DOP-C02 Incident and Event Response Practice Question
A company uses Amazon RDS for MySQL with Multi-AZ deployment. During an incident, the primary DB instance becomes unreachable. The failover to the standby instance succeeds, but application connections are failing with 'Access denied for user'. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The application is using the old master user credentials that were changed on the primary but not replicated to the standby
The most likely cause is that the application is using credentials that were changed on the primary but not replicated to the standby. In RDS Multi-AZ, changes made via the RDS console or API (e.g., modifying the master password) are automatically replicated, but direct SQL modifications (e.g., ALTER USER) are not. After failover, the standby becomes the new primary with the old credentials, causing 'Access denied for user' errors. Option A is incorrect because DNS CNAME propagation delays cause connection timeouts, not authentication failures. Option B is incorrect because storage configuration differences do not affect authentication. Option D is incorrect because the security group remains associated with the RDS instance and the application's IP address does not change during failover.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The DNS CNAME for the RDS endpoint has not propagated to the application's DNS resolver
Why it's wrong here
DNS issues cause connection timeouts, not access denied.
- ✗
The standby instance has a different storage configuration than the primary
Why it's wrong here
Storage is replicated; the standby has the same configuration.
- ✓
The application is using the old master user credentials that were changed on the primary but not replicated to the standby
Why this is correct
Credentials are not replicated across Multi-AZ; they must be the same.
- ✗
The security group for the RDS instance does not allow inbound traffic from the application's new IP address
Why it's wrong here
Security groups are attached to the RDS instance, which retains the same endpoint.
Go deeper
Related to this question
About these practice questions
One of 251 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.