Instant Access Amazon.DBS-C01.v2023-12-26.q241 Actual Practice Test Engine for Free (Page 9)

Question 36

A database specialist needs to enable IAM authentication on an existing Amazon Aurora PostgreSQL DB cluster. The database specialist already has modified the DB cluster settings, has created IAM and database credentials, and has distributed the credentials to the appropriate users.
What should the database specialist do next to establish the credentials for the users to use to log in to the DB cluster?

A.Add the users' IAM credentials to the Aurora cluster parameter group.
B.Run the generate-db-auth-token command with the user names to generate a temporary password for the users.
C.Add the users' IAM credentials to the default credential profile, Use the AWS Management Console to access the DB cluster.
D.Use an AWS Security Token Service (AWS STS) token by sending the IAM access key and secret key as headers to the DB cluster API endpoint.

Correct Answer: B

Correct answer: B
Explanation from Amazon documents:
Amazon Aurora PostgreSQL supports IAM authentication, which is a method of using AWS Identity and Access Management (IAM) to manage database access. IAM authentication allows you to use IAM users and roles to control who can access your Aurora PostgreSQL DB cluster, instead of using a traditional database username and password. IAM authentication also provides more security by using temporary credentials that are automatically rotated.
To enable IAM authentication on an existing Aurora PostgreSQL DB cluster, the database specialist needs to do the following :
Modify the DB cluster settings to enable IAM database authentication. This can be done using the AWS Management Console, the AWS CLI, or the RDS API.
Create IAM and database credentials for each user who needs access to the DB cluster. The IAM credentials consist of an access key ID and a secret access key. The database credentials consist of a database username and an optional password. The IAM credentials and the database username must match.
Distribute the IAM and database credentials to the appropriate users. The users must keep their credentials secure and not share them with anyone else.
Run the generate-db-auth-token command with the user names to generate a temporary password for the users. This command is part of the AWS CLI and it generates an authentication token that is valid for 15 minutes. The authentication token is a string that has the same format as a password. The users can use this token as their password when they connect to the DB cluster using a SQL client.
Therefore, option B is the correct solution to establish the credentials for the users to use to log in to the DB cluster. Option A is incorrect because adding the users' IAM credentials to the Aurora cluster parameter group is not necessary or possible. A cluster parameter group is a collection of DB engine configuration values that define how a DB cluster operates. Option C is incorrect because adding the users' IAM credentials to the default credential profile and using the AWS Management Console to access the DB cluster is not supported or secure. The default credential profile is a file that stores your AWS credentials for use by AWS CLI or SDKs. The AWS Management Console does not allow you to connect to an Aurora PostgreSQL DB cluster using IAM authentication. Option D is incorrect because using an AWS Security Token Service (AWS STS) token by sending the IAM access key and secret key as headers to the DB cluster API endpoint is not supported or secure. AWS STS is a service that enables you to request temporary, limited-privilege credentials for IAM users or federated users. The DB cluster API endpoint is an endpoint that allows you to perform administrative actions on your DB cluster using RDS API calls.

Question 37

A company is running critical applications on AWS. Most of the application deployments use Amazon Aurora MySQL for the database stack. The company uses AWS CloudFormation to deploy the DB instances.
The company's application team recently implemented a CI/CD pipeline. A database engineer needs to integrate the database deployment CloudFormation stack with the newly built CllCD platform. Updates to the CloudFormation stack must not update existing production database resources.
Which CloudFormation stack policy action should the database engineer implement to meet these requirements?

A.Use a Deny statement for the Update:Modify action on the production database resources.
B.Use a Deny statement for the action on the production database resources.
C.Use a Deny statement for the Update:Delete action on the production database resources.
D.Use a Deny statement for the Update:Replace action on the production database resources.

Question 38

A company has an application that uses an Amazon DynamoDB table to store user dat a. Every morning, a single-threaded process calls the DynamoDB API Scan operation to scan the entire table and generate a critical start-of-day report for management. A successful marketing campaign recently doubled the number of items in the table, and now the process takes too long to run and the report is not generated in time.
A database specialist needs to improve the performance of the process. The database specialist notes that, when the process is running, 15% of the table's provisioned read capacity units (RCUs) are being used.
What should the database specialist do?

A.Enable auto scaling for the DynamoDB table.
B.Use four threads and parallel DynamoDB API Scan operations.
C.Double the table's provisioned RCUs.
D.Set the Limit and Offset parameters before every call to the API.

Question 39

A company has migrated a single MySQL database to Amazon Auror
a. The production data is hosted in a DB cluster in VPC_PROD, and 12 testing environments are hosted in VPC_TEST using the same AWS account. Testing results in minimal changes to the test data. The Development team wants each environment refreshed nightly so each test database contains fresh production data every day.
Which migration approach will be the fastest and most cost-effective to implement?

A.Run the master in Amazon Aurora MySQL. Take a nightly snapshot, and restore it into 12 databases in VPC_TEST using Aurora Serverless.
B.Run the master in Amazon Aurora MySQL. Create 12 clones in VPC_TEST, and script the clones to be deleted and re-created nightly.
C.Run the master in Amazon Aurora MySQL. Create 12 Aurora Replicas in VPC_TEST, and script the replicas to be deleted and re-created nightly.
D.Run the master in Amazon Aurora MySQL using Aurora Serverless. Create 12 clones in VPC_TEST, and script the clones to be deleted and re-created nightly.

Question 40

A software company uses an Amazon RDS for MySQL Multi-AZ DB instance as a data store for its critical applications. During an application upgrade process, a database specialist runs a custom SQL script that accidentally removes some of the default permissions of the master user.
What is the MOST operationally efficient way to restore the default permissions of the master user?

A.Review the IAM user that owns the DB instance, and add missing permissions.
B.Use AWS Secrets Manager to modify the master user password and restart the DB instance.
C.Create a new master user for the DB instance.
D.Modify the DB instance and set a new master user password.

Question 36

Question 37

Question 38

Question 39

Question 40

Download PDF File