DBS-C01 Question Bank · Latest 50 Questions Free Preview (Page 4/5)
Questions 31–40 of the latest 50 DBS-C01 questions (5 pages total), with answers and explanations, no login required. Practice all 376 questions online.
Question 31 · No. 357 · Single choice
A company is running critical applications on AWS. Most of the application deployments use Amazon Aurora MySQL for the database stack. The company uses AWS CloudFormation to deploy the DB instances. The company's application team recently implemented a CI/CD pipeline. A database engineer needs to integrate the database deployment CloudFormation stack with the newly built CI/CD platform. Updates to the CloudFormation stack must not update existing production database resources. Which CloudFormation stack policy action should the database engineer implement to meet these requirements?
- A. Use a Deny statement for the Update:Modify action on the production database resources.
- B. Use a Deny statement for the Update:* action on the production database resources.
- C. Use a Deny statement for the Update:Delete action on the production database resources.
- D. Use a Deny statement for the Update:Replace action on the production database resources.
Answer: A
Explanation: The database engineer should implement a Deny statement for the Update:Modify action on the production database resources. This will prevent any updates to the existing production database resources while allowing other actions to be performed.
Question 32 · No. 358 · Single choice
A company runs online transaction processing (OLTP) workloads on an Amazon RDS for PostgreSQL Multi-AZ DB instance. The company recently conducted tests on the database after business hours, and the tests generated additional database logs. As a result, free storage of the DB instance is low and is expected to be exhausted in 2 days. The company wants to recover the free storage that the additional logs consumed. The solution must not result in downtime for the database. Which solution will meet these requirements?
- A. Modify the rds.log_retention_period parameter to 0. Reboot the DB instance to save the changes.
- B. Modify the rds.log_retention_period parameter to 1440. Wait up to 24 hours for database logs to be deleted.
- C. Modify the temp_file_limit parameter to a smaller value to reclaim space on the DB instance.
- D. Modify the rds.log_retention_period parameter to 1440. Reboot the DB instance to save the changes.
Answer: B
Explanation: I chose option B because modifying the rds.log_retention_period parameter to 1440 and waiting up to 24 hours for database logs to be deleted will reclaim the free storage consumed by the additional logs without causing downtime for the database. Option A suggests setting the log retention period to 0 and rebooting the DB instance, which will not delete the logs. Option C suggests modifying the temp_file_limit parameter, which may not directly address the issue of reclaiming storage. Option D suggests the same solution as option B but also includes a reboot, which is unnecessary and may cause downtime.
Question 33 · No. 359 · Single choice
A company is using AWS CloudFormation to provision and manage infrastructure resources, including a production database. During a recent CloudFormation stack update, a database specialist observed that changes were made to a database resource that is named ProductionDatabase. The company wants to prevent changes to only ProductionDatabase during future stack updates. Which stack policy will meet this requirement?
- A. <img src="https://img.examtopics.com/aws-certified-database-specialty/image1.png" class="in-exam-image">
- B. <img src="https://img.examtopics.com/aws-certified-database-specialty/image2.png" class="in-exam-image">
- C. <img src="https://img.examtopics.com/aws-certified-database-specialty/image3.png" class="in-exam-image">
- D. <img src="https://img.examtopics.com/aws-certified-database-specialty/image4.png" class="in-exam-image">
Answer: C
Explanation: The stack policy option C, 'Deny then Allow', allows only specified resources to be updated while denying updates to other resources. This will meet the requirement of preventing changes to only ProductionDatabase during future stack updates.
Question 34 · No. 360 · Multiple choice
An ecommerce company is running Amazon RDS for Microsoft SQL Server. The company is planning to perform testing in a development environment with production data. The development environment and the production environment are in separate AWS accounts. Both environments use AWS Key Management Service (AWS KMS) encrypted databases with both manual and automated snapshots. A database specialist needs to share a KMS encrypted production RDS snapshot with the development account. Which combination of steps should the database specialist take to meet these requirements? (Choose three.)
- A. Create an automated snapshot. Share the snapshot from the production account to the development account.
- B. Create a manual snapshot. Share the snapshot from the production account to the development account.
- C. Share the snapshot that is encrypted by using the development account default KMS encryption key.
- D. Share the snapshot that is encrypted by using the production account custom KMS encryption key.
- E. Allow the development account to access the production account KMS encryption key.
- F. Allow the production account to access the development account KMS encryption key.
Answer: B, C, D
Explanation: The database specialist should create a manual snapshot (Choice B) of the production RDS instance and share it with the development account. Additionally, the specialist should share the snapshot that is encrypted using the development account default KMS encryption key (Choice C) or the production account custom KMS encryption key (Choice D). This ensures that the development account can access and use the encrypted snapshot for testing.
Question 35 · No. 361 · Single choice
A company is using an Amazon Aurora PostgreSQL database for a project with a government agency. All database communications must be encrypted in transit. All non-SSL/TLS connection requests must be rejected. What should a database specialist do to meet these requirements?
- A. Set the rds.force_ssl parameter in the DB cluster parameter group to default.
- B. Set the rds.force_ssl parameter in the DB cluster parameter group to 1.
- C. Set the rds.force_ssl parameter in the DB cluster parameter group to 0.
- D. Set the SQLNET.SSL_VERSION option in the DB cluster option group to 1.2.
Answer: B
Explanation: To meet the requirement of encrypting all database communications in transit, the database specialist should set the rds.force_ssl parameter in the DB cluster parameter group to 1. This setting enables SSL/TLS encryption for all non-SSL/TLS connection requests.
Question 36 · No. 362 · Single choice
A company performs an audit on various data stores and discovers that an Amazon S3 bucket is storing a credit card number. The S3 bucket is the target of an AWS Database Migration Service (AWS DMS) continuous replication task that uses change data capture (CDC). The company determines that this field is not needed by anyone who uses the target data. The company has manually removed the existing credit card data from the S3 bucket. What is the MOST operationally efficient way to prevent new credit card data from being written to the S3 bucket?
- A. Add a transformation rule to the DMS task to ignore the column from the source data endpoint.
- B. Add a transformation rule to the DMS task to mask the column by using a simple SQL query.
- C. Configure the target S3 bucket to use server-side encryption with AWS KMS keys (SSE-KMS).
- D. Remove the credit card number column from the data source so that the DMS task does not need to be altered.
Answer: A
Explanation: The most operationally efficient way to prevent new credit card data from being written to the S3 bucket is to add a transformation rule to the DMS task to ignore the column from the source data endpoint. By ignoring the column, the DMS task will not replicate or write the credit card data to the S3 bucket, ensuring its prevention.
Question 37 · No. 363 · Multiple choice
A healthcare company is running an application on Amazon EC2 in a public subnet and using Amazon DocumentDB (with MongoDB compatibility) as the storage layer. An audit reveals that the traffic between the application and Amazon DocumentDB is not encrypted and that the DocumentDB cluster is not encrypted at rest. A database specialist must correct these issues and ensure that the data in transit and the data at rest are encrypted. Which actions should the database specialist take to meet these requirements? (Choose two.)
- A. Download the SSH RSA public key for Amazon DocumentDB. Update the application configuration to use the instance endpoint instead of the cluster endpoint and run queries over SSH.
- B. Download the SSL .pem public key for Amazon DocumentDAdd the key to the application package and make sure the application is using the key while connecting to the cluster.
- C. Create a snapshot of the unencrypted cluster. Restore the unencrypted snapshot as a new cluster with the --storage-encrypted parameter set to true. Update the application to point to the new cluster.
- D. Create an Amazon DocumentDB VPC endpoint to prevent the traffic from going to the Amazon DocumentDB public endpoint. Set a VPC endpoint policy to allow only the application instance's security group to connect.
- E. Activate encryption at rest using the modify-db-cluster command with the --storage-encrypted parameter set to true. Set the security group of the cluster to allow only the application instance's security group to connect.
Answer: D, E
Explanation: The correct actions that the database specialist should take to meet the requirements are: D. Create an Amazon DocumentDB VPC endpoint to prevent the traffic from going to the Amazon DocumentDB public endpoint. Set a VPC endpoint policy to allow only the application instance's security group to connect. This ensures that the traffic between the application and Amazon DocumentDB remains within the VPC. E. Activate encryption at rest using the modify-db-cluster command with the --storage-encrypted parameter set to true. This ensures that the data stored in Amazon DocumentDB is encrypted. By creating a VPC endpoint and setting a policy, the traffic can be restricted and encrypted. This helps to ensure the security of data in transit and data at rest.
Question 38 · No. 364 · Single choice
A large financial services company uses Amazon ElastiCache for Redis for its new application that has a global user base. A database administrator must develop a caching solution that will be available across AWS Regions and include low-latency replication and failover capabilities for disaster recovery (DR). The company's security team requires the encryption of cross-Region data transfers. Which solution meets these requirements with the LEAST amount of operational effort?
- A. Enable cluster mode in ElastiCache for Redis. Then create multiple clusters across Regions and replicate the cache data by using AWS Database Migration Service (AWS DMS). Promote a cluster in the failover Region to handle production traffic when DR is required.
- B. Create a global datastore in ElastiCache for Redis. Then create replica clusters in two other Regions. Promote one of the replica clusters as primary when DR is required.
- C. Disable cluster mode in ElastiCache for Redis. Then create multiple replication groups across Regions and replicate the cache data by using AWS Database Migration Service (AWS DMS). Promote a replication group in the failover Region to primary when DR is required.
- D. Create a snapshot of ElastiCache for Redis in the primary Region and copy it to the failover Region. Use the snapshot to restore the cluster from the failover Region when DR is required.
Answer: C
Explanation: The solution that meets the requirements with the least amount of operational effort is to disable cluster mode in ElastiCache for Redis and create multiple replication groups across Regions. This allows for low-latency replication and failover capabilities for disaster recovery. The cache data can be replicated using AWS Database Migration Service (AWS DMS), and a replication group in the failover Region can be promoted to primary when DR is required.
Question 39 · No. 365 · Single choice
A global company is creating an application. The application must be highly available. The company requires an RTO and an RPO of less than 5 minutes. The company needs a database that will provide the ability to set up an active-active configuration and near real-time synchronization of data across tables in multiple AWS Regions. Which solution will meet these requirements?
- A. Amazon RDS for MariaDB with cross-Region read replicas
- B. Amazon RDS with a Multi-AZ deployment
- C. Amazon DynamoDB global tables
- D. Amazon DynamoDB with a global secondary index (GSI)
Answer: C
Explanation: Amazon DynamoDB global tables provide the ability to set up an active-active configuration and near real-time synchronization of data across tables in multiple AWS Regions, which aligns with the company's requirements for high availability and RTO/RPO of less than 5 minutes.
Question 40 · No. 366 · Single choice
A manufacturing company stores its inventory details in an Amazon DynamoDB table in the us-east-2 Region. According to new compliance and regulatory policies, the company is required to back up all of its tables nightly and store these backups in the us-west-2 Region for disaster recovery for 1 year.
- A. Convert the existing DynamoDB table into a global table and create a global table replica in the us-west-2 Region.
- B. Use AWS Backup to create a backup plan. Configure cross-Region replication in the plan and assign the DynamoDB table to this plan.
- C. Create an on-demand backup of the DynamoDB table and restore this backup in the us-west-2 Region.
- D. Enable Amazon S3 Cross-Region Replication (CRR) on the S3 bucket where DynamoDB on-demand backups are stored.
Answer: B
Explanation: chose option B because using AWS Backup to create a backup plan with cross-Region replication is a more efficient and reliable way to back up the DynamoDB table and meet the new compliance and regulatory policies.