Amazon Amazon Certifications DBS-C01 Questions & Answers

• Question 171:

  A company is developing an application that performs intensive in-memory operations on advanced data structures such as sorted sets. The application requires sub-millisecond latency for reads and writes. The application occasionally must run a group of commands as an ACID-compliant operation. A database specialist is setting up the database for this application. The database specialist needs the ability to create a new database cluster from the latest backup of the production cluster.

  Which type of cluster should the database specialist create to meet these requirements?

  A. Amazon ElastiCache for Memcached

  B. Amazon Neptune

  C. Amazon ElastiCache for Redis

  D. Amazon DynamoDB Accelerator (DAX)

  Correct Answer: C

  Explanation: https://aws.amazon.com/elasticache/redis-vs-memcached/ https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/elasticache-use- cases.html #elasticache-for-redis-use-cases-gaming

• Question 172:

  The Security team for a finance company was notified of an internal security breach that happened 3 weeks ago. A Database Specialist must start producing audit logs out of the production Amazon Aurora PostgreSQL cluster for the Security team to use for monitoring and alerting. The Security team is required to perform real- time alerting and monitoring outside the Aurora DB cluster and wants to have the cluster push encrypted files to the chosen solution.

  Which approach will meet these requirements?

  A. Use pg_audit to generate audit logs and send the logs to the Security team.

  B. Use AWS CloudTrail to audit the DB cluster and the Security team will get data from Amazon S3.

  C. Set up database activity streams and connect the data stream from Amazon Kinesis to consumer applications.

  D. Turn on verbose logging and set up a schedule for the logs to be dumped out for the Security team.

  Correct Answer: C

  https://aws.amazon.com/about-aws/whats-new/2019/05/amazon-aurora-with-postgresql- compatibility-supports-database-activity-streams/

  "Database Activity Streams for Amazon Aurora with PostgreSQL compatibility provides a near real-time data stream of the database activity in your relational database to help you monitor activity. When integrated with third party database

  activity monitoring tools, Database Activity Streams can monitor and audit database activity to provide safeguards for your database and help meet compliance and regulatory requirements."

  https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Overview.LoggingAnd Monitoring.html

• Question 173:

  A company has a on-premises Oracle Real Application Clusters (RAC) database. The company wants to migrate the database to AWS and reduce licensing costs. The company's application team wants to store JSON payloads that expire after 28 hours. The company has development capacity if code changes are required.

  Which solution meets these requirements?

  A. Use Amazon DynamoDB and leverage the Time to Live (TTL) feature to automatically expire the data.

  B. Use Amazon RDS for Oracle with Multi-AZ. Create an AWS Lambda function to purge the expired data. Schedule the Lambda function to run daily using Amazon EventBridge.

  C. Use Amazon DocumentDB with a read replica in a different Availability Zone. Use DocumentDB change streams to expire the data.

  D. Use Amazon Aurora PostgreSQL with Multi-AZ and leverage the Time to Live (TTL) feature to automatically expire the data.

  Correct Answer: A

• Question 174:

  A large company has a variety of Amazon DB clusters. Each of these clusters has various configurations that adhere to various requirements. Depending on the team and use case, these configurations can be organized into broader categories.

  A database administrator wants to make the process of storing and modifying these parameters more systematic. The database administrator also wants to ensure that changes to individual categories of configurations are automatically applied to all instances when required.

  Which AWS service or feature will help automate and achieve this objective?

  A. AWS Systems Manager Parameter Store

  B. DB parameter group

  C. AWS Config

  D. AWS Secrets Manager

  Correct Answer: B

  Reference: https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/ USER_WorkingWithParamGroups.html

• Question 175:

  A company has a reporting application that runs on an Amazon EC2 instance in an isolated developer account on AWS. The application needs to retrieve data during non-peak company hours from an Amazon Aurora PostgreSQL database that runs in the companys production account The companys security team requires that access to production resources complies with AWS best security practices A database administrator needs to provide the reporting application with access to the production database. The company has already configured VPC peering between the production account and developer account The company has also updated the route tables in both accounts With the necessary entries to correctly set up VPC peering.

  What must the database administrator do to finish providing connectivity to the reporting application?

  A. Add an inbound security group rule to the database security group that allows access from the developer account VPC CIDR on port 5432. Add an outbound security group rule to the EC2 security group that allows access to the production account VPC CIDR on port 5432.

  B. Add an outbound security group rule to the database security group that allows access from the developer account VPC CIDR on port 5432. Add an outbound security group rule to the EC2 security group that allows access to the production account VPC CIDR on port 5432.

  C. Add an inbound security group rule to the database security group that allows access from the developer account VPC CIDR on all TCP ports. Add an inbound security group rule to the EC2 security group that allows access to the production account VPC CIDR on port 5432_

  D. Add an inbound security group rule to the database security group that allows access from the developer account VPC CIDR on port 5432_ Add an outbound security group rule to the EC2 security group that allows access to the production account VPC CIDR on all TCP ports

  Correct Answer: A

  Explanation: The correct answer is A. Add an inbound security group rule to the database security group that allows access from the developer account VPC CIDR on port 5432. Add an outbound security group rule to the EC2 security group that allows access to the production account VPC CIDR on port 5432. The explanation is as follows: To allow the reporting application to access the production database, the database administrator needs to configure the security group rules for both the database and the EC2 instance. The security group rules must allow traffic between the peered VPCs on the port that the database uses, which is 5432 for PostgreSQL1. Option A is correct because it adds an inbound rule to the database security group that allows access from the developer account VPC CIDR on port 5432. This means that the database can accept connections from the EC2 instance in the peered VPC. It also adds an outbound rule to the EC2 security group that allows access to the production account VPC CIDR on port 5432. This means that the EC2 instance can initiate connections to the database in the peered VPC. Option B is incorrect because it adds an outbound rule to the database security group, which is not necessary. The database does not need to initiate connections to the EC2 instance, only accept them. It also does not add an inbound rule to the EC2 security group, which is not required. The EC2 instance does not need to accept connections from the database, only initiate them. Option C is incorrect because it adds an inbound rule to the database security group that allows access from the developer account VPC CIDR on all TCP ports. This is too permissive and violates the principle of least privilege2. It also adds an inbound rule to the EC2 security group that allows access to the production account VPC CIDR on port 5432. This is unnecessary and does not help with connectivity. Option D is incorrect because it adds an outbound rule to the EC2 security group that allows access to the production account VPC CIDR on all TCP ports. This is too permissive and violates the principle of least privilege2. It also does not add an outbound rule to the database security group, which is not needed. References: 1: [Working with PostgreSQL and pgAdmin - Amazon Aurora] 2: [Security best practices in IAM - AWS Identity and Access Management]

• Question 176:

  A gaming company has implemented a leaderboard in AWS using a Sorted Set data structure within Amazon ElastiCache for Redis. The ElastiCache cluster has been deployed with cluster mode disabled and has a replication group deployed with two additional replicas. The company is planning for a worldwide gaming event and is anticipating a higher write load than what the current cluster can handle.

  Which method should a Database Specialist use to scale the ElastiCache cluster ahead of the upcoming event?

  A. Enable cluster mode on the existing ElastiCache cluster and configure separate shards for the Sorted Set across all nodes in the cluster.

  B. Increase the size of the ElastiCache cluster nodes to a larger instance size.

  C. Create an additional ElastiCache cluster and load-balance traffic between the two clusters.

  D. Use the EXPIRE command and set a higher time to live (TTL) after each call to increment a given key.

  Correct Answer: B

• Question 177:

  A database specialist is designing an enterprise application for a large company. The application uses Amazon DynamoDB with DynamoDB Accelerator (DAX).

  The database specialist observes that most of the queries are not found in the DAX cache and that they still require DynamoDB table reads.

  What should the database specialist review first to improve the utility of DAX?

  A. The DynamoDB ConsumedReadCapacityUnits metric

  B. The trust relationship to perform the DynamoDB API calls

  C. The DAX cluster's TTL setting

  D. The validity of customer-specified AWS Key Management Service (AWS KMS) keys for DAX encryption at rest

  Correct Answer: C

  https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DAX.cluster- management.html#DAX.cluster-management.custom-settings.ttl

• Question 178:

  Amazon Aurora MySQL is being used by an ecommerce business to migrate its main application database. The firm is now doing OLTP stress testing using concurrent database connections. A database professional detected sluggish performance for several particular write operations during the first round of testing.

  Examining the Amazon CloudWatch stats for the Aurora DB cluster revealed a CPU usage of 90%.

  Which actions should the database professional take to determine the main cause of excessive CPU use and sluggish performance most effectively? (Select two.)

  A. Enable Enhanced Monitoring at less than 30 seconds of granularity to review the operating system metrics before the next round of tests.

  B. Review the VolumeBytesUsed metric in CloudWatch to see if there is a spike in write I/O.

  C. Review Amazon RDS Performance Insights to identify the top SQL statements and wait events.

  D. Review Amazon RDS API calls in AWS CloudTrail to identify long-running queries.

  E. Enable Advance Auditing to log QUERY events in Amazon CloudWatch before the next round of tests.

  Correct Answer: AC

  Explanation: https://aws.amazon.com/premiumsupport/knowledge-center/rds-instance- high-cpu/ https://aws.amazon.com/premiumsupport/knowledge-center/rds-mysql-slow-query/

• Question 179:

  A clothing company uses a custom ecommerce application and a PostgreSQL database to sell clothes to thousands of users from multiple countries. The company is migrating its application and database from its on- premises data center to the AWS Cloud. The company has selected Amazon EC2 for the application and Amazon RDS for PostgreSQL for the database. The company requires database passwords to be changed every 60 days. A Database Specialist needs to ensure that the credentials used by the web application to connect to the database are managed securely.

  Which approach should the Database Specialist take to securely manage the database credentials?

  A. Store the credentials in a text file in an Amazon S3 bucket. Restrict permissions on the bucket to the IAM role associated with the instance profile only. Modify the application to download the text file and retrieve the credentials on start up. Update the text file every 60 days.

  B. Configure IAM database authentication for the application to connect to the database. Create an IAM user and map it to a separate database user for each ecommerce user. Require users to update their passwords every 60 days.

  C. Store the credentials in AWS Secrets Manager. Restrict permissions on the secret to only the IAM role associated with the instance profile. Modify the application to retrieve the credentials from Secrets Manager on start up. Configure the rotation interval to 60 days.

  D. Store the credentials in an encrypted text file in the application AMI. Use AWS KMS to store the key for decrypting the text file. Modify the application to decrypt the text file and retrieve the credentials on start up. Update the text file and publish a new AMI every 60 days.

  Correct Answer: C

• Question 180:

  A Database Specialist is designing a disaster recovery strategy for a production Amazon DynamoDB table. The table uses provisioned read/write capacity mode, global secondary indexes, and time to live (TTL). The Database Specialist has restored the latest backup to a new table.

  To prepare the new table with identical settings, which steps should be performed? (Choose two.)

  A. Re-create global secondary indexes in the new table

  B. Define IAM policies for access to the new table

  C. Define the TTL settings

  D. Encrypt the table from the AWS Management Console or use the update-table command

  E. Set the provisioned read and write capacity

  Correct Answer: BC

  Explanation: The following items need to be reconfigured after restoring the DynamoDB table. --AutoScaling policy --IAM policy --CloudWatch settings --Tags --Stream settings --TTL https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/backuprestore_Ho wItWorks.html