Amazon DBS-C01 Online Practice Questions and Exam Preparation

Amazon DBS-C01 Online Questions & Answers

• Question 41:

  A database specialist is constructing an AWS CloudFormation stack using AWS CloudFormation. The database expert wishes to avoid the stack's Amazon RDS ProductionDatabase resource being accidentally deleted.

  Which solution will satisfy this criterion?

  A. Create a stack policy to prevent updates. Include Effect : ProductionDatabase and Resource : Deny in the policy.
  B. Create an AWS CloudFormation stack in XML format. Set xAttribute as false.
  C. Create an RDS DB instance without the DeletionPolicy attribute. Disable termination protection.
  D. Create a stack policy to prevent updates. Include Effect, Deny, and Resource :ProductionDatabase in the policy.
  D. Create a stack policy to prevent updates. Include Effect, Deny, and Resource :ProductionDatabase in the policy.

  ---

  Explanation/Reference:

  https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/protect-stack- resources.html "When you set a stack policy, all resources are protected by default. To allow updates on all resources, we add an Allow statement that allows all actions on all resources. Although the Allow statement specifies all resources, the explicit Deny statement overrides it for the resource with the ProductionDatabase logical ID. This Deny statement prevents all update actions, such as replacement or deletion, on the ProductionDatabase resource."

• Question 42:

  A company uses Microsoft SQL Server on Amazon RDS in a Multi-AZ deployment as the database engine for its application. The company was recently acquired by another company. A database specialist must rename the database to follow a new naming standard.

  Which combination of steps should the database specialist take to rename the database? (Choose two.)

  A. Turn off automatic snapshots for the DB instance. Rename the database with the rdsadmin.dbo.rds_modify_db_name stored procedure. Turn on the automatic snapshots.
  B. Turn off Multi-AZ for the DB instance. Rename the database with the rdsadmin.dbo.rds_modify_db_name stored procedure. Turn on Multi-AZ Mirroring.
  C. Delete all existing snapshots for the DB instance. Use the rdsadmin.dbo.rds_modify_db_name stored procedure.
  D. Update the application with the new database connection string.
  E. Update the DNS record for the DB instance.
  B. Turn off Multi-AZ for the DB instance. Rename the database with the rdsadmin.dbo.rds_modify_db_name stored procedure. Turn on Multi-AZ Mirroring.
  D. Update the application with the new database connection string.

  ---

  Explanation/Reference:

  https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.SQLServer.Commo nDBATasks.RenamingDB.html

• Question 43:

  A database specialist is responsible for an Amazon RDS for MySQL DB instance with one read replica. The DB instance and the read replica are assigned to the default parameter group. The database team currently runs test queries against a read replica. The database team wants to create additional tables in the read replica that will only be accessible from the read replica to benefit the tests.

  Which should the database specialist do to allow the database team to create the test tables?

  A. Contact AWS Support to disable read-only mode on the read replica. Reboot the read replica. Connect to the read replica and create the tables.
  B. Change the read_only parameter to false (read_only=0) in the default parameter group of the read replica. Perform a reboot without failover. Connect to the read replica and create the tables using the local_only MySQL option.
  C. Change the read_only parameter to false (read_only=0) in the default parameter group. Reboot the read replica. Connect to the read replica and create the tables.
  D. Create a new DB parameter group. Change the read_only parameter to false (read_only=0). Associate the read replica with the new group. Reboot the read replica. Connect to the read replica and create the tables.
  D. Create a new DB parameter group. Change the read_only parameter to false (read_only=0). Associate the read replica with the new group. Reboot the read replica. Connect to the read replica and create the tables.

  ---

  Explanation/Reference:

  https://aws.amazon.com/premiumsupport/knowledge-center/rds-read-replica/

• Question 44:

  A company needs to deploy an Amazon Aurora PostgreSQL DB instance into multiple accounts. The company will initiate each DB instance from an existing Aurora PostgreSQL DB instance that runs in a shared account. The company wants the process to be repeatable in case the company adds additional accounts in the future. The company also wants to be able to verify if manual changes have been made to the DB instance configurations after the company deploys the DB instances.

  A database specialist has determined that the company needs to create an AWS CloudFormation template with the necessary configuration to create a DB instance in an account by using a snapshot of the existing DB instance to initialize the DB instance. The company will also use the CloudFormation template's parameters to provide key values for the DB instance creation (account ID, etc.).

  Which final step will meet these requirements in the MOST operationally efficient way?

  A. Create a bash script to compare the configuration to the current DB instance configuration and to report any changes.
  B. Use the CloudFormation drift detection feature to check if the DB instance configurations have changed.
  C. Set up CloudFormation to use drift detection to send notifications if the DB instance configurations have been changed.
  D. Create an AWS Lambda function to compare the configuration to the current DB instance configuration and to report any changes.
  B. Use the CloudFormation drift detection feature to check if the DB instance configurations have changed.

  ---

  Explanation/Reference:

• Question 45:

  A company wants to automate the creation of secure test databases with random credentials to be stored safely for later use. The credentials should have sufficient information about each test database to initiate a connection and perform automated credential rotations. The credentials should not be logged or stored anywhere in an unencrypted form.

  Which steps should a Database Specialist take to meet these requirements using an AWS CloudFormation template?

  A. Create the database with the MasterUserName and MasterUserPassword properties set to the default values. Then, create the secret with the user name and password set to the same default values. Add a Secret Target Attachment resource with the SecretId and TargetId properties set to the Amazon Resource Names (ARNs) of the secret and the database. Finally, update the secret's password value with a randomly generated string set by the GenerateSecretString property.
  B. Add a Mapping property from the database Amazon Resource Name (ARN) to the secret ARN. Then, create the secret with a chosen user name and a randomly generated password set by the GenerateSecretString property. Add the database with the MasterUserName and MasterUserPassword properties set to the user name of the secret.
  C. Add a resource of type AWS::SecretsManager::Secret and specify the GenerateSecretString property. Then, define the database user name in the SecureStringTemplate template. Create a resource for the database and reference the secret string for the MasterUserName and MasterUserPassword properties. Then, add a resource of type AWS::SecretsManagerSecretTargetAttachment with the SecretId and TargetId properties set to the Amazon Resource Names (ARNs) of the secret and the database.
  D. Create the secret with a chosen user name and a randomly generated password set by the GenerateSecretString property. Add an SecretTargetAttachment resource with the SecretId property set to the Amazon Resource Name (ARN) of the secret and the TargetId property set to a parameter value matching the desired database ARN. Then, create a database with the MasterUserName and MasterUserPassword properties set to the previously created values in the secret.
  C. Add a resource of type AWS::SecretsManager::Secret and specify the GenerateSecretString property. Then, define the database user name in the SecureStringTemplate template. Create a resource for the database and reference the secret string for the MasterUserName and MasterUserPassword properties. Then, add a resource of type AWS::SecretsManagerSecretTargetAttachment with the SecretId and TargetId properties set to the Amazon Resource Names (ARNs) of the secret and the database.

  ---

  Explanation/Reference:

  Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws- resource- secretsmanager-secrettargetattachment.html

• Question 46:

  A company has a quarterly customer survey. The survey uses an Amazon EC2 instance that is hosted in a public subnet to host a customer survey website. The company uses an Amazon RDS DB instance that is hosted in a private subnet in the same VPC to store the survey results.

  The company takes a snapshot of the DB instance after a survey is complete, deletes the DB instance, and then restores the DB instance from the snapshot when the survey needs to be conducted again. A database specialist discovers that the customer survey website times out when it attempts to establish a connection to the restored DB instance.

  What is the root cause of this problem?

  A. The VPC peering connection has not been configured properly for the EC2 instance to communicate with the DB instance.
  B. The route table of the private subnet that hosts the DB instance does not have a NAT gateway configured for communication with the EC2 instance.
  C. The public subnet that hosts the EC2 instance does not have an internet gateway configured for communication with the DB instance.
  D. The wrong security group was associated with the new DB instance when it was restored from the snapshot.
  D. The wrong security group was associated with the new DB instance when it was restored from the snapshot.

• Question 47:

  A company is releasing a new mobile game featuring a team play mode. As a group of mobile device users play together, an item containing their statuses is updated in an Amazon DynamoDB table. Periodically, the other users' devices read

  the latest statuses of their teammates from the table using the BatchGetltemn operation.

  Prior to launch, some testers submitted bug reports claiming that the status data they were seeing in the game was not up-to-date. The developers are unable to replicate this issue and have asked a database specialist for a recommendation.

  Which recommendation would resolve this issue?

  A. Ensure the DynamoDB table is configured to be always consistent.
  B. Ensure the BatchGetltem operation is called with the ConsistentRead parameter set to false.
  C. Enable a stream on the DynamoDB table and subscribe each device to the stream to ensure all devices receive up-to-date status information.
  D. Ensure the BatchGetltem operation is called with the ConsistentRead parameter set to true.
  D. Ensure the BatchGetltem operation is called with the ConsistentRead parameter set to true.

  ---

  Explanation/Reference:

  https://docs.aws.amazon.com/ja_jp/amazondynamodb/latest/developerguide/API_BatchGe tItem_v20111205.html

  By default, BatchGetItem performs eventually consistent reads on every table in the request. If you want strongly consistent reads instead, you can set ConsistentRead to true for any or all tables.

• Question 48:

  The Security team for a finance company was notified of an internal security breach that happened 3 weeks ago. A Database Specialist must start producing audit logs out of the production Amazon Aurora PostgreSQL cluster for the Security team to use for monitoring and alerting. The Security team is required to perform real- time alerting and monitoring outside the Aurora DB cluster and wants to have the cluster push encrypted files to the chosen solution.

  Which approach will meet these requirements?

  A. Use pg_audit to generate audit logs and send the logs to the Security team.
  B. Use AWS CloudTrail to audit the DB cluster and the Security team will get data from Amazon S3.
  C. Set up database activity streams and connect the data stream from Amazon Kinesis to consumer applications.
  D. Turn on verbose logging and set up a schedule for the logs to be dumped out for the Security team.
  C. Set up database activity streams and connect the data stream from Amazon Kinesis to consumer applications.

  ---

  Explanation/Reference:

  https://aws.amazon.com/about-aws/whats-new/2019/05/amazon-aurora-with-postgresql- compatibility-supports-database-activity-streams/

  "Database Activity Streams for Amazon Aurora with PostgreSQL compatibility provides a near real-time data stream of the database activity in your relational database to help you monitor activity. When integrated with third party database

  activity monitoring tools, Database Activity Streams can monitor and audit database activity to provide safeguards for your database and help meet compliance and regulatory requirements."

  https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Overview.LoggingAnd Monitoring.html

• Question 49:

  A company runs online transaction processing (OLTP) workloads on an Amazon RDS for PostgreSQL Multi- AZ DB instance. Tests were run on the database after work hours, which generated additional database logs. The free storage of the RDS DB instance is low due to these additional logs.

  What should the company do to address this space constraint issue?

  A. Log in to the host and run the rm $PGDATA/pg_logs/* command
  B. Modify the rds.log_retention_period parameter to 1440 and wait up to 24 hours for database logs to be deleted
  C. Create a ticket with AWS Support to have the logs deleted
  D. Run the SELECT rds_rotate_error_log() stored procedure to rotate the logs
  B. Modify the rds.log_retention_period parameter to 1440 and wait up to 24 hours for database logs to be deleted

  ---

  Explanation/Reference:

  To set the retention period for system logs, use the rds.log_retention_period parameter. You can find rds.log_retention_period in the DB parameter group associated with your DB instance. The unit for this parameter is minutes.

  For example, a setting of 1,440 retains logs for one day. The default value is 4,320 (three days). The maximum value is 10,080 (seven days).

  https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_LogAccess.Co ncepts.PostgreSQL.html

• Question 50:

  A company has multiple applications serving data from a secure on-premises database. The company is migrating all applications and databases to the AWS Cloud. The IT Risk and Compliance department requires that auditing be enabled on all secure databases to capture all log ins, log outs, failed logins, permission changes, and database schema changes. A Database Specialist has recommended Amazon Aurora MySQL as the migration target, and leveraging the Advanced Auditing feature in Aurora.

  Which events need to be specified in the Advanced Auditing configuration to satisfy the minimum auditing requirements? (Choose three.)

  A. CONNECT
  B. QUERY_DCL
  C. QUERY_DDL
  D. QUERY_DML
  E. TABLE
  F. QUERY
  A. CONNECT
  B. QUERY_DCL
  C. QUERY_DDL

  ---

  Explanation/Reference:

  Connect - logins / DCL - authorizations (grant,revoke), DDL - schema updates