Amazon DBS-C01 Online Practice Questions and Exam Preparation

Amazon DBS-C01 Online Questions & Answers

• Question 11:

  A company uses Amazon Aurora for secure financial transactions. The data must always be encrypted at rest and in transit to meet compliance requirements.

  Which combination of actions should a database specialist take to meet these requirements? (Choose two.)

  A. Create an Aurora Replica with encryption enabled using AWS Key Management Service (AWS KMS). Then promote the replica to master.
  B. Use SSL/TLS to secure the in-transit connection between the financial application and the Aurora DB cluster.
  C. Modify the existing Aurora DB cluster and enable encryption using an AWS Key Management Service (AWS KMS) encryption key. Apply the changes immediately.
  D. Take a snapshot of the Aurora DB cluster and encrypt the snapshot using an AWS Key Management Service (AWS KMS) encryption key. Restore the snapshot to a new DB cluster and update the financial application database endpoints.
  E. Use AWS Key Management Service (AWS KMS) to secure the in-transit connection between the financial application and the Aurora DB cluster.
  A. Create an Aurora Replica with encryption enabled using AWS Key Management Service (AWS KMS). Then promote the replica to master.
  B. Use SSL/TLS to secure the in-transit connection between the financial application and the Aurora DB cluster.

  ---

  Explanation/Reference:

  https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/aurora- replicas-adding.html

• Question 12:

  A company is going through a security audit. The audit team has identified cleartext master user password in the AWS CloudFormation templates for Amazon RDS for MySQL DB instances. The audit team has flagged this as a security risk to the database team.

  What should a database specialist do to mitigate this risk?

  A. Change all the databases to use AWS IAM for authentication and remove all the cleartext passwords in CloudFormation templates.
  B. Use an AWS Secrets Manager resource to generate a random password and reference the secret in the CloudFormation template.
  C. Remove the passwords from the CloudFormation templates so Amazon RDS prompts for the password when the database is being created.
  D. Remove the passwords from the CloudFormation template and store them in a separate file. Replace the passwords by running CloudFormation using a sed command.
  B. Use an AWS Secrets Manager resource to generate a random password and reference the secret in the CloudFormation template.

  ---

  Explanation/Reference:

  https://aws.amazon.com/blogs/infrastructure-and-automation/securing- passwords-in-aws-quick-starts-using-aws-secrets-manager/

• Question 13:

  A company has more than 100 AWS accounts that need Amazon RDS instances. The company wants to build an automated solution to deploy the RDS instances with specific compliance parameters. The data does not need to be replicated. The company needs to create the databases within 1 day.

  Which solution will meet these requirements in the MOST operationally efficient way?

  A. Create RDS resources by using AWS CloudFormation. Share the CloudFormation template with each account.
  B. Create an RDS snapshot. Share the snapshot With each account Deploy the snapshot into each account
  C. use AWS CloudFormation to create RDS instances in each account. Run AWS Database Migration Service (AWS DMS) replication to each ot the created instances.
  D. Create a script by using the AWS CLI to copy the ROS instance into the other accounts from a template account.
  A. Create RDS resources by using AWS CloudFormation. Share the CloudFormation template with each account.

  ---

  Explanation/Reference:

  AWS CloudFormation is a service that helps you model and set up your AWS resources so that you can spend less time managing those resources and more time focusing on your applications that run in AWS. You create a template that

  describes all the AWS resources that you want (like Amazon RDS instances), and CloudFormation takes care of provisioning and configuring those resources for you1. Using AWS CloudFormation to create RDS resources and share the

  template with each account is a suitable solution for the company's requirements, as it can:

  Automate the deployment of RDS instances with specific compliance parameters, such as security groups, encryption, backup settings, etc. Reduce the operational overhead and human errors of manually creating RDS instances in each

  account.

  Enable the company to create the databases within one day, as CloudFormation can provision resources in parallel and in a consistent manner.

• Question 14:

  A financial services company is developing a shared data service that supports different applications from throughout the company. A Database Specialist designed a solution to leverage Amazon ElastiCache for Redis with cluster mode enabled to enhance performance and scalability. The cluster is configured to listen on port 6379.

  Which combination of steps should the Database Specialist take to secure the cache data and protect it from unauthorized access? (Choose three.)

  A. Enable in-transit and at-rest encryption on the ElastiCache cluster.
  B. Ensure that Amazon CloudWatch metrics are configured in the ElastiCache cluster.
  C. Ensure the security group for the ElastiCache cluster allows all inbound traffic from itself and inbound traffic on TCP port 6379 from trusted clients only.
  D. Create an IAM policy to allow the application service roles to access all ElastiCache API actions.
  E. Ensure the security group for the ElastiCache clients authorize inbound TCP port 6379 and port 22 traffic from the trusted ElastiCache cluster's security group.
  F. Ensure the cluster is created with the auth-token parameter and that the parameter is used in all subsequent commands.
  A. Enable in-transit and at-rest encryption on the ElastiCache cluster.
  C. Ensure the security group for the ElastiCache cluster allows all inbound traffic from itself and inbound traffic on TCP port 6379 from trusted clients only.
  F. Ensure the cluster is created with the auth-token parameter and that the parameter is used in all subsequent commands.

  ---

  Explanation/Reference:

  https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/encryption.html

• Question 15:

  A Database Specialist is troubleshooting an application connection failure on an Amazon Aurora DB cluster with multiple Aurora Replicas that had been running with no issues for the past 2 months. The connection failure lasted for 5 minutes

  and corrected itself after that. The Database Specialist reviewed the Amazon RDS events and determined a failover event occurred at that time. The failover process took around 15 seconds to

  complete.

  What is the MOST likely cause of the 5-minute connection outage?

  A. After a database crash, Aurora needed to replay the redo log from the last database checkpoint
  B. The client-side application is caching the DNS data and its TTL is set too high
  C. After failover, the Aurora DB cluster needs time to warm up before accepting client connections
  D. There were no active Aurora Replicas in the Aurora DB cluster
  B. The client-side application is caching the DNS data and its TTL is set too high

  ---

  Explanation/Reference:

  When your application tries to establish a connection after a failover, the new Aurora PostgreSQL writer will be a previous reader, which can be found using the Aurora read only endpoint before DNS updates have fully propagated. Setting the java DNS TTL to a low value helps cycle between reader nodes on subsequent connection attempts.

  Amazon Aurora is designed to recover from a crash almost instantaneously and continue to serve your application data. Unlike other databases, after a crash Amazon Aurora does not need to replay the redo log from the last database checkpoint before making the database available for operations. Amazon Aurora performs crash recovery asynchronously on parallel threads, so your database is open and available immediately after a crash. Because the storage is organized in many small segments, each with its own redo log, the underlying storage can replay redo records on demand in parallel and asynchronously as part of a disk read after a crash. This approach reduces database restart times to less than 60 seconds in most cases

• Question 16:

  A company has an on-premises system that tracks various database operations that occur over the lifetime of a database, including database shutdown, deletion, creation, and backup.

  The company recently moved two databases to Amazon RDS and is looking at a solution that would satisfy these requirements. The data could be used by other systems within the company.

  Which solution will meet these requirements with minimal effort?

  A. Create an Amazon Cloudwatch Events rule with the operations that need to be tracked on Amazon RDS. Create an AWS Lambda function to act on these rules and write the output to the tracking systems.
  B. Create an AWS Lambda function to trigger on AWS CloudTrail API calls. Filter on specific RDS API calls and write the output to the tracking systems.
  C. Create RDS event subscriptions. Have the tracking systems subscribe to specific RDS event system notifications.
  D. Write RDS logs to Amazon Kinesis Data Firehose. Create an AWS Lambda function to act on these rules and write the output to the tracking systems.
  C. Create RDS event subscriptions. Have the tracking systems subscribe to specific RDS event system notifications.

• Question 17:

  A large financial services company uses Amazon ElastiCache for Redis for its new application that has a global user base. A database administrator must develop a caching solution that will be available across AWS Regions and include low-latency replication and failover capabilities for disaster recovery (DR). The company's security team requires the encryption of cross- Region data transfers.

  Which solution meets these requirements with the LEAST amount of operational effort?

  A. Enable cluster mode in ElastiCache for Redis. Then create multiple clusters across Regions and replicate the cache data by using AWS Database Migration Service (AWS DMS). Promote a cluster in the failover Region to handle production traffic when DR is required.
  B. Create a global datastore in ElastiCache for Redis. Then create replica clusters in two other Regions. Promote one of the replica clusters as primary when DR is required.
  C. Disable cluster mode in ElastiCache for Redis. Then create multiple replication groups across Regions and replicate the cache data by using AWS Database Migration Service (AWS DMS). Promote a replication group in the failover Region to primary when DR is required.
  D. Create a snapshot of ElastiCache for Redis in the primary Region and copy it to the failover Region. Use the snapshot to restore the cluster from the failover Region when DR is required.
  B. Create a global datastore in ElastiCache for Redis. Then create replica clusters in two other Regions. Promote one of the replica clusters as primary when DR is required.

  ---

  Explanation/Reference:

  Correct Answer: B

  from Amazon documents:

  Amazon ElastiCache for Redis is a fully managed in-memory data store that supports Redis, an open source, key-value database. Amazon ElastiCache for Redis provides several features to enhance the performance, availability, scalability,

  and security of your Redis data, such as cluster mode, global datastore, replication groups, snapshots, and encryption.

  A global datastore is a feature that allows you to create a cross-Region read replica of your ElastiCache for Redis cluster. A global datastore consists of a primary cluster that is replicated across up to two other Regions as secondary clusters.

  A global datastore provides low-latency reads and high availability for your Redis data across Regions. A global datastore also supports encryption of cross-Region data transfers using AWS Key Management Service (AWS KMS).

  To create a global datastore in ElastiCache for Redis, you need to do the following:

  Create a primary cluster in one Region. You can use an existing cluster or create a new one. The cluster must have cluster mode enabled and use Redis engine version 5.0.6 or later.

  Create a global datastore and add the primary cluster to it. You can use the AWS Management Console, the AWS CLI, or the ElastiCache API to create a global datastore.

  Create one or two secondary clusters in other Regions and add them to the global datastore. The secondary clusters must have the same specifications as the primary cluster, such as node type, number of shards, and number of replicas per

  shard.

  Enable encryption in transit and at rest for the primary and secondary clusters. Specify a customer master key (CMK) from AWS KMS for each cluster. By creating a global datastore in ElastiCache for Redis and creating replica clusters in two

  other Regions, the database administrator can develop a caching solution that will be available across Regions and include low-latency replication and failover capabilities for DR. This solution will also meet the security requirement of

  encrypting cross-Region data transfers using AWS KMS. This solution will also require the least amount of operational effort, as it does not involve any data migration or manual intervention. Therefore, option B is the correct solution to meet

  the requirements. Option A is not optimal because enabling cluster mode in ElastiCache for Redis and creating multiple clusters across Regions will not provide cross-Region replication or failover capabilities. Using AWS DMS to replicate the

  cache data by using AWS DMS will incur additional time and cost, and may not support encryption of cross-Region data transfers. Option C is not optimal because disabling cluster mode in ElastiCache for Redis and creating multiple

  replication groups across Regions will not provide cross-Region replication or failover capabilities. Using AWS DMS to replicate the cache data will incur additional time and cost, and may not support encryption of cross-Region data transfers.

  Option D is not optimal because creating a snapshot of ElastiCache for Redis in the primary Region and copying it to the failover Region will not provide low-latency replication or high availability for the Redis data across Regions. Using the

  snapshot to restore the cluster from the failover Region when DR is required will involve manual intervention and downtime.

• Question 18:

  A database specialist is designing an enterprise application for a large company. The application uses Amazon DynamoDB with DynamoDB Accelerator (DAX).

  The database specialist observes that most of the queries are not found in the DAX cache and that they still require DynamoDB table reads.

  What should the database specialist review first to improve the utility of DAX?

  A. The DynamoDB ConsumedReadCapacityUnits metric
  B. The trust relationship to perform the DynamoDB API calls
  C. The DAX cluster's TTL setting
  D. The validity of customer-specified AWS Key Management Service (AWS KMS) keys for DAX encryption at rest
  C. The DAX cluster's TTL setting

  ---

  Explanation/Reference:

  https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DAX.cluster- management.html#DAX.cluster-management.custom-settings.ttl

• Question 19:

  A company is running an Amazon RDS for PostgeSQL DB instance and wants to migrate it to an Amazon Aurora PostgreSQL DB cluster. The current database is 1 TB in size. The migration needs to have minimal downtime. What is the FASTEST way to accomplish this?

  A. Create an Aurora PostgreSQL DB cluster. Set up replication from the source RDS for PostgreSQL DB instance using AWS DMS to the target DB cluster.
  B. Use the pg_dump and pg_restore utilities to extract and restore the RDS for PostgreSQL DB instance to the Aurora PostgreSQL DB cluster.
  C. Create a database snapshot of the RDS for PostgreSQL DB instance and use this snapshot to create the Aurora PostgreSQL DB cluster.
  D. Migrate data from the RDS for PostgreSQL DB instance to an Aurora PostgreSQL DB cluster using an Aurora Replica. Promote the replica during the cutover.
  D. Migrate data from the RDS for PostgreSQL DB instance to an Aurora PostgreSQL DB cluster using an Aurora Replica. Promote the replica during the cutover.

  ---

  Explanation/Reference:

  https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.Mi grating.html Migrating data from an RDS PostgreSQL DB instance to an Aurora PostgreSQL DB cluster by using an Aurora read replica. https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.Mi grating.html#AuroraPostgreSQL.Migrating.RDSPostgreSQ https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraPostgreSQL.Mi grating.html#AuroraPostgreSQL.Migrating.RDSPostgreSQL.Replica

• Question 20:

  A company has an application that uses an Amazon DynamoDB table as its data store. During normal business days, the throughput requirements from the application are uniform and consist of 5 standard write calls per second to the DynamoDB table. Each write call has 2 KB of data.

  For 1 hour each day, the company runs an additional automated job on the DynamoDB table that makes 20 write requests per second. No other application writes to the DynamoDB table. The DynamoDB table does not have to meet any additional capacity requirements.

  How should a database specialist configure the DynamoDB table's capacity to meet these requirements MOST cost-effectively?

  A. Use DynamoDB provisioned capacity with 5 WCUs and auto scaling.
  B. Use DynamoDB provisioned capacity with 5 WCUs and a write-through cache that DynamoDB Accelerator (DAX) provides.
  C. Use DynamoDB provisioned capacity with 10 WCUs and auto scaling.
  D. Use DynamoDB provisioned capacity with 10 WCUs and no auto scaling.
  C. Use DynamoDB provisioned capacity with 10 WCUs and auto scaling.

  ---

  Explanation/Reference:

  https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/HowItWorks.Read WriteCapacityMode.html