client applications use the DynamoDB HTTPS endpoint.

C.Place the DynamoDB table behind Amazon CloudFront.

D.Enable SSL on the DynamoDB table by setting the 'ssl_enabled' parameter.

AnswerB

All DynamoDB requests must be made over HTTPS; this is the only way to encrypt data in transit.

Why this answer

DynamoDB uses HTTPS for all API calls by default, ensuring encryption in transit. Option A is incorrect because configuring a VPC endpoint does not enable encryption; it provides private connectivity, but encryption in transit is already handled by HTTPS. Option C is incorrect because placing DynamoDB behind CloudFront is not a valid configuration; CloudFront is a CDN for content delivery, not for securing database access.

Option D is incorrect because DynamoDB does not have an 'ssl_enabled' parameter; encryption in transit is always enforced via HTTPS.

Full explanation →

657

Multi-Selectmedium

A company is designing a disaster recovery strategy for an Amazon RDS for PostgreSQL database. They need a Recovery Point Objective (RPO) of less than 5 seconds and a Recovery Time Objective (RTO) of less than 1 minute. Which TWO actions should they take? (Choose two.)

Select 2 answers

A.Use AWS Database Migration Service for continuous replication to a separate instance

B.Create a cross-region read replica and manually update DNS in a disaster

C.Take hourly snapshots and restore in another region

D.Create a cross-region read replica and configure automatic failover using Amazon Route 53 health checks

E.Configure Multi-AZ deployment with a synchronous standby in another AZ

AnswersD, E

Automatic failover with health checks can achieve RTO <1 minute and RPO <5 seconds with synchronous replication.

Why this answer

A cross-region read replica can be promoted to a primary instance in under a minute, and with Amazon Route 53 health checks configured for automatic failover, the DNS update occurs automatically, meeting the RTO of less than 1 minute. The asynchronous replication lag is typically sub-second, achieving an RPO of less than 5 seconds. Option E is correct because a Multi-AZ deployment with a synchronous standby in another Availability Zone provides automatic failover with no data loss (RPO of 0) and failover completes in about 30-60 seconds, satisfying both RPO and RTO requirements.

Exam trap

The trap here is that candidates often assume cross-region read replicas support automatic failover natively, but they do not; you must explicitly configure Route 53 health checks and DNS failover to achieve the required RTO, while Multi-AZ provides automatic failover but only within the same region, not cross-region.

Full explanation →

658

MCQeasy

A company is using Amazon RDS for PostgreSQL and needs to ensure that all connections to the database use encryption in transit. The database is accessible over the internet. Which configuration is required?

A.Restrict the security group to only allow traffic from trusted IP addresses.

B.Modify the DB instance to use a custom port 443 instead of 5432.

C.Set the rds.force_ssl parameter to 1 and configure the client to use the AWS RDS SSL certificate.

D.Use a self-signed certificate on the server and configure the client to trust it.

AnswerC

This enforces SSL connections.

Why this answer

To enforce encryption in transit for Amazon RDS for PostgreSQL, you must set the `rds.force_ssl` parameter to 1 in the DB parameter group. Additionally, clients need to be configured to use the AWS RDS SSL certificate (downloaded from AWS) to establish a secure connection. Option A is incorrect because security groups only control network traffic based on IP addresses, they do not enforce encryption.

Option B is incorrect because changing the port to 443 does not enforce SSL; SSL is enforced through parameter settings and client configuration. Option D is incorrect because while a self-signed certificate could technically be used, the recommended and simpler method is to use the AWS-provided SSL certificate, especially since clients need to trust the certificate authority.

Full explanation →

659

MCQmedium

A company is using Amazon RDS for MySQL with a cross-Region read replica to support disaster recovery. The primary DB instance is in us-west-2, and the read replica is in us-east-1. The read replica is used for reporting and also serves as a failover target. The operations team notices that the read replica lag is consistently above 10 seconds during peak hours. What should the team do to reduce replica lag?

A.Increase the DB instance class of the read replica.

B.Enable Multi-AZ on the primary DB instance.

C.Increase the backup retention period for the primary DB instance.

D.Disable binary logging (binlog) on the primary DB instance.

AnswerA

A larger instance class can process replication events faster.

Why this answer

Increasing the DB instance class of the read replica provides more CPU and memory resources, which allows the replica to apply changes from the binary log more quickly. Cross-Region replication lag is often caused by the replica being unable to keep up with the write rate on the primary, so scaling up the replica directly addresses the bottleneck in applying binlog events.

Exam trap

The trap here is that candidates may think enabling Multi-AZ on the primary will reduce replica lag, but Multi-AZ only provides synchronous replication within the same Region and does not affect cross-Region asynchronous replication performance.

How to eliminate wrong answers

Option B is wrong because enabling Multi-AZ on the primary provides high availability and automatic failover within the same Region, but does not affect the replication throughput to a cross-Region read replica. Option C is wrong because increasing the backup retention period only affects how long automated backups are retained; it has no impact on replication lag. Option D is wrong because disabling binary logging on the primary would stop all replication, including the cross-Region read replica, and is not a valid method to reduce lag.

Full explanation →

660

MCQhard

A company is migrating a 5 TB MongoDB database to Amazon DocumentDB. They have a short maintenance window and need to minimize downtime. Which migration strategy should be used?

A.Use AWS DMS to perform a full load and then ongoing replication from the source MongoDB.

B.Use the MongoDB change streams feature to replicate changes to DocumentDB in real time.

C.Set up AWS Direct Connect to the source and use mongorestore directly to DocumentDB.

D.Export the data using mongodump, transfer to Amazon S3, and import using mongorestore.

AnswerA

DMS supports MongoDB as source and DocumentDB as target with ongoing replication.

Why this answer

AWS DMS supports MongoDB as a source and Amazon DocumentDB as a target, enabling a full load of the 5 TB database followed by ongoing change data capture (CDC) using MongoDB's oplog. This minimizes downtime by keeping the target nearly synchronized during the migration window, allowing a final cutover with minimal interruption.

Exam trap

The trap here is that candidates may assume MongoDB change streams are a universal replication mechanism, but DocumentDB does not support consuming them as a target, and AWS DMS is the only fully managed service that provides both full load and ongoing replication for this specific source-target pair.

How to eliminate wrong answers

Option B is wrong because MongoDB change streams are not natively supported by Amazon DocumentDB as a replication target; DocumentDB uses its own change streams, and there is no built-in mechanism to consume MongoDB change streams for real-time replication. Option C is wrong because AWS Direct Connect provides a dedicated network connection but does not solve the migration tooling issue; mongorestore directly to DocumentDB would require stopping writes on the source, causing downtime, and does not support ongoing replication. Option D is wrong because exporting with mongodump and importing with mongorestore is a batch process that requires the source database to be quiesced or taken offline, resulting in significant downtime for a 5 TB dataset, and it lacks ongoing replication capability.

Full explanation →

661

Multi-Selecthard

A company is designing a security architecture for Amazon DynamoDB. They need to ensure that only authorized applications can access the data, and that data in transit is encrypted. Which THREE steps should be taken? (Choose THREE.)

Select 3 answers

A.Use a customer-managed KMS key to encrypt data in transit.

B.Attach an IAM policy that grants access only to specific IAM roles or users.

C.Use an AWS PrivateLink VPC endpoint to access DynamoDB from within a VPC.

D.Configure a security group to restrict inbound traffic to the DynamoDB table.

E.Use HTTPS (TLS) for all API calls to DynamoDB.

AnswersB, C, E

IAM policies control access to DynamoDB.

Why this answer

The correct answers are B, C, and E. IAM policies ensure only authorized principals can access DynamoDB. AWS PrivateLink VPC endpoints keep traffic within the AWS network, enhancing security.

HTTPS (TLS) encrypts data in transit, which is required for confidentiality. Option A is incorrect because KMS keys are for encryption at rest, not in transit. Option D is incorrect because security groups are associated with network interfaces, not DynamoDB tables; they can be used with VPC endpoints but not directly on the table.

Full explanation →

662

Multi-Selectmedium

Which TWO of the following are valid strategies for reducing costs for an Amazon DynamoDB table with on-demand capacity mode? (Choose TWO.)

Select 2 answers

A.Implement DynamoDB Accelerator (DAX) to cache reads.

B.Use Amazon DynamoDB TTL to automatically delete expired data.

C.Enable DynamoDB global tables to distribute traffic.

D.Use DynamoDB Streams to process updates asynchronously.

E.Switch to provisioned capacity mode with auto scaling.

AnswersA, E

DAX reduces the number of read requests to DynamoDB, lowering read capacity consumption.

Why this answer

Implementing DAX reduces the number of read requests to the underlying DynamoDB table by serving cached results, which lowers read capacity consumption and thus reduces costs for on-demand tables. Switching to provisioned capacity with auto scaling allows you to pay for a baseline of read/write capacity units rather than per-request pricing, which is more cost-effective for predictable or steady workloads.

Exam trap

The trap here is that candidates often think TTL or Streams reduce operational costs, but they only affect storage or enable event-driven processing, not the per-request billing that drives on-demand costs.

Full explanation →

663

Multi-Selecthard

Which THREE actions should be taken to prepare for a migration of an on-premises MySQL database to Amazon RDS for MySQL with minimal downtime using AWS DMS?

Select 3 answers

A.Enable binary logging on the source MySQL database

B.Set up an SSH tunnel or VPN for secure connectivity between DMS and the source

C.Create a database user with REPLICATION CLIENT and REPLICATION SLAVE privileges

D.Disable foreign key checks on the source database

E.Take a full backup of the source database

AnswersA, B, C

Binary logging is required for DMS to capture changes.

Why this answer

AWS DMS requires binary logging (binlog) to be enabled on the source MySQL database for ongoing replication (change data capture). DMS reads the binary log to capture inserts, updates, and deletes in near real-time, which is essential for minimizing downtime during migration.

Exam trap

The trap here is that candidates may think a full backup is necessary for migration, but DMS handles the full load itself, and the key to minimal downtime is enabling binary logging and proper privileges for continuous replication.

Full explanation →

664

MCQmedium

A company is using Amazon RDS for Oracle with Transparent Data Encryption (TDE) enabled. They need to rotate the TDE master key. What is the correct procedure?

A.Use Oracle's ALTER SYSTEM SET ENCRYPTION KEY command to rotate the key.

B.Use the AWS KMS RotateKey operation to rotate the customer master key (CMK) that is used for TDE.

C.Create a new encrypted RDS instance and migrate the data.

D.Modify the DB instance to use a new KMS key.

AnswerB

KMS key rotation is the supported method for TDE key rotation.

Why this answer

In Amazon RDS for Oracle with TDE, the master key is stored in AWS KMS. To rotate the TDE master key, you can call the AWS KMS RotateKey operation on the customer master key (CMK) used for TDE, or use the Amazon RDS procedure rds.rds_rotate_tde_key. Option B is correct.

Option A is incorrect because Oracle's ALTER SYSTEM SET ENCRYPTION KEY command rotates the Oracle-internal master key, not the KMS CMK, and RDS does not support direct Oracle TDE key rotation. Option C is incorrect because full migration is unnecessary. Option D is incorrect because modifying the DB instance to use a new KMS key changes the key, but does not rotate the existing TDE key.

Full explanation →

665

MCQhard

A company is migrating an on-premises Oracle database to Amazon Aurora PostgreSQL. The migration uses AWS Database Migration Service (DMS) with ongoing replication. The team notices that the target Aurora database is falling behind the source during peak hours. Which of the following actions would MOST effectively improve the replication performance?

A.Disable Multi-AZ on the target Aurora cluster

B.Increase the Amazon Aurora instance size

C.Use a smaller Aurora instance to reduce write latency

D.Configure the DMS task to use 'Limited LOB mode' and increase the max LOB size

AnswerD

Configuring 'Limited LOB mode' and increasing max LOB size reduces overhead for large objects and improves replication efficiency, making this the most effective action.

Why this answer

The most effective action. Using 'Limited LOB mode' in AWS DMS reduces the overhead of replicating large objects by only transferring metadata until the LOB is accessed, and increasing the max LOB size ensures that LOBs fit within a single transaction, preventing fragmentation. Option A is incorrect because disabling Multi-AZ does not directly affect DMS replication performance; Multi-AZ provides high availability but does not impact replication throughput.

Option B, increasing the Aurora instance size, may help if the instance is CPU or memory constrained, but the primary bottleneck in replication is often the handling of large objects, making DMS task configuration more targeted. Option C is incorrect because using a smaller instance would worsen performance, not improve it.

Full explanation →

666

Drag & Dropmedium

Arrange the steps to set up cross-Region read replicas for an Amazon Aurora MySQL DB cluster in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Cross-Region replicas require binary logging enabled on the source, then creating a read replica in another Region and verifying replication.

Full explanation →

667

MCQmedium

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database uses Oracle Data Guard for disaster recovery. Which AWS service should be used to monitor the replication lag between the source and target databases during migration?

A.Amazon RDS Performance Insights

B.AWS Database Migration Service (AWS DMS)

C.Amazon CloudWatch

D.AWS CloudTrail

AnswerB

AWS DMS provides metrics for replication lag.

Why this answer

AWS DMS provides metrics for replication lag. Option A is wrong because Performance Insights does not monitor replication lag. Option C is wrong because CloudWatch can monitor DMS metrics but is not specific to Data Guard.

Option D is wrong because CloudTrail does not monitor replication lag.

Full explanation →

668

MCQeasy

A company needs to migrate an on-premises PostgreSQL database to Amazon Aurora PostgreSQL with minimal downtime. Which AWS service should be used for the ongoing replication?

A.AWS Glue.

B.AWS Backup.

C.AWS Database Migration Service (DMS).

D.AWS Schema Conversion Tool (SCT).

AnswerC

DMS provides CDC for ongoing replication.

Why this answer

AWS Database Migration Service (DMS) supports ongoing replication (change data capture, CDC) from an on-premises PostgreSQL source to an Amazon Aurora PostgreSQL target using logical replication slots. This allows you to keep the target database synchronized with minimal downtime after the initial full load, making it the correct choice for a migration with minimal downtime.

Exam trap

The trap here is that candidates often confuse AWS DMS with AWS SCT, thinking SCT handles both schema conversion and data migration, but SCT only converts schemas and generates migration scripts, while DMS handles the actual data movement and ongoing replication.

How to eliminate wrong answers

Option A is wrong because AWS Glue is a serverless data integration service for ETL (extract, transform, load) jobs, not a database migration tool; it does not support ongoing replication for live databases. Option B is wrong because AWS Backup is a centralized backup service for creating and managing backups, not for continuous replication or migration with minimal downtime. Option D is wrong because the AWS Schema Conversion Tool (SCT) is used to convert database schemas from one engine to another (e.g., Oracle to Aurora), but it does not perform data migration or ongoing replication.

Full explanation →

669

MCQmedium

A company is migrating an Oracle database to Amazon RDS for Oracle. Security policy requires that all database connections be encrypted in transit. The security team wants to enforce that clients must use TLS 1.2 or higher. How can this be achieved?

A.Modify the DB subnet group to only allow traffic from specific IP ranges.

B.Create an IAM policy that denies access unless the connection uses TLS.

C.Set the require_secure_transport parameter to ON in the DB parameter group.

D.Set the rds.force_ssl parameter to 1 in the DB parameter group.

AnswerD

Correct. Setting rds.force_ssl to 1 requires SSL/TLS encryption for all connections, enforcing TLS 1.2 or higher.

Why this answer

Amazon RDS for Oracle supports SSL/TLS encryption, and setting the rds.force_ssl parameter to 1 in the DB parameter group enforces SSL connections, which ensures all connections use TLS 1.2 or higher (as per Oracle's implementation). Option A is incorrect because modifying the DB subnet group controls network-level access, not encryption requirements. Option B is incorrect because IAM policies cannot enforce encryption in transit at the database level; they can only control authentication and authorization.

Option C is incorrect because require_secure_transport is a MySQL parameter, not applicable to Oracle.

Full explanation →

670

MCQeasy

A startup is building a social media application. User profiles, posts, and comments have relationships but the team expects rapid growth and wants to scale horizontally with no single points of failure. They need a database that supports flexible schemas for different content types. Which database service is most appropriate?

A.Amazon DynamoDB

B.Amazon Neptune

C.Amazon Redshift

D.Amazon RDS for MySQL

AnswerA

DynamoDB provides horizontal scaling, flexible schema, and high availability.

Why this answer

Amazon DynamoDB is the most appropriate choice because it is a fully managed NoSQL key-value and document database that supports flexible schemas, enabling the application to handle user profiles, posts, and comments with varying attributes. It scales horizontally by automatically partitioning data across multiple nodes, and its multi-AZ replication eliminates single points of failure, meeting the startup's requirements for rapid growth and high availability.

Exam trap

The trap here is that candidates may choose Amazon Neptune because the question mentions 'relationships,' but the primary requirements are flexible schemas and horizontal scaling, which DynamoDB handles better for general-purpose content storage, while Neptune is specialized for graph traversal use cases.

How to eliminate wrong answers

Option B (Amazon Neptune) is wrong because it is a graph database optimized for highly connected data and complex relationship queries (e.g., social graphs), but the question emphasizes flexible schemas and horizontal scaling for general content types, not graph traversal performance; Neptune also has a different scaling model and is not as cost-effective for simple key-value or document workloads. Option C (Amazon Redshift) is wrong because it is a columnar data warehouse designed for analytical queries on large datasets, not for transactional workloads with flexible schemas; it does not support real-time, low-latency reads/writes for a social media application and has a different scaling architecture. Option D (Amazon RDS for MySQL) is wrong because it is a relational database with a fixed schema, requiring predefined tables and relationships, which contradicts the need for flexible schemas; it also scales vertically (by increasing instance size) rather than horizontally, and single-AZ deployments can be a single point of failure unless Multi-AZ is configured, which still does not provide the same horizontal scaling as DynamoDB.

Full explanation →

671

MCQhard

A KMS key has the grant shown. An IAM role named AdminRole is the grantee. What additional permission does this grant provide to AdminRole beyond what the role's IAM policy allows?

A.The role can use the key to encrypt and decrypt, regardless of its IAM policy.

B.The role can use the key to encrypt and decrypt, but only if its IAM policy also allows it.

C.The role can delete the KMS key.

D.The role can create new grants for this key.

AnswerA

The grant explicitly allows Encrypt and Decrypt operations, and grants bypass IAM policy restrictions.

Why this answer

A KMS grant allows the grantee to perform the specified operations (in this case, Encrypt and Decrypt) on the KMS key without needing additional permissions in the IAM policy. The grant provides these permissions directly to the grantee, independent of IAM policies. Option B is incorrect because the grant's permissions are effective regardless of the IAM policy; they do not require IAM policy to also allow the operations.

Option C is incorrect because the grant does not include permission to delete the key; deletion requires separate IAM permissions. Option D is incorrect because creating new grants is a separate permission (CreateGrant) that is not included in a grant that only allows Encrypt and Decrypt.

Full explanation →

672

MCQeasy

A developer accidentally deleted a table in an Amazon RDS for PostgreSQL DB instance. The instance has automated backups enabled with a retention period of 7 days. The deletion occurred 2 hours ago. What is the quickest way to recover the table?

A.Perform a point-in-time recovery to a time just before the deletion.

B.Use PostgreSQL pg_dump to connect and dump the table from the current instance.

C.Download the automated backup file from S3 and restore the table.

D.Restore the DB instance from the latest automated snapshot.

AnswerA

Point-in-time recovery uses transaction logs to restore to any time within the retention period.

Why this answer

Point-in-time recovery (PITR) allows restoring the RDS for PostgreSQL DB instance to any time within the 7-day backup retention period. Since the deletion occurred 2 hours ago, you can restore the instance to a time just before the deletion, then connect to the restored instance and extract the deleted table using pg_dump or similar tools. This is the quickest method because it does not require restoring a full snapshot and then applying transaction logs manually.

Option B is incorrect because pg_dump cannot export a table that has already been deleted from the current instance. Option C is incorrect because automated backup files are not directly accessible as downloadable files from S3; they are used internally by RDS for PITR. Option D is incorrect because restoring from the latest automated snapshot would not recover the table if the snapshot was taken after the deletion, or if the snapshot includes the deletion state.

Full explanation →

673

Multi-Selecteasy

A company is planning to migrate a 1 TB SQL Server database to Amazon RDS for SQL Server. Which TWO factors should be considered when choosing the migration approach?

Select 2 answers

A.The number of concurrent users accessing the database

B.The need to modify the database schema for compatibility

C.Whether the database uses SQL Server Agent jobs

D.The acceptable downtime window for the application

E.The version of the source SQL Server instance

AnswersB, D

Schema changes may be required and SCT can assist.

Why this answer

When migrating a SQL Server database to Amazon RDS, certain features like full-text search, CLR assemblies, or deprecated data types may not be supported or require schema modifications. RDS for SQL Server does not support all SQL Server features (e.g., FileStream, Service Broker, or cross-database references), so the schema must be reviewed and potentially altered to ensure compatibility before migration.

Exam trap

The trap here is that candidates confuse operational factors (like concurrent users or version compatibility) with migration approach decisions, when the key differentiator is whether the source database schema and features are fully supported by the RDS platform.

Full explanation →

674

MCQeasy

A company needs to store application logs for 90 days and run periodic analytical queries. The logs are generated at 1 TB per day. Which storage solution is most cost-effective?

A.Store logs in Amazon RDS for MySQL with partitioning.

B.Store logs in Amazon Redshift with automatic compression.

C.Store logs in Amazon DynamoDB with TTL for expiration.

D.Store logs in Amazon S3 and use S3 Select for queries.

AnswerD

S3 is cost-effective and S3 Select supports queries.

Why this answer

Amazon S3 is the most cost-effective storage solution for 90-day retention of 1 TB/day of application logs, as it offers low-cost object storage with lifecycle policies to automatically expire data after 90 days. S3 Select allows you to run analytical queries (e.g., filtering, aggregations) directly on the data stored in S3 using SQL-like statements, without needing to load data into a separate analytics engine, thus minimizing compute costs and operational overhead.

Exam trap

The trap here is that candidates often over-engineer the solution by choosing a database or data warehouse (like Redshift or RDS) for log storage, forgetting that S3 with S3 Select is purpose-built for cost-effective storage and serverless querying of large datasets with minimal operational complexity.

How to eliminate wrong answers

Option A is wrong because Amazon RDS for MySQL is a relational database designed for transactional workloads, not for storing and querying large volumes of log data at petabyte scale; it would be prohibitively expensive for 90 TB of logs and lacks native log expiration features. Option B is wrong because Amazon Redshift is a data warehouse optimized for complex analytical queries on structured data, but it is overkill and costly for simple log retention and periodic queries; it also requires loading data into the warehouse, incurring additional compute and storage costs. Option C is wrong because Amazon DynamoDB is a NoSQL key-value and document database designed for low-latency access at scale, but it is not cost-effective for storing 90 TB of log data due to its per-GB storage cost and provisioned throughput costs; while TTL can expire items, DynamoDB is not optimized for analytical queries like S3 Select.

Full explanation →

675

MCQmedium

A company is designing a database for an e-commerce platform that requires high availability and automatic failover with minimal downtime. The application performs both OLTP and read-heavy analytics. Which AWS database service should be used?

A.Amazon DynamoDB

B.Amazon RDS for MySQL

C.Amazon Redshift

D.Amazon Aurora

AnswerD

Aurora offers high availability, automatic failover, and up to 15 read replicas for analytics.

Why this answer

Amazon Aurora is the correct choice because it combines the high availability and automatic failover of a relational database with the performance needed for both OLTP and read-heavy analytics. Aurora provides six-way replication across three Availability Zones, automatic failover in under 30 seconds, and supports up to 15 low-latency read replicas that can offload analytics queries without impacting write performance.

Exam trap

The trap here is that candidates often choose Amazon RDS for MySQL because they assume Multi-AZ provides automatic failover and read replicas for analytics, but they overlook that Aurora offers faster failover, better read replica performance, and integrated storage replication without the need for separate Multi-AZ configuration.

How to eliminate wrong answers

Option A is wrong because Amazon DynamoDB is a NoSQL key-value and document database optimized for high-scale OLTP workloads, but it lacks native support for complex SQL joins, aggregations, and the relational schema required for read-heavy analytics typical of an e-commerce platform. Option B is wrong because Amazon RDS for MySQL, while supporting read replicas, has a single-AZ primary by default and requires Multi-AZ deployment for failover, which still incurs a longer failover time (typically 1-2 minutes) and does not offer the same level of read replica performance or automatic scaling as Aurora. Option C is wrong because Amazon Redshift is a columnar data warehouse designed for large-scale analytics and OLAP workloads, not for OLTP transactions with high concurrency and sub-millisecond latency requirements.

Full explanation →

Page 9 of 23

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23

Practice DBS-C01 by domain

Target a specific domain to shore up weak areas.

Workload-Specific Database Design Deployment and Migration Management and Operations Monitoring and Troubleshooting Database Security

See all domains with question counts →