Question 620
A PostgreSQL-to-Aurora PostgreSQL migration uses DMS CDC. After a table schema change, replication events fail because the target schema has not been updated. How should the team handle incompatible DDL during ongoing replication?
- Enable DMS target-table preparation DROP_AND_CREATE for each schema change while active application reads continue, without coordinating target compatibility.
- Coordinate source and target schema changes with tested compatibility, task settings and controlled deployment sequencing.
- Assume DMS CDC always translates and applies every arbitrary source DDL change without validation.
- Increase the DMS target replication-instance class only and ignore the target-column mismatch shown in task errors.
Explanation
Correct Answer
B:Data change replication depends on compatible target tables; uncoordinated schema changes can make incoming events invalid.
Incorrect Answers
A:Dropping/recreating live target tables does not safely translate arbitrary incompatible DDL, and can cause data loss or service interruption.
C:Change data capture does not guarantee complete automated cross-environment schema evolution.
D:More replication CPU cannot repair incompatible target DDL definitions or replay invalid changes automatically.
Question 621
A regulated migration requires a known rollback if an application moved to Aurora experiences functional failures. The source database continues accepting writes after AWS cutover, making a reversal difficult. What architectural requirement must the team address before launch?
- Keep writing in the cutover Aurora target and merely shorten the source DNS TTL, without planning where accepted target transactions go on rollback.
- Define the reverse-data and reconciliation strategy or a controlled write-freeze/fallback window, then test rollback with real transactions.
- Plan only to restore a pre-cutover snapshot and ignore all business transactions accepted after the migration.
- Restore the last pre-cutover source snapshot and treat all new target-side accepted writes as dispensable, despite the business rollback-data requirement.
Explanation
Correct Answer
B:Rollback feasibility depends on where writes occur after cutover, so reversing DNS alone cannot reconstruct new source-state.
Incorrect Answers
A:DNS changes route connection attempts, but cannot replay committed transactions into the recovery source.
C:Restoring old data discards new accepted writes and violates the stated transactional recovery need.
D:Snapshot restore alone would discard the post-cutover transactions that the business says must be preserved.
Question 622
A laboratory exported a 900-GiB VHDX data disk from an old virtual machine. The AWS target EC2 instance is already running the correct operating system, and the migration needs only the files on the data disk mounted as a new EBS volume. The team must not import a bootable machine image or install a continuous replication agent. Which supported process is appropriate?
- Use VM Import/Export import-snapshot on the compatible disk uploaded to S3, create an EBS volume from the resulting snapshot in the instance AZ, and attach it.
- Use VM Import/Export import-image to create a new AMI and replace the existing correct EC2 operating system solely to move its data disk.
- Configure AWS DataSync to copy the exported VHDX to S3 and assume DataSync registers it as an attachable EBS volume automatically.
- Use the AWS Backup EC2 restore action even though no AWS recovery point exists for the external virtual disk.
Explanation
Correct Answer
A:VM Import/Export supports importing compatible disks as EBS snapshots, after which a volume can be created in the desired AZ and attached.
Incorrect Answers
B:Importing a new machine image is unnecessary and changes the tested decision from a data-disk-only migration to replacing compute.
C:DataSync moves eligible file data, but does not convert a VHDX object into an EBS snapshot or create an attachable volume.
D:AWS Backup restore requires compatible protected recovery points and does not import an arbitrary external VHDX as an EBS volume.
Question 623
A company transfers millions of files from on-premises NFS into EFS with AWS DataSync. Transfer metrics show time lost in directory scans because every new run traverses the entire huge source tree, although only a small selected set changes. What should be considered?
- Turn off destination validation and assume an incomplete scan represents a complete source copy.
- Increase destination EFS provisioned throughput without changing DataSync selection when transfer duration is dominated by source directory enumeration.
- Use supported DataSync task filters or manifests and scheduling appropriate to the known changed-path workload.
- Switch the task to a full source tree scan every hour to detect changed files despite the stated known file subset.
Explanation
Correct Answer
C:Selecting the intended file subset can reduce needless enumeration and transfer activity while preserving required verification.
Incorrect Answers
A:Skipping verification can conceal missing data and does not cure the unnecessary enumeration.
B:EFS throughput tuning does not necessarily reduce source scans across millions of unchanged paths.
D:More frequent full scans increase the exact directory enumeration work the migration is trying to avoid.
Question 624
A migration application copies encrypted S3 objects from one AWS account into another account. The source uses a customer-managed KMS key, and the destination must retain objects encrypted under its own key. Which permission model is required?
- Publish the source KMS key policy to every AWS principal to avoid needing targeted migration permissions.
- Remove encryption from the destination bucket and assume the requirement for destination-owned encryption is met.
- Authorize the migration role for source object access and source KMS decrypt and destination S3 write and destination KMS encrypt.
- Grant s3:ListBucket alone on the source and assume it decrypts and rewrites the object ciphertext.
Explanation
Correct Answer
C:Cross-account encrypted copying requires both storage and KMS authorization in the accounts involved.
Incorrect Answers
A:Unrestricted cryptographic access violates least privilege and is unnecessary for the migration.
B:Disabling encryption directly contradicts the destination encryption control.
D:Listing object keys does not provide read access or cryptographic use of the source key.
Question 625
A company is retiring a regional operational RDS PostgreSQL instance after a compliance migration. Analysts need a one-time, internally queryable Parquet extract of approved tables from its existing DB snapshot in S3, but production query load must not increase and no new live relational replica is required. Which supported export workflow best meets this target?
- Attach the RDS DB snapshot file as a Linux EBS volume and assume Aurora tables become Parquet objects automatically.
- Export selected supported RDS DB snapshot data to S3 using an RDS snapshot export task with appropriate IAM/KMS access, then catalog the Parquet data for analytics.
- Copy a database snapshot between accounts without exporting its relational records and assume Athena can execute SQL against the binary snapshot directly.
- Create a continuous DMS CDC replication stream despite the requirement for a bounded one-time snapshot-based analytics extract.
Explanation
Correct Answer
B:RDS snapshot export to S3 emits supported relational snapshot records as compressed Parquet without reading from the active database, aligning with the one-off analytics target.
Incorrect Answers
A:A managed RDS DB snapshot is not an ordinary attachable EBS volume and does not auto-convert into queryable Parquet.
C:A copied native snapshot remains a recovery artifact rather than an Athena-ready Parquet dataset of table records.
D:CDC replicates ongoing change streams and adds continuous operations unrelated to the approved one-time static snapshot export.
Question 626
A company migrates SQL Server to Amazon RDS for SQL Server and already has tested native full database backups. It needs a supported restore path into the managed database engine, not a raw block-image rehost. Which mechanism should it use?
- Use a DMS CDC-only task against a target with no schema and no initialized rows even though supported SQL Server native full-backup restore is already available.
- Use supported RDS for SQL Server native backup and restore integration with appropriately permitted S3 backup files.
- Attach a Windows server C: drive as the RDS managed system volume and run the old SQL Server installation in place.
- Import the entire SQL Server host operating-system disk as an EC2 AMI and assume that installs the database into the managed RDS engine.
Explanation
Correct Answer
B:Native backup/restore support can ingest compatible SQL Server database backups while keeping RDS management semantics.
Incorrect Answers
A:CDC alone does not restore the complete SQL Server database from the validated native full backup.
C:Managed RDS does not expose the underlying host for arbitrary OS disk mounting and server installation.
D:An OS image is a server rehost, not the supported RDS native backup restore workflow requested.
Question 627
An on-premises Oracle application uses Oracle Transparent Data Encryption and needs a migration into a supported RDS architecture. The owners propose copying encrypted data files directly without validating key custody and engine support. What must be evaluated before migration?
- Check target database engine and edition TDE compatibility, key management and approved export/restore or logical migration procedure.
- Use a source TDE wallet with an incompatible target database engine and assume the target can decrypt arbitrary Oracle ciphertext without a tested supported key migration.
- Disable database encryption permanently to simplify migration without the required security risk approval.
- Choose any RDS engine regardless of its Oracle TDE option support, relying only on the original database port and hostname to preserve encryption.
Explanation
Correct Answer
A:Engine-specific encryption and key handling must remain supported; copying ciphertext alone cannot guarantee a usable target.
Incorrect Answers
B:Key/ciphertext compatibility and target engine capability must be validated; copying encrypted files alone is not enough.
C:Removing required encryption would violate the regulatory data-protection requirement.
D:Network naming does not establish engine/edition support or the necessary TDE key custody.
Question 628
A migration pipeline has already implemented reliable multipart uploads for 200-GB objects into S3 and retries failed parts. Compliance now requires evidence that the uploaded parts were not silently corrupted in transit. The team uses SHA-256 checksums and knows that multipart SHA-256 objects have composite checksum semantics rather than a naive full-object digest. What should the uploader validate?
- Rely exclusively on ETag as a universal full-object MD5 digest for every multipart upload, regardless of encryption or multipart composition.
- Use supported S3 multipart checksum declarations and checks during upload, verify completed object checksum metadata under the selected composite algorithm, and treat checksum type correctly.
- Use only the per-part ETags and compare their concatenation to a locally computed ordinary full-object MD5, regardless of checksum algorithm.
- Validate checksums on part 1 only and assume the completed multipart object cannot include a corrupted later part.
Explanation
Correct Answer
B:S3 supports per-part and composite checksums including SHA-256 in multipart workflows, enabling integrity validation when the checksum algorithm and type are handled consistently.
Incorrect Answers
A:For multipart uploads, an ETag is not reliably the full-object MD5; using it as a universal content checksum would misinterpret the multipart and encryption formats.
C:Multipart ETags are not a universal full-object content digest; checksum type and algorithm must match the S3 multipart integrity semantics.
D:Every required part must be covered by supported integrity checks; validating one part does not prove object integrity.
Question 629
A data platform is migrating high-volume MySQL data with DMS, and validation reports show some tables have no primary keys. Ongoing CDC must apply updates and deletes reliably. What risk and preparation should be addressed?
- Enable DMS table validation but leave unsupported keyless source tables unchanged and assume validation adds the missing row identifiers.
- Evaluate key or replica identity requirements for CDC, define reliable row identification and correct unsupported table designs before cutover.
- Ignore all key constraints and assume the replication engine can always identify updated rows without ambiguity.
- Increase the DMS replication instance capacity only while ignoring source-side unique key and replica-identity limitations.
Explanation
Correct Answer
B:CDC updates and deletes may need stable row identity to apply changes efficiently and correctly at the target.
Incorrect Answers
A:Validation can find mismatches but does not supply a source-row identity for reliable update/delete replay in an unsuitable schema.
C:Unstable row identification can cause performance failures and incorrect change application.
D:More replication compute cannot reconstruct missing stable row identity used to apply changes reliably.
Question 630
A regulated migration team has already finalized its application waves. It now needs a custom executable cutover runbook across several AWS accounts that calls supported DMS, EC2 and networking APIs in a required order, pauses for a signed approval, waits for asynchronous activities to finish, and records state even if a coordinator workstation disconnects. This is orchestration of a known procedure, not discovery or migration-wave planning. What AWS capability should the team implement?
- Use AWS Transform migration planning only and assume a finalized wave plan automatically executes arbitrary per-account migration APIs with human approval and retry semantics.
- Build a Step Functions Standard state machine with scoped AWS SDK/service integrations, explicit wait/retry/failure states and an approved callback approval step for the migration workflow.
- Use Route 53 latency routing to order migration steps because a DNS health check records durable multistep cutover state.
- Invoke separate scripts from one EC2 console session with no durable execution state and assume workstation connection loss is a valid rollback mechanism.
Explanation
Correct Answer
B:Standard Step Functions supports durable multi-service workflow orchestration, synchronous waits, retries, error handling and callback/task-token approvals across supported AWS APIs.
Incorrect Answers
A:Migration planning establishes and coordinates waves but is not a substitute for the custom durable service API execution state machine and manual approval specified.
C:DNS routing cannot invoke and track dependency-ordered DMS/EC2/network activities or persist an audited process history.
D:Ad hoc scripts lack the requested managed durable workflow state, structured approval boundary and restart/retry handling.
AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests