How many Troubleshooting Scenario Questions questions are on this page?

This page has 14 Troubleshooting Scenario Questions scenario questions for the DBS-C01 exam, each with detailed explanations and wrong-answer analysis.

How should I approach DBS-C01 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to AWS Certified Database Specialty DBS-C01 questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise AWS Certified Database Specialty DBS-C01 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

DBS-C01

exam code

Amazon Web Services

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediumdrag order

Full question →

Arrange the steps to troubleshoot a connection timeout issue from an EC2 instance to an Amazon RDS for SQL Server DB instance in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 2mediummultiple choice

Full question →

A company is using Amazon RDS for MySQL and notices that database connections are being rejected intermittently. The application logs show 'Too many connections' errors. The DB instance has 1000 max_connections. Which action should the DBA take to troubleshoot and resolve this issue without impacting performance?

A
Increase the max_connections parameter to 5000 in the DB parameter group
Why wrong: Increasing max_connections can cause memory pressure and performance degradation.
B
Create a read replica to offload read traffic
Why wrong: Read replicas do not reduce the number of connections to the primary instance.
C
Enable Performance Insights and review the 'DB Connections' metric to identify spikes and troubleshoot application connection pooling
Performance Insights helps identify the source of connection bursts and allows tuning of the application's connection pooling behavior.
D
Set the 'wait_timeout' parameter to a lower value to close idle connections faster
Why wrong: Reducing wait_timeout may cause active queries to be terminated prematurely.

Full breakdown with real-world context →

Question 3hardmultiple choice

Full question →

Refer to the exhibit. A security engineer has applied this key policy to a customer managed KMS key used to encrypt a Secrets Manager secret containing database credentials. An application running on an Amazon EC2 instance in the same account and region is unable to decrypt the secret. What is the MOST likely cause?

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "kms:Decrypt",
      "Resource": "arn:aws:kms:us-east-1:123456789012:key/abc12345-...",
      "Condition": {
        "StringEquals": {
          "kms:ViaService": "secretsmanager.us-east-1.amazonaws.com",
          "kms:CallerAccount": "123456789012"
        }
      }
    }
  ]
}

A
The condition kms:ViaService restricts the decryption to requests made via Secrets Manager, but the application is calling KMS directly.
Option B is correct: The condition kms:ViaService requires the request to come via Secrets Manager, but the application likely decrypts directly using the KMS API.
B
The KMS key ARN in the resource field is incorrect.
Why wrong: Option A is incorrect: The ARN format appears correct.
C
The policy is missing an encryption context that matches the secret's encryption context.
Why wrong: Option C is incorrect: The policy does not specify an encryption context, so the condition is not based on it.
D
The policy only allows Decrypt, but the application needs Encrypt permission.
Why wrong: Option D is incorrect: The application needs Decrypt, not Encrypt.

Full breakdown with real-world context →

Question 4hardmultiple choice

Full question →

A security engineer is troubleshooting an issue where an application using IAM role 'app-role' with a trust policy to assume the 'app-user' user is unable to decrypt an RDS database that uses a customer-managed KMS key. The above key policy is attached to the KMS key. What is the likely cause of the failure?

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowRoot",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:root"
      },
      "Action": "kms:*",
      "Resource": "*"
    },
    {
      "Sid": "AllowAppUser",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:user/app-user"
      },
      "Action": [
        "kms:Decrypt",
        "kms:GenerateDataKey"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "kms:ViaService": "rds.us-east-1.amazonaws.com"
        }
      }
    }
  ]
}

A
The 'kms:ViaService' condition requires the request to come from RDS, but the application is making KMS API calls directly.
Why wrong: The decryption of RDS databases is done by RDS on behalf of the application, so the call to KMS comes from RDS, satisfying the condition.
B
The policy has a missing 'Effect': 'Deny' statement that is blocking access.
Why wrong: There is no explicit deny; the issue is that the role is not authorized.
C
The principal in the policy is 'app-user', but the application uses an IAM role that does not have the necessary permissions.
The policy grants permissions to the user 'app-user', but the application uses a role. The role needs to be added to the key policy.
D
The condition 'kms:ViaService' restricts the key to be used only with RDS, but the application is using a different service.
Why wrong: The application is using RDS, so this condition should be satisfied.

Full breakdown with real-world context →

Question 5hardmultiple choice

Full question →

A team is setting up a DMS migration task. The IAM policy above is attached to the DMS replication instance's IAM role. The team is unable to modify the target RDS instance's maintenance window during the migration. Which additional permission is missing?

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dms:CreateEndpoint",
        "dms:ModifyEndpoint",
        "dms:DescribeEndpoints"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "rds:DescribeDBInstances",
        "rds:ModifyDBInstance"
      ],
      "Resource": "arn:aws:rds:us-east-1:123456789012:db:target-db"
    }
  ]
}

A
Add 'rds:ModifyDBInstance' permission for the source RDS instance.
The policy only allows modification of the target instance; the source instance also needs to be modified during migration, e.g., enabling binary logging.
B
Add 'rds:ModifyOptionGroup' permission for the target RDS instance.
Why wrong: Modifying the option group is different from modifying the maintenance window; the maintenance window is part of rds:ModifyDBInstance.
C
Add 'dms:ModifyReplicationInstance' permission for the DMS replication instance.
Why wrong: The maintenance window is a property of the RDS instance, not the DMS replication instance.
D
Add 'ec2:DescribeVpcs' permission to the policy.
Why wrong: VPC permissions are not needed to modify the RDS maintenance window.

Full breakdown with real-world context →

Question 6hardmultiple choice

Full question →

A database administrator is troubleshooting an Amazon RDS for PostgreSQL DB instance that is experiencing high CPU utilization. The administrator runs the following query to find the current running queries:

SELECT pid, now() - pg_stat_activity.query_start AS duration, query, state FROM pg_stat_activity WHERE state = 'active';

The output shows a high number of queries with a state of 'active' and durations exceeding several minutes. What should the administrator do FIRST to reduce CPU utilization?

A
Modify the max_connections parameter to limit concurrent sessions.
Why wrong: This won't affect already connected sessions.
B
Scale up the DB instance to a larger instance class.
Why wrong: This is a reactive measure and not the first step.
C
Use pg_terminate_backend to terminate the long-running queries.
Terminating long-running queries immediately reduces CPU usage.
D
Enable pg_stat_statements to collect query performance data.
Why wrong: This adds overhead and does not solve the immediate problem.

Full breakdown with real-world context →

Question 7hardmulti select

Full question →

A database engineer is troubleshooting slow query performance on an Amazon RDS for PostgreSQL instance. The instance is db.r5.large with 500 GB of General Purpose SSD (gp2) storage. CloudWatch metrics show high Read Latency and high Read IOPS, but low CPU utilization. Which TWO actions should the engineer take to improve performance?

A
Create a read replica and offload read queries to it.
Read replicas reduce the read IOPS on the primary, which can lower latency on the primary.
B
Increase the DB instance class to a larger size, such as db.r5.2xlarge.
Why wrong: Larger instance provides more CPU and memory but does not directly improve storage latency.
C
Enable Multi-AZ to use the standby for read traffic.
Why wrong: Standby instances in Multi-AZ are not used for reads.
D
Optimize queries by adding appropriate indexes.
Why wrong: While indexing can reduce IOPS, the metrics suggest a storage bottleneck; indexing is application-specific and not directly indicated.
E
Switch from General Purpose SSD (gp2) to Provisioned IOPS SSD (io1) with a higher IOPS rate.
Provisioned IOPS provides consistent low latency for I/O-intensive workloads.

Full breakdown with real-world context →

Question 8hardmultiple choice

Full question →

A database administrator runs the above AWS CLI command to troubleshoot replication issues. The DB instance 'mydb' is a read replica of 'my-source-db'. The administrator notices that the replica lag is increasing. Which of the following is the MOST likely cause?

Network Topology

A
The source DB instance is running a different MySQL version.
Why wrong: The version is the same.
B
The read replica has Multi-AZ disabled.
Why wrong: Multi-AZ on a replica does not affect replication lag.
C
The read replica is using a smaller instance class than the source.
Why wrong: The instance class is not specified as smaller; it's db.r5.large.
D
The read replica is in a different AWS Region than the source.
Cross-Region replication introduces network latency, causing lag.

Full breakdown with real-world context →

Question 9mediummulti select

Full question →

A database specialist is troubleshooting an Amazon DynamoDB table that is experiencing high throttling on write requests. The table has on-demand capacity and uses a composite primary key (partition key and sort key). Which THREE actions should the specialist take to identify and resolve the issue?

A
Examine the partition key value distribution to identify hot partitions
Uneven distribution causes throttling on hot partitions.
B
Implement DynamoDB Accelerator (DAX) to offload read traffic
DAX reduces read load, freeing write capacity.
C
Change the table to provisioned capacity mode
Why wrong: Provisioned capacity may still have hot partition issues.
D
Increase the read capacity units on the table
Why wrong: Read capacity does not affect write throttling.
E
Review Amazon CloudWatch metrics for 'WriteThrottleEvents' and 'ConsumedWriteCapacityUnits'
These metrics pinpoint throttling and capacity usage.

Full breakdown with real-world context →

Question 10hardmultiple choice

Full question →

A database engineer is troubleshooting a production Amazon Aurora MySQL DB cluster. The application is experiencing high latency on write operations. The engineer checks the Amazon CloudWatch metrics and sees that the 'AuroraBinlogReplicaLag' metric is high. What is the most likely cause of the write latency?

A
The DB cluster has insufficient storage capacity for the binlog files
Why wrong: Insufficient storage would cause errors, not binlog lag.
B
The DB cluster has a high CPU utilization that is causing replication lag
Why wrong: CPU utilization is a separate metric; binlog lag is specific to replication.
C
The binlog replication to a downstream MySQL instance is falling behind
High binlog lag means the downstream replica cannot keep up, causing write delays if the source waits for acknowledgment.
D
A recent failover event caused the binlog to be replayed from the last checkpoint
Why wrong: Failover does not cause binlog lag; it may cause a brief stall but not sustained high lag.

Full breakdown with real-world context →

Question 11easymultiple choice

Review the full subnetting walkthrough →

A database specialist is troubleshooting a connectivity issue with an Amazon RDS for PostgreSQL instance. The instance is in a VPC with a public subnet. The security group allows inbound traffic on port 5432 from the application server's IP address. The application server is in the same VPC but in a private subnet. Despite the security group configuration, the application cannot connect. Which action should the specialist take to resolve the issue?

A
Launch the RDS instance in the default VPC.
Why wrong: Placing the instance in a different VPC would complicate connectivity.
B
Change the DB subnet group to include the application server's subnet.
Why wrong: The DB subnet group defines which subnets the RDS instance can be in, not which subnets can connect to it.
C
Add a network ACL rule allowing inbound traffic on port 5432 from the application server's public IP.
Why wrong: Network ACLs are stateless and the application uses private IP; also security groups are sufficient.
D
Modify the RDS instance to be publicly accessible.
Why wrong: Public accessibility is not needed if the application is in the same VPC.
E
Update the security group inbound rule to allow traffic from the application server's private IP address.
The application connects from its private IP within the VPC, so the security group should allow that private IP.

Full breakdown with real-world context →

Question 12mediummulti select

Read the full NAT/PAT explanation →

A database engineer is troubleshooting high CPU usage on an Amazon RDS for PostgreSQL instance. Amazon CloudWatch shows CPU Utilization consistently above 90% during business hours. Which combination of actions should the engineer take to identify the root cause? (Choose TWO.)

A
Enable Enhanced Monitoring and review OS process list.
Why wrong: Enhanced Monitoring shows OS-level metrics like memory and disk I/O, but not query-level CPU usage.
B
Review the slow query log to identify long-running queries.
Slow query logs can reveal queries that consume significant CPU resources.
C
Scale up the DB instance to a larger instance class.
Why wrong: Scaling up addresses symptoms but does not identify the root cause; it may also increase costs unnecessarily.
D
Enable Performance Insights and review the top SQL queries.
Performance Insights provides query-level performance data to pinpoint high-CPU queries.
E
Install pg_stat_statements extension and query it.
Why wrong: pg_stat_statements requires prior installation and is not available by default; Performance Insights is easier to enable and provides similar information.

Full breakdown with real-world context →

Question 13hardmultiple choice

Full question →

A security engineer created the IAM policy above for an application that reads from a DynamoDB table named UserSessions. The application reports that it cannot query the table using a Global Secondary Index (GSI). The table's GSI is named GSI_UserSessions. Why is the application unable to query the index?

Exhibit

Refer to the exhibit.

```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:GetItem",
        "dynamodb:Query"
      ],
      "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/UserSessions"
    },
    {
      "Effect": "Deny",
      "Action": "dynamodb:*",
      "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/UserSessions/index/*"
    }
  ]
}
```

A
The Query action is not allowed on the index because the Allow statement only applies to the table, not the index.
The Allow statement's resource is the table, not the index; however, the Deny is explicit. Actually, both A and C could be argued, but A is the primary reason because the Deny explicitly blocks. But the question expects A. However, in the context, the correct answer is A because Deny overrides Allow. However, note that the Allow statement does not include index ARN, so Query on index is implicitly denied. But there is an explicit Deny, which makes it explicit. The best answer is A.
B
The Deny statement explicitly denies all DynamoDB actions on the index resource, overriding the Allow statement.
Explicit Deny always takes precedence.
C
The application is using GetItem instead of Query to access the index.
Why wrong: GetItem is for table primary key, not index.
D
The policy allows Query on the table, which automatically includes the index.
Why wrong: Query on index requires permission on the index resource.

Full breakdown with real-world context →

Question 14mediummultiple choice

Full question →

A database administrator is troubleshooting a slow-performing query on an Amazon RDS for MySQL instance. The slow query log shows the above entry. Based on the exhibit, which index would most improve the query performance?

Network Topology

A
Index on `created_at` only.
Why wrong: Does not help filtering on status.
B
Index on `status` only.
Why wrong: Helps filtering but not sorting; still may need file sort.
C
Full-text index on `status` and `created_at`.
Why wrong: Full-text indexes are for text search, not this query.
D
Composite index on (`status`, `created_at`).
Covers both filter and sort, avoiding a full table scan.

Full breakdown with real-world context →

These DBS-C01 practice questions are part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style DBS-C01 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related DBS-C01 topic practice pages

Workload-Specific Database Design practice questions

Deployment and Migration practice questions

Management and Operations practice questions

Monitoring and Troubleshooting practice questions

Database Security practice questions

DBS-C01 fundamentals practice questions

DBS-C01 scenario practice questions

DBS-C01 troubleshooting practice questions

Practice scenarios

Arrange the steps to troubleshoot a connection timeout issue from an EC2 instance to an Amazon RDS for SQL Server DB instance in the correct order.

Exhibit

Exhibit

A team is setting up a DMS migration task. The IAM policy above is attached to the DMS replication instance's IAM role. The team is unable to modify the target RDS instance's maintenance window during the migration. Which additional permission is missing?

Exhibit

A database administrator runs the above AWS CLI command to troubleshoot replication issues. The DB instance 'mydb' is a read replica of 'my-source-db'. The administrator notices that the replica lag is increasing. Which of the following is the MOST likely cause?

A database specialist is troubleshooting an Amazon DynamoDB table that is experiencing high throttling on write requests. The table has on-demand capacity and uses a composite primary key (partition key and sort key). Which THREE actions should the specialist take to identify and resolve the issue?

A database engineer is troubleshooting high CPU usage on an Amazon RDS for PostgreSQL instance. Amazon CloudWatch shows CPU Utilization consistently above 90% during business hours. Which combination of actions should the engineer take to identify the root cause? (Choose TWO.)

Exhibit

A database administrator is troubleshooting a slow-performing query on an Amazon RDS for MySQL instance. The slow query log shows the above entry. Based on the exhibit, which index would most improve the query performance?