Quizzes · Service

RDS

Level 0 questions on RDS. Read about it first if it's new to you.

Works with: VPC (6), IAM (3), Organizations (1), Lambda (1), SQS (1), EC2 (1), CloudTrail (1)

15 questions, from a pool of 18
1 correct answer of 4 each
Pass line 80%

Questions and answers come in a new order every time, and every choice is explained. Your answers feed your weak spots on the exam page; they don't change your exam score.

Question 1An SCP on the Prod OU denies a set of RDS actions. Which of these does the SCP NOT restrict?

Service-linked roles, such as the one RDS uses to manage its own network interfaces.Correct. SCPs never apply to service-linked roles, so AWS services can keep running what they manage for you.IAM users in the Prod account.Not this one. SCPs apply to every IAM user in a member account.IAM roles in the Prod account.Not this one. SCPs apply to every IAM role in a member account, except service-linked roles.The root user of the Prod account.Not this one. SCPs apply to root in member accounts.

Learn it: SCP (service control policy) · Service-linked role

Question 2Only Todo.io's app servers may connect to the MySQL database on port 3306. The app servers come and go during the day, so their private IP addresses keep changing. How should the database's security group allow them in?

Allow inbound TCP 3306 with the app servers' security group as the source.Correct. A security group rule can name another security group as its source: anything wearing that group may connect, whatever its IP. It follows the servers as they come and go.Allow inbound TCP 3306 from each app server's private IP address.Not this one. This breaks every time a server is replaced, because the new one gets a different IP.Allow inbound TCP 3306 from the whole VPC's address range.Not this one. It works, but anything in the VPC could then reach the database. Least privilege means only the app servers.Allow inbound TCP 3306 from 0.0.0.0/0, since the database is in a private subnet anyway.Not this one. The subnet isn't a filter for traffic from inside the VPC. Defence in depth means the security group should still allow only what needs in.

Learn it: Security group

Question 3Where should Todo.io place its MySQL database inside the VPC?

In a private subnet, with a security group that only lets the app servers in.Correct. With no route to the internet gateway, nothing on the internet can even try to connect. The security group then narrows it to the app.In a public subnet, with a public IP, so the app can find it.Not this one. The app reaches it by private IP. A public IP only adds exposure.In a public subnet with no security group.Not this one. Every network interface has a security group, and a database should never face the internet.Outside the VPC, on the internet.Not this one. RDS databases always run inside a VPC.

Learn it: Subnet · Security group

Question 4When should Todo.io attach a Lambda function to its VPC?

When it needs to reach something private inside the VPC, such as the RDS database.Correct. Attaching gives the function network interfaces in your subnets, so it can reach private resources.Whenever it needs the internet.Not this one. Outside a VPC it already has it. Inside, it would need a NAT gateway.To make it run faster.Not this one. Speed comes from memory size, not from the VPC.Always; IAM only works inside a VPC.Not this one. IAM has nothing to do with VPCs.

Learn it: Lambda

Question 5Every morning at 9:00, thousands of Todo.io users add todos within a few minutes. The app writes each todo straight to its database, which can't keep up, and some saves fail. No todo may be lost. What should Todo.io do?

Have the app send each new todo to an SQS queue, and let a worker save todos from the queue at a pace the database can handle.Correct. A queue decouples the burst from the database. Messages wait safely until the worker gets to them, so nothing is lost and the database is never overrun.Move the app from EC2 to Lambda so it can handle more requests at once.Not this one. The app isn't the bottleneck, the database is. More concurrent app code just sends the database even more writes at once.Write each todo to CloudWatch Logs first, and copy it to the database later.Not this one. CloudWatch Logs stores log lines for people to read. It isn't a work queue: nothing tracks which todos were saved, and nothing retries the ones that fail.Give the database a public IP address so it can accept more connections.Not this one. A public IP changes who can reach the database, not how much work it can do. It also exposes the database to the internet.

Learn it: SQS (Simple Queue Service) · Design Todo.io with the Queue add-on

Question 6A teammate created Todo.io's RDS database while the console was set to eu-west-1. The app runs in us-east-1 and can't find the database. Why?

RDS is a regional service: a database exists only in the Region it was created in.Correct. Most AWS services are regional. Always check the Region menu before you build or go looking.An SCP is hiding the database from us-east-1.Not this one. SCPs allow or deny API calls. They don't hide resources, and nothing is denied here.The database hasn't finished copying itself to the other Regions yet.Not this one. Nothing is copied between Regions unless you set it up (Level 3). The database will only ever be in eu-west-1.The database's Availability Zone is down.Not this one. Availability Zones are inside a Region. The database isn't in us-east-1 at all.

Learn it: Region · Set up AWS: Wrong Region

Question 7What does Amazon RDS do for Todo.io that running MySQL on its own EC2 instance would not?

AWS installs, patches and backs up the database for you.Correct. You still design tables and write SQL; RDS runs the database server.It removes the need for SQL.Not this one. RDS runs ordinary engines like MySQL and PostgreSQL; you still use SQL.It removes the need for security groups.Not this one. RDS runs in your VPC, and security groups still decide who can connect.It turns the database into HTTPS API calls with no connections.Not this one. That describes DynamoDB. With RDS you open normal database connections.

Learn it: RDS (Relational Database Service)

Question 8Todo.io's app can't connect to its RDS MySQL database: the connection times out. The password is correct. What is the most likely cause?

The database's security group doesn't allow inbound TCP 3306 from the app.Correct. A silent timeout is what a security group does with traffic it doesn't allow.The app's IAM role lacks permission to run SQL.Not this one. Connections to MySQL on RDS use a database username and password, and a wrong one is refused, not timed out.CloudTrail is blocking the connection.Not this one. CloudTrail only records; it never blocks.The database needs a public IP.Not this one. The app is in the same VPC and uses the private IP.

Learn it: Security group · RDS (Relational Database Service)

Question 9In Todo.io's Level 0 setup, how does the app prove who it is to its RDS MySQL database?

With a database username and password, over a normal connection on port 3306.Correct. RDS is connected to like any MySQL server. Keeping that password out of code is a Level 1 topic.Every SQL query is an HTTPS call signed with IAM, like DynamoDB.Not this one. That is how DynamoDB works, not MySQL.It doesn't; anything inside the VPC may connect.Not this one. The security group decides who may reach it, and the database still checks credentials.With the root user's access keys.Not this one. Root keys should never exist, and MySQL doesn't use them.

Learn it: RDS (Relational Database Service)

Question 10Todo.io is creating a single-AZ RDS database, but its DB subnet group must include subnets in at least two Availability Zones. Why?

So a standby in another Availability Zone can be added later without rebuilding.Correct. RDS insists on two AZs up front, even if you only use one today.Because the data is split across both AZs.Not this one. A single-AZ database keeps its data in one AZ.Because it is cheaper.Not this one. The subnet group costs nothing either way.So the database gets a public IP.Not this one. Public access is a separate setting, and a bad idea here.

Learn it: RDS (Relational Database Service) · Subnet

Question 11Someone ran DELETE FROM todos on Todo.io's RDS database. Will CloudTrail show who did it?

No. CloudTrail records AWS API calls, not the SQL run inside a database. The database's own logs would show it.Correct. CloudTrail would show CreateDBInstance or DeleteDBInstance, never what happens inside.Yes. CloudTrail records every SQL statement.Not this one. It never sees inside the database.Yes, but only with AWS Config turned on.Not this one. Config records resource settings, not queries.Yes, in CloudWatch metrics.Not this one. Metrics are numbers, such as connections or CPU, not who ran what.

Learn it: RDS (Relational Database Service) · CloudTrail

Question 12After Todo.io created its first RDS database, a role named AWSServiceRoleForRDS appeared. What is it?

A service-linked role that RDS uses to manage things like network interfaces for your databases.Correct. The service owns it: you can't change its permissions, and it only trusts RDS.A role someone created by mistake, which should be deleted.Not this one. RDS needs it. You can only delete it once RDS no longer uses it.The role the app uses to connect to the database.Not this one. The app connects with a database username and password.A role from IAM Identity Center.Not this one. Those are named AWSReservedSSO_…

Learn it: Service-linked role

Question 13A developer can create RDS databases, but creating one with an Enhanced Monitoring role fails with AccessDenied. What is missing?

Permission for iam:PassRole on the monitoring role.Correct. Handing a role to RDS is passing it, which needs iam:PassRole.The root user must create databases that have roles.Not this one. Root isn't needed; PassRole is.An SCP that allows RDS.Not this one. SCPs never grant anything.An inbound rule in the database's security group.Not this one. That is about network traffic, not about creating the database.

Learn it: iam:PassRole

Question 14Todo.io needs reports that join users, todos and tags with SQL. Which service fits?

Amazon RDS, a relational database.Correct. Joins across related tables are what relational databases are built for.Amazon DynamoDB.Not this one. DynamoDB finds items by key and has no SQL joins.Amazon S3.Not this one. S3 stores files, not related tables.Amazon SQS.Not this one. SQS holds messages waiting to be processed.

Learn it: RDS (Relational Database Service) · DynamoDB

Question 15Unlike DynamoDB, where does an Amazon RDS database run?

Inside your VPC, in your subnets, with security groups deciding who can connect.Correct. DynamoDB is reached through a public AWS endpoint instead.Outside the VPC, behind a public AWS endpoint.Not this one. That describes DynamoDB.Only in your own data centre.Not this one. RDS runs in AWS.Inside the Lambda function that uses it.Not this one. Databases run on their own; functions connect to them.

Learn it: RDS (Relational Database Service) · VPC (Virtual Private Cloud)

Question 16What does "RDS (Relational Database Service)" mean?

A managed SQL database, like MySQL or PostgreSQL, that AWS runs for you.Correct. Think of it as: A filing cabinet with a librarian AWS employs.A fully managed NoSQL database you use through AWS API calls.Not this one. That describes DynamoDB.Unlimited storage for files ("objects") in containers called buckets.Not this one. That describes S3 (Simple Storage Service).The permission to hand an existing role to an AWS service.Not this one. That describes iam:PassRole.

Learn it: RDS (Relational Database Service)

Question 17Which term is this? "A managed SQL database, like MySQL or PostgreSQL, that AWS runs for you."

RDS (Relational Database Service)Correct. Yes. Think of it as: A filing cabinet with a librarian AWS employs.DynamoDBNot this one. DynamoDB is: A fully managed NoSQL database you use through AWS API calls.S3 (Simple Storage Service)Not this one. S3 (Simple Storage Service) is: Unlimited storage for files ("objects") in containers called buckets.iam:PassRoleNot this one. iam:PassRole is: The permission to hand an existing role to an AWS service.

Learn it: RDS (Relational Database Service)

Question 18Which AWS term is described by this analogy? "A filing cabinet with a librarian AWS employs."

RDS (Relational Database Service)Correct. Yes: A managed SQL database, like MySQL or PostgreSQL, that AWS runs for you.DynamoDBNot this one. DynamoDB is: A fully managed NoSQL database you use through AWS API calls. Its analogy: A giant labelled locker wall where you fetch lockers by their exact key.S3 (Simple Storage Service)Not this one. S3 (Simple Storage Service) is: Unlimited storage for files ("objects") in containers called buckets. Its analogy: A warehouse of labelled boxes you can reach from anywhere.iam:PassRoleNot this one. iam:PassRole is: The permission to hand an existing role to an AWS service. Its analogy: Being allowed to lend your colleague's key card to a contractor.

Learn it: RDS (Relational Database Service)

RDS

Worth another look

Your weak spots

Services

Concepts